[lucidprogrammer]

Hosted run: CI 39975873897 — green, 27 min 26 s (15:09:42 → 15:37:08 UTC), every job passed, including lint-macos (7 min 41 s).

Commits (on dev 6a0d4b4)

1. 69b3975a engine: verify macOS readers by process identity, keep reader holds separate from writer ownership, and let reader waits be cancelled.
2. b02c85af ci, tests: add macOS linting, regroup test bundles, and isolate concurrent test observations.

What changed

Readers on macOS. A database reader is recognised by its verified process identity (process start plus the database file's identity), so a recycled process id or a replaced file cannot pass for a live reader. Reader holds are tracked apart from writer ownership, so a reader can never be mistaken for the writer or release its lock. A reader waiting for a release can be cancelled instead of blocking until the holder goes away.

macOS channel location (security fix). The default macOS owner channel used to sit at a predictable directory in the shared sticky /tmp; any other local user could create it first and permanently deny the channel. It now lives in the per-user Darwin temporary directory, checked for ownership, mode 0700, no symlinks and a local filesystem, and fits the 104-byte socket-path limit. Linux is unchanged.

CI. A macOS lint job is a required PR check; integration test bundles are regrouped by measured time; the aarch64 cross-compile uses a pinned, checksum-verified zig.

Tests. Tests that observed process-wide state use a thread-local recorder or isolated child processes. Tests that depended on timing now wait on real events: the purge-export test releases its pause on every path, the writer-flood trigger test holds its first callback until a contender actually reaches the contention point, and CLI pull progress is driven from page events. The crashed-holder PID-lock test (tests/acceptance/db_lock_visibility.rs) is built on Linux only, on purpose.

Cross-family review (Grok)

• Commit 2: SHIP, no findings.
• Commit 1: STEER, one documentation gap — two rustdoc comments in local_transport/runtime.rs still named the contextdb child on macOS. Fixed in 69b3975a (comment-only).
• Earlier slices of the same work: SHIP on CI docs, determinism and cursor-clock ordering; the zig-version STEER was resolved by pinning the latest zig with a checksum.

Supersedes #9.