[stacknil]

Fixes #11

Problem

At the pinned base, PROCESS_RE.finditer can admit the valid fragment of a malformed saved users list. Both member orders lose the malformed reference without an error. In a synthetic before/after comparison this can become socket_link_removed for previously represented context; it does not establish a real socket closure.

For example, users:(("worker-a",pid=120,fd=3),("worker-b",pid=bad,fd=4)) succeeds with only worker-a. Reversing the members has the same result. The evidence and controls are in #11.

Invariant

Validate the entire supported nonempty users field before constructing any process reference. Reject the whole malformed declared list through the existing line-numbered ValueError pathway.

Design decision

Add a full-field guard before the existing extraction. Keep PID conversion, quoted name contents, ordering, (pid, name) deduplication, FD omission and absent-users behavior. The exact accepted contribution changes only the parser, parser tests, CLI tests and lab README: four files, +192/-2.

Failure model

The input is a saved local artifact. A matching substring does not establish structural completeness. Snapshot parsing must fail before discarded context can become a successful partial snapshot and then a misleading link disappearance. This adds no source authentication, collection atomicity, execution-instance attribution or real-world observation-completeness claim.

Rejected alternatives

• Salvaging matches or adding a warning leaves an incomplete observation on the successful path.
• Splitting on commas would damage accepted quoted names.
• Adding evidence fields or generalized native ss support expands contracts beyond this syntactic defect.

Compatibility

Canonical single/multiple references, both orders, exact/FD-only duplicates, quoted spaces/commas/parentheses, decimal PID conversion and missing users remain supported. Numeric FD text, complete wrappers and full consumption intentionally tighten admission. Empty lists, malformed members, truncated fields and unsupported nonempty tails fail closed.

Thread attributes, alternate key order, quote escapes, fd-less references and extra tail metadata are outside the documented bounded grammar. Universal iproute2/native-variant compatibility is not claimed. Existing nonblank-line numbering is unchanged. Schema, identity, snapshot, diff, report and telemetry contracts and all seven original golden files remain unchanged.

Validation

• Local Python 3.12.14: RED 15 failed / 19 passed, with unchanged production and no collection errors.
• GREEN: 34 focused / 90 complete passed, independently reproduced and rerun on the publication clone.
• Independent review: ACCEPT_WITH_DOCUMENTED_LIMITATIONS, with 39 additional parser cases, 29 actual CLI subprocess checks, and seven golden outputs byte-identical.
• CLI failures preserve raw input and existing outputs, return 1 with empty stdout/contextual input=ss stderr, and expose no traceback.
• Valid multiple-reference comparisons produce no change; both malformed after-input orders fail before diff/telemetry generation.
• Local Python 3.11 execution was unavailable. Remote CI passed on Ubuntu 22.04 / Python 3.11.17: auth 24, socket 8, permission 6, process 90; 128 passed total.

Rollback considerations

There is no artifact migration: valid output bytes and consumer contracts are unchanged. Reversing the admission guard would restore silent partial acceptance, so a future rollback must retain the malformed-list witnesses when assessing that behavior.