Interrupted local-store write can leave a short `level.pending` that blocks repository open

[dtmland]

Lore version

lore 0.9.0

Installation method

Built from source

Operating system / architecture

• macOS aarch64(primary reproduction)
• Linux x86_64 (also reproduced, lower frequency)
• Windows x86_64 (completed without marker, no reproduction)

Steps to reproduce

Deterministic reduction from a healthy local/offline repository containing one commit:

group="$(find .lore/immutable/index -mindepth 1 -maxdepth 1 \
    -type d | head -1)"
: > "$group/level.pending"
lore status --repository "$PWD" --offline --no-pager

Or to reproduce via process termination:

1. Create a new local/offline repository
2. Stage and commit a file
3. Kill the process during a subsequent commit operation
4. Attempt to open the repository

On macOS arm64: reproduced in 1 of 5 process-kill attempts (20% frequency). On Linux x86_64: interrupted 3 of 6 attempts but did not produce the marker in those cases.

Expected vs actual behavior

Expected: Opening the repository should recover an empty/short pending marker, or expose a supported repair operation that does not require an application to interpret LORE's private files.

Actual: The repository remains unusable until the empty private marker (.lore/immutable/index//level.pending) is manually removed. LORE reports that the level header is 0 bytes instead of 16 and cannot open the repository.

Component

Client (CLI)

Server context

N/A - local/offline mode only

Regression?

This still reproduces in 0.9.0 and also reproduced in 0.8.5 (approximately 20% of trials in 0.8.5).

Relevant logs or output

The 0.9.0 source opens this marker with create-and-truncate before its asynchronous 16-byte write, while recovery rejects every header shorter than 16 bytes. This creates a real process-termination window between truncate and header completion that matches the deterministic empty-marker residue above.

Is a short pending header intended to be recoverable, and can recovery tests cover termination between truncate and completion of the header write?