[stacknil]

Problem

Saved procfs/SS FIFO inputs can block waiting for a writer. On native Linux, an invalid UTF-8 exe link target also survives baseline parsing and raises UnicodeEncodeError after truncating a previously valid snapshot. Existing read errors lack consistent PID/field context, and snapshot/diff output filesystem failures escape as tracebacks.

Base: 1d31d4287036cf2bbd3aeb8059d7d332bedef598. Final reviewed tree: 0c0969c6f0c276ed1be95a66cd020a1be89efa00.

Invariant

Reject incomplete or unsupported required saved inputs before snapshot artifact writes; preserve existing evidence on input-validation failure. Keep successful stacknil.system-evidence.v1 output, adapter fields, observation-time meaning and same-boot identity limits unchanged.

Design decision

• Share a stdlib regular-file reader: inspect the path, use POSIX nonblocking open, validate the opened descriptor and close owned descriptors on errors. Preserve native OS/decoding classes with input context; missing PID files and invalid UTF-8 cmdline keep their established ValueError classification.
• Decode executable-link target bytes as UTF-8 during validation. Valid and dangling UTF-8 executable targets remain literal context; established numeric-directory symlink discovery remains supported.
• Attribute snapshot/diff write failures to input=output, separate from evidence-input failures. Writes remain sequential and can partially update outputs if a later write fails.

Threat/failure model

This is an offline lab for trusted, stable local saved exports. It does not establish a path sandbox, authenticated provenance, live acquisition, complete numbered-entry inventory, atomic acquisition, or a general filesystem timeout. Broken numeric directory links and numeric non-directory entries retain the existing ignored-entry profile. Filesystem/UTF-8 diagnostics avoid copying raw field contents; existing malformed-value parser messages can still include the offending value.

Rejected alternatives

1. Skip unreadable discovered PIDs: rejected because this would silently turn incomplete evidence into successful output.
2. Reject every symlink: rejected because executable targets are supported context and directory links are established trusted-export behavior.
3. Rely only on pre-open stat: rejected by deterministic regular-file-to-FIFO replacement; validate the fd and use nonblocking open too.
4. Add transactional output publication here: deferred because it needs a separate storage and compatibility contract. No multi-file rollback is claimed.

Compatibility

Six process-lab files only; no schema, adapter, golden, dependency or CI changes. All seven regenerated producer artifact bytes match the base Git goldens on Linux, including the exact JSONL contract. No consumer migration for successful artifacts; diagnostic strings gain context and output failures become structured.

The unmodified reviewed telemetry-lab PR #97 runner (bbe483eb43ca11bd54c3ffe609e369abc2850980) independently passed twice on native ext4 with the producer fixed at the base above. The changed producer then fed the reviewed consumer twice: seven events, one window, eleven numeric features, four sources, seven targets and zero default-rule alerts; four schema validations and six PNG smoke checks. Existing telemetry-lab #97, Website #3 and Profile #4 remain untouched.

Validation

• Ubuntu 24.04.4 / WSL2, native ext4, UID/EUID 1000 (non-root), Python 3.12.3, Git 2.43.0. Actual chmod denial and FIFO/link objects; deterministic discovery/replacement injection without sleep races.
• Base suite: 90 passed. Initial new failure tests against base: 14 failed / 10 passed, then green after the patch. Final focused module: 27 passed; full process suite: 117 passed, including a new clean clone of the signed final tree. Other unchanged labs: auth 24, socket 8, permissions 6 (155 native passes across four labs).
• Fresh Windows Python 3.12.14: focused 15 passed / 12 explicit POSIX skips; full process suite 105 passed / 12 skipped. Both environments pass pip check.
• Three isolated mutants rejected after their selected tests first passed: denied enumeration becoming empty success; blocking FIFO replacement open; surrogate-escaped executable-link target reaching output writes.
• Four independent read-only reviewers: intent, security, reliability and contracts. One shared README scope finding was corrected and independently closed; no remaining material findings. Ruff, syntax parsing, final diff check and targeted privacy/secret scans passed. Original 33 checkout states and protected Git objects/PR metadata preserved before commit.
• Commands from the process project: python -m pip install -e ".[dev]", python -m pytest tests/test_native_read_failures.py -v, python -m pytest -q; disposable native source copies and the reviewed integration runner provide the additional mutation/integration checks. Full local receipts remain outside Git.
• Three semantic commits are GPG-signed with DCO and the existing public GitHub noreply identity. Remote CI passes on this exact head (Python 3.11: all four labs, 155 passes including all 27 native failure cases). GitHub marks all three commits Verified with valid signatures and public noreply author/committer/DCO. Final six-file diff reviewed again after CI: descriptor/input validation is the chosen boundary; the main remaining risk is concurrent export mutation or partial sequential output on write failure; successful artifacts remain byte-compatible; rollback is the unit revert above. PR issue comments, inline review comments and reviews were empty at this readback.

Rollback

Revert this three-commit PR as one unit. No data migration, golden refresh or dependency rollback is required. Reverting restores the original FIFO and invalid-link failure behavior.

Draft / no merge in Round 3. Input-admission and diagnostics review hold: at least 24 hours after the final change. Last change: 2026-10-20T17:53:24+08:00; earliest eligibility: 2026-10-21T17:53:24+08:00 (2026-10-21T09:53:24+00:00 UTC). Any later change restarts the hold. Eligibility does not authorize merging in this round. No release, tag or deployment.