Make OS lease guards prove process-bound release across inherited descriptors

[flyingrobots]

Idea

Treat an operating-system file lease as an explicit process-bound authority guard rather than an owned File whose close is assumed to release authority.

Rust's Unix file-lock contract maps File::try_lock to flock and retains the lock until every duplicated or inherited descriptor is closed, unless File::unlock is called. O_CLOEXEC still leaves a fork-to-exec inheritance window. The writer-epoch lease exposed this distinction when a musl test attempted immediate takeover while another test spawned a child process.

A reusable internal lease guard could make the contract executable:

• acquisition owns the exact OS lock capability;
• an explicit fallible release path unlocks before close when the caller needs a typed outcome;
• Drop performs a best-effort unlock fallback;
• duplicated/inherited-descriptor tests prove release does not depend on the last descriptor closing;
• platform-specific posture is explicit rather than inferred from an empty error set.

Acceptance

• Specify whether lease authority is bound to a process, an open-file description, or another named owner.
• Add a deterministic duplicated-descriptor conformance witness.
• Add a bounded fork-to-exec witness on supported Unix targets without timing sleeps.
• Distinguish explicit release success, fallback-on-drop, and release obstruction where that distinction is authoritative.
• Keep the guard internal until a second real lease consumer establishes a reusable public shape.
• The abstraction must not weaken live-writer exclusion or permit a forked child to continue writing without fresh admission.

This is a design follow-up, not a blocker for the narrow PR #716 CI repair.

[coderabbitai]

🔗 Related PRs

#715 - Persist filesystem WAL writer epochs [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!