From 5c656717eff11c056191ac0f0a1d48c950910cd4 Mon Sep 17 00:00:00 2001
From: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Date: Mon, 19 Oct 2026 14:45:05 +0000
Subject: [PATCH] test(ci): declare unresolved legacy pathname coverage

Report the historical-PID access surfaces actually checked and explicitly mark
legacy cwd-relative pathname calls unverified. The existing tracer does not
provide their cwd identity, and a blanket rejection also rejects legitimate
GDB build-ID metadata queries.

Retain every committed access guard and document the preexisting limit without
claiming absence from missing path evidence. The complete real 44-case CLI/MCP
recorded-crash qualification passes with the coverage declaration.

Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
---
 docs/recorded-crashes.md                       | 5 ++++-
 scripts/verify/recorded-crash/trace-policy.mjs | 2 +-
 scripts/verify/recorded-crash/trace.mjs        | 8 ++++++++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/docs/recorded-crashes.md b/docs/recorded-crashes.md
index 3a7bbfcde..14dbac8cd 100644
--- a/docs/recorded-crashes.md
+++ b/docs/recorded-crashes.md
@@ -108,10 +108,13 @@ CLI/MCP parity, optional debugger context and historical PID collision with an
 owned live sentinel. Observed Node processes and their traced threads may read
 that live process's `stat` for the shared ownership inventory; debugger and
 decoder processes cannot use this exception. A second recording uses a valid
-historical PID above the host's assignable PID range and rejects every lookup,
+historical PID above the host's assignable PID range and rejects resolved lookups,
 including Node `stat` reads, to detect historical-PID-driven access separately
 from live inventory. Descriptor paths come from strace's `-yy` decoding; exact
 PID-directory opens and relative accesses through those handles are rejected.
+Failed FD-relative pathname attempts are checked across syscall variants.
+Legacy relative pathname calls without dirfd/cwd evidence remain unverified;
+the verification report declares this gap rather than establishing their absence.
 The trace includes signal calls and rejects PID-targeted signals/probes and
 pidfd controls, including nonfatal signals and signal zero. These checks cover
 the recorded file/process/signal syscall surfaces, not every possible kernel
diff --git a/scripts/verify/recorded-crash/trace-policy.mjs b/scripts/verify/recorded-crash/trace-policy.mjs
index 9760f3a6f..a1bfde540 100644
--- a/scripts/verify/recorded-crash/trace-policy.mjs
+++ b/scripts/verify/recorded-crash/trace-policy.mjs
@@ -82,7 +82,7 @@ const readsMetadata = (line, root, names) => {
   );
 };
 
-/** Permit only observed inventory reads; PID-directory handles and controls never qualify. */
+/** Check resolved PID references; cwd-relative legacy paths remain unqualified. */
 export function assertHistoricalPidAccess({
   trace,
   historicalPid,
diff --git a/scripts/verify/recorded-crash/trace.mjs b/scripts/verify/recorded-crash/trace.mjs
index d37fb9994..87715ec2c 100644
--- a/scripts/verify/recorded-crash/trace.mjs
+++ b/scripts/verify/recorded-crash/trace.mjs
@@ -198,6 +198,14 @@ export async function verifyCoreInspectionTrace({
       executions,
       historical_pid: historicalPid,
       sentinel: "still-alive",
+      historical_pid_access_coverage: {
+        checked: [
+          "absolute-proc-paths",
+          "decoded-fd-paths",
+          "pid-targeted-controls",
+        ],
+        unverified: ["legacy-cwd-relative-paths"],
+      },
       ownership_process_table_reads: ownershipReads,
     });
   }