v1.4.0 — Detached workers, the kernel boundary, and a frozen report

Four days, 75 commits and twenty-four entries since v1.3.0. One trace-contract version, v17, and it is the one that lets Sideeye judge a target that detaches its workers. The full section is CHANGELOG.md at this tag.

Read this first if a target of yours was refused for a process leaving its group, for writes that bypass libc, or for a thread under --oracle-fs-usage. All three refusals have moved.

• A process that leaves the process group is judged where the engine holds the run in a cgroup of its own (contract v17, ADR 0065). On Linux, where the engine can make cgroups — a writable cgroup v2 delegated to its user, or root over a writable one — the recording run, every explored world and the baseline, and preflight --twice's second run each run in a cgroup the engine made, and both the crash point's kill and the cleanup's reach it. A worker that calls setsid is stopped and judged like any other child, and what leaves the cgroup is watched and refused. ansible-core's lineinfile, refused in every earlier run, reaches PASS 2/2 in both observation modes as root in a --privileged container. Where the engine cannot make cgroups — a default container, macOS — the detach is still refused, and on Linux the refusal now says what would let it be judged. CI runs the acceptance suite both uncontained and in a delegated systemd scope.
• --observe syscalls counts every kill point at the kernel boundary (ADR 0059): open, write, rename, unlink, fsync, truncate, mkdir, rmdir, link and symlink, in each spelling the architecture has — so a target that reaches the kernel without libc, a Go runtime above all, is judged rather than refused. copy_file_range and pwritev2 stay outside, and the report schema says so. A handler a target installs through libc sigaction no longer holds SIGSYS blocked while it runs (#556, ADR 0063), which is what node 20 needed to be accepted in that mode.
• Under --oracle-fs-usage, a single-process run whose writes come from one thread the shim recorded is explored and judged (ADR 0060) — on macOS as on Linux.

Refusals that say more. A SETUP_ERROR report carries why as data: setup_error_reason, one of five classes, and a failing --setup's setup_exit_code or setup_signal (#518, ADR 0057). A state_unsnapshotable refusal names the entry it could not read, with the errno, and an entry that became unreadable during the run gets a step of its own, unreadable_entry_appeared (#535, ADR 0056). A run whose only writer is a thread the shim never recorded creating says so instead of calling itself a single process (#543). epoll_ctl and faccessat2 on the state directory are read as reads (#542).

The shim's footprint is bounded on Linux (#555): under 1 KiB of thread-local storage and at most 5 KiB of stack per interposed call, measured on every acceptance run. It used to carry 256 KiB of TLS, which stopped a target from starting a thread with a small stack.

The report says it is frozen. Every --json report now writes "schema_status": "frozen" (#565); every tag through v1.3.0 wrote "experimental". The freeze page records the change as the fourth break of surface 2, and the changelog's header now says compatibility is promised by docs/contract-freeze.md, not by the version number (#566, ADR 0064).

Inside. src/main.zig was cut into modules along measured seams, with no change a user can see (#572, ADR 0062). Every action a workflow runs is pinned by commit, with its tag beside it (ADR 0061). The README is an entrance again, with the flags, the MCP surface and each limit's reason on pages of their own. The fs_usage sentinels are named from entropy, so a target cannot forge the observer's closing line (#549). The past-walls dogfood run met again seven targets v1.3.0 had moved a wall for: oxipng FAIL (reported upstream), rsync PASS, newsboat PASS.

Upgrading. Saved cases from v16 replay as case_no_longer_applies; re-record them. A v16 shim under this engine refuses contract_version_mismatch. The unknown_reason closed set is unchanged at 34 members; next_step gains unreadable_entry_appeared, and setup_error_reason is a new closed set of five. A consumer that branched on schema_status reads "frozen".

Known. A world whose crash point is in a worker thread is not always killed there (#569), and on macOS a thread id changes across exec (#571); both are open.