fix(host-kit): process lock proves ownership before release and never evicts a live owner

CHANGELOG.md

@@ -147,6 +147,31 @@
   against the instant that attempt signalled the recorder rather than the time of the retry. A stop
   that fails and is then abandoned keeps the pulled set on the host beside `--out`. Chunk paths and
   `--client-output-path` naming are unchanged.
+- Fixed: a process lock that could not be given back no longer waits for the daemon to restart. A
+  release that cannot verify ownership — a refused `unlink`, an unreadable record — left its record
+  standing and naming the live daemon, and the next acquire read that as a live owner and timed out
+  after 30 s on every runner build or launch until the process restarted. The claim inside is spent
+  the moment the release is asked for, so a reclaim here now reads it as dead and takes the path
+  back, and the failed release is recorded in the request log as `process_lock_release_unverified`.
+  A record is only read that way when this loading of the lock code issued it: a second bundled copy
+  of the module in the same process shares the pid and cannot have a live claim cleared under it.
+- Changed (lock errors): code that takes a process lock now answers one question in one helper, which
+  of its two failures the caller hears. The work inside the lock outranks a lock that could not be
+  handed back, so a build or a publish that failed keeps its own error instead of being replaced by
+  `Timed out waiting for …`, and work that succeeded still reports the lock it could not give back.
+  The Apple runner's artifact, cache, lease and disposal paths, the managed-allocation store, the
+  device-claim store, the iOS snapshot bridge cache, the Swift recording cache and the agent-browser setup
+  moved onto it, replacing hand-written try/catch pairs that each chose differently.
+- Fixed: the redirect of `~/Library/Developer/XCTestDevices` gives itself back in one order — restore
+  the host's own device set, then release the lock — and a restore that was refused is what the caller
+  is told, whichever give-back door a teardown used. The lock's own complaint used to replace it in a
+  `finally` and the best-effort door then dropped it, leaving the symlink pointed at the agent-device
+  simulator set with nothing said about why. A simulator whose set already is `XCTestDevices` is no
+  longer failed by a lock it could not verify, either. A leftover from an interrupted build — the host's
+  set renamed aside and `XCTestDevices` symlinked into a simulator's own set — is now put back before the
+  redirect decides whether it is needed, so the first build after an interruption still gets its own
+  device set instead of the host's. A redirect that could not be installed reports the restore that failed
+  with it, and names a backup path only when that backup is really on disk.
 - Changed (sessions): the implicit session is now keyed by workspace **and platform**, so one checkout
 
   can drive iOS and Android without inventing a `--session` name for every command (#2580). An

packages/capture-kit/src/recording/swift-cache.test.ts

@@ -162,6 +162,32 @@ test('compileSwiftSourceText falls back to swift-helper when the cache name sani
   expect(fs.statSync(executablePath).mode & 0o111).not.toBe(0);
 });
 
+test('a compile that failed is reported over a cache lock that could not be given back', async () => {
+  const sourcePath = writeSourceFile();
+  const buildFailure = new Error('swiftc: error: build failed');
+  let lockDir = '';
+  mockRunCmd.mockImplementationOnce(async (_cmd: string, args: string[]) => {
+    // The temp executable sits one directory under the cache entry, and the lock beside it.
+    const outputPath = args[args.indexOf('-o') + 1]!;
+    const executablePath = path.join(
+      path.dirname(path.dirname(outputPath)),
+      path.basename(outputPath),
+    );
+    lockDir = `${executablePath}.lock`;
+    // A record that cannot be read is a release that cannot prove ownership.
+    const ownerFile = path.join(lockDir, 'owner.json');
+    fs.rmSync(ownerFile);
+    fs.mkdirSync(ownerFile);
+    throw buildFailure;
+  });
+
+  await expect(compileSwiftSourceFile({ sourcePath, cacheName: 'recording-overlay' })).rejects.toBe(
+    buildFailure,
+  );
+  // The release really could not verify itself: the lock is still standing.
+  expect(fs.existsSync(lockDir)).toBe(true);
+});
+
 function writeSourceFile(source = 'print("recording")'): string {
   const sourcePath = path.join(tmpDir, 'recording-overlay.swift');
   fs.writeFileSync(sourcePath, source);

