issue-1040-serialize-audit-state-writes.md

bump	patch
type	Fixed

• Serialize the create-issue audit state owner's writes so concurrent invocations cannot corrupt the record. scripts/issue-audit-state.py now wraps every mutating subcommand in an exclusive-create sentinel critical section (a .lock file beside the state document, created with os.O_CREAT | os.O_EXCL), so two concurrent invocations for the same slug produce a document reflecting one of them entirely and then the other, never a mixture. save_state obtains a unique per-writer temporary path from tempfile.mkstemp (retaining the .json.tmp suffix) and retries os.replace over PermissionError, so two writers never share and truncate one temporary file. Read-only subcommands (query-*, emit-body, check-claim-staleness) acquire no sentinel and stay unserialized; an abandoned sentinel is recovered by age. A new fail-closed transitive call-graph check in lib/test/check-audit-lifecycle-contracts.py proves save_state is unreachable from every read-only-classified subcommand. The mechanism is standard-library only (no fcntl/msvcrt), adds no state-document field, and produces no new mutation-exit class — every section failure is a could not persist state to … condition the shipped routing already carries. The decision channel (next_call= / query-*) remains unserialized, and its non-authoritative-under-concurrency residual is stated in docs/DEVFLOW_SYSTEM_OVERVIEW.md §11. (#1045)
• #1004 migration note. This change adds two test-only environment variables in the frozen DEVFLOW_ namespace — DEVFLOW_IAS_ACQUIRE_WINDOW_S and DEVFLOW_IAS_STALE_AFTER_S — which the Tier-3 env-var rename (#1004) must migrate alongside the existing DEVFLOW_* members. (#1045)