Concurrent seed copies can jointly violate the free-space floor #1527

Problem

Source-revalidated on main 3f2a835c78e9daba7baefc4c018c6fc9ca3c6e4a.

Probe locks are per target checkout; build/dependency copies independently snapshot filesystem free space and apply a pure seed_fits predicate. There is no shared disk reservation across distinct targets. Concurrent copies can all pass against the same free bytes although their sum violates the floor.

Location: crates/prod-code-gateway/src/sync/sync_fs.rs:177-184; crates/prod-code-gateway/src/seed_cache/build_cache.rs:59-83; crates/prod-code-gateway/src/seed_cache/virtualenv.rs:54-84.

Reproduction boundary

With a synthetic filesystem total980 units/free290, three48-unit seeds each predict242 free and pass a20% floor; together they leave146. Model the interleaving with a controlled disk-space provider, not actual disk pressure.

Expected correction

Reserve capacity atomically across seed operations sharing a filesystem, or serialize capacity check and copy. Release reservations on success/failure/cancellation and account for build/dependency copies without confusing the memory-admission ledger with disk usage.

Verification limits

Read-only production/test source inspection, including the current-main acceptance-test diff (formatting changes do not alter the tested boundary). No destructive cleanup, cache mutation, benchmark, new tests, child processes or server restarts were executed. Outcomes above are source-derived, not fresh runtime results.

Original review findings

• A worktree seed leaves a fifth of the disk free and logs a skipped copy (#419) #420 (comment)