fix(windows): tolerate concurrent auth claims

tools/tht/internal/safeio/claim_windows_test.go

@@ -4,8 +4,10 @@ package safeio
 
 import (
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
+	"sync"
 	"testing"
 )
 
@@ -135,3 +137,51 @@ func TestRemoveCanonicalPrivateClaimRejectsMismatchedTwoLinkFiles(t *testing.T)
 		}
 	}
 }
+
+func TestClaimCanonicalPrivateRegularHasOneConcurrentWinner(t *testing.T) {
+	parent := filepath.Join(t.TempDir(), "claims")
+	if err := os.Mkdir(parent, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := ProtectPrivateDirectory(parent); err != nil {
+		t.Fatal(err)
+	}
+	for iteration := range 16 {
+		source := filepath.Join(parent, fmt.Sprintf("state-%02d.json", iteration))
+		claim := filepath.Join(parent, fmt.Sprintf("state-%02d.claim", iteration))
+		createWindowsPrivateTestFile(t, source, []byte("state"))
+
+		type result struct {
+			claimed bool
+			err     error
+		}
+		results := make(chan result, 2)
+		var group sync.WaitGroup
+		for range 2 {
+			group.Add(1)
+			go func() {
+				defer group.Done()
+				claimed, err := ClaimCanonicalPrivateRegular(source, claim)
+				results <- result{claimed: claimed, err: err}
+			}()
+		}
+		group.Wait()
+		close(results)
+
+		winners := 0
+		for got := range results {
+			if got.err != nil {
+				t.Fatalf("iteration %d concurrent claim error = %v", iteration, got.err)
+			}
+			if got.claimed {
+				winners++
+			}
+		}
+		if winners != 1 {
+			t.Fatalf("iteration %d winning claims = %d, want 1", iteration, winners)
+		}
+		if removed, err := RemoveCanonicalPrivateClaim(source, claim); err != nil || !removed {
+			t.Fatalf("iteration %d claim cleanup = removed %v, err %v", iteration, removed, err)
+		}
+	}
+}

tools/tht/internal/safeio/private_root_windows.go

@@ -953,16 +953,35 @@ func windowsRelativeClaimAbsentOrOrphan(directory *windowsPrivateDirectory, sour
 	return false, ErrUnsafeFile
 }
 
+const windowsClaimSharingRetries = 100
+
+func openWindowsPrivateClaimSource(directory windows.Handle, source string) (*windowsPrivateRegularAt, error) {
+	for attempt := 0; ; attempt++ {
+		value, err := openWindowsPrivateRegularAt(
+			directory,
+			source,
+			windows.FILE_GENERIC_READ|windows.FILE_GENERIC_WRITE|windows.DELETE,
+			1,
+		)
+		if !errors.Is(err, windows.ERROR_SHARING_VIOLATION) &&
+			!errors.Is(err, windows.STATUS_SHARING_VIOLATION) {
+			return value, err
+		}
+		if attempt == windowsClaimSharingRetries {
+			return nil, err
+		}
+		time.Sleep(time.Millisecond)
+	}
+}
+
 func (directory *windowsPrivateDirectory) ClaimRegular(source, claim string) (bool, error) {
 	if directory.Validate() != nil || !validPrivateLeafName(source) || !validPrivateLeafName(claim) {
 		return false, ErrUnsafeFile
 	}
-	value, err := openWindowsPrivateRegularAt(
-		directory.handle,
-		source,
-		windows.FILE_GENERIC_READ|windows.FILE_GENERIC_WRITE|windows.DELETE,
-		1,
-	)
+	// A concurrent winner temporarily holds the source with DELETE access and deliberately
+	// without FILE_SHARE_DELETE. Wait only for that specific, bounded contention before
+	// observing the resulting pair or absence below. Persistent sharing remains unsafe.
+	value, err := openWindowsPrivateClaimSource(directory.handle, source)
 	if err != nil {
 		pair, pairErr := windowsRelativeClaimPairExists(directory, source, claim)
 		if pairErr == nil && pair {