fix(s010): the data-directory lock reads a pid's liveness on macOS and Windows

Red: package runs 35512430836 (slice/011), 35515556177 (slice/012),
35521749862 and 35522642934 (this branch), the last one printing the
reason at last: on macOS and Windows the serve step's launch refused to
start with "is held by OS pid ... in desktop mode" after the smoke run's
clean exit. Slice 010 read liveness through /proc on Linux and treated
any file as held elsewhere ("the safe direction"), and the smoke path
halts without running terminate/2, so the file it left made every
second launch of the packaged app refuse on both platforms: a user
whose app crashed once would be locked out until they found the file.
Liveness now comes from kill -0 on the other Unixes and tasklist on
Windows; a check that cannot run still says held. Linux unchanged (the
/proc test in lock_test.exs); the package run is the measurement for
the other two. The four lock.ex sobelow skips rekeyed (the moduledoc
grew three lines), reasons carried over. Gate exit 0, 177 tests.

Signed-off-by: Ayla Croft <aylacroft@proton.me>

Author: HackTuah

.sobelow-skips

@@ -1,5 +1,5 @@
 Config.CSP: Missing Content-Security-Policy,lib/trinity_web/router.ex:14,1DC4768
-Traversal.FileModule: Directory Traversal in `File.mkdir_p`,lib/trinity/data_dir/lock.ex:57,35AB9EC
-Traversal.FileModule: Directory Traversal in `File.read`,lib/trinity/data_dir/lock.ex:143,55D5ADB
-Traversal.FileModule: Directory Traversal in `File.rm`,lib/trinity/data_dir/lock.ex:82,21D88E2
-Traversal.FileModule: Directory Traversal in `File.write`,lib/trinity/data_dir/lock.ex:132,1C42814
+Traversal.FileModule: Directory Traversal in `File.mkdir_p`,lib/trinity/data_dir/lock.ex:60,4ECF02C
+Traversal.FileModule: Directory Traversal in `File.read`,lib/trinity/data_dir/lock.ex:146,5EFB666
+Traversal.FileModule: Directory Traversal in `File.rm`,lib/trinity/data_dir/lock.ex:85,7D2B826
+Traversal.FileModule: Directory Traversal in `File.write`,lib/trinity/data_dir/lock.ex:135,42D2817

.sobelow-skips.reasons

@@ -10,7 +10,7 @@
 #
 # format: <fingerprint><TAB><reason>
 1DC4768	Slice 013, the browser pipeline: the policy IS set, by TrinityWeb.Plugs.ContentSecurityPolicy with a nonce per request, placed before put_secure_browser_headers. sobelow recognises only a header map given to put_secure_browser_headers, so it keeps reporting the pipeline. test/trinity_web/plugs/content_security_policy_test.exs asserts the header and the nonce on every browser response. Rekeyed from 2DBC9F9 (router.ex:12, slice 000, "slice 013 owns it") when the plug moved the line to 14.
-35AB9EC	Slice 010, Trinity.DataDir.Lock.acquire/2: the directory is the application's own data directory from config or Trinity.Paths, never a request or a model output; the lock has to create it before the Repo does. Low confidence traversal by the tool's own label.
-55D5ADB	Slice 010, Trinity.DataDir.Lock read/1: reads <data_dir>/LOCK, a path this module composes from the data directory and a constant file name; no caller supplies it.
-21D88E2	Slice 010, Trinity.DataDir.Lock.release/2: removes <data_dir>/LOCK only when the file carries this process's own token; same composed path as the read.
-1C42814	Slice 010, Trinity.DataDir.Lock take_over/2: rewrites <data_dir>/LOCK after the recorded holder's pid is found dead; same composed path, same constant name.
+4ECF02C	Rekeyed at slice 013 (the moduledoc grew three lines for the macOS and Windows liveness check). Slice 010, Trinity.DataDir.Lock.acquire/2: the directory is the application's own data directory from config or Trinity.Paths, never a request or a model output; the lock has to create it before the Repo does. Low confidence traversal by the tool's own label.
+5EFB666	Rekeyed at slice 013 (the moduledoc grew three lines for the macOS and Windows liveness check). Slice 010, Trinity.DataDir.Lock read/1: reads <data_dir>/LOCK, a path this module composes from the data directory and a constant file name; no caller supplies it.
+7D2B826	Rekeyed at slice 013 (the moduledoc grew three lines for the macOS and Windows liveness check). Slice 010, Trinity.DataDir.Lock.release/2: removes <data_dir>/LOCK only when the file carries this process's own token; same composed path as the read.
+42D2817	Rekeyed at slice 013 (the moduledoc grew three lines for the macOS and Windows liveness check). Slice 010, Trinity.DataDir.Lock take_over/2: rewrites <data_dir>/LOCK after the recorded holder's pid is found dead; same composed path, same constant name.

