Keep held runner locks referenced so GC cannot release them

A caller that dropped the returned RunnerLock let its SQLite connection be
garbage-collected, which released the OS lock while the runner was still
alive. Found by a CI failure of the cross-process lock test on #60. The new
test drops the lock and forces GC in a child, and fails without the fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: mchwang

runner/recovery.ts

@@ -29,6 +29,11 @@ function assertLocal(path: string): void {
   if (NETWORK_FILESYSTEMS.has(Number(statfsSync(path).type))) throw new Error(`${path} is on a network filesystem; the runner lock needs a local filesystem.`);
 }
 
+/**
+ * Strong references to every held lock connection. Without this, a caller that drops the returned RunnerLock lets the
+ * connection be garbage-collected, and closing it silently releases the OS lock while the runner is still alive.
+ */
+const heldLocks = new Set<DatabaseSync>();
 export interface RunnerLock {
   readonly file: { dev: bigint; ino: bigint };
   /** Step 4: the database path still names the locked file. Call after the Store opens. */
@@ -67,6 +72,7 @@ export function acquireRunnerLock(databasePath: string, options: { lockRoot?: st
       throw error;
     }
     const file = { dev: st.dev, ino: st.ino }, heldDb = db;
+    heldLocks.add(heldDb);
     let released = false;
     return {
       file,
@@ -75,7 +81,7 @@ export function acquireRunnerLock(databasePath: string, options: { lockRoot?: st
         if (now.isSymbolicLink() || !now.isFile() || now.dev !== file.dev || now.ino !== file.ino || now.nlink !== 1n)
           throw new Error('The database path changed while opening. Refusing to start.');
       },
-      release() { if (released) return; released = true; heldDb.close(); closeSync(fd); },
+      release() { if (released) return; released = true; heldLocks.delete(heldDb); heldDb.close(); closeSync(fd); },
     };
   } catch (error) { db?.close(); closeSync(fd); throw error; }
 }

test/runner-recovery.test.ts

@@ -39,6 +39,14 @@ describe('runner lock', () => {
     expect(again.file).toEqual(first.file);
     expect(existsSync(join(locksDir, `${first.file.dev}-${first.file.ino}.runner-lock`))).toBe(true);
   });
+  it('keeps holding the lock when the caller drops the returned object and garbage collection runs', async () => {
+    const d = dir(), locksDir = join(d, 'locks'), path = join(d, 'db.sqlite');
+    const recovery = fileURLToPath(new URL('../runner/recovery.ts', import.meta.url));
+    const child = spawn(process.execPath, ['--expose-gc', '-e', `import(${JSON.stringify(recovery)}).then(m => { m.acquireRunnerLock(${JSON.stringify(path)}, { lockRoot: ${JSON.stringify(locksDir)} }); for (let i = 0; i < 5; i++) globalThis.gc(); setTimeout(() => { globalThis.gc(); console.log('held'); }, 50); setInterval(() => {}, 1000); })`], { stdio: ['ignore', 'pipe', 'inherit'] });
+    children.push(child);
+    await new Promise<void>(resolve => child.stdout!.on('data', chunk => { if (String(chunk).includes('held')) resolve(); }));
+    expect(() => acquireRunnerLock(path, { lockRoot: locksDir })).toThrow(LockHeld);
+  });
   it('is released by the OS when the holding process is killed', async () => {
     const d = dir(), locksDir = join(d, 'locks'), path = join(d, 'db.sqlite');
     const recovery = fileURLToPath(new URL('../runner/recovery.ts', import.meta.url));