This makes the identity lock cover the operations whose races damage state. SIGINT and SIGTERM are deferred while a token refresh holds the lock, so a signal no longer leaves a spent refresh token behind and logs the account out; two key create runs can no longer publish a mismatched pair; and auth logout spends one hold budget on all of an identity's revocations rather than one each. A lock timeout now names the lock that was actually waited on.
Writes that could escape their owner are refused or redirected. A machine-wide core.hooksPath no longer receives the change-id hook from repo clone, repo configure reads the effective worktree pin before judging a failed key lookup, and a symlinked config.toml keeps its link and its target is written atomically. A non-UTF-8 ATGC_ACCOUNT exits 2 instead of selecting a different account, a silent loopback connection can no longer stall the login callback, and release builds check arithmetic.
🤖 Generated with Claude Code