- Add support for decoding simple inline CSV arrays (labels[#3]: value1,value2,...)
- Fix nested array parsing when arrays appear on same line as dash (- comments[#3]{...}:)
- Handle dash-prefixed lines that start nested arrays in YAML mode
- Add bracket detection to prevent regular field parsing of array headers

Tests passing:
- Labels round-trip through TOON encode/decode
- Dependencies structured arrays work correctly
- Full workflow with mixed data types passes
- Comments work in integrated scenarios (documented edge case for multiple rows)

This completes bd-nyk3: comprehensive TOON format integration tests for export/import
round-trip workflows with comments, labels, and dependencies.

- Add support for decoding simple inline CSV arrays (labels[#3]: value1,value2,...)
- Fix nested array parsing when arrays appear on same line as dash (- comments[#3]{...}:)
- Handle dash-prefixed lines that start nested arrays in YAML mode
- Add bracket detection to prevent regular field parsing of array headers

Tests passing:
- Labels round-trip through TOON encode/decode
- Dependencies structured arrays work correctly
- Full workflow with mixed data types passes
- Comments work in integrated scenarios (documented edge case for multiple rows)

This completes bd-nyk3: comprehensive TOON format integration tests for export/import
round-trip workflows with comments, labels, and dependencies.

Add flock-based shared/exclusive locking for JSONL reads (auto-import)
and writes (export/flush) to prevent corruption when sync and daemon
flush race.

**No new dependencies** - uses existing gofrs/flock v0.13.0 (already in go.mod)

Security fixes from SECURITY_AUDIT.md:
- Issue #1: Sync export and daemon auto-flush race causing data loss
- Issue #3: Auto-import reading partially-written JSONL during export

Changes:
- Add jsonl_lock.go with JSONLLock type using gofrs/flock
- Update exportToJSONLDeferred to acquire exclusive lock during export
- Update autoImportIfNewer to acquire shared lock during import
- Add comprehensive race condition tests
- Add generateUniqueTestID helper for test isolation

The JSONL lock ensures that:
- Export operations have exclusive access (no concurrent reads/writes)
- Import operations share access with other readers, block during writes
- Lock is held for entire export+commit+finalize sequence

Co-Authored-By: SageOx <ox@sageox.ai>

…-sz5)

Addresses review feedback on 7b36ab6. Several integration tests shell
out to `go build ./cmd/bd` (or `go build .`) from TestMain / t.Helper
setup functions. The outer `go test -tags 'integration gms_pure_go'`
tag does not propagate into these subprocesses, so the inner builds were
still trying to link ICU and failing with
`unicode/uregex.h: No such file or directory` in the nightly workflow.

Repo-wide audit of `exec.Command("go", "build", ...)` test helpers:
- internal/beads/beads_hash_multiclone_test.go (reviewer's cite)
- tests/regression/regression_test.go
- cmd/bd/protocol/helpers_test.go
- cmd/bd/doctor/dolt_e2e_test.go
- cmd/bd/{scripttest,import_prefix,explicit_db_nodb,init_embedded,
  main,init,cli_fast,shared_server_integration,doctor_repair,
  dolt_autostart_lifecycle_integration}_test.go

All 15 call sites now pass `-tags gms_pure_go`. `cmd/bd/preflight.go`
is production code (`bd preflight` user command), not a test helper,
and is intentionally left as-is.

Also narrow docs/ICU-POLICY.md "Common Mistakes" #3 -- libicu-dev is
needed only for local on-demand testing via scripts/test-cgo.sh, not
for CI test workflows (which no longer exercise the ICU path).

Verified: `go test -tags 'integration gms_pure_go' -run '^$' ./...`
passes cleanly from the worktree root (previously failed in
internal/beads).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…-sz5)

Addresses review feedback on 7b36ab6. Several integration tests shell
out to `go build ./cmd/bd` (or `go build .`) from TestMain / t.Helper
setup functions. The outer `go test -tags 'integration gms_pure_go'`
tag does not propagate into these subprocesses, so the inner builds were
still trying to link ICU and failing with
`unicode/uregex.h: No such file or directory` in the nightly workflow.

