mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 17:45:53 +01:00
Priya RamanandPaperclip
eddb215f73
A slow disk can keep a live recovery pass running past the recovery lock's stale-age bound. The old check judged staleness by age alone, so it could reap a still-live lock and let a second admission recover the same gate at the same time, risking unsafe teardown of a live sandbox root. The lock now stages its holder pid before it ever names the shared path, the same way the gate itself stages its content, and a break attempt checks that pid for life before it removes the lock — matching the check the gate already uses for its own holder. Age is now only a fallback for a lock whose content cannot be read. Also close a related race in the same break function: it kept its own pin file linked until the whole function returned, so a poll could observe the lock already restored while the pin's private name was still present. The pin is now released right after the identity check it protects, closing that window. Co-authored-by: Paperclip <noreply@paperclip.ing>