Widen atomicWriteFile's Windows rename-retry budget and sleep without spinning

The ~910ms backoff budget (8 retries, 200ms cap) was exhausted twice in a row
by the same test on a Windows CI runner (harper#2036) - an AV real-time scan
can hold harper-config.yaml for over a second. Widen to 12 retries with a
500ms cap (~3.6s worst case), and replace the performance.now() busy-spin
with a timeout-only Atomics.wait so the wait is CPU-idle, which is what makes
the longer budget affordable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 2 people

config/configUtils.ts

@@ -7,7 +7,6 @@ import YAML from 'yaml';
 import path from 'path';
 import { threadId } from 'node:worker_threads';
 import { randomBytes } from 'node:crypto';
-import { performance } from 'node:perf_hooks';
 import isNumber from 'is-number';
 import propertiesReaderModule from 'properties-reader';
 import _ from 'lodash';
@@ -87,10 +86,15 @@ export function getConfigPath(param: string) {
 // Every worker thread runs its own RootConfigWatcher (chokidar), so a write on one thread
 // routinely races a hot-reload read on another; Windows Defender / AV real-time scanning can
 // hold a similar transient handle. Retry with exponential backoff to ride out the race -
-// callers are synchronous, so the wait is a synchronous busy-loop rather than a real sleep.
-const RENAME_RETRY_MAX_ATTEMPTS = 8;
+// callers are synchronous, so the wait is a synchronous sleep rather than an async one.
+// The budget must outlast a single AV real-time scan pass (seconds, not hundreds of ms):
+// the previous ~910ms budget was exhausted twice in a row by the same test on a CI runner
+// (harper#2036), so the worst case is now ~3.6s.
+const RENAME_RETRY_MAX_ATTEMPTS = 12;
 const RENAME_RETRY_INITIAL_DELAY_MS = 10;
-const RENAME_RETRY_MAX_DELAY_MS = 200;
+const RENAME_RETRY_MAX_DELAY_MS = 500;
+// Never notified; exists only so Atomics.wait can time out (a synchronous, CPU-idle sleep).
+const renameRetrySleepBuffer = new Int32Array(new SharedArrayBuffer(4));
 
 function atomicWriteFile(
 	filePath,
@@ -112,11 +116,10 @@ function atomicWriteFile(
 		} catch (err) {
 			if (retries > 0 && (err.code === 'EPERM' || err.code === 'EACCES')) {
 				retries--;
-				// Sleep synchronously (all call sites are sync) to allow the reader to close the
-				// file. Uses performance.now() rather than Date.now(): the latter tracks wall-clock
-				// time and can jump backward (NTP sync), which would turn this into an unbounded spin.
-				const start = performance.now();
-				while (performance.now() - start < delayMs) {}
+				// Sleep synchronously (all call sites are sync) to allow the holder to close the
+				// file. Atomics.wait yields the thread to the OS instead of spinning the CPU,
+				// which is what makes a multi-second worst-case budget affordable.
+				if (delayMs > 0) Atomics.wait(renameRetrySleepBuffer, 0, 0, delayMs);
 				delayMs = Math.min(delayMs * 2, maxDelayMs);
 				continue;
 			}

unitTests/config/configUtils.test.js

@@ -246,12 +246,12 @@ describe('Test configUtils module', () => {
 			try {
 				// Use the default retry count (unspecified maxRetries) so this exercises the real
 				// production budget, but override the delay to ~0 so the backoff doesn't burn real
-				// wall-clock time (default backoff would take ~900ms for a persistent failure).
+				// wall-clock time (default backoff would take ~3.6s for a persistent failure).
 				expect(() => atomicWriteFile(ATOMIC_TEST_PATH, 'content', { initialDelayMs: 0, maxDelayMs: 0 })).to.throw(
 					epermError
 				);
-				// 1 initial attempt + 8 retries (the production default maxRetries)
-				expect(renameStub.callCount).to.equal(9);
+				// 1 initial attempt + 12 retries (the production default maxRetries)
+				expect(renameStub.callCount).to.equal(13);
 				const stragglers = fs
 					.readdirSync(ATOMIC_TEST_DIR)
 					.filter((e) => e.startsWith('atomic-write-test.yaml.') && e.endsWith('.tmp'));