G-095 activated: punkcheck concurrent-writer safety (atomic saves + advisory event-scoped locking)

Follows straight from G-094's landing: the single save chokepoint
(installtrack save_working_recordset) is in place and the G-094
verification itself logged a transient concurrent-save failure with a
second session active in this checkout - the exact exposure this goal
closes.

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

GOALS.md

@@ -334,7 +334,7 @@ Detail: goals/G-089-scriptlib-kits-and-modes.md
 Scope: src/modules/shellfilter-999999.0a1.0.tm (stack placement, insert_transform, junctions), src/modules/shellthread-999999.0a1.0.tm (worker park/adoption/termination), src/tests/modules/ (new characterization suites), README.md ('very unripe parts' note)
 Detail: goals/G-090-shellfilter-shellthread-audit.md
 
-### G-095 [proposed] punkcheck concurrent-writer safety: atomic saves and advisory event-scoped locking
+### G-095 [active] punkcheck concurrent-writer safety: atomic saves and advisory event-scoped locking
 Scope: src/modules/punkcheck-999999.0a1.0.tm (save/load chokepoint: atomic rename, lockfile protocol, merge-on-flush, non-interactive recovery), src/make.tcl + src/modules/punk/mix/cli-999999.0a1.0.tm (event-scoped lock consumers as verified), src/tests/modules/punkcheck/testsuites/punkcheck/ (new concurrency suite)
 Detail: goals/G-095-punkcheck-concurrent-writer-safety.md
 

goals/G-095-punkcheck-concurrent-writer-safety.md

@@ -1,6 +1,6 @@
 # G-095 punkcheck concurrent-writer safety: atomic saves and advisory event-scoped locking
 
-Status: proposed
+Status: active
 Scope: src/modules/punkcheck-999999.0a1.0.tm (save/load chokepoint: atomic rename, lockfile protocol, merge-on-flush, non-interactive recovery), src/make.tcl + src/modules/punk/mix/cli-999999.0a1.0.tm (event-scoped lock consumers as verified), src/tests/modules/punkcheck/testsuites/punkcheck/ (new concurrency suite)
 Goal: Concurrent writers to the same .punkcheck file cannot corrupt it or silently erase each other's records, and readers never observe torn content - every save is write-temp-then-atomic-rename (bounded retry for Windows sharing violations); an advisory cross-platform lockfile (open {WRONLY CREAT EXCL}, contents naming holder pid/host/installer/timestamp, bounded-retry acquisition, age-based stale-break with warning) serializes whole installer events per punkcheck root; deferred-mode flushes merge own records (INSTALLER by -name, FILEINFO by -targets) into freshly-loaded file state instead of wholesale overwrite; and the duplicate-INSTALLER sanity recovery degrades to a clean actionable error instead of an askuser prompt when stdin is non-interactive.
 Acceptance: a concurrency test drives two child tclsh installer processes against one .punkcheck folder - the file parses cleanly throughout (a polling load_records_from_file reader hits no TDL parse error), both installers' records are present afterwards, and no duplicate INSTALLER records exist; lock behaviour verified - the second writer observably waits, or times out with a message naming the holder from lockfile contents; stale-break verified against a planted orphan lockfile; suite passes on the project's Windows Tcl 8.6 + Tcl 9 test matrix (capability-gated where child-process facilities require it), with a unix run when an environment is available.