Make the records append rollback-safe and validate record shapes - #207

Fixes #206

What changed and why

• _append_records no longer appends to the live morphobricks.records.jsonl. It builds old bytes plus new lines, writes them to a synced temporary file in the same folder, and replaces the live file in one atomic replace. A failure in write, flush or fsync leaves the live file untouched and removes the temporary file.
• publish_description now puts back both the description and the records bytes (or removes the records file if there was none) when the append fails.
• read_records refuses any line that is not one of the Spec record types (reconfirmation, image_count_changed, removed) with exactly that type's key set (Spec main 964f097, docs/experiment-v1.md section 4.6). {} was accepted before.
• Reader rule for a record whose SHA does not match the published file: the hashes are history. Later publications change the file without a record, so an older record rightly names a hash that is no longer the published one. A reader never compares them with the published file and never drops or trusts a record by them. Written in the module docstring and covered by a test. This is my reading of the Spec; please confirm.
• tests/test_spec_encoding.py: the non-ASCII record now carries all keys of a reconfirmation record (it was an incomplete record that the new validation refuses).

The durability of the records write is as before (temporary file is fsynced before the replace); the directory is not fsynced, as for the description.

Regression tests (tests/test_description_file.py)

On the old code (origin/main source, new tests): 12 failed, 23 passed. On the new code: all 35 pass.

Failing on old code:

• test_a_write_that_fails_inside_the_append_leaves_file_and_records_as_before (4 cases: no records file or existing records, times partial bytes or full bytes written before the failure)
• test_a_failed_fsync_of_the_records_leaves_file_and_records_as_before
• test_a_records_file_that_is_not_lines_of_spec_records_is_refused (7 new cases: {}, type only, unknown type, no type, extra key, renamed key, partial removed)

Also added test_a_record_whose_hash_is_not_the_published_file_is_history_not_an_error (passes on both).

Checks

• ruff check .: all checks passed; ruff format --check .: 293 files already formatted; python tools/check.py --rules: passed.
• pytest: 7 failed, 3811 passed, 25 skipped. The 7 failures are all in tests/test_notebook_setup.py and also fail on unmodified origin/main (1c54f4e; 7 failed, 4 passed in that file): pre-existing, not touched. The 25 skips are optional-dependency skips (for example ipywidgets not installed); skipped tests were not run.
• The CHANGELOG entry is under Unreleased; open PRs Derived experiment_design.csv and cross-version parity suite (Stage 1, PR 10) #196, Detect mask hierarchy cycles before reducing direct edges #200, Re-check every mask fingerprint right before the manifest replacement #202, Hold module-level skips and missing modules in the Spec test gate #205 will conflict there, keep both entries.

Generated by Claude Code