Test that an interrupt inside the guard's drop still removes apply.lock

The drop now stays in the interrupt table until after its own unlink,
but nothing exercised a real signal landing there. Add a debug-only
`apply_lock.releasing` failpoint just before R1 and an e2e test that
parks `apply` in the drop, sends SIGTERM, and checks the process dies
by it without leaving apply.lock. The test fails if the guard leaves
the table before the unlink, as it did before.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: claude

crates/socket-patch-cli/tests/e2e_safety_lock.rs

@@ -469,12 +469,17 @@ mod interrupted_holder {
     /// `ignore_sigint`, the child starts with SIGINT ignored, as under
     /// `nohup` or a launcher that ignores Ctrl-C.
     fn spawn_holding_lock(root: &Path, ignore_sigint: bool) -> Child {
+        spawn_parked_at(root, "apply_lock.acquired", ignore_sigint)
+    }
+
+    /// Spawn `apply` in `root` and wait until it parks at `failpoint`.
+    fn spawn_parked_at(root: &Path, failpoint: &str, ignore_sigint: bool) -> Child {
         let ready = root.join("failpoint-ready");
         let mut cmd = hermetic_command(&binary());
         jvm_env::isolate_cli(&mut cmd);
         cmd.args(["apply", "--json"])
             .current_dir(root)
-            .env("SOCKET_PATCH_FAILPOINT", "apply_lock.acquired~pause")
+            .env("SOCKET_PATCH_FAILPOINT", format!("{failpoint}~pause"))
             .env("SOCKET_PATCH_FAILPOINT_READY", &ready)
             .stdin(Stdio::null())
             .stdout(Stdio::null())
@@ -511,12 +516,16 @@ mod interrupted_holder {
     }
 
     fn assert_interrupt_cleans_up(sig: libc::c_int) {
+        assert_interrupt_at_cleans_up("apply_lock.acquired", sig);
+    }
+
+    fn assert_interrupt_at_cleans_up(failpoint: &str, sig: libc::c_int) {
         let dir = tempfile::tempdir().unwrap();
         let socket_dir = dir.path().join(".socket");
         setup_socket_dir(&socket_dir);
         let lock = socket_dir.join("apply.lock");
 
-        let mut child = spawn_holding_lock(dir.path(), false);
+        let mut child = spawn_parked_at(dir.path(), failpoint, false);
         assert!(lock.is_file(), "the parked apply holds apply.lock");
 
         signal(&child, sig);
@@ -551,6 +560,15 @@ mod interrupted_holder {
         assert_interrupt_cleans_up(libc::SIGHUP);
     }
 
+    /// An interrupt that lands while the guard's drop is already under
+    /// way — before the drop's own unlink — still removes the file: the
+    /// handler ends the process without resuming the drop, so the guard
+    /// must stay in the interrupt table until the drop has unlinked it.
+    #[test]
+    fn interrupt_during_release_removes_the_lock_file() {
+        assert_interrupt_at_cleans_up("apply_lock.releasing", libc::SIGTERM);
+    }
+
     /// A process started with SIGINT ignored keeps ignoring it (no handler
     /// is installed over SIG_IGN), and SIGTERM still cleans up.
     #[test]

crates/socket-patch-core/src/patch/apply_lock.rs

@@ -210,7 +210,9 @@ impl Drop for LockGuard {
         // the barrier, which can take seconds over a large vendored tree,
         // or during the identity probe) still removes the file: the CLI's
         // handler ends the process, so this drop never gets to finish.
-        //
+        // Debug-only hook: the interrupt tests park the process here and
+        // signal it.
+        crate::utils::failpoint::hit("apply_lock.releasing");
         // R1: unlink while still holding the lock — but only the file we
         // hold. The unlink is gated on the path still naming the held
         // inode: after a non-cooperating `rm` + `touch`, the path names a