Fix concurrency races, unchecked type assertions, and cross-platform syscall issues

[Copilot]

Comprehensive audit addressing concurrency safety, panic prevention, cross-platform compatibility, and resource management across the codebase.

Concurrency safety

• Respond() TOCTOU race — Hash was computed under read lock but consumed after lock promotion. Re-computes hash under write lock with proper double-checked locking:

  // Slow path: re-check under write lock
  w.cacheMutex.Lock()
  defer w.cacheMutex.Unlock()
  hash = w.Hash256()
  if w.cacheHash == hash && w.cachedWrap != nil {
      return w.cachedWrap
  }

• WriteLevel() TOCTOU race — lfw.mu was released before rf.write(p), allowing concurrent Close() to invalidate the rotatingFile between lookup and use. Now holds lock through the write.

Panic prevention

• Bare type assertions → comma-ok in hashTime(), ToTime(), and getFileMutex() — all were using v.(T) form which panics on type mismatch.
• Nil-receiver guards on HashMap.Get, Size, IsEmpty, ContainsKey, KeySet.

Cross-platform compatibility

• lock_windows.go — Replaced locale-dependent err.Error() != "The operation completed successfully." with err != syscall.Errno(0). The string comparison fails on non-English Windows.

Resource management

• defer for Close() calls in IsReadable, IsWritable, IsPortAvailable, CheckTCPConn — previously called Close() inline, leaking on hypothetical future early-return paths.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• this.host.definitely.does.not.exist.invalid
  • Triggering command: /tmp/go-build918891802/b262/sysx.test /tmp/go-build918891802/b262/sysx.test -test.paniconexit0 -test.timeout=10m0s -test.count=1 -I cgo 0224729/b193/ x64/pkg/tool/lin--64 --gdwarf-5 --64 -o x64/pkg/tool/lin-trimpath 0224�� _.a -I ache/go/1.24.13/-lang=go1.24 --gdwarf-5 ions =0 ache/go/1.24.13//tmp/go-build918891802/b203/vet.cfg (dns block)
  • Triggering command: /tmp/go-build676607140/b262/sysx.test /tmp/go-build676607140/b262/sysx.test -test.paniconexit0 -test.timeout=10m0s -test.count=1 8918�� ache/go/1.24.13/x64/src/net cfg x64/pkg/tool/linux_amd64/vet --gdwarf-5 --64 -o x64/pkg/tool/linux_amd64/vet -p 891802/b191/_pkg_.a -trimpath (dns block)
  • Triggering command: /tmp/go-build723361286/b262/sysx.test /tmp/go-build723361286/b262/sysx.test -test.paniconexit0 -test.timeout=10m0s -test.count=1 -o 891802/b214/_pkg_.a -trimpath sh -p crypto/internal/-o -lang=go1.24 as -I /opt/hostedtoolc-installsuffix 2 ux_amd64/compile-s --gdwarf-5 --64 -o ux_amd64/compile-buildtags (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)