R.6-R.10: sealing, claim/lease, masking, and the nine defects the critic found

[tom-snyder]

Summary

R.6 sealing, R.7 claim/lease, R.8 masking, R.9 retention doc, R.10 critic — plus the fix round for everything R.10 raised, and an amendment to my own enum ruling.

The critic returned FAIL with 3 blockers and 6 majors, and reproduced every one with a named probe rather than arguing it. All are fixed, and every fix leaves a permanent regression test behind (critique02_regression_test.go in both packages). A fixed defect with no test is a defect waiting to return.

Blockers

B1 — two live leases on one finding. Durable uniqueness was (finding_id, audit_record_id), not (fingerprint, record_version): a re-scan mints a new audit_record per scan_run, each defaulting to audit_version 1, so one fingerprint got independent concurrent leases. Now guarded in both the selecting and the granting statement — the latter reads fingerprint and version via scalar subqueries on handoff_id, so there's no read-then-write window. Verified by reverting the guard and watching two probes fail.

Honest limit: this is a statement-level guarantee, not a durable constraint. It does not stop a row being set to leased by a different binary. The DDL that would make it structural is recorded rather than silently omitted.

B2 — a consumed audit fell out of the eligibility gate and was then expired. S1 requires a re-entrant consumer, and R.6's own sealer already kept consumed audits readable — R.7's gate simply disagreed with it.

B3 — masking missed fields carrying live credentials. Discovery covered only webRequest/webResponse headers and parameters, so anvil/repro.curl — a reproduction command line that routinely carries a bearer token — reached the store unmasked. S7 names this the highest-risk field in the system. Masking now walks a single enumerated surface of ten pointers, and curl arguments are masked structurally (-H, -b, -u, -d/-F, bare URLs), failing closed on an unparseable header argument.

The new tests build a minimal record and assert the planted secret appears exactly once before masking, so they cannot pass by propagation from a header — that false-confidence pattern was itself one of the findings.

Majors

AssertMasked was weaker than Mask — the gate sinks are told to trust — and now drives off the same enumeration with a divergence guard that walks the surface rather than a hand-written list. ReadPacket checked nothing and is now gated on lease ownership, audit eligibility and record version, re-asserted against the database rather than a stale Handle. Sealer.Inspect bypassed the expiry arm. IdempotencyKey hashed an autoincrement rowid instead of the audit identity. And a requires_dynamic_confirmation finding could reach validated with no dynamic evidence, contradicting S7 outright.

An amendment to my own ruling, and the mistake I made making it

R.6 flagged — rather than absorbed — that the frozen nine-value dastStatus enum had no image for "the DAST half itself broke", and was folding it onto completed_partial. Wrong for the reason S6 gives about targets: a half that crashed differs from one that covered part of the surface, and collapsing them makes dast_coverage uninterpretable. So the enum gains completed_failed, and DeriveDastStatus is now total.

I landed that amendment in two of the five places the vocabulary lives, and the tree went red. R.4's TestEnumCheckConstraintsMatchContractLiteralForLiteral caught it by comparing the SQL CHECK against the Go enum literal-for-literal — the guard doing exactly its job. Had it shipped, the consequence would have been worse than the fold it replaced: an audit whose DAST half crashed could not be persisted at all.

All five copies now move together, and CONTRACT.md records the list — because one vocabulary with five definitions is the same defect §6 exists to close, and an amendment is exactly when it recurs.

Left open, deliberately

• Queue.PacketPath stays exported and ungated; gated ReadPacket is the polite path, not the only one. Cache-file confidentiality rests on the 0700 directory mode.
• checkDynamicEvidence trusts the caller's Handle.DastStatus rather than re-reading audit_record, unlike the checks beside it.
• CRITIQUE-02 F10 (a voluntary hand-back burns an attempt) and F13 (any caller can set expired from outside the reaper that owns that clock) still reproduce. Neither was in the eight I asked to be fixed.

Testing

gofmt / vet / build   clean
go test -count=1      green: cmd/anvil, internal/handoff, internal/record, internal/store
                      163 tests pass

go test -race cannot run on this Windows host (cgo.exe exit 2). CI runs it on Linux — and the B1 concurrency probe needs that confirmation, so this PR's own CI run is the real check on it.