mirror of
https://github.com/torlando-tech/pyxis.git
synced 2026-09-25 22:23:37 +00:00
Torlando
affd5566ab
Greptile round 7 remediation:
The CLI's advisory flock and the web flasher's Web Locks name live in
incompatible lock namespaces, so a CLI install and a browser install
on the same card could each hold "their" lock, both pass preflight on
identical slot state, and clobber each other's records (orphaning a
pack, or writing the same generation into two slots).
Both producers now share two symmetric layers:
1. An on-disk install marker (.pyxis-installing in pyxis-map/,
token "PYXI 1 <owner> <epoch_ms>") claimed at install start via an
atomic exclusive create, with ownership verified by read-back. A
fresh foreign marker refuses the install before any mutation; a
stale one (30-minute TTL; a future epoch counts as fresh under
clock skew) is reclaimed. Release only deletes the releasee's own
token.
2. Commit-time revalidation: activate_map_set / activateMapSet
snapshot the raw slot and style bytes at derivation, re-read them
immediately before the record writes, and abort if the activation
state moved or a fresh foreign marker is present. The published
pack is kept (device-harmless: the firmware only reads packs named
by an active selection) and the existing retry/resume path
converges it.
Regression tests on both producers: marker refusal before any
publication, stale-marker reclamation and release, and
commit-time-race abort with retry convergence. The in-memory flasher
FS now models getFileHandle({exclusive:true}) -> FileExistsError.
CLI: 85 passed. Flasher: 24 passed.