Ok(())

}

/// The suffix every staging file carries, so a sweep can recognise one.

pub(crate) const TEMP_SUFFIX: &str = ".tmp";

/// A staging path beside `path` that no other writer can be using.

///

/// The name a staged write goes through must not be shared. A fixed one —

/// `path.with_extension("tmp")` — gives every process writing this file the

/// same staging path, so two `oa` runs over one config directory truncate and

/// rename each other's half-written bytes: one wins, and the other's `rename`

/// finds nothing and reports a failed credential write for a credential that

/// may in fact have been stored. That is the worst shape a credential error

/// can take, because the caller cannot tell what is on disk. A fleet of agents

/// under one `$HOME` is the normal way this CLI runs, so the overlap is not a

/// corner case.

///

/// Process id, wall clock, and a per-process counter make the name unique

/// across processes, across threads, and across calls on one thread. The

/// original file name stays in it so a human reading the directory knows what

/// crashed, and so that path guards matching on `credentials.json` still match

/// the staging file.

pub(crate) fn unique_temp_path(path: &Path) -> PathBuf {

    use std::sync::atomic::{AtomicU64, Ordering};

    static COUNTER: AtomicU64 = AtomicU64::new(0);

    let name = path

        .file_name()

        .map(|name| name.to_string_lossy().into_owned())

        .unwrap_or_else(|| "file".to_string());

    let nanos = SystemTime::now()

        .duration_since(UNIX_EPOCH)

        .map(|since| since.as_nanos())

        .unwrap_or(0);

    let ordinal = COUNTER.fetch_add(1, Ordering::Relaxed);

    path.with_file_name(format!(

        ".{name}.{}.{nanos}.{ordinal}{TEMP_SUFFIX}",

        std::process::id()

    ))

}

/// Write a file 0600 through a temporary file in the same directory.

///

/// Staged and renamed, so a reader never sees half a file and a crash leaves

/// the previous contents intact. The staging name is unique per call — see

/// [`unique_temp_path`] — which is what makes concurrent writers safe rather

/// than merely atomic for one.

fn write_private_file(path: &Path, contents: &str) -> Result<(), AuthError> {

    let parent = path

        .parent()

        .ok_or_else(|| AuthError::new(format!("{} has no parent directory", path.display())))?;

    ensure_private_directory(parent)?;

    let temporary = path.with_extension("tmp");

    let temporary = unique_temp_path(path);

    let staged = stage_private_file(&temporary, contents);

    if staged.is_err() {

        // The name was ours alone, so removing it can strand nobody else's

        // write. Leaving it would litter the config directory once per failure.

        let _ = fs::remove_file(&temporary);

    }

    staged?;

    fs::rename(&temporary, path).map_err(|error| {

        let _ = fs::remove_file(&temporary);

        AuthError::new(format!("could not write {}: {error}", path.display()))

    })

}

/// Create the staging file 0600 and put `contents` in it.

fn stage_private_file(temporary: &Path, contents: &str) -> Result<(), AuthError> {

    let mut options = fs::OpenOptions::new();

    // `create_new` rather than `truncate`: the name is unique to this call, so

    // finding one already there means the assumption broke and the write must

    // refuse rather than trample whatever is in it.

    options.write(true).create_new(true);

    #[cfg(unix)]

    {

        let mut options = fs::OpenOptions::new();

        options.write(true).create(true).truncate(true);

        #[cfg(unix)]

        {

            use std::os::unix::fs::OpenOptionsExt;

            options.mode(0o600);

        }

        let mut file = options.open(&temporary).map_err(|error| {

            AuthError::new(format!("could not write {}: {error}", temporary.display()))

        })?;

        file.write_all(contents.as_bytes()).map_err(|error| {

            AuthError::new(format!("could not write {}: {error}", temporary.display()))

        })?;

        use std::os::unix::fs::OpenOptionsExt;

        options.mode(0o600);

    }

    let mut file = options.open(temporary).map_err(|error| {

        AuthError::new(format!("could not write {}: {error}", temporary.display()))

    })?;

    file.write_all(contents.as_bytes()).map_err(|error| {

        AuthError::new(format!("could not write {}: {error}", temporary.display()))

    })?;

    #[cfg(unix)]

    {

        use std::os::unix::fs::PermissionsExt;

        fs::set_permissions(&temporary, fs::Permissions::from_mode(0o600)).map_err(|error| {

        fs::set_permissions(temporary, fs::Permissions::from_mode(0o600)).map_err(|error| {

            AuthError::new(format!(

                "could not restrict {} to 0600: {error}",

                temporary.display()

            ))

        })?;

    }

    fs::rename(&temporary, path)

        .map_err(|error| AuthError::new(format!("could not write {}: {error}", path.display())))

    Ok(())

}

// ---------------------------------------------------------------------------

    write_private_file(&config.paths.config, &format!("{encoded}\n"))

}

/// Write `computer.json` or the agent-key store `0600`, staged and renamed.

