0.0.10 review: the cache fixes a pre-release deep review found

[Sunrisepeak]

Follow-up to #39 (already squash-merged as eaf9ea4, not yet released). A pre-release deep review of the 0.0.10 cache work found four P0 defects that could take a live instance's data or block the session loop, plus their kin. All verified against the code before fixing, all covered by tests, all local gates green.

P0 — fixed

P0-1 A 0.0.10 owner renamed a live 0.0.9 guest's cache aside. rename_dead_instances had no grace branch for a directory without instance.json (only sweep_instances did), so the tick renamed a fresh 0.0.9 leftover on its next 10s pass and the background pass then removed it — the old test asserted exactly this. Rename now gives an undescribed directory the same grace (newest_modified) the sweep does.

P0-2 resetCache deleted the resetting instance's own instance.json — the heartbeat that says the directory is alive; the comment claimed the opposite of what the code did. It survives a reset now, like owner.lease.

P0-3 mcppls.sweepCache and a stale cxxModules/cache ran whole-tree walks on the session's event loop. Minutes of filesystem work (the 64 GiB case) held every request and the lease renewal behind it — a blocked owner loses its lease to a new instance. The sweep is now prepared on the loop (prepare_sweep), run on a thread as plain data (run_prepared_sweep), and answered through a deferred_answer event (the exportBundle F18 pattern); a stale report answers the last snapshot while a report-only pass refreshes it off the loop (S3-5.7-8, S3-5.8-10).

P0-4 An unreadable process identity read as a dead lease owner. owner_gone treated process_identity == nullopt (OpenProcess access-denied on Windows, a failed ps on macOS) as gone, so a live owner's lease could be taken over. Only a definite answer releases a lease early: a different incarnation, or a pid process_alive says is gone; lease_owner_gone is exported and unit-tested.

P1 — fixed

• single-flight for every cache pass with coalescing (startup/engine-start/command used to race on the same tree)
• generationStartedAt_ resets when clangd exits (staleCommands was unreachable after any crash)
• a heartbeat ahead of the clock (NTP step, wake from sleep) is alive within the window
• parse_bytes consumes its input whole (1.5G silently meant 1G, 12abcG meant 12G); a budget that does not parse is logged
• cache.maxBytes's summary now says what it does (reporting; eviction answers to cache.totalBytes)
• staleCommands/CLI --prune count what left the disk (tree_remove), not what they attempted
• a dry run changes nothing remembered (it wrote lastSweep, so a preview read as a sweep)
• a multi-root sweep answers the sum over roots (the last root's answer overwrote the others')

P2 — fixed

report refresh renders prompts once from one facts object; enforce_budget walks each workspace once (was two full walks); the card's Open logs opens the logs directory (was the cache root); the receipt reads human sizes (sizeText); ps runs under LC_ALL=C on macOS; KINDS has a static_assert and a bounds guard.

Verification

• server suites dev + release: pass (new cases: rename grace, future heartbeat, strict parse_bytes, lease_owner_gone)
• validate.py: 296 rules, 0 failures (new rules S3-5.7-8, S3-5.8-9..12 with evidence)
• extension: 114 units, E2E 40/0/1 in source and VSIX mode
• cross builds: x86_64-windows-gnu and aarch64-macos compile
• during verification the E2E caught one regression of this very PR (a nlohmann brace-initialisation wrapping the prompt facts in an array crashed cxxModules/cache) — fixed before push