fix(service): guard log rotation file identities

[luvs01]

Summary

• Check active and archive log leaves and open descriptors for regular-file, single-link and matching device/inode identities before rotation writes. Create archives exclusively and preserve the active source when copy or flush fails.
• Resolve only the parent directory for filesystem operations, retaining parent-junction compatibility while rechecking the requested and canonical paths. Keep the existing append descriptor, 20 MiB limit, 64 KiB buffer, two archives and nonfatal error behavior.
• Add synthetic regression coverage and update the service-logging contract. This is bounded filesystem hardening; privilege escalation is not established, and these checks do not provide atomic namespace locking or eliminate every TOCTOU race.

Verification

Linux validation on fixed base c37161c512d102f11eeca7db3697e79d52b4246f, Bun 1.4.3, reused locked dependencies (package manifest and lockfile unchanged):

• bun test tests/service/service-log.test.ts: 27 passed, 106 assertions.
• bun test tests/service/service-log.test.ts tests/service/service-secrets.test.ts tests/service/service-start-environment.test.ts tests/ci-workflows/structure-ssot.test.ts: 102 passed, 294 assertions. This includes the focused tests above; counts are not additive.
• bun node_modules/typescript/bin/tsc --noEmit, bun scripts/privacy-scan.ts, bun scripts/structure-ssot.ts, and git diff --check: passed.
• Prior read-only review found no new must-fix issue; the original four and newer five supplemental Linux synthetic checks were rerun and passed on that fixed base.

Prior native Windows validation on base 7640a942b35044c974e534b84d5a8049f4a8ae9a, build 26300 x64, NTFS, Bun 1.4.2 (the three candidate files and patch are byte-identical; Windows was not rerun on the refreshed base):

• Focused suite: 24 passed, 0 failed, 3 explicit Windows skips, 98 assertions.
• Original supplemental checks: 4 passed. Windows contract checks: 8 passed, including parent junctions, append descriptors, bounded generations and available leaf-symlink checks. Three separate symlink-through-junction checks also passed. These scopes overlap.
• Exact-base comparison confirmed normal junction-path rotation succeeds with this candidate. Privacy, structure and diff checks passed.
• The newer supplemental script did not complete: alias replacement after flush passed, but renaming the canonical parent while descriptors were open returned EPERM. That fixture restriction leaves successful canonical-parent replacement untested on Windows; it is not counted as a passing protection test.
• Windows used an existing dependency subset, not a full locked install. Windows typecheck and full suite were not run. Bun 1.4.3 was not tested on Windows. Existing high-token symlink capability does not establish medium-token behavior.

All behavioral checks used synthetic fixtures. Full-suite validation was not run for this focused change. Concurrent changes after a final identity check remain a limitation, as does the existing copy-truncate concurrent-write window. This PR does not claim complete closure of a broader security boundary.

The branch starts from tested base c37161c512d102f11eeca7db3697e79d52b4246f and targets dev. Before publication, upstream changes through 0b13396af41b66758322c857663e1214b4635379 were inspected: the two commits change provider context inference and tool-catalog delivery, without changing the three log files, the service-log contract, its direct dependencies, or the package manifest/lockfile. This inspection is not an integration test on the newer dev.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Being carried into #7215 with your authorship preserved; this PR will be closed when the bundle lands.

[lidge-jun]

Landed on dev in d3a84c2 via #7215 (your change is its own commit in that bundle, and the squash keeps your authorship as Co-authored-by). Thank you!