v0.34.2

v0.34.2

Follow-up fix for the #281 migration-guard lockout. v0.34.1 closed the PID-reuse hole but classified any unparseable RPC discovery record as "possibly a live server" and blocked fail-closed — with no self-heal, one corrupt or legacy port file among accumulated records locked Magic Context out on every boot.

Fixes

• Migration guard: junk discovery records self-heal (#281): a port file that fails to parse (empty, truncated, legacy format) or carries no usable PID is now classified stale and removed, behind a 10-minute age grace window (the port-file writer has used atomic temp+rename, so a torn record cannot belong to a live server; the window guards pre-atomic history). Genuine I/O uncertainty (permission errors on read or cleanup) still blocks fail-closed. The refusal message now names the offending file and whether it was a parse or I/O problem, and doctor cleans junk records through the same path, so the recovery command in the error actually recovers.
• Rust mode: cold-start seed can no longer rewind a materialized boundary (dev-mode transform_mode: "rust" only): a fresh adapter instance's state seed could rewind the module's fold boundary to the lagging TypeScript mirror, making the session re-serve already-compacted history until it exceeded the provider context window. Seeds are bootstrap-only once the module state is initialized.
• Rust mode: overflow recovery no longer disarms on stale usage: after a provider overflow, recovery now requires a usage observation newer than the arm (or a trusted estimate of the actually-served array), so a frozen pre-overflow percentage cannot silently clear the emergency latch.
• Rust mode: first-render tagging is byte-stable: a brand-new session's first provider request now renders with tags active, so the first defer replay is byte-identical instead of rewriting the prefix.