feat(scheduler): the CLI's own job log + a safe vault run record (#377)

[kengio]

Tracks 2–3 of v3.4.23. Spec: 01-projects/onebrain/cli/2026-08-03-v3.4.23-design.md. Companion to #378.

These primitives have NO production callers yet — deliberately. Task 4 wires them into run_skill. Landing them separately keeps the pure, heavily-guarded core reviewable on its own; the wiring PR carries its own end-to-end proof. Flagging it here so "dead code" reads as a sequencing decision rather than an oversight.

What and why

run_log.rs — open_job_log() opens the CLI's own append-only job log after exec. Unlike the launchd redirect it replaces for skill-mode entries (#378), a real process can mkdir, fall back, and report. It never returns an error: a job that dies because its log could not be opened is exactly the bug this release removes (#372).

run_record.rs — pure rendering of one run as vault-readable markdown. No clock, no filesystem, no $HOME — everything injected, so the format is testable on every platform without env mutation. v3.4.22 shipped a check whose tests read the developer's real $HOME and passed vacuously; splitting the verdict from the resolver is what prevents that.

Three design points worth naming:

• exit_code is i32, not Option<i32> — translate_exit (run_skill.rs:407-421) returns 128 + signal for signals and 1 otherwise, so an Option would add a production-unreachable arm.
• source: Scheduled | Manual exists because run_skill::run serves both the scheduler and a human at a terminal. Without it, one manual run would satisfy doctor's staleness check for a job dead a week.
• safe_tail strips ANSI and neutralises ``` runs. A headless claude -p run routinely emits fenced blocks, and one would close the record's own fence and corrupt the user's vault note.

The plan's own test set had a hole, and coverage found it

The plan specified 3 tests for run_log. Measuring the coverage HTML showed the OpenOptions::open() Err arm was never executed — the "cannot create" fixture only ever trips create_dir_all. A 4th test (suppresses_when_the_open_itself_fails_after_the_directory_exists, forcing EISDIR by occupying the log path with a directory) closes it. Both Suppressed constructions are now hit.

This is the rule earning its keep: sabotage proves a guard can fail on one path; only measuring reach shows which paths it touches at all.

Evidence

Behavioral audit on real data — safe_tail + render run against genuine scheduler output (~/Library/Logs/onebrain/onebrain-daily.stdout, today's 09:01 run, 2618 bytes):

REAL INPUT: 2618 bytes  →  TAIL: 2003 bytes   (bounded)
no ANSI survived · no raw fence survived · exactly one fence pair in the record

The real content contains Thai text, which survived intact — the multibyte-boundary path is proven on genuine data, not only the synthetic fixture. Rendered output is readable Obsidian markdown.

11 tests, all seen to FAIL when their guard is broken (each sabotage applied and restored separately — one sabotage does not vouch for several guards):

sabotage	guard that went RED
create_dir_all → no-op	creates_a_missing_log_directory…
.append(true) → .truncate(true)	appends_rather_than_truncating…
create_dir_all Err → panic!	suppresses_instead_of_failing…
open() Err → panic!	suppresses_when_the_open_itself_fails… (exit 101)
render ignores exit_code	a_failure_is_visually_distinct…
safe_tail slices from the front	safe_tail_keeps_the_end… RED and the multibyte test panicked, proving the boundary loop is load-bearing
drop strip_ansi	safe_tail_strips_ansi_escapes
drop the fence .replace	safe_tail_neutralises_a_fence_close
render ignores source	a_manual_run_is_distinguishable…

Coverage per at-risk branch (read line-by-line from the HTML report, not inferred):

branch	hits
Suppressed (create_dir_all) / (open)	1 / 1 — both
status arms ✅ / ❌	6 / 1
source arms scheduled / manual	5 / 2
while !is_char_boundary body	1
CSI-consuming for body	5/2/3

Gates, each bare with its real exit code — never through tee/tail, which report the pipeline's status and would let a failing gate read as a pass:

cargo fmt --check                                        exit=0
cargo clippy --workspace --all-targets -- -D warnings    exit=0
cargo test --workspace                                   exit=0   (3361 passed, 5 ignored, 47 suites)
bash scripts/coverage.sh --ci-gate                       exit=0   (core 94.68%, threshold 94%)

Both commits verified to build standalone (cargo build -p onebrain-core exit 0 at each sha), so a bisect cannot land on a broken tree.

Deviations from the plan, stated

• 11 tests, not 10 — the 4th run_log test above.
• Test renamed safe_tail_keeps_the_END_not_the_beginning → …the_end…; the plan's literal mixed-case name fails clippy -D warnings (non_snake_case).
• No pub use re-exports added in mod.rs — the plan specified only pub mod. Task 4 uses the full paths or adds them.