A store commit that loses the index.lock race retries once and speaks in the CLI's words (#444)

[tonite31]

Closes #444

Two sessions writing into one git-backed store hit git's index lock, and the
loser used to be told, in git's words, to remove a lock file a live process was
holding — printed after this command's own receipt, with a non-zero exit for a
write that had succeeded. commitAll staged and committed through mustGit,
and mustGit puts git's stderr into the refusal it raises.

The append was never at stake: it is in log.jsonl before commitAll is
reached, and whichever session commits next sweeps it in. Several events per
commit is what decision 01kz57aqsxym2g2g8wasp6vv7j (#7) accepts. This is the
wording and the exit status only.

The three decisions

1. One short retry. add and commit go through tookTheIndex, which
   tries each step twice with a 300 ms Atomics.wait between the attempts —
   the synchronous sleep human.ts already uses, because git runs under
   spawnSync and there is no loop turn to await on. No loop, no lock of the
   CLI's own: a loop would be the write coordination Concurrent event writes collapse several events into one store commit #7 ruled out, arrived at
   from underneath.
2. The CLI's words, never git's. Losing both attempts prints one notice —
   the store is being written by another session; this event is recorded and
   will be committed with the next write — and returns, exit 0. Nothing of
   git's stderr reaches the reader on this path. Any other git failure keeps
   today's behaviour: the same refusal, carrying git's own stderr, from the
   sentence mustGit has always raised, extracted as gitFailed so the two
   paths cannot drift apart.
3. Recognised by the lock's path, index.lock in git's stderr — not by the
   exit status, which git shares with every other fatal, and not by the
   sentence around the path, which git translates while the path itself is
   never translated.

Scope is commitAll and the mustGit plumbing it needs to see stderr. status --porcelain keeps mustGit: it declines to refresh an index it cannot lock
and still answers, exit 0. The nine callers, the signature and the write path
are untouched, and nothing removes a lock or coordinates the two sessions.

The notice is said in commitAll rather than by its callers, for the reason
the server-backed check is made there — a caller added later would otherwise be
the one that lets git's advice through — and is silent under --json, for the
reason pipeline.ts's receipt is: a line of prose ahead of the envelope is an
agent's parse error, and the agent has its receipt either way.

The cells

docs/maintainers/case-tables/444-index-lock.md, one test each in
apps/cli/test/store-lock.test.mjs. The lock is a file the suite holds, not a
second git racing this one — a real race answers differently on every machine.

#	Seeded state	Expected
1	a held .git/index.lock, standing for the whole run, while state add runs	exit 0; the receipt; exactly one CLI-worded notice; no line holding index.lock or manually; the lock still there; the event in log.jsonl; status --porcelain showing the log uncommitted; no new commit
2	the same lock, removed 150 ms after the command starts	the retry lands the event's own commit, and no notice
3	no lock	the printed bytes are the receipt, the review line and the entity id, exactly as before; one new commit; a clean status --porcelain
4	a server-backed store with a lock file lying in it	exit 0; the append queued in pending.jsonl; no notice; no git text; no commit — none of this path runs
5	a held lock under a French LC_ALL/LANG/LANGUAGE	the same as cell 1 — recognition is on the path, which git does not translate

Cells 4 and 5 are the two reads commitAll makes from outside its arguments
that the issue's own table left unstated: which kind of store this is, and what
language git says it in.

Gates

Run locally on the branch: pnpm --filter superself typecheck, pnpm --filter superself build, node test/structure.mjs (base 8b010621a594, ceiling 30
lines, 0 dead exports), and node --test on store-lock.test.mjs (5/5),
docs.test.mjs (12/12) and place, context, execution, integrity,
lifecycle (98/98). CI runs the whole suite.

Self-adversarial pass: with the retry removed cell 2 fails and the rest pass;
with the wording reverted to mustGit cells 1, 2 and 5 fail — the defect
itself — and 3 and 4 stay green. Both reverts restored.

🤖 Generated with Claude Code