feat(rfc-008): P3a — extract marker reads into enforcement-owned lib/marker-state.mjs

[lantisprime]

RFC-008 P3a — extract marker reads into enforcement-owned lib/marker-state.mjs

First sub-PR of RFC-008 P3 (the thin-waist decoupling phase). Establishes R1's strong form: the memory substrate must not own marker reads.

What

Pure extraction — relocate the stop-gate carve-out predicate, relaxed/strict mtime helpers, and own-session resolver out of em-recall.mjs (and the deleted stop-gate-helpers.mjs) into a new enforcement-owned scripts/lib/marker-state.mjs. No behavior change: em-recall --gate stop output is byte-identical.

• new scripts/lib/marker-state.mjs — 7 helpers, verbatim move (char-identical to origins)
• em-recall.mjs — imports 4 helpers from marker-state; drops now-unused TASK_SIGNAL_MARKERS/CHECKPOINT_QUARTET imports. The --gate stop dispatch handler stays (moves to enforce-contract.mjs in P3b)
• delete scripts/lib/stop-gate-helpers.mjs (sole importer updated in the same commit)
• marker-paths.mjs — repoint PLAN_MARKER_ENFORCEMENT_SITES E11/E19 → marker-state; E20 (SessionStart sweep) correctly stays at em-recall
• repoint 4 test fixtures; new tests/test-marker-state.mjs

Why P3a-first

Extracting the marker reads with no behavior change is the low-risk foundation P3b (enforce-contract.mjs) builds on, and isolates the move from the later em-recall STRICT DELETION (P3d). P3d is ordered last so deletion never breaks a live consumer.

Maps to

RFC-008 R1 (memory is the substrate; enforcement owns marker reads). Principle anchor P9.

Tests (all green)

Suite	Result
test-marker-state.mjs (new)	23/0
test-stop-gate.sh (E2E: unit + hook integration + failure scenarios + M5 retime)	31/0
test-issue-146.mjs (carve-out + real hook-chain SessionStart→Stop E2E)	51/0
test-em-strict-lstat.mjs	5/0
test-em-recall-session-aware / -start-early-exit / -baseline-monotonic / -plan-marker-sweep	13/0 · 11/0 · 56/0 · 25/0
validate-plan-marker-sites.mjs	ok, 2 checks

Review trail

• Plan (Rule 18 step 2): codex second-opinion ACCEPT-with-FU + negative-scenario-planner HOLD → 3 drift-completeness blockers (4th fixture ref, 3rd registry site, validator registration) folded before implementation.
• Code review (Rule 18 step 6): negative-scenario-reviewer ACCEPT — 0 blocker/major/minor, 1 NIT (registry line:0, kept as correct module-level convention). Verbatim-equivalence, imports, import-cycle, drift-completeness, registry, and an independent clean-room --gate stop E2E all verified.

🤖 Generated with Claude Code

[lantiscooperdev]

Substantive review — RFC-008 P3a (marker-state.mjs extraction)

Reviewed the diff against the "byte-identical, pure extraction" invariant. Verdict: looks correct, ready for maintainer approval.

Verified

• Verbatim equivalence — all 7 relocated helpers are character-identical to their origins (stop-gate-helpers.mjs strict trio + the 4 carve-out/relaxed functions from em-recall.mjs); only diff is a prepended export and one stale-comment fix. No logic / branch / fail-closed / symlink / ENOENT / ENOTDIR handling changed.
• Imports & cycle — marker-state.mjs imports all 9 symbols it uses from marker-paths.mjs; em-recall still imports everything its surviving --gate stop handler uses and the removed TASK_SIGNAL_MARKERS/CHECKPOINT_QUARTET now appear only in comments. em-recall → marker-state → marker-paths is acyclic.
• Drift completeness — zero live references to the deleted stop-gate-helpers.mjs; install.mjs deploys scripts/lib/*.mjs by glob so the new file auto-deploys and the deleted one auto-drops with no installer edit.
• Registry (Rule 14) — PLAN_MARKER_ENFORCEMENT_SITES E11/E19 repointed to marker-state; E20 (SessionStart sweep) correctly stays at em-recall; validate-plan-marker-sites.mjs green.
• Behavior E2E — independent clean-room --gate stop run (block + allow) through the relocated lib, plus test-stop-gate.sh 31/0 and the test-issue-146 hook-chain E2E 51/0.

Note: 1 NIT — registry entries use line: 0; this is the correct convention for a module-level consumer (matches existing E5b) and is left as-is.

Plan-time + code-review trail: codex ACCEPT-with-FU, negative-scenario-planner HOLD→folded (3 drift blockers), negative-scenario-reviewer ACCEPT (0 blocker/major/minor). CI validate jobs pending at time of review.

Approving is the maintainer's call (UI). I'm posting this as a comment review per the bot-reviews / user-approves split.