post-merge bugfixes: 7 real issues found by deep review of PR #11

[clay-good]

Summary

After PR #11 (v29 + v30 closure) merged, a deep reviewer pass surfaced seven real bugs that the test suite missed because either the affected code path wasn't exercised end-to-end or the tests mocked the broken helpers directly. All seven are fixed here.

Fixes

1. _branch_exists_locally / _branch_exists_remotely always returned False — they called getattr(result, "stdout", "") on a value that was already a string (_run_cmd returns stripped stdout, not a CompletedProcess). Disambiguation never triggered in production. Tests passed because they mocked the predicates.
2. _run_lock was misused as a non-context-manager in main(), so on any uncaught exception between __enter__ and the natural exit, the lock was never released. Re-wired through contextlib.ExitStack. _release is now also idempotent — the prior atexit + finally double-fire could close a reused fd.
3. Engine-fallover left self.engine stale when the rate-limit loop exited. The verify/fix path then ran on the wrong engine. Now self.engine is re-bound from self._engines[0] after every pop.
4. Postmortem markdown was vulnerable to fence injection. Log lines (which include LLM-controlled tee'd output) and ledger-supplied chunk titles were embedded raw. Backticks are now split with a zero-width joiner; titles are stripped of newlines/backticks.
5. enforce_token_budget used list.pop(0) (O(n)) and inserted at index 1 in a way that scrambled order under recursion. Replaced with collections.deque for O(1) front-ops and correct sub-chunk ordering.
6. AuditLogger's cross-process lock used blocking LOCK_EX, so a peer process doing a slow rotation could hang the orchestrator's main loop indefinitely. Now uses LOCK_EX | LOCK_NB with 3 × 10 ms retry and falls back to intra-process locking on timeout.
7. verify_paths ran pytest as bare python -m pytest — picks up whatever python is first on PATH. Now uses sys.executable, matching check_tests.

Quality

• pytest -q --no-cov → 1928 passed (no regressions, no new tests required for these fixes — they are corrections to plumbing the existing tests don't reach end-to-end)
• ruff check / ruff format clean

Test plan

• CI matrix green
• Manual: trigger a continuation branch creation when an old branch already exists locally — confirm the disambiguator now appends a suffix instead of silently checking out the stale branch
• Manual: run with both Claude and HF creds, force a Claude rate-limit mid-spec — confirm the verify step that follows uses the HF engine, not Claude
• Manual: send SIGKILL during codelicious build, then codelicious build again — confirm .codelicious/run.lock is gone

🤖 Generated with Claude Code