fix(control): isolate concurrent helper builds

[LogicDuke]

Finding

Codex exact-head finding on parent PR #90: "Serialize concurrent helper rebuilds"

Classification: CURRENT / P2

Affected parent head: 134b513e15a056d037cc51b794d72c1a9891a4b4

Impact: supported concurrent provisioning (two gate processes, e.g. npm run control + npm run cockpit:live) can make one launch fail because builders share destructive mutable compilation outputs. No security bypass; availability/deployability failure; fail-closed.

Root cause

Concurrent build.mjs invocations shared dist/control/native/obj and the compiler/helper output path — one builder could rmSync/recreate the shared obj or lock the shared exe path while another's cl.exe was mid-compile. The race was independently reproduced 3/3 before repair (one exit 0 + one exit 1 per round; final pair canonical).

Repair invariant

NO TWO BUILDERS SHARE MUTABLE COMPILATION STATE.

Each builder:

• creates a private, collision-safe workspace (mkdtempSync);
• compiles fully inside it (/Fe and /Fo target the private workspace, cwd inside it);
• validates/hashes its private helper before publication;
• atomically publishes only completed output (rename onto the final path);
• converges successfully if another builder already published byte-identical bytes;
• never silently accepts differing final helper bytes (fails closed);
• derives provenance from the final authoritative helper bytes;
• requires the final canonical pair before reporting success;
• cleans only its own private workspace, best-effort.

Canonical lifecycle invariant preserved:

LIFECYCLE_VALID IFF actualProvenanceBytes == encodeProvenance(SHA256(actualHelperBytes))

Scope

Exactly two files:

• tools/control-owner/build.mjs
• tests/control/launch-lifecycle.test.ts

One commit: c954d0feed8ff87f889e18e65ae439fec9830ac9
Parent: 134b513e15a056d037cc51b794d72c1a9891a4b4
Patch: F0159E6766F9A5DFFFBA8EB7CC74FC5A53F70A6387140A00EFB0D4B85B86E244 (13246 bytes)

Validation

Fresh independent validation: PASS_PR90_CONCURRENT_REBUILD_FRESH_INDEPENDENT_VALIDATION

Evidence:

• pre-fix race reproduced 3/3;
• 2/3/4 concurrent builders all succeed after repair;
• 45 concurrent candidate invocations all exit 0;
• deterministic helper digest: 2a88a45eec8206d535a2d45a137f521a3ed75bed1f04001d52ab2f031dbf1951;
• differing final helper corrected or fails closed (locked-differing → exit 1); identical-locked → converge (exit 0);
• final provenance derived from final authoritative helper bytes;
• FALSE_VALID_SET == EMPTY preserved (truncate-every-byte + tamper-every-position matrix);
• protected runtime/security files unchanged (ensure-helper, provenance-format, control-store, control-runtime, win-owner.c + the six D062 files);
• tests/control: 168 pass / 1 skip;
• full suite: 2059 pass / 1 skip;
• typecheck PASS; lint PASS; build PASS; git diff --check PASS.

Quarantine

This is a Draft stacked validation PR into PR #90's head branch (repair/pr85-helper-lifecycle-reconstruction).

It grants NO Ready authority and NO merge authority. PR #90 remains protected and unchanged until this child independently passes exact-head CI, review/evidence gates, Ready, post-Ready observation, and the human merge gate. Human merge authority preserved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XbdCwWt1oUsGvybbqUxwJp

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 5af72077-0038-4f39-b0ea-2db049ca24fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T18:34:43.523064Z	c954d0f	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c954d0feed

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".