Problem
The authoritative smoke aggregate for #2463 exposed a cross-process handoff that the lock protocol detected correctly but classified incorrectly. tryAcquireCacheLock() can create the shared lock directory and then be descheduled before opening it. After the bounded empty-directory grace expires, another process may legitimately reclaim and replace that uninitialized generation. The original creator then observes a generation change between lstat() and open().
Observed failure: smoke aggregate run 33561166359
LeaseSidecarUnsafeError: Playground cache lease sidecar changed while opening
The protocol already retried generation changes detected while accessing an opened sidecar, but identified that outcome by matching one error-message phrase. A generation change detected while opening therefore escaped as a terminal unsafe-sidecar failure.
Desired outcome
Represent legitimate sidecar generation changes as one explicit typed handoff outcome and retry them consistently during lock acquisition and inspection. Preserve the directory protocol because its non-empty removal interlock prevents a stale cleaner from deleting a replacement owner. Keep symlinks, non-directories, and other unsafe filesystem states fail-closed.
Acceptance criteria
- Generation changes while opening or accessing a lease sidecar use one typed handoff classification.
- A creator that loses its uninitialized directory generation retries instead of terminating.
- Unsafe filesystem type and symlink replacements remain rejected or conservatively protected.
- Empty abandoned directories remain reclaimable without extending timing allowances.
- The separate-process archive-cache regression and full smoke aggregate pass.
Rejected design
An initialized file published by hard link was evaluated and rejected: portable Node filesystems do not provide atomic conditional unlink by inode, so stale cleanup could unlink a replacement owner and permit concurrent lock holders.
AI assistance
GPT-5.6 Sol via OpenCode analyzed the failed aggregate, evaluated and rejected an unsafe hard-link design during review, and drafted the typed handoff repair under Chris Huber's direction.
Problem
The authoritative smoke aggregate for #2463 exposed a cross-process handoff that the lock protocol detected correctly but classified incorrectly.
tryAcquireCacheLock()can create the shared lock directory and then be descheduled before opening it. After the bounded empty-directory grace expires, another process may legitimately reclaim and replace that uninitialized generation. The original creator then observes a generation change betweenlstat()andopen().Observed failure: smoke aggregate run 33561166359
The protocol already retried generation changes detected while accessing an opened sidecar, but identified that outcome by matching one error-message phrase. A generation change detected while opening therefore escaped as a terminal unsafe-sidecar failure.
Desired outcome
Represent legitimate sidecar generation changes as one explicit typed handoff outcome and retry them consistently during lock acquisition and inspection. Preserve the directory protocol because its non-empty removal interlock prevents a stale cleaner from deleting a replacement owner. Keep symlinks, non-directories, and other unsafe filesystem states fail-closed.
Acceptance criteria
Rejected design
An initialized file published by hard link was evaluated and rejected: portable Node filesystems do not provide atomic conditional unlink by inode, so stale cleanup could unlink a replacement owner and permit concurrent lock holders.
AI assistance
GPT-5.6 Sol via OpenCode analyzed the failed aggregate, evaluated and rejected an unsafe hard-link design during review, and drafted the typed handoff repair under Chris Huber's direction.