///

/// This wrote in place — `fs::write` onto the target, then `chmod` — which two

/// `oa` processes under one config directory could interleave into one file,

/// leaving JSON that neither of them wrote and that the next run refuses to

/// decode. It also left the file world-readable for the moment between the

/// create and the `chmod`, which for the agent-key store is a window on

/// credentials. Staging under a name unique to this call and renaming fixes

/// both: `rename` inside a directory is atomic, so the last writer wins whole

/// and no reader sees a partial file. See [`crate::auth::unique_temp_path`].

fn write_private_file(path: &Path, contents: &str) -> Result<(), String> {

    if let Some(directory) = path.parent() {

        std::fs::create_dir_all(directory)

            let _ = std::fs::set_permissions(directory, std::fs::Permissions::from_mode(0o700));

        }

    }

    std::fs::write(path, contents)

        .map_err(|error| format!("could not write {}: {error}", path.display()))?;

    let temporary = crate::auth::unique_temp_path(path);

    if let Err(error) = stage_private_file(&temporary, contents) {

        let _ = std::fs::remove_file(&temporary);

        return Err(error);

    }

    std::fs::rename(&temporary, path).map_err(|error| {

        let _ = std::fs::remove_file(&temporary);

        format!("could not write {}: {error}", path.display())

    })

}

/// Create the staging file `0600` and put `contents` in it.

fn stage_private_file(temporary: &Path, contents: &str) -> Result<(), String> {

    let mut options = std::fs::OpenOptions::new();

    // The name is unique to this call, so anything already there means the

    // assumption broke; refuse rather than trample it.

    options.write(true).create_new(true);

    #[cfg(unix)]

    {

        use std::os::unix::fs::OpenOptionsExt;

        options.mode(0o600);

    }

    let mut file = options

        .open(temporary)

        .map_err(|error| format!("could not write {}: {error}", temporary.display()))?;

    file.write_all(contents.as_bytes())

        .map_err(|error| format!("could not write {}: {error}", temporary.display()))?;

    #[cfg(unix)]

    {

        use std::os::unix::fs::PermissionsExt;

        std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600))

            .map_err(|error| format!("could not secure {}: {error}", path.display()))?;

        std::fs::set_permissions(temporary, std::fs::Permissions::from_mode(0o600))

            .map_err(|error| format!("could not secure {}: {error}", temporary.display()))?;

    }

    Ok(())

}

    /// The seed file: a sealed envelope under the OS keychain, or the mnemonic

    /// itself where there is no keychain. Mode `0600` either way.

    pub fn path(&self) -> PathBuf {

        self.directory.join("seed")

        self.directory.join(Self::SEED_FILE_NAME)

    }

    /// The path the atomic rewrite stages through. Named so `forget` and the

    /// write path can both make sure a crashed write leaves nothing behind.

    const SEED_FILE_NAME: &'static str = "seed";

    /// A staging path for one rewrite, unique to this call.

    ///

    /// It used to be the fixed `seed.tmp`. Two processes writing a seed under

    /// one `$HOME` then shared it: each truncated the other's staged bytes and

    /// removed the file out from under it, so one rewrite could rename a

    /// half-written envelope over the seed, or fail after the other had already

    /// replaced it. A seed is the one file where either outcome loses an

    /// identity outright. See [`crate::auth::unique_temp_path`].

    fn temp_path(&self) -> PathBuf {

        self.directory.join("seed.tmp")

        crate::auth::unique_temp_path(&self.path())

    }

    /// Remove staging files this directory still holds from crashed rewrites.

    ///

    /// With one fixed staging name `forget` could just delete it. Unique names

    /// mean a sweep instead: anything beside the seed that this store's writes

    /// would have named.

    fn sweep_temp_files(&self) {

        let Ok(entries) = fs::read_dir(&self.directory) else {

            return;

        };

        let prefix = format!(".{}.", Self::SEED_FILE_NAME);

        for entry in entries.flatten() {

            let name = entry.file_name();

            let name = name.to_string_lossy();

            if name.starts_with(&prefix) && name.ends_with(crate::auth::TEMP_SUFFIX) {

                let _ = fs::remove_file(entry.path());

            }

            // The name a crashed pre-sweep `oa` left behind.

            if name == "seed.tmp" {

                let _ = fs::remove_file(entry.path());

            }

        }

    }

    /// True when a seed is already stored. Presence only; the bytes stay on disk.

