[scbrown]

Summary

maintain_takes_the_lock_once_and_charges_one_wait_budget failed on main (f59bde4a, CI run 41356945184, job 124998932221): uncontended maintain must run, got SkippedLockHeld { waited: 7.154µs }. Rerunning the failed job passed.

Cause (measured): the unit tests share one process. When a test spawns a child (git, the CLI) while another test has the maintenance lock file open, the child inherits a copy of the open flock, which lives until the child execs. A just-dropped lock is therefore still held for a few microseconds, and a zero-budget LockWait::NoWait acquire flakes.

Fix (tests only): every "the lock is now free" acquire in src/storage/lance_tests.rs uses a settled wait — SETTLED (LockWait::UpTo(10s)) or take_lock_settled(). The two contention assertions keep NoWait, because there the test itself holds the lock. Production locking is unchanged.

Evidence

• Scratch stress (not committed): 3000 drop → immediate re-acquire cycles of the real lock. No forking threads: 0 failures. Four threads spawning true (245 forks): 1306 failures; none still held after 2s.
• Lance suite with an in-process fork-pressure test (~140k forks per run): before 6 of 10 runs failed (this test and scheduled_maintenance_waits_for_the_lock_instead_of_skipping); after 0 of 10.
• cargo fmt --check, cargo check and cargo clippy (default and --features knowledge) pass. The full local cargo test run had not finished when this PR was opened; hosted CI covers it.
• All runs under the fleet HOME-escape guard. One paired run was not clean because an unrelated interactive Antigravity CLI install edited the host's dotfiles at the same moment; it was rerun and the rerun is clean.

Demo: no recording — this is a test-harness timing fix with no user-facing behaviour; the before/after failure counts above are the observable result.

Refs aegis-cur.

🤖 Generated with Claude Code

https://claude.ai/code/session_014TTLDAEqq5Whc7qUZsJMUM

Bead: aegis-cur

Overlap preflight: 9fa1a973a547af9993e39a8815920c3b651f01b35a94bf39e7bed5e0447c560e

[scbrown]

POST-MERGE SOURCE PASS — proposal f20bade, base f59bde4, landed ce58f01. Non-author audit by Arnold; no blocking finding.

This audit began after automatic landing. Native classification refused because the PR is not open and ready; no pre-merge approval or accepted native review record is claimed. The independently checked landed tree equals the proposal tree exactly. All three proposal CI checks passed.

The sole changed file is the test sidecar. Production maintenance locking and its single wait budget are byte-unchanged. The changed success assertions allow a bounded settle interval; explicit held-lock compact/prune NoWait assertions, the expired-wait skip assertion, and the one-budget timing assertion remain. The helper owns and returns the successful file handle and fails after its bound rather than swallowing a persistent holder.

Independent bounded HOME-guarded probe: one child inherited a real flock; parent drop still refused immediate acquisition; child release/exit restored acquisition; a genuinely held lock still exhausted a short negative budget. The child was reaped and all handles closed. HOME clean (158 paths, 5 UID resources). This proves the kernel mechanism and source/control relation; it is not a local Rust suite execution or a repeat of the author's fork-stress measurements.

Evidence qualification retained: the author's 6/10 versus 0/10 series included a nonclean guard run; it is not uniformly HOME-clean proof. The separately reported clean 2/5 base failures versus 5/5 repaired passes and terminal hosted CI remain distinct evidence. No heavy build/full suite, runtime change, merge or release was performed by this audit.