Repo-wide audit of `exec.Command("go", "build", ...)` test helpers:
- internal/beads/beads_hash_multiclone_test.go (reviewer's cite)
- tests/regression/regression_test.go
- cmd/bd/protocol/helpers_test.go
- cmd/bd/doctor/dolt_e2e_test.go
- cmd/bd/{scripttest,import_prefix,explicit_db_nodb,init_embedded,
  main,init,cli_fast,shared_server_integration,doctor_repair,
  dolt_autostart_lifecycle_integration}_test.go

All 15 call sites now pass `-tags gms_pure_go`. `cmd/bd/preflight.go`
is production code (`bd preflight` user command), not a test helper,
and is intentionally left as-is.

Also narrow docs/ICU-POLICY.md "Common Mistakes" #3 -- libicu-dev is
needed only for local on-demand testing via scripts/test-cgo.sh, not
for CI test workflows (which no longer exercise the ICU path).

Verified: `go test -tags 'integration gms_pure_go' -run '^$' ./...`
passes cleanly from the worktree root (previously failed in
internal/beads).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…where (gastownhall#3240)

* fix(ci): drop ICU linkage from Linux/macOS test jobs (bd-sz5, GH#3506)

Align the CI test matrix with how we ship: all Go build/test invocations
now use -tags gms_pure_go, matching the Windows job, goreleaser, and the
install scripts. Remove libicu-dev / icu4c installs and CGO_* env setup
from ubuntu-latest and macos-latest jobs in ci.yml, plus nightly,
migration-test, and cross-version-smoke workflows.

Upstream dolthub/go-mysql-server#3506 confirmed -tags=gms_pure_go is the
sanctioned escape hatch; testing an ICU-linked config nobody installs was
wasting CI minutes and producing spurious duplicate-rpath / malformed
LC_DYSYMTAB linker warnings on macOS.

Update docs/ICU-POLICY.md to reflect that the CI matrix no longer
intentionally omits the tag; scripts/test-cgo.sh remains as the local
developer tool for exercising the ICU code path on demand.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(ci): add -tags gms_pure_go to test-helper go build shell-outs (bd-sz5)

Addresses review feedback on 7b36ab6. Several integration tests shell
out to `go build ./cmd/bd` (or `go build .`) from TestMain / t.Helper
setup functions. The outer `go test -tags 'integration gms_pure_go'`
tag does not propagate into these subprocesses, so the inner builds were
still trying to link ICU and failing with
`unicode/uregex.h: No such file or directory` in the nightly workflow.

Repo-wide audit of `exec.Command("go", "build", ...)` test helpers:
- internal/beads/beads_hash_multiclone_test.go (reviewer's cite)
- tests/regression/regression_test.go
- cmd/bd/protocol/helpers_test.go
- cmd/bd/doctor/dolt_e2e_test.go
- cmd/bd/{scripttest,import_prefix,explicit_db_nodb,init_embedded,
  main,init,cli_fast,shared_server_integration,doctor_repair,
  dolt_autostart_lifecycle_integration}_test.go

All 15 call sites now pass `-tags gms_pure_go`. `cmd/bd/preflight.go`
is production code (`bd preflight` user command), not a test helper,
and is intentionally left as-is.

Also narrow docs/ICU-POLICY.md "Common Mistakes" #3 -- libicu-dev is
needed only for local on-demand testing via scripts/test-cgo.sh, not
for CI test workflows (which no longer exercise the ICU path).

Verified: `go test -tags 'integration gms_pure_go' -run '^$' ./...`
passes cleanly from the worktree root (previously failed in
internal/beads).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(preflight): add -tags gms_pure_go to test/lint shell-outs (bd-sz5)

preflight is a beads-maintainer pre-PR tool. On dev machines without
ICU dev libraries installed, `bd preflight --check` was failing at the
`go test -short ./...` step with the same `unicode/uregex.h` error we
fixed in nightly CI (bd13871).

Apply the gms_pure_go tag consistently:
- runTestCheck: `go test -tags gms_pure_go -short ./...`
- runLintCheck: `golangci-lint run --build-tags=gms_pure_go ./...`
- Update the user-visible Command labels to match
- Update the static checklist printed by `bd preflight` (no --check)
  so copy-pasted commands work on no-ICU machines

Matches the tag golangci-lint is now passed in CI, keeping local and
CI runs consistent.

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>