packages/capture-kit/src/recording/swift-cache.ts

@@ -6,7 +6,11 @@ import { trimEdgeDashes } from '@agent-device/kernel/collections';
 import { AppError } from '@agent-device/kernel/errors';
 import { runCmd } from '@agent-device/host-kit/command';
 import { readProcessStartTime } from '@agent-device/host-kit/process';
-import { acquireProcessLock } from '@agent-device/host-kit/file';
+import {
+  acquireProcessLock,
+  withProcessLock,
+  type ProcessLockRelease,
+} from '@agent-device/host-kit/file';
 
 const SWIFT_CACHE_VERSION = '2';
 const LOCK_RETRY_DELAY_MS = 25;
@@ -98,48 +102,44 @@ async function ensureSwiftExecutable(params: {
 
   const executableDir = path.dirname(params.executablePath);
   fs.mkdirSync(executableDir, { recursive: true });
-  const lockDir = `${params.executablePath}.lock`;
-  const releaseLock = await acquireSwiftCacheLock(
-    lockDir,
-    params.executablePath,
-    params.timeoutMs ?? 120_000,
-  );
-  if (!releaseLock) {
-    return;
-  }
-
-  const tempDir = fs.mkdtempSync(
-    path.join(executableDir, `.${path.basename(params.executablePath)}.${process.pid}.`),
-  );
-  const tempExecutablePath = path.join(tempDir, path.basename(params.executablePath));
-  try {
-    if (isExecutableFile(params.executablePath)) {
-      return;
-    }
-    const [primarySourcePath] = params.sourcePaths;
-    if (params.sourceText !== undefined && primarySourcePath && !fs.existsSync(primarySourcePath)) {
-      fs.mkdirSync(path.dirname(primarySourcePath), { recursive: true });
-      fs.writeFileSync(primarySourcePath, params.sourceText);
-    }
-    await runCmd('xcrun', ['swiftc', ...params.sourcePaths, '-o', tempExecutablePath], {
-      timeoutMs: params.timeoutMs ?? 120_000,
-      env: buildSwiftToolEnv(),
-    });
-    fs.renameSync(tempExecutablePath, params.executablePath);
-  } finally {
-    fs.rmSync(tempDir, { recursive: true, force: true });
-    await releaseLock();
-  }
+  const timeoutMs = params.timeoutMs ?? 120_000;
+  await withProcessLock({
+    acquire: () => acquireSwiftCacheLock(`${params.executablePath}.lock`, timeoutMs),
+    task: async () => {
+      // Another process may have published the executable while this one waited for the lock.
+      if (isExecutableFile(params.executablePath)) {
+        return;
+      }
+      const tempDir = fs.mkdtempSync(
+        path.join(executableDir, `.${path.basename(params.executablePath)}.${process.pid}.`),
+      );
+      const tempExecutablePath = path.join(tempDir, path.basename(params.executablePath));
+      try {
+        const [primarySourcePath] = params.sourcePaths;
+        if (
+          params.sourceText !== undefined &&
+          primarySourcePath &&
+          !fs.existsSync(primarySourcePath)
+        ) {
+          fs.mkdirSync(path.dirname(primarySourcePath), { recursive: true });
+          fs.writeFileSync(primarySourcePath, params.sourceText);
+        }
+        await runCmd('xcrun', ['swiftc', ...params.sourcePaths, '-o', tempExecutablePath], {
+          timeoutMs,
+          env: buildSwiftToolEnv(),
+        });
+        fs.renameSync(tempExecutablePath, params.executablePath);
+      } finally {
+        fs.rmSync(tempDir, { recursive: true, force: true });
+      }
+    },
+  });
 }
 
 async function acquireSwiftCacheLock(
   lockDir: string,
-  executablePath: string,
   timeoutMs: number,
-): Promise<(() => Promise<void>) | null> {
-  if (isExecutableFile(executablePath)) {
-    return null;
-  }
+): Promise<ProcessLockRelease> {
   try {
     return await acquireProcessLock({
       lockDirPath: lockDir,

packages/host-kit/src/file.ts

@@ -12,4 +12,9 @@ export {
   openVerifiedFileForTruncate,
 } from './internal/verified-file.ts';
 export { expandUserHomePath, resolveUserPath } from './internal/path-resolution.ts';
-export { acquireProcessLock, type ProcessLockOwner } from './internal/process-lock.ts';
+export {
+  acquireProcessLock,
+  withProcessLock,
+  type ProcessLockOwner,
+  type ProcessLockRelease,
+} from './internal/process-lock.ts';