fsutil.ReadDeclaration refuses a home-scoped declaration as replaced between its vetting and its read when another abcd process of the same user atomically renames a new version into place inside the lstat-to-open window, so two abcd processes on one machine (two sessions, or a hook and a verb) can make one refuse its own ~/.abcd/config.json, rules.json or credentials index; the merge-group macOS leg of PR 744 failed TestConcurrentConnectsKeepEveryKeyAndBlock on it.

fsutil.ReadDeclaration refuses a home-scoped declaration as replaced between its vetting and its read when another abcd process of the same user atomically renames a new version into place inside the lstat-to-open window, so two abcd processes on one machine (two sessions, or a hook and a verb) can make one refuse its own ~/.abcd/config.json, rules.json or credentials index; the merge-group macOS leg of PR 744 failed TestConcurrentConnectsKeepEveryKeyAndBlock on it.

Grounds

• pursued: two abcd processes on one machine no longer make one refuse its own ~/.abcd/config.json when the other rewrites it; TestReadDeclarationReadsABenignReplacementAfterRevetting or TestConcurrentConnectsKeepEveryKeyAndBlock failing with ErrDeclarationSwapped would show it wrong, and TestReadDeclarationRefusesANonBenignReplacement reading a symlink, FIFO, directory, group-writable or foreign-owned replacement would show the fix weakened the guard