        Self::set_mode(&self.directory, 0o700)?;

        let path = self.path();

        let temp = self.temp_path();

        let _ = fs::remove_file(&temp);

        fs::write(&temp, bytes)?;

        Self::set_mode(&temp, 0o600)?;

        // No `remove_file` first: the name belongs to this call alone, so

        // anything already at it would be a surprise rather than our own

        // leftovers, and `create_new` inside `write_sealed` says so.

        if let Err(error) = Self::write_sealed(&temp, bytes) {

            let _ = fs::remove_file(&temp);

            return Err(error);

        }

        if let Err(error) = fs::rename(&temp, &path) {

            let _ = fs::remove_file(&temp);

            return Err(IdentityError::Io(error));

        Ok(path)

    }

    /// Put `bytes` in a new file that is `0600` from the moment it exists.

    ///

    /// Created `0600` rather than created and then restricted: the seed must

    /// never be readable to the rest of the machine, not even for the instant

    /// between the two calls.

    fn write_sealed(temp: &std::path::Path, bytes: &[u8]) -> Result<(), IdentityError> {

        let mut options = fs::OpenOptions::new();

        options.write(true).create_new(true);

        #[cfg(unix)]

        {

            use std::os::unix::fs::OpenOptionsExt;

            options.mode(0o600);

        }

        let mut file = options.open(temp)?;

        file.write_all(bytes)?;

        Self::set_mode(temp, 0o600)?;

        Ok(())

    }

    /// Move a plaintext seed under the OS keychain, and report what is protecting

    /// it afterwards. `Ok(None)` when nothing is stored.

    ///

    /// for an identity that no longer exists.

    pub fn forget(&self) -> Result<bool, IdentityError> {

        let path = self.path();

        let _ = fs::remove_file(self.temp_path());

        self.sweep_temp_files();

        if !path.exists() {

            self.keys.delete();

            return Ok(false);

//! Concurrent writers to one config directory.

//!

//! Every private file this CLI keeps — the credential store, the pending

//! device authorizations, the identity seed, `computer.json` — is written by a

//! process that has no claim on the machine. A fleet of agents runs under one

//! `$HOME` by design: the delegation engine starts children and each one

//! carries a credential. Two `oa auth login` runs at once are the same thing at

//! human speed.

//!

//! These writes used to stage through a name derived only from the target —

//! `path.with_extension("tmp")` — so every writer of a given file shared one

//! staging path. They truncated and renamed each other's half-written bytes:

//! one won, and the other's `rename` found nothing and reported a failed

//! credential write for a credential that may well have been stored. A caller

//! that cannot tell whether its own token landed has no move left.

//!

//! So each test here runs N writers against one directory and demands two

//! things a shared staging name cannot give: **every writer reports success**,

//! and **the file left behind is whole**. `computer.json` had it worse still —

//! it wrote in place, with no staging at all — so its test adds concurrent

//! readers, which is what makes the truncate window visible. Put any of these

//! writers back the way it was and the matching test fails.

use openagents_cli::auth::{CredentialStore, PendingDeviceAuthorization, PendingStore, Secret};

use openagents_cli::computer::{ComputerPaths, PolicyConfig};

use openagents_cli::identity::{generate_seed_phrase, NoKeyStore, SeedStore};

use std::io::{BufRead, BufReader, Read, Write};

use std::net::TcpListener;

use std::path::Path;

use std::process::Command;

use std::thread;

/// Enough writers to overlap on any machine that runs this, and few enough

/// that spawning them as processes stays quick.

const WRITERS: usize = 12;

// ---------------------------------------------------------------------------

// the reported failure: separate `oa` processes, one config directory

// ---------------------------------------------------------------------------

/// A server that answers every request with one canned device authorization.

