[SashaMIT]

Fixes #381.

What this changes

Four test sites in capsules/model-provider/src/journal.rs took the journal directory lock with a single try_lock().unwrap(): lines 3944, 3950, 4263 and 4336 on develop. They now take it with lock_journal_directory, the provider's own bounded retry (journal.rs:2167). Only test code changes. The provider's try_lock at :2172, inside that retry, is unchanged.

Why

5051505 (#381) found the cause. A child process that another test thread forks can hold a copy of an earlier lock fd for a short time, so a single try_lock() can return WouldBlock. That commit fixed one test: held_transaction_directory_lock_blocks_recovery_and_atomic_writes at journal.rs:4223, which is the failure Anders cites when he reopened #381 (alpha.22 develop push, run 38919906568, job 117040001433). The same pattern then failed in CI in another test:

thread 'journal::tests::live_transaction_creator_preserves_partial_files_and_bindings' panicked at src/journal.rs:4336:35:
called `Result::unwrap()` on an `Err` value: "WouldBlock"
test result: FAILED. 291 passed; 1 failed; 2 ignored

(job 117356008539, run 39018319086, test-capsules on #417's merge with develop.)

This PR fixes every remaining site at once, so the flake does not move to the next test. With 5051505 (already on develop) and this PR, every test in journal.rs that takes the directory lock itself uses the bounded retry. That is the first fix #381 proposes ("the test retries try_lock for a bounded time"). The other option it names, close-on-exec test fds before any fork, is not done here.

Proof

On this branch, cargo test --lib journal:: ran three times in a row:

test result: ok. 52 passed; 0 failed; 0 ignored; 0 measured; 242 filtered out; finished in 5.08s
test result: ok. 52 passed; 0 failed; 0 ignored; 0 measured; 242 filtered out; finished in 5.14s
test result: ok. 52 passed; 0 failed; 0 ignored; 0 measured; 242 filtered out; finished in 5.13s

cargo fmt -- --check and cargo clippy --all-targets with -D warnings are clean.

Gap: the flake depends on timing. Passing runs here do not prove the race is gone. It goes away because every test site now waits the same bounded time that the provider itself waits.

Merged into

This fix is merged into any open draft PR whose test-capsules job fails on this test. The first is #417.

---

Generated by Claude Code

[SashaMIT]

Review: A. The bounded retry matches the WouldBlock failure in run 39018319086. Ready for Anders once CI is green.

[SashaMIT]

Round 3 review: PASS (A). Body, code and tests agree.