fix(file-lock): preserve diagnostics for invalid UTF-8 holder records

[steven-kid]

Goal And Delivered Outcome

Damaged UTF-8 in advisory lock-holder records currently makes liveness reads and contended acquisition raise UnicodeDecodeError, masking the typed timeout and recovery guidance. Treat decoding failure as unreadable metadata in the existing shared filesystem reader. Keep valid alternate records, kernel exclusion, incident recording and normal recovery after the actual holder exits.

Source-checked against upstream main 84dfa63c26a6b03a3c5e6039108f1540e8b2b1bb; the failing baseline and unchanged reader are identified below. This is a bounded S10 reliability/diagnostics fix, not broader roadmap completion. No duplicate issue is created for this self-contained defect. Intended target: loopx-project/loopx:main. Draft requested by the contributor.

Author Declaration

Written by: model_agent — OpenAI Codex (GPT-6).

Specification: docs/reference/protocols/file-lock-acquisition-v0.md, Holder And Incident Records / Operator Recovery, at 84dfa63c26a6b03a3c5e6039108f1540e8b2b1bb.

Criterion	Disposition	Owner / evidence
Preserve typed timeout and incident	implemented	Existing shared holder reader; real subprocess contention regression
Metadata cannot grant kernel ownership	implemented	Waiter refused while holder lives; readback leaves damaged bytes unchanged
Keep valid current/legacy alternate record	implemented	Both Windows layout directions tested
Recover after actual holder exit	implemented	Real reacquisition and released-state readback

Scope And Continuation

Complete within the reproduced defect. Retains the existing Python OS/filesystem adapter; no parallel domain decision owner, new capability, state vocabulary or public API shape. Both consumers already share one reader, so no additional refactor is warranted. The existing protocol and repair-pattern catalog capture the same failure/recovery contract. No independent successor needed for this repair.

Validation

Tested revision: 8d956fd08ffdaef3838985c1b3abbfeeb8a90319 (same source content tested before the local commit). Run state: finished. Input classes: synthetic, public_fixture.

Check kind	Result	Evidence / limits
regression_parity	passed	python -m pytest -q tests/test_file_lock.py -k invalid_utf8 --tb=short on baseline 73aa2bc: 5 new cases fail with UnicodeDecodeError; production reader and regression source are unchanged at this PR base; all pass on the candidate
real_backend / integration / unit	passed	python -m pytest -q -rs tests/test_file_lock.py tests/test_file_lock_cross_process.py tests/test_collaboration_mcp.py tests/test_repair_pattern_lookup.py: 45 passed, 2 skipped in 16.36s; disposable Linux kernel locks, competing subprocess, incident/recovery and stdio collaboration
static	passed	python -m ruff check loopx/file_lock.py tests/test_file_lock.py; git diff --check
static	passed	Public-boundary scan of all four changed files; two missing-registry warnings in an unconfigured checkout
static	passed	python scripts/check_rfc_bilingual.py --base 84dfa63c26a6b03a3c5e6039108f1540e8b2b1bb --staged: no RFC pair changed
integration	not_run	Native Windows: two existing Win32 extended-path skips; sidecar layout exercised via existing fixture on Linux
integration	not_run	Full repository suite, full canary, packaged frontend/Lark journeys

Python 3.12.14, pytest 9.1.1, MCP 1.30.0, Node 24.19.0. Current checkout test dependencies and npm lockfile installed. No live user data or provider accounts used.

Frontend / Visual Evidence

UI impact: none. Existing timeout envelope and operator action preserved; no frontend/Lark/CLI command shape change. Visual evidence and shared-authority RFC fixture promotion: not applicable.

Type of Change

• Bug fix
• Test update
• Documentation update

Boundary Checklist

• No private state, credentials, raw traces, internal links or local machine paths in this proposal.
• No benchmark duplication or new operational permissions.
• Scope limited to the reproduced defect.
• UI impact none.
• DCO Signed-off-by included.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @steven-kid.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[steven-kid]

Resolved the conflict reported in this comment with signed-off merge commit a2ee229fc616d0bcd3148ea4a98b0024e5bdb42a, incorporating upstream main at a0fb547af9aac4e4d36f59fb05cb64eb56fd750f. Pushed normally; published history is preserved. GitHub readback now reports mergeable=true; the PR remains draft.

The only conflict was adjacent additions in skills/loopx-self-repair/references/repair-patterns.md. Both the upstream scheduler entry and the lock-holder diagnostic entry are retained. Relative to the incorporated upstream, the PR remains the original four-file fix (+76/-1); production and regression-test patch content is unchanged.

Validation on this exact merge content:

• python -m pytest -q -rs tests/test_file_lock.py tests/test_file_lock_cross_process.py tests/test_collaboration_mcp.py tests/test_repair_pattern_lookup.py tests/test_chat_process_recovery.py: 60 passed, 2 existing Win32 extended-path skips (49.32s).
• python -m ruff check loopx/file_lock.py tests/test_file_lock.py: passed.
• Standard loopx canary premerge, using the incorporated upstream as the base and the four PR paths explicitly: all six direct checks, five catalog smokes, eight risk-profile smokes and the public-boundary scan passed.

Full repository tests, local browser journeys and native Windows qualification were not rerun locally. Fresh hosted CI is pending; the previously diagnosed upstream browser failure was not modified or blindly rerun.