fix: eliminate TOCTOU race in MemoryRuntimeManager.acquire()

[Hugo-DDT]

What changed

Serialized acquire(), swap(), and release() in MemoryRuntimeManager with a ReentrantLock, closing the TOCTOU window between the draining check and the inFlightRequests increment in acquire().

Why

acquire() previously did check-then-act across two separate atomics (draining and inFlightRequests). A thread could observe draining == false, then another thread's swap() could set draining and close the underlying memory (when in-flight was 0) before the first thread incremented. The first thread then releases a lease on an already-closed handle, and release() → tryClose() closes it a second time. With the lock, the increment and the drain/close are mutually exclusive, so a handle is closed at most once and no lease is handed out for a draining handle.

The previous while (true) + re-check loop in acquire() became unnecessary: swap() atomically removes the old handle from current (via getAndSet) before setting draining, so current can never reference a draining handle.

How verified

• Existing tests in MemoryRuntimeManagerTest still cover the lease lifecycle and swap ordering.
• Added concurrentAcquireDuringSwapClosesOldRuntimeExactlyOnce, which runs concurrent acquire() loops against repeated swap()s and asserts the old runtime's close() is invoked exactly once (the buggy path could invoke it twice).

Note: the CI workflow runs mvn clean install -Dmaven.test.skip=true plus a license-header check, so this test is not exercised by CI — it runs with mvn -pl memind-server test locally.

Related

Fixes #84

[Copilot]

🟡 Changes recommended

Two unresolved moderate issues affect lock contention and regression-test reliability.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR fixes a TOCTOU race in MemoryRuntimeManager by serializing runtime lifecycle operations and adding concurrency coverage.

Changes:

• Added locking around acquisition, swapping, and release.
• Added a concurrent close-count regression test.

File summaries

File	Summary
memind-server/src/main/java/com/openmemind/ai/memory/server/runtime/MemoryRuntimeManager.java	Serializes runtime lifecycle operations. Moderate issue: Memory.close() runs while the lock is held, potentially blocking operations (2 votes).
memind-server/src/test/java/com/openmemind/ai/memory/server/runtime/MemoryRuntimeManagerTest.java	Adds concurrent swap/acquire coverage. Moderate issue: the test does not reliably force the required interleaving (3 votes).

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.