fix(windows): complete concurrent auth consumption

tools/tht/internal/safeio/claim_windows_test.go

@@ -185,3 +185,62 @@ func TestClaimCanonicalPrivateRegularHasOneConcurrentWinner(t *testing.T) {
 		}
 	}
 }
+
+func TestCanonicalPrivateClaimConsumeHasOneConcurrentWinner(t *testing.T) {
+	parent := filepath.Join(t.TempDir(), "claims")
+	if err := os.Mkdir(parent, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := ProtectPrivateDirectory(parent); err != nil {
+		t.Fatal(err)
+	}
+	for iteration := range 16 {
+		source := filepath.Join(parent, fmt.Sprintf("consume-%02d.json", iteration))
+		claim := filepath.Join(parent, fmt.Sprintf("consume-%02d.claim", iteration))
+		createWindowsPrivateTestFile(t, source, []byte("state"))
+
+		type result struct {
+			found bool
+			err   error
+		}
+		results := make(chan result, 2)
+		var group sync.WaitGroup
+		for range 2 {
+			group.Add(1)
+			go func() {
+				defer group.Done()
+				claimed, err := ClaimCanonicalPrivateRegular(source, claim)
+				if err != nil || !claimed {
+					results <- result{err: err}
+					return
+				}
+				contents, found, err := ReadCanonicalPrivateClaim(source, claim, 32)
+				if err != nil || !found || string(contents) != "state" {
+					results <- result{err: err}
+					return
+				}
+				removed, err := RemoveCanonicalPrivateClaim(source, claim)
+				if err != nil || !removed {
+					results <- result{err: err}
+					return
+				}
+				results <- result{found: true}
+			}()
+		}
+		group.Wait()
+		close(results)
+
+		winners := 0
+		for got := range results {
+			if got.err != nil {
+				t.Fatalf("iteration %d concurrent consume error = %v", iteration, got.err)
+			}
+			if got.found {
+				winners++
+			}
+		}
+		if winners != 1 {
+			t.Fatalf("iteration %d winning consumes = %d, want 1", iteration, winners)
+		}
+	}
+}