fix(windows): serialize claim operations

tools/tht/internal/safeio/claim_windows_test.go

@@ -9,6 +9,7 @@ import (
 	"path/filepath"
 	"sync"
 	"testing"
+	"time"
 )
 
 func createWindowsPrivateTestFile(t *testing.T, path string, contents []byte) {
@@ -100,6 +101,70 @@ func TestRemoveCanonicalPrivateClaimPreservesOrphan(t *testing.T) {
 	}
 }
 
+func TestCanonicalPrivateClaimWaitsForRetainedRemoveOperation(t *testing.T) {
+	parent := filepath.Join(t.TempDir(), "claims")
+	if err := os.Mkdir(parent, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := ProtectPrivateDirectory(parent); err != nil {
+		t.Fatal(err)
+	}
+	source := filepath.Join(parent, "state.json")
+	claim := filepath.Join(parent, "state.claim")
+	createWindowsPrivateTestFile(t, source, []byte("state"))
+	if claimed, err := ClaimCanonicalPrivateRegular(source, claim); err != nil || !claimed {
+		t.Fatalf("ClaimCanonicalPrivateRegular() = claimed %v, err %v", claimed, err)
+	}
+
+	removeOpened := make(chan struct{})
+	releaseRemove := make(chan struct{})
+	var releaseOnce sync.Once
+	release := func() { releaseOnce.Do(func() { close(releaseRemove) }) }
+	defer release()
+	restoreHook := SetPrivateDirectoryTestHookForTest(func(stage string) {
+		if stage != "after-canonical-private-claim-parent-open" {
+			return
+		}
+		select {
+		case <-removeOpened:
+		default:
+			close(removeOpened)
+		}
+		<-releaseRemove
+	})
+	defer restoreHook()
+
+	type result struct {
+		changed bool
+		err     error
+	}
+	removeResult := make(chan result, 1)
+	go func() {
+		removed, err := RemoveCanonicalPrivateClaim(source, claim)
+		removeResult <- result{changed: removed, err: err}
+	}()
+	<-removeOpened
+
+	claimResult := make(chan result, 1)
+	go func() {
+		claimed, err := ClaimCanonicalPrivateRegular(source, claim)
+		claimResult <- result{changed: claimed, err: err}
+	}()
+	select {
+	case got := <-claimResult:
+		t.Fatalf("concurrent claim returned before retained removal completed: claimed %v, err %v", got.changed, got.err)
+	case <-time.After(250 * time.Millisecond):
+	}
+
+	release()
+	if got := <-removeResult; got.err != nil || !got.changed {
+		t.Fatalf("RemoveCanonicalPrivateClaim() = removed %v, err %v", got.changed, got.err)
+	}
+	if got := <-claimResult; got.err != nil || got.changed {
+		t.Fatalf("concurrent ClaimCanonicalPrivateRegular() = claimed %v, err %v, want false/nil", got.changed, got.err)
+	}
+}
+
 func TestRemoveCanonicalPrivateClaimRejectsMismatchedTwoLinkFiles(t *testing.T) {
 	parent := filepath.Join(t.TempDir(), "claims")
 	if err := os.Mkdir(parent, 0o700); err != nil {