fix(T13299): global backup lock LOWs: clock at acquisition, abandon lost locks, sweep orphaned copies

[kryptobaseddev]

Summary

Follow-up to #1948 (T13293). It fixes the three review-hotfix LOWs on the single-flight session-end global backup.

This branch includes #1948's commits until #1948 merges. Review only the top commit, d39da76.

• LOW-1: the stale-window clock (lockedAt) now starts as soon as takeLock returns, not after the db-heavy admission, so the admission wait counts against the window.
• LOW-2: a lock that was lost (compromised) or held past its stale window is abandoned, never released.
  • Skipping unlock() alone would not be enough. proper-lockfile also registers a signal-exit hook that rmdirSyncs every lock it still tracks, and its release removes the directory without checking ownership.
  • The new acquireAbandonableLock (store/lock.ts) passes proper-lockfile a guarded fs. Once abandon() is called, both rmdir and rmdirSync are no-ops for that lock, and the release clears the refresh timer and the tracking entry.
  • A directory that was still ours is already older than the stale window, so the next taker reclaims it.
• LOW-3: sweepOrphanedGlobalCopies removes cleo.db.<id>.tmp copies and their -journal/-wal/-shm files once they are older than the stale window. It runs under the lock, before the due check. A live copy is younger, because VACUUM INTO keeps writing it.

Tests

• lock-abandon.test.ts: release removes the directory. After a simulated takeover, abandon leaves the other holder's directory in place, a second abandon never throws, and the lock can be taken again.
• backup-store-roundtrip.test.ts:
  • the compromised case abandons and does not release;
  • an admission that returns after the whole window discards the copy and abandons;
  • a normal backup releases and leaves no lock directory;
  • the sweep removes old .tmp/.tmp-journal files and keeps a live .tmp and an unrelated other.tmp.
• Mutation-checked: each of the 4 mutants (clock after admission, always release, abandon not marking, no sweep) fails at least one test.
• Targeted run: 22/22. tsc -b packages/core is clean, and so is biome.
• Gates pass: 3 (strict), 32 (PR mode), 34, 38 (--base origin/main, with the new LOCK_TIMEOUT throw tagged none:local-only) and 40.

Task: T13299

🤖 Generated with Claude Code