feat(silo/trace): write_set lock-coverage assert (izanagi 後続段 3, D38)

writePhase の #if TRACE ブロックに lock 被覆 assert を追加。verifier が構造的に
見えない領域 (lock 獲得・被覆・torn read) を検証ビルドでのみ検出する。

- trace.hh: namespace izanagi_trace に thread_local shadow set (どのタプルを自
  worker が CAS-lock したか) + emit_lock_violation ('X' 行)。全て #if TRACE ゆえ
  perf ビルドに一切残らない (観測者効果分離)。namespace 内に置くことで perf ビルドの
  nm ガード (izanagi_trace 部分文字列一致) が漏れを確定的に覆う。
- transaction.cc: lockWriteSet 入口で shadow を whole-set clear (per-txn 隔離)、
  CAS 成功で record_lock。writePhase で 2 点検査 — 入口 (獲得被覆: 全非 INSERT が
  lock==1 かつ自 worker 保持) と各 storeRelease 直前 (保持継続: 早期 unlock 検出)。
  違反ごとに X 行 (reason=not-locked-at-entry / lock-lost-before-write)。txid は
  writePhase スコープに hoist し X を同 txn の C/R/W と相関させる。unlockWriteSet
  2 種と writePhase 末尾でも shadow を clear。

X 行は izanagi 側 verifier で Integrity.lock_coverage_violations に配線され verdict
を indeterminate に倒す (torn read は版 stamp を信用不能にするため。cycle ではない)。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: thawk105

cc/silo/transaction.cc

@@ -144,6 +144,13 @@ Status TxExecutor::delete_record(Storage s, std::string_view key) {
 
 void TxExecutor::lockWriteSet() {
   Tidword expected, desired;
+#if TRACE
+  // Per-txn lock-coverage shadow reset (D38, 裁定7). Unconditional whole-set
+  // clear at entry makes per-txn isolation independent of any abort/retry exit
+  // path (defense-in-depth; the real false-green guard is the raw-lock-bit check
+  // in writePhase). #if TRACE only -> compiled out of the perf build (絶対規律1).
+  izanagi_trace::clear_shadow();
+#endif
 
   [[maybe_unused]] retry
       : for (auto itr = write_set_.begin(); itr != write_set_.end(); ++itr) {
@@ -163,8 +170,16 @@ void TxExecutor::lockWriteSet() {
         desired = expected;
         desired.lock = 1;
         if (compareExchange((*itr).rcdptr_->tidword_.obj_, expected.obj_,
-                            desired.obj_))
+                            desired.obj_)) {
+#if TRACE
+          // This worker now holds the lock on this tuple (D38). On the skeleton
+          // CAS-success path (not the coder edit surface = the conflict response
+          // above), so a variant cannot suppress the record without also failing
+          // the acquisition it is meant to prove.
+          izanagi_trace::record_lock((*itr).rcdptr_);
+#endif
           break;
+        }
       }
     }
     if (itr->op_ == OpType::UPDATE && itr->rcdptr_->tidword_.absent) {
@@ -344,6 +359,9 @@ void TxExecutor::unlockWriteSet() {
     desired.lock = 0;
     storeRelease((*itr).rcdptr_->tidword_.obj_, desired.obj_);
   }
+#if TRACE
+  izanagi_trace::clear_shadow();  // abort/retry exit -> reset coverage shadow (D38, 裁定7)
+#endif
 }
 
 void TxExecutor::unlockWriteSet(
@@ -357,6 +375,9 @@ void TxExecutor::unlockWriteSet(
     desired.lock = 0;
     storeRelease((*itr).rcdptr_->tidword_.obj_, desired.obj_);
   }
+#if TRACE
+  izanagi_trace::clear_shadow();  // partial unlock (retry/abort) -> reset shadow (D38, 裁定7)
+#endif
 }
 
