fix(trace): tape-record file_exists / ls / mkdir / getcwd / exe_path (#585)

[InauguralPhysicist]

Closes #585

Five filesystem builtins predated the trace tape and were neither recorded nor replay-blocked, so under EIGS_REPLAY they ran live. A program branching on file_exists of p replayed against the current filesystem, not the recorded one — a tape recorded on one machine silently diverged on another. The same closed-world hole #471 closed for args and #148 covered for proc_*, and it sat visibly next to the already-taped is_dir (#576) in the same BUILTINS.md table.

Reproduction (before)

record file_exists("probe") with the file present  -> 1
delete the file
replay                                              -> 0   # ran live

Fix

Each is wrapped with the TAKE/RECORD pair — their live paths do real work (fopen, readdir list construction, a syscall) before the return value exists, so TRACE_NONDET_RET alone would still run that work under replay. The early TAKE short-circuits before any fs access and serves the recorded value.

mkdir — the design decision

mkdir is a write whose return (a success bit) is filesystem-dependent. It's Recorded, not #148-non-replayable, because that bit is pinnable by the tape (unlike a subprocess fd). Under EIGS_REPLAY the TAKE short-circuits before mkdir(2), so the recorded bit is served and the directory is not created a second time — replay doesn't re-run the write side effect, the same rule as the subprocess/audio boundary.

Oracle (transcript, both tiers)

test_replay.sh records with the fs in one state, mutates it, and replays — the recorded answer must win:

builtin	record	mutate	replay
file_exists	present → 1	delete file	1 (JIT + EIGS_JIT_OFF)
ls	2 entries	delete them	2
mkdir	success → 1	remove dir	1, dir not re-created
getcwd	dir A	replay from /	A

exe_path uses the same getcwd pattern but is invariant between record and replay (same interpreter binary), so it's documented rather than mutation-tested.

Consumer gates

The reason the trace-tape skill mandates checking them — one consumer calls these:

• liferaft test/replay.sh: unaffected (calls none of the five), still N=1 (argv only).
• tidelog test/replay.sh: calls file_exists; byte-for-byte identical record vs replay. The change improves its determinism — file_exists no longer runs live under replay.

Docs

docs/TRACE.md lists the five under Recorded Builtins with mkdir's write-side-effect note; docs/BUILTINS.md marks each trace-recorded, closing the side-by-side inconsistency the issue flagged.

Gates

• Release suite 3090/3090
• ASan + UBSan detect_leaks=1 3094/3094, leak tally 0
• test_replay.sh 23/23 including strict-mode (exit 3 on name mismatch)

🤖 Generated with Claude Code