msdmd: run node --jitless; signal-killed node and failed identity probe exit 3

[erinepshovel-code]

Unblocks stack #78 keeping MemoryDenyWriteExecute=true on its msdmd worker (Review finding on stack #78 at 131497c).

Problem

Under systemd MemoryDenyWriteExecute=yes, V8's JIT can't map writable-then-executable pages, so Node aborts with a V8 fatal error (SIGTRAP, shell exit 133). Then:

• the generator-identity probe reported node and typescript as absent and still exited 0;
• the TypeScript reader turned it into typescript_reader_failed without changing the exit code, so TypeScript facts went missing without anyone noticing (unless --strict was set).

Fix (msdmd/native_code.py, msdmd/collect.py)

• NODE_ARGV = ("node", "--jitless") is used by both the TypeScript worker and the identity probe. The output is byte-identical: I checked the worker output on collection.ts and skill-lib_msdmd.ts under JIT, --jitless, and --jitless under real PR_SET_MDWE, and the sha256 matched in all three. It's slower because it only interprets.
• node_signal() recognizes a signal death, either -N from Python or 128+N from a shell or shim wrapper. If the worker is killed by a signal, it reports the new node_runtime_unavailable diagnostic, which is in RUNTIME_UNAVAILABLE_CODES. The CLI exits 3 and writes nothing. --check also gives 3, not drift. The opt-out is unchanged (--allow-missing-reader-runtimes). The CLI prints the signal name, but never the worker's stderr.
• When the --print-generator-identity probe is killed by a signal, exits nonzero, can't spawn (OSError, for example ENOMEM), or prints unexpected output, it raises GeneratorIdentityError, and the CLI exits 3 with nothing on stdout. If Node isn't on PATH at all, it's still recorded as absent, as documented before.

Tests (tests/test_msdmd_node_sandbox.py, 8 tests)

• I simulated the signal death with a patched subprocess.run (-5 and 133) and with a fake node on PATH that runs kill -TRAP $$. They cover the reader, the probe, and both CLI paths. The CLI tests check exit 3, that the previous artifact is left byte-identical, that no temp files remain, and that the identity prints nothing.
• Both subprocess calls start with node --jitless.
• Node missing from PATH is still absent.
• One test runs the real restriction where the kernel supports PR_SET_MDWE (Linux 6.3+). It's skipped otherwise. In that test, JIT node gets killed, the jitless collection and identity under MDWE match the unrestricted run byte for byte, and TypeScript isn't absent.
• All 8 new tests fail on 38c6433.

Docs

msdmd/SKILL.md, docs/runner-config-guidance.md, docs/propagation-checklist.md, the collector docstring, and a new CHANGELOG entry. Consumers must treat a nonzero --print-generator-identity as meaning there's no identity at all, not an empty one.

Gates, all run locally (Python 3.13, Node 24.15.0)

msdmd.collect --strict --check plus tsc, unittest discover (426 OK), gonol authority, drift --warnings-fail, compliance --warnings-fail, build_codex_plugin_skills --check, ratios_check --strict (0 drift), llms.build --check, and RepoLOTO audit and checks (7/7). The skill-lib_msdmd.ts churn is mechanical: snapshot revision and implementation digest.

Consumers: stack #78 will re-pin to the merge of this PR.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-06T11:02:10.741867Z	3fa40b9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.