///

/// `oa auth login --headless` starts an authorization, prints the code, writes

/// it to `device-authorizations.json`, and exits — no polling, so a run of it

/// is a short process whose only side effect is that write. That makes it the

/// honest way to put N real `oa` processes on one file at once.

fn stub_authorization_server() -> String {

    const BODY: &str = r#"{"device_code":"d-race","user_code":"AAAA-BBBB",

        "verification_uri":"https://example.test/device",

        "verification_uri_complete":"https://example.test/device?user_code=AAAA-BBBB",

        "expires_in":600,"interval":5,"scope":"forge:write"}"#;

    let listener = TcpListener::bind("127.0.0.1:0").expect("bind a port");

    let port = listener.local_addr().expect("read the port").port();

    thread::spawn(move || {

        for stream in listener.incoming() {

            let Ok(mut stream) = stream else { break };

            thread::spawn(move || {

                let mut reader = BufReader::new(stream.try_clone().expect("clone the stream"));

                let mut line = String::new();

                if reader.read_line(&mut line).is_err() {

                    return;

                }

                let mut length = 0usize;

                loop {

                    let mut header = String::new();

                    if reader.read_line(&mut header).unwrap_or(0) == 0 || header.trim().is_empty() {

                        break;

                    }

                    if let Some(value) = header.to_lowercase().strip_prefix("content-length:") {

                        length = value.trim().parse().unwrap_or(0);

                    }

                }

                if length > 0 {

                    let mut discard = vec![0u8; length];

                    let _ = reader.read_exact(&mut discard);

                }

                let response = format!(

                    "HTTP/1.1 201 Created\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{BODY}",

                    BODY.len()

                );

                let _ = stream.write_all(response.as_bytes());

                let _ = stream.flush();

            });

        }

    });

    format!("http://127.0.0.1:{port}")

}

/// N `oa` processes sharing a config directory each store their authorization,

/// and none of them is told the write failed.

///

/// This is the reported bug end to end. With the staging name derived only

/// from the target, running only the two scope tests in `tests/flags.rs` —

/// which is enough to make two `oa` runs overlap — failed 29 times in 30 with

/// `could not write .../device-authorizations.json: No such file or directory`.

/// Twelve deliberate writers make that certain rather than likely.

#[test]

fn concurrent_oa_processes_all_record_their_authorization() {

    let home = tempfile::tempdir().expect("a home of this test's own");

    let origin = stub_authorization_server();

    let runs: Vec<_> = (0..WRITERS)

        .map(|_| {

            let home = home.path().to_path_buf();

            let origin = origin.clone();

            thread::spawn(move || {

                Command::new(env!("CARGO_BIN_EXE_oa"))

                    .args(["--api-url", &origin, "auth", "login", "--headless"])

                    .env("NO_COLOR", "")

                    .env("HOME", &home)

                    .output()

                    .expect("run oa")

            })

        })

        .collect();

    for (index, run) in runs.into_iter().enumerate() {

        let output = run.join().expect("an oa process finished");

        assert_eq!(

            output.status.code(),

            Some(0),

            "writer {index} was told its authorization was not stored: {}",

            String::from_utf8_lossy(&output.stderr)

        );

    }

    let path = home

        .path()

        .join(".config")

        .join("openagents")

        .join("device-authorizations.json");

    let stored: serde_json::Value =

        serde_json::from_str(&std::fs::read_to_string(&path).expect("the file is on disk"))

            .expect("concurrent writers left whole JSON behind");

    assert_eq!(

        stored["authorizations"][&origin]["user_code"], "AAAA-BBBB",

        "the file survived but holds no authorization for the origin every writer used: {stored}"

    );

    assert_no_staging_files_left(path.parent().expect("the config directory"));

}

// ---------------------------------------------------------------------------

// the same overlap, one writer per thread, for each store in turn

// ---------------------------------------------------------------------------

/// Run `writer` on `WRITERS` threads at once and return what each one reported.

fn race<T, E>(writer: impl Fn(usize) -> Result<T, E> + Send + Sync + 'static) -> Vec<Result<T, E>>

where

    T: Send + 'static,

    E: Send + 'static,

{

    let writer = std::sync::Arc::new(writer);

    // A barrier rather than "spawn and hope": the point is that the writes

    // overlap, and a thread that starts after another has finished proves

    // nothing.

    let gate = std::sync::Arc::new(std::sync::Barrier::new(WRITERS));

    let threads: Vec<_> = (0..WRITERS)

        .map(|index| {

            let writer = writer.clone();

            let gate = gate.clone();

            thread::spawn(move || {

                gate.wait();

                writer(index)

            })

        })

        .collect();

    threads

        .into_iter()

        .map(|thread| thread.join().expect("a writer thread finished"))

        .collect()

}

/// No `.tmp` litter: a staging file left behind is a write that half happened,

/// and in this directory it is a half-written credential sitting on disk.

