Shared incremental caches

The cache layout remains manifest, interfaces/<Module>.aci, and programs/<digest>.acp. Each publisher creates its own temporary file beside the destination, writes and closes it completely, then atomically renames it. An exception cleans up only that publisher's temporary file. A killed process can leave an unpublished candidate; later compiler startups do not sweep it.

Admission depends on each entry, not on the manifest. Interface decoding checks the schema and integrity digest; reuse also requires the expected module, source digest, dependency identities, compiler identity, and edition. A sealed program's key includes the resulting interface identities. A mismatched entry is recomputed. Concurrent repaired writers with different configurations can replace each other's interface slots; this may cause additional misses, but cannot make a mismatched entry reusable.

The manifest describes the last writer's schema, edition, and compiler. It is informational. Changing it no longer resets the interfaces/programs directories. Existing cache encodings, paths, and JSON field names are unchanged.

alpha cache stats counts promoted .aci and .acp files and their byte sizes. alpha cache verify validates promoted entries. alpha cache prune removes only promoted interfaces outside the selected root's graph. These commands do not treat another process's temporary files or unrelated files as entries. Unpublished candidates and older sealed programs remain until explicit cleanup; there is no automatic concurrent garbage collection in this change.

Run python3 debug/cache-concurrency-check.py --alpha /path/to/alpha --output /mounted/evidence for four rounds of four fresh processes sharing a cache: two executable identities, two editions, and valid/invalid source snapshots. Every result is compared with its corresponding cache-free check, including module identities and diagnostics. The test checks foreign-file preservation, verification, warm convergence, statistics, pruning, and corruption recovery.

This guarantee applies to repaired writers. An older compiler that still sweeps or resets the same cache directory can delete another writer's files. Full crash/power-loss qualification and the broader L23 incremental state-machine acceptance remain separate work; atomic rename does not imply durable fsync.