lib/trinity/data_dir/lock.ex

@@ -14,9 +14,12 @@ defmodule Trinity.DataDir.Lock do
 
   The file is created with `:exclusive`, so two boots racing for it cannot both win. It
   carries the holder's OS pid, mode (`desktop` or `headless`), a per-boot token and the time.
-  A file whose pid is no longer alive is stale and is taken over; on platforms where
-  liveness cannot be read this module treats the file as held, so the only way past a
-  dead holder there is removing the file by hand, which is the safe direction.
+  A file whose pid is no longer alive is stale and is taken over. Liveness is read from
+  `/proc` on Linux, `kill -0` on the other Unixes and `tasklist` on Windows (slice 013:
+  slice 010 read it on Linux alone and treated any file as held elsewhere, and the packaged
+  binary's second launch on macOS and Windows then refused to start after a clean first run,
+  package runs 35512430836 through 35522642934). When the check itself fails the file is
+  treated as held, which is the safe direction; the message names the pid to remove by hand.
 
   The lock file is not the database and is never inside a transaction; it says nothing
   about the integrity of the data, only about who may open it.
@@ -163,13 +166,34 @@ defmodule Trinity.DataDir.Lock do
 
   defp token, do: Base.url_encode64(:crypto.strong_rand_bytes(9), padding: false)
 
-  # Liveness of an OS pid. Linux answers through /proc; anywhere else this says "alive", so a
-  # stale file from a crashed holder is refused rather than silently taken over. That is
-  # the safe direction and the message names the pid to remove it by hand.
+  # Liveness of an OS pid. Linux answers through /proc; the other Unixes through `kill -0`
+  # (exit 0: exists; 1: gone, or another user's, which this per-user directory does not
+  # expect); Windows through `tasklist`, which prints the pid on a match and an INFO line
+  # otherwise. A check that cannot run says "alive", so a file is refused rather than taken
+  # over on doubt.
   defp alive?(pid) do
     case :os.type() do
       {:unix, :linux} -> File.dir?("/proc/#{pid}")
-      _ -> true
+      {:unix, _} -> alive_by_kill?(pid)
+      {:win32, _} -> alive_by_tasklist?(pid)
     end
   end
+
+  defp alive_by_kill?(pid) do
+    case System.cmd("kill", ["-0", Integer.to_string(pid)], stderr_to_stdout: true) do
+      {_, 0} -> true
+      {_, _} -> false
+    end
+  rescue
+    _ -> true
+  end
+
+  defp alive_by_tasklist?(pid) do
+    case System.cmd("tasklist", ["/FI", "PID eq #{pid}", "/NH"], stderr_to_stdout: true) do
+      {out, 0} -> String.contains?(out, " #{pid} ")
+      {_, _} -> true
+    end
+  rescue
+    _ -> true
+  end
 end

slices/013-liveview-chat-streaming/PROOF.md

@@ -204,3 +204,13 @@ The packaged chat against `openrouter:ling` renders the answer as markdown with
 log: `proof/ac1-final-openrouter-packaged.png`. `VERSIONS.md` gained the `rustler` row (build time only);
 `versions.verify`: 84 locked packages, 48 pins. Gate on this tree: exit 0, 177 tests. The `package` run on the
 final tree is named in the next correction.
+
+## Correction, 2026-09-20: the package run on the decided tree
+Supersedes "the `package` run on the final tree is named in the next correction" above. Run **35521749862**
+(dispatched on `22cd58c`'s tree, the musl NIF build): **linux x86_64 green end to end**, the NIF compiled from
+source in the job, the smoke step reading `TRINITY_SMOKE_MARKDOWN=ok`, the serve step HTTP 200. **macOS
+aarch64 and windows x86_64: the smoke step passed on both**, `TRINITY_SMOKE_MARKDOWN=ok` from the precompiled
+artifact on each, so the renderer's NIF loads on all three operating systems; both then failed the serve step
+exactly as the slice/011 and slice/012 tag runs did before this slice, with an empty log (the port loop timing
+out). The step now prints `serve.log` on that path too (`fix(s001)`), and run 35522642934 was dispatched to read
+it; its result is the next correction.