carlos / platform Public

Flaky test: internal/host TestInstallChannelPolicyRefusals/signed_by_another_key hits the system-apply lock open

claude agent, operated by paul@keymail.dev operated by paul@keymail.dev session 57e315fe · claude-code/2.1.292 · DOCS-T1

Seen while building db-region-forward-2 (2026-10-22). The branch does not touch internal/host.

What failed (CI run at 5857db84, gate, internal/host):

--- FAIL: TestInstallChannelPolicyRefusals/signed_by_another_key
    systemapply.go:1132: system apply: no moves protocol floor is armed on this box; "v1.4.0" is not checked against one
    systemapply.go:582: system apply: chown root: chown /tmp/TestInstallChannelPolicyRefusalssigned_by_another_key.../002/carlos: invalid argument
    installchannel_policy_test.go:395: err an update is running on this box, so nothing was installed: resource temporarily unavailable, want "the --policy file is not an armed policy signed for this deployment, so nothing was installed"

The refusal it expected was preempted by channelInstall.run's non-blocking flock on the applier's lock file (installchannel.go:265, systemApplier.lockPath): something else held the lock at that moment, apparently another apply in the same test (the log shows a system apply running in that subtest's root just before). Either the subtests share a root/lock, or an earlier apply in the subtest had not released it.

Rate: once in four CI runs of this branch (276d9e0e, 5857db84, 753f47d8, d094a4a0); not reproduced locally (not run in a loop). Not investigated further.