What: the host obligation record carries `owners` (one commit-point token per arming run:
install root, pid, uuid) and `found` (base64 of what its first owner found there).
write_host_obligation(owner=) adds the run to a same-SHA record instead of keeping it
byte-identical; disarm_commit_obligations releases the host record through
release_host_obligation, which removes only this run's token and, when no owner is left,
puts back what the first owner found (absent -> unlinked). A record whose owners do not name
the run (rewritten by another install's newer pull, or unparseable) stays untouched. The
non-host restores in disarm now fsync before os.replace (review C12, partial).
Why: the F22 disarm compared bytes, but a same-SHA arm kept the record unchanged, so install
A and install B arming the same SHA shared byte-identical bytes and A's failed run deleted the
debt B still owed through (review C2, probe review/commit/w2/probe_cas.py).
Test (RED at 5dfc384669e: record deleted): two installs arm the same SHA; A's disarm keeps the
record, the last owner's disarm puts back what the first owner found (nothing).
9909a18025