Summary

Fixes the four BUG-severity findings from the fresh-eyes deep review (2026-07-02), each verified against the code by an independent adversarial pass. Tracked as I143–I146 in ISSUES.md (added in the companion review PR).

Fixes

I143 — TOCTOU create-vs-open race (src/lib.rs)
Chisel::open chose create_new vs open_existing from an unlocked path.exists() stat taken before the flock. Two processes racing open() could have B stat an empty/absent file, A concurrently create + commit + release the lock, then B run create_new over A's committed data. Now the create/open decision uses io.page_count() — the count cached from the file length observed after the lock is held. The pre-lock stat is retained only for the create_if_missing gate (which must stay pre-lock so a refused open never materializes an empty file).

I144 — unvalidated stride → panic / DoS on open (src/transaction/recovery.rs)
The encrypted crypto-header's stride (plaintext, guarded only by the forgeable XXH3 checksum) was passed verbatim to set_stride, which computes file_len / stride. A forged stride = 0 was a guaranteed division-by-zero panic (violating the poison-not-panic model); a huge value drove multi-GiB read allocations. Now stride must equal ENC_PAGE_SIZE before set_stride; a mismatch returns CorruptSuperblock. This also makes the crypto_header.rs "validated by the engine" comment true. Regression test: corrupt_crypto_header_stride_errors_not_panic forges the on-disk stride to 0, re-stamps the checksum, and asserts the reopen returns CorruptSuperblock rather than panicking.

I145 — reclaim_freemap_orphans not poison-wrapped (src/transaction/freemap.rs)
Every other TransactionManager entry point routes fatal errors through poison_on_fatal; the orphan sweep did not. A fatal error mid-sweep returned un-poisoned, and reclaim_orphans writes the partially-advanced freemap root back into current_roots even on its error path — leaving a usable manager holding an indeterminate freemap. Now wrapped in poison_on_fatal like the rest (inner cache borrow scoped so it's released before poison_on_fatal takes &self).

I146 — README contradicted the code on a durability contract (README.md)
The format-compatibility section said the newer-minor write-refusal gate was "not yet wired up." It shipped as I29 (recovery.rs, forces the handle read-only so mutations return ReadOnlyMode), and THEORY.md already documented it as live. Corrected the README to match the code and its sibling doc.

Not in this PR

The 13 DESIGN findings and 45 SMELL/NIT from the same review are recorded in the companion review PR (review file + ISSUES.md triage) for separate triage, not fixed here.

Verification

cargo build, full cargo test (incl. the new forge test), cargo clippy --workspace -- -D warnings, and cargo fmt --check all clean. No behavior change on the plaintext path; the I143 change is guarded by every existing reopen test (data preserved ⇒ open_existing chosen).