[stacknil]

Problem

Fixes #9. Duplicate numeric PID candidates and contradictory saved process/link records can reach diffs or telemetry under a plausible identity. Matched links also overwrite the distinct name reported by ss.

Invariant

A cohort has one process candidate per numeric PID. Declared process IDs must agree with host/PID/start fields, and linked records must reference that paired process with matching PID/executable/UID/GID. This establishes internal consistency of represented evidence; linked=true remains PID-based contextual association.

Design decision

The exact independently accepted eight-file patch has five production change categories:

1. Reject duplicate numeric PIDs in procfs parsing and direct socket association.
2. Preserve the ss name in socket process_name, retaining procfs name separately.
3. Share declared-process identity validation and the unchanged socket identity key.
4. Validate paired process/link reference and context before diff generation; unlinked records cannot claim procfs identity/context.
5. Check process and socket change-label self-consistency during standalone adaptation.

Threat/failure model

Saved artifacts may be inconsistent or combined incorrectly. Equal declared observation times do not authorize contradictory context. Name differences can be legitimate; neither disagreement nor agreement proves PID reuse or ownership.

E1/E2 show an information limit: identical supported inputs can represent different possible execution-instance histories. Atomic capture, instance ownership, executable integrity, causality and cross-boot/namespace identity remain unverified. The standalone adapter has no complete paired cohort.

G6 remains a separate pre-existing parser defect: malformed content beside a valid ss users reference may be ignored. Independent replay found unchanged baseline/candidate outputs; this PR does not claim complete users-field validation or fix G6.

Rejected alternatives

Name-equality admission would reject legitimate observations and still miss same-name reuse. First/last candidate selection is order-dependent. No confidence score, schema version, boot identifier, namespace inference or live collection is introduced.

Compatibility

Inconsistent normalized artifacts now fail closed. Socket process_name now preserves ss provenance; consumers must not assume procfs-name equality. Existing schema, dependencies, fixtures, workflows, socket identity/order and event types remain unchanged. Missing-PID sockets and multiple references remain represented; name-only link differences still create no link-change event.

Validation

• Unchanged pinned production: 30 complete tests passed; the final 32 regressions were 28 failed / 4 passed, then 32 passed with the correction.
• Independent local reviewer: ACCEPT_WITH_DOCUMENTED_LIMITATIONS; 46 additional cases passed, including both temporal sides, types, aliases, permutations, CLI output preservation and adapter boundaries.
• Fresh publication copy: process complete 62 passed on Windows Python 3.12.14 and existing WSL Python 3.12.3; other labs 24 auth / 8 socket / 6 permission passed on Windows.
• All seven original golden artifacts reproduced byte-for-byte. Clean patch application, exact accepted diff, whitespace and privacy checks passed.
• Python 3.11 was not executed locally; the unchanged CI workflow runs all four mini-labs on Ubuntu 22.04 / Python 3.11.
• Retained bounded 10k-record measurements show about 10.8 ms / 64% additional diff time and 4.3 ms / 8% adapter time. Matching retains dictionary indexing and existing sorts; these local timings are not capacity guarantees.

Rollback

Existing artifact versions need no migration. Removing these checks would restore order-dependent duplicate-PID selection and acceptance of inconsistent context; reverting name preservation would again discard the distinct ss observation.