checklocks: track contracts and correctness fixes

This tracks the checklocks work described in [the discussion on #14345](https://github.com/google/gvisor/pull/14345#issuecomment-5390284879). The work is separated by review burden:

1. Add contracts for accesses that are already correct, in owner-cohesive batches without a checker dependency.
2. Harden the checker, investigating newly exposed misuse rather than adding compatibility exceptions.
3. Keep runtime fixes and their regression coverage focused enough to review carefully.

The current review set is **26 proposals: five independent contract batches, four checker-related PRs and seventeen focused runtime/test fixes**. Six dependent follow-ups remain held: four will reuse existing draft PRs, and two remain unopened.

Proof-only refactors are identified separately from behavioral fixes. A comment or narrow exception remains only where the actual ownership or lifetime relationship cannot be represented.

## Already-correct contracts

| Scope | Pull request |
|---|---|
| Shared infrastructure and metric/verifier contracts | #14350 |
| Memory-manager and accounting contracts | #14351 |
| Kernel, auth and IPC contracts | #14352 |
| Filesystem contracts | #14353 — conflicts resolved |
| Network contracts | #14354 — approved; conflicts resolved |

## Checker hardening

| Scope | Pull request | Prerequisite |
|---|---|---|
| Nogo analysis inputs, facts and template annotations | #14502 | None |
| Core lock and atomic contracts | #14237 | #14502 |
| Returned-lock aliases and inference diagnostics | #14503 | None |
| AIO and default-logger guards | #14504 | #14237 |

These split the cumulative contents of #14237. Dependent PRs show prerequisite commits until those land; their descriptions identify the commits to review. The diagnostics PR is independent and is not a prerequisite for the held follow-ups below.

Implicit-return/recovery handling with unresolved mutable-owner identity remains outside this proposal; the known diagnostics are not hidden by new filters.

## Runtime and test fixes

| Scope | Pull request |
|---|---|
| ARM64 race-build compare-and-swap | #14355 |
| Compression and shared-utility ownership | #14356 |
| Clock calibration and watchdog behavior | #14357 |
| Runtime control and port-forward ownership | #14358 |
| Metric shutdown, savings and state-load retries | #14359 |
| Async restore and checkpoint registration | #14360 — conflicts resolved |
| LisaFS node and socket lifetimes | #14361 |
| Virtual host-file ownership | #14362 |
| Mountinfo option snapshots | #14363 — conflicts resolved |
| IPC removal errors | #14364 |
| Shared key permissions | #14365 |
| TCP atomic state and probe snapshots | #14366 — merged |
| UDP receive-state synchronization | #14367 — merged |
| Fragment reassembly unlock | #14368 — approved; internal safe review pending |
| Network sysctl synchronization | #14369 — merged |
| Plugin readiness cache | #14370 |
| Gonet, FIFO and TUN ownership | #14371 — merged |

## Dependent follow-ups

These six branches are prepared but held; four will reuse the draft PRs noted below. They are not duplicate cumulative PRs to review now. After the real prerequisites land, their comparisons need to be rebased, reconciled and revalidated.

| Scope | Prerequisites |
|---|---|
| FD-table, TPU and PIDFD ownership | #14237 and #14352 |
| TMPFS/VFS ownership adaptations — reserved draft #14343 | #14237 |
| Native futex atomic pointers | #14237 and #14352 |
| Unix transport ownership and unsupported-stream handling — reserved draft #14338 | #14237 |
| Allocator atomic-pointer contracts — reserved draft #14348 | #14237 and #14360 |
| Kernel runtime and TaskSet contracts — reserved draft #14345 | #14237 and #14352 |

## Earlier proposals

| Original | Replacements and disposition |
|---|---|
| #14289 | Closed; #14350, #14355, #14356 |
| #14313 | Closed; #14350, #14359, #14237 |
| #14339 | Closed; #14351, #14357 |
| #14342 | Closed; #14350, #14358 |
| #14338 | Draft reserved for Unix transport; replacements #14354, #14366–#14371. FD-table/TPU stays separate. |
| #14343 | Draft reserved for TMPFS/VFS; replacements #14353, #14361–#14363. FD-table stays separate. |
| #14345 | Draft reserved for kernel-runtime/TaskSet; replacements #14352, #14364, #14365. Futex stays separate. |
| #14348 | Draft reserved for allocator contracts; replacements #14351, #14360, #14237. |

The four drafts will be narrowed to their reserved scopes after prerequisites land; their current broad diffs are not additional review units. Please use the linked replacements for work ready to review now. #14240 has merged and is excluded from this reorganization.

## Validation and automation notes

Existing validation limitations remain explicit on the affected changes: the independent infrastructure branch reproduces the stock NaN-bucketer failure (fixed in the metrics runtime branch); standalone TCP full-race results have unresolved failures; namespace/capability-dependent runtime coverage is limited by the local environment. These are not reasons to suppress diagnostics or claim unexecuted coverage.

The initial GitHub status rollup is not a substitute for the recorded build and runtime evidence. The reviewer-assignment jobs for [#14361](https://github.com/google/gvisor/actions/runs/32689367595/job/97320145025) and [#14371](https://github.com/google/gvisor/actions/runs/32689438362/job/97320339364) failed with HTTP 422 because one or more bot-selected reviewers were not repository collaborators. Scoped `r?` comments were posted on the original 23 proposals; no assignment bypass or retry was attempted.

Assisted-by: Codex

Start by reviewing the replacement proposals listed in the contracts, checker-hardening, and runtime/test sections, especially the independent PRs and their prerequisites. Use the recorded build and runtime evidence to assess validation; this tracking work is done when the ready proposals land and the held follow-ups are rebased, reconciled, and revalidated.

Written by the indexing model from the issue text.