 bool TxExecutor::validationPhase() { // Validation Phase
@@ -521,20 +542,37 @@ void TxExecutor::writePhase() {
   // key and the produced version id. read_set_/write_set_ are still intact
   // here (cleared at the end of writePhase). All data is CC-native -- no
   // verification-only tuple field is added (docs/ccbench-anatomy.md  4-5).
-  {
-    const std::uint64_t txid = izanagi_trace::next_txid();
-    izanagi_trace::emit_commit(thid_, txid, maxtid.epoch, maxtid.tid);
-    for (auto& re : read_set_) {
-      const Tidword v = re.get_tidword();
-      izanagi_trace::emit_read(thid_, txid, izanagi_trace::key_to_hex(re.key_),
-                               v.epoch, v.tid);
-    }
-    for (auto& we : write_set_) {
-      const char op = (we.op_ == OpType::INSERT)   ? 'I'
-                      : (we.op_ == OpType::DELETE) ? 'D'
-                                                   : 'U';
-      izanagi_trace::emit_write(thid_, txid, izanagi_trace::key_to_hex(we.key_),
-                                op, maxtid.epoch, maxtid.tid);
+  // txid is hoisted to writePhase scope (D38) so the per-storeRelease retention
+  // check in the write loop below shares this txn's id (keeps X lines correlated
+  // with this txn's C/R/W; a fresh next_txid() would orphan them).
+  const std::uint64_t izanagi_txid = izanagi_trace::next_txid();
+  izanagi_trace::emit_commit(thid_, izanagi_txid, maxtid.epoch, maxtid.tid);
+  for (auto& re : read_set_) {
+    const Tidword v = re.get_tidword();
+    izanagi_trace::emit_read(thid_, izanagi_txid, izanagi_trace::key_to_hex(re.key_),
+                             v.epoch, v.tid);
+  }
+  for (auto& we : write_set_) {
+    const char op = (we.op_ == OpType::INSERT)   ? 'I'
+                    : (we.op_ == OpType::DELETE) ? 'D'
+                                                 : 'U';
+    izanagi_trace::emit_write(thid_, izanagi_txid, izanagi_trace::key_to_hex(we.key_),
+                              op, maxtid.epoch, maxtid.tid);
+  }
+  // Entry lock-coverage check (D38, 裁定4 point 1 = acquisition coverage).
+  // Every non-INSERT write must be covered, right now at writePhase entry, by a
+  // lock THIS worker holds. Reads the live tidword.lock (ground truth in the
+  // tuple) AND the shadow set (owner = us; tidword has no owner field). Emits X
+  // (not-locked-at-entry) per uncovered write = catches lock-skip. INSERT excluded
+  // (created lock=1/absent, covered by construction).
+  for (auto& we : write_set_) {
+    if (we.op_ == OpType::INSERT) continue;
+    Tidword cur;
+    cur.obj_ = loadAcquire(we.rcdptr_->tidword_.obj_);
+    if (!cur.lock || !izanagi_trace::holds_lock(we.rcdptr_)) {
+      izanagi_trace::emit_lock_violation(thid_, izanagi_txid,
+                                         izanagi_trace::key_to_hex(we.key_),
+                                         "not-locked-at-entry");
     }
   }
 #endif
@@ -548,6 +586,19 @@ void TxExecutor::writePhase() {
     // update and unlock
     switch ((*itr).op_) {
       case OpType::UPDATE: {
+#if TRACE
+        // Retention check (D38, 裁定4 point 2): the lock must still be held right
+        // before we write this tuple's data. An early unlock (lock released before
+        // the memcpy) opens a torn-read window -> emit X (lock-lost-before-write).
+        {
+          Tidword cur;
+          cur.obj_ = loadAcquire((*itr).rcdptr_->tidword_.obj_);
+          if (!cur.lock)
+            izanagi_trace::emit_lock_violation(
+                thid_, izanagi_txid, izanagi_trace::key_to_hex((*itr).key_),
+                "lock-lost-before-write");
+        }
+#endif
         memcpy((*itr).rcdptr_->body_.get_val_ptr(), (*itr).body_.get_val_ptr(),
                (*itr).body_.get_val_size());
         storeRelease((*itr).rcdptr_->tidword_.obj_, maxtid.obj_);
@@ -559,6 +610,16 @@ void TxExecutor::writePhase() {
         break;
       }
       case OpType::DELETE: {
+#if TRACE
+        {
+          Tidword cur;
+          cur.obj_ = loadAcquire((*itr).rcdptr_->tidword_.obj_);
+          if (!cur.lock)
+            izanagi_trace::emit_lock_violation(
+                thid_, izanagi_txid, izanagi_trace::key_to_hex((*itr).key_),
+                "lock-lost-before-write");
+        }
+#endif
         maxtid.absent = true;
         // Return value intentionally ignored: a missing key still needs the
         // tid bump and gc_records_ push below.
@@ -574,6 +635,9 @@ void TxExecutor::writePhase() {
     }
   }
 
+#if TRACE
+  izanagi_trace::clear_shadow();  // success path -> reset coverage shadow (D38, 裁定7)
+#endif
   gc_records();
   read_set_.clear();
   write_set_.clear();

include/trace.hh

@@ -30,6 +30,7 @@
 #include <fstream>
 #include <ios>
 #include <string>
+#include <unordered_set>
 
 namespace izanagi_trace {
 
@@ -94,6 +95,30 @@ inline void emit_write(std::size_t thid, std::uint64_t txid,
                << ' ' << tid << '\n';
 }
 
+// --- Lock-coverage shadow set (izanagi 後続段 3, D38) ---
+// Records which tuples THIS worker CAS-locked in lockWriteSet, so writePhase
+// can verify every written tuple is still covered by a lock this thread holds.
+// Verification-only: entirely inside `#if TRACE`, so the perf build has none of
+// it (絶対規律1). Kept in namespace izanagi_trace so the perf-build nm guard
+// (buildcache._has_trace_symbols = "izanagi_trace" substring) deterministically
+// covers any accidental leak of this TU's symbols (D38/OBS-1).
+inline std::unordered_set<const void*>& lock_shadow() {
+  thread_local std::unordered_set<const void*> s;
+  return s;
+}
+inline void record_lock(const void* rcd) { lock_shadow().insert(rcd); }
+inline void clear_shadow() { lock_shadow().clear(); }
+inline bool holds_lock(const void* rcd) { return lock_shadow().count(rcd) != 0; }
+
+// A lock-coverage violation: writePhase wrote (or is about to write) a tuple
+// without holding its lock. reason in {not-locked-at-entry, lock-lost-before-write}.
+// The verifier maps X lines to Integrity.lock_coverage_violations -> indeterminate
+// (a torn-read window makes version stamps untrustworthy; not a cycle). D38.
+inline void emit_lock_violation(std::size_t thid, std::uint64_t txid,
+                                const std::string& key_hex, const char* reason) {
+  stream(thid) << "X " << txid << ' ' << key_hex << ' ' << reason << '\n';
+}
+
 } // namespace izanagi_trace
 
 #endif // TRACE