fn assert_no_staging_files_left(directory: &Path) {

    let left: Vec<String> = std::fs::read_dir(directory)

        .expect("read the directory")

        .flatten()

        .map(|entry| entry.file_name().to_string_lossy().into_owned())

        .filter(|name| name.ends_with(".tmp"))

        .collect();

    assert!(

        left.is_empty(),

        "staging files were left in {}: {left:?}",

        directory.display()

    );

}

#[cfg(unix)]

fn mode_of(path: &Path) -> u32 {

    use std::os::unix::fs::PermissionsExt;

    std::fs::metadata(path)

        .expect("stat the path")

        .permissions()

        .mode()

        & 0o777

}

/// Concurrent token writes all report where the token landed, and the store is

/// still readable afterwards.

///

/// Each writer uses its own origin, so the file is also the one place the

/// writes meet. The assertion is not that every origin survives — these are

/// read-modify-write callers and the last one legitimately wins — but that no

/// writer was told its token failed, and that the file the survivor left is a

/// credential store rather than two of them spliced together.

#[test]

fn concurrent_credential_writes_all_succeed_and_leave_a_readable_store() {

    let directory = tempfile::tempdir().expect("a config directory");

    let at = directory.path().to_path_buf();

    let results = race(move |index| {

        CredentialStore::isolated(&format!("https://writer-{index}.test"), &at)

            .store(&Secret::new(format!("token-for-{index}")))

    });

    for (index, result) in results.iter().enumerate() {

        assert!(

            result.is_ok(),

            "writer {index} was told its token was not stored: {}",

            result.as_ref().unwrap_err()

        );

    }

    let path = directory.path().join("credentials.json");

    let stored: serde_json::Value =

        serde_json::from_str(&std::fs::read_to_string(&path).expect("the store is on disk"))

            .expect("concurrent writers left whole JSON behind");

    let tokens = stored["tokens"]

        .as_object()

        .expect("the store holds a token map");

    assert!(

        !tokens.is_empty(),

        "every writer reported success and the store holds nothing: {stored}"

    );

    for (origin, token) in tokens {

        let index = origin

            .trim_start_matches("https://writer-")

            .trim_end_matches(".test");

        assert_eq!(

            token,

            &serde_json::json!(format!("token-for-{index}")),

            "the store pairs {origin} with a token no writer wrote, so two writes were spliced"

        );

    }

    #[cfg(unix)]

    {

        assert_eq!(

            mode_of(&path),

            0o600,

            "the store is readable to the machine"

        );

        assert_eq!(

            mode_of(directory.path()),

            0o700,

            "the config directory is open to the machine"

        );

    }

    assert_no_staging_files_left(directory.path());

}

/// The same for the half-finished logins, which is the file the reported

/// failure actually named.

#[test]

fn concurrent_pending_authorization_writes_all_succeed() {

    let directory = tempfile::tempdir().expect("a config directory");

    let path = directory.path().join("device-authorizations.json");

    let at = path.clone();

    let results = race(move |index| {

        PendingStore::at(at.clone()).set(&PendingDeviceAuthorization {

            origin: format!("https://writer-{index}.test"),

            device_code: format!("device-{index}"),

            user_code: format!("CODE-{index:04}"),

            verification_uri: "https://example.test/device".to_string(),

            verification_uri_complete: "https://example.test/device?user_code=X".to_string(),

            expires_at_ms: 1_000_000,

            interval: 5,

            kind: None,

        })

    });

    for (index, result) in results.iter().enumerate() {

        assert!(

            result.is_ok(),

            "writer {index} was told its authorization was not stored: {}",

            result.as_ref().unwrap_err()

        );

    }

    let stored: serde_json::Value =

        serde_json::from_str(&std::fs::read_to_string(&path).expect("the file is on disk"))

            .expect("concurrent writers left whole JSON behind");

    assert!(

        !stored["authorizations"]

            .as_object()

            .expect("the file holds an authorization map")

            .is_empty(),

        "every writer reported success and the file holds nothing: {stored}"

    );

    #[cfg(unix)]

    assert_eq!(mode_of(&path), 0o600, "the file is readable to the machine");

    assert_no_staging_files_left(directory.path());

}

/// Concurrent seed writes all succeed and the seed that remains is one somebody

/// actually wrote.

///

/// The seed store staged through a fixed `seed.tmp` and removed it before each

/// write, so two writers could put half of one phrase and half of another in

/// the file that then got renamed over the seed. A seed is the one file where

/// that costs an identity outright: nothing recovers a mnemonic that is six

/// words from one wallet and six from another.

