fix: ownershipOf's stat catch conflated absent with inconclusive

Flagged independently by both gemini-code-assist and the CI claude
reviewer bot on the pushed PR: the bare `catch { return 'absent' }`
in ownershipOf() treated every statSync failure — not just ENOENT —
as "nothing is on disk." A permission or I/O error on a path a live
foreign worker actually owns would misclassify as 'absent' rather
than 'foreign', and markUdsBindFailed()'s guard only blocks on
'foreign' — so an inconclusive stat error could make it delete a
live worker's yaml metadata, reintroducing the bug class this PR
exists to fix. cleanupUdsFiles() is unaffected (it treats 'absent'
and 'foreign' identically), but the distinction matters wherever
'absent' alone is trusted.

Now checks error.code === 'ENOENT' specifically; any other error
returns 'foreign' (the conservative default) instead. Added a test
forcing a non-ENOENT stat failure deterministically via ENOTDIR
(treating a plain file as a path segment) rather than EACCES, since
permission checks aren't reliably enforced when tests run as root
(common in CI containers).

Co-Authored-By: Claude Opus <noreply@anthropic.com>

Author: kriszyp

server/http.ts

@@ -110,8 +110,11 @@ export function recordUdsBindSuccess(socketPath: string) {
 /**
  * 'owned' — the (dev, inode) this worker recorded at bind time still matches what's on disk.
  * 'foreign' — a socket exists at the path, but with a different identity (or none was ever
- *   recorded): something else — almost always a replacement worker — currently owns it.
- * 'absent' — nothing is on disk at the path at all: there is no live owner to protect.
+ *   recorded): something else — almost always a replacement worker — currently owns it. Also the
+ *   safe default when statSync fails for any reason other than ENOENT (e.g. EACCES): we can't
+ *   confirm the path is genuinely empty, so treat it as though something we can't verify owns it.
+ * 'absent' — statSync confirmed ENOENT: nothing is on disk at the path. There is no live owner to
+ *   protect.
  */
 function ownershipOf(entry: {
 	socketPath: string;
@@ -121,8 +124,8 @@ function ownershipOf(entry: {
 	try {
 		const stat = statSync(entry.socketPath, { bigint: true });
 		current = { dev: stat.dev, ino: stat.ino };
-	} catch {
-		return 'absent';
+	} catch (error) {
+		return (error as NodeJS.ErrnoException).code === 'ENOENT' ? 'absent' : 'foreign';
 	}
 	return entry.identity !== undefined && current.dev === entry.identity.dev && current.ino === entry.identity.ino
 		? 'owned'

unitTests/server/udsMirror.test.js

@@ -625,6 +625,24 @@ describe('UDS mirror (writeUdsMetadata, cleanup helpers)', () => {
 			assert.ok(fs.existsSync(yamlPath), "a live socket this worker never bound means its yaml isn't ours to delete");
 		});
 
+		it('leaves the yaml in place when stat fails for a reason other than ENOENT', () => {
+			// A stat failure that isn't "the file doesn't exist" (permissions, I/O, etc.) means we
+			// can't confirm the path is genuinely empty — treat it like 'foreign', not 'absent', so a
+			// transient stat error can't be misread as license to delete a live owner's yaml. Forced
+			// deterministically via ENOTDIR (treating a plain file as a path segment) rather than
+			// EACCES, which isn't reliably enforced when tests run as root (common in CI containers).
+			const blockingFile = path.join(TEST_SOCKETS_DIR, 'not-a-directory');
+			const sockPath = path.join(blockingFile, 'nested.sock');
+			const yamlPath = path.join(TEST_SOCKETS_DIR, 'enotdir-failed.yaml');
+			fs.writeFileSync(blockingFile, '');
+			fs.writeFileSync(yamlPath, 'stale: metadata\n');
+			registerUdsCleanupPaths(sockPath, yamlPath);
+
+			markUdsBindFailed(sockPath);
+
+			assert.ok(fs.existsSync(yamlPath), 'an inconclusive stat error must not be treated as a safe-to-retract absence');
+		});
+
 		it('leaves the yaml in place when a replacement worker now owns the socket at the same path', () => {
 			const sockPath = path.join(TEST_SOCKETS_DIR, 'replaced-failed.sock');
 			const yamlPath = path.join(TEST_SOCKETS_DIR, 'replaced-failed.yaml');