#[test]

fn concurrent_seed_writes_all_succeed_and_the_seed_still_opens() {

    let directory = tempfile::tempdir().expect("an identity directory");

    let at = directory.path().join("identity");

    let phrases: Vec<String> = (0..WRITERS)

        .map(|_| generate_seed_phrase(12).expect("a phrase"))

        .collect();

    let written = phrases.clone();

    let target = at.clone();

    let results = race(move |index| {

        SeedStore::with_key_store(target.clone(), Box::new(NoKeyStore))

            .write_phrase(&written[index])

    });

    for (index, result) in results.iter().enumerate() {

        assert!(

            result.is_ok(),

            "writer {index} was told the seed was not written: {}",

            result.as_ref().unwrap_err()

        );

    }

    let store = SeedStore::with_key_store(at.clone(), Box::new(NoKeyStore));

    let recovered = store

        .read_phrase()

        .expect("the seed opens")

        .expect("a seed is stored");

    assert!(

        phrases.contains(&recovered),

        "the stored seed is not any phrase that was written, so two writes were spliced"

    );

    #[cfg(unix)]

    {

        assert_eq!(

            mode_of(&store.path()),

            0o600,

            "the seed is readable to the machine"

        );

        assert_eq!(

            mode_of(&at),

            0o700,

            "the identity directory is open to the machine"

        );

    }

    assert_no_staging_files_left(&at);

}

/// A reader of `computer.json` never sees a policy it cannot decode, however

/// many writers are working on it.

///

/// `computer.json` wrote in place — truncate the target, then write it — so

/// between those two calls the file on disk is empty, and any `oa` that read

/// the policy in that window was told its own configuration is not valid JSON.

/// It is the policy file: the answer decides which commands the Computer will

/// run at all, and `load_config` is right to refuse a file it cannot read

/// rather than fall back to a default the owner never chose. So the refusal

/// lands on a reader that did nothing wrong.

///

/// Writers alone would not settle this. Two small `write` calls usually land

/// whole, so a test that only writes passes against the broken version. Readers

/// are what make the truncate window visible, and staging elsewhere and

/// renaming is what closes it: the target is only ever the old file or the new

/// one.

#[test]

fn a_reader_never_sees_a_half_written_computer_policy() {

    /// Enough passes for the truncate window to be observed if it is open.

    const PASSES: usize = 40;

    let directory = tempfile::tempdir().expect("a config directory");

    let paths = ComputerPaths::in_directory(directory.path());

    // Seed the file, so a reader finding it absent means it was unlinked rather

    // than never written.

    let mut initial = PolicyConfig::closed(paths.clone());

    initial.pre_approved = vec!["writer-initial".to_string()];

    openagents_cli::computer::write_config(&initial).expect("the first write lands");

    let at = paths.clone();

    let results = race(move |index| {

        // Half write and half read, so both are going at once.

        if index.is_multiple_of(2) {

            for pass in 0..PASSES {

                let mut config = PolicyConfig::closed(at.clone());

                // Lengths differ between writers, so an interleave leaves a tail

                // rather than a file that happens to be the same size.

                config.pre_approved = (0..=index * pass % 7)

                    .map(|n| format!("writer-{index}-pass-{pass}-entry-{n}"))

                    .collect();

                openagents_cli::computer::write_config(&config)

                    .map_err(|error| format!("writer {index} pass {pass}: {error}"))?;

            }

        } else {

            for pass in 0..PASSES {

                openagents_cli::computer::load_config(&at)

                    .map(|_| ())

                    .map_err(|error| format!("reader {index} pass {pass}: {error}"))?;

            }

        }

        Ok::<(), String>(())

    });

    for result in &results {

        assert!(

            result.is_ok(),

            "a concurrent run of the policy file failed: {}",

            result.as_ref().unwrap_err()

        );

    }

    let settled = openagents_cli::computer::load_config(&paths)

        .expect("the policy the writers left behind still decodes");

    assert!(

        settled

            .pre_approved

            .iter()

            .all(|entry| entry.starts_with("writer-")),

        "the policy holds an entry no writer wrote, so two writes were spliced: {:?}",

        settled.pre_approved

    );

    #[cfg(unix)]

    assert_eq!(

        mode_of(&paths.config),

        0o600,

        "the configuration is readable to the machine"

    );

    assert_no_staging_files_left(directory.path());

}