fix: stop a uintptr round-trip and a racy ordering check failing CI

Both only appear where this machine cannot look: the checkptr crash is in a
Linux-only file that does not compile on Darwin, and the rollback race needs
CI's scheduling to lose. Local `go test ./...` on Darwin passes either way,
which is why the first tag push reached CI before they were found.

The Linux session-deletion ioctl seam took its argument as a uintptr, so the
production caller converted a pointer to an integer and the test stub converted
it back. A uintptr that crosses a function boundary is not a valid pointer and
`checkptr`, which `-race` enables, rejects converting it back. The seam now
carries an unsafe.Pointer and only the syscall expression itself holds the
address as an integer, where the compiler keeps the object alive.

The rollback test proved "rollback did not return early" with a non-blocking
receive, which assumes the restoring goroutine's channel send happens before
rollback returns. It does not: rollback waits on the acknowledgement file, and
the send is the statement after writing it. The goroutine now marks the route
restored before publishing that acknowledgement, so reading the flag after
rollback returns is a real ordering check, and the channel read has a bounded
wait for the goroutine's outcome.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: jstar0

internal/cli/fs_test.go

@@ -13,6 +13,7 @@ import (
 	"reflect"
 	"runtime"
 	"strings"
+	"sync/atomic"
 	"syscall"
 	"testing"
 	"time"
@@ -3729,6 +3730,7 @@ func TestFSRollbackCanonicalFailureWaitsForManagedRouteRestoration(t *testing.T)
 	retirementRequest := filepath.Join(stateDirectory, "retire.request.json")
 	canonicalRoute := "/sessions/2026/07/12/" + filename
 	restored := make(chan error, 1)
+	var routeRestored atomic.Bool
 	go func() {
 		deadline := time.Now().Add(5 * time.Second)
 		for time.Now().Before(deadline) {
@@ -3775,6 +3777,12 @@ func TestFSRollbackCanonicalFailureWaitsForManagedRouteRestoration(t *testing.T)
 					restored <- err
 					return
 				}
+				// Mark the route restored before publishing the acknowledgement
+				// that rollback is waiting on. Rollback cannot observe that
+				// acknowledgement, and so cannot return, until after this flag is
+				// set — which is what makes reading it below a real ordering check
+				// rather than a race against this goroutine's next statement.
+				routeRestored.Store(true)
 				restored <- writeMountAcknowledgement(storeDir, "session", state.Generation, canonicalRoute)
 				return
 			}
@@ -3795,13 +3803,16 @@ func TestFSRollbackCanonicalFailureWaitsForManagedRouteRestoration(t *testing.T)
 	if !errors.Is(err, errRetirementRejected) {
 		t.Fatalf("rollback error = %v, want retirement rejection", err)
 	}
+	if !routeRestored.Load() {
+		t.Fatal("rollback returned before the managed route became readable again")
+	}
 	select {
 	case restoreErr := <-restored:
 		if restoreErr != nil {
 			t.Fatal(restoreErr)
 		}
-	default:
-		t.Fatal("rollback returned before the managed route became readable again")
+	case <-time.After(10 * time.Second):
+		t.Fatal("the restoring goroutine never reported its outcome")
 	}
 	state, err := managedState(storeDir, "session")
 	if err != nil {

internal/vfs/session_deletion_object_linux.go

@@ -121,7 +121,7 @@ func readSessionDeletionGenerationLinux(file *os.File) (uint64, error) {
 	errno := sessionDeletionIoctlLinux(
 		file.Fd(),
 		sessionDeletionFSIOCGetVersionRequestLinux(),
-		uintptr(unsafe.Pointer(&version)),
+		unsafe.Pointer(&version),
 	)
 	runtime.KeepAlive(file)
 	if errno != 0 {
@@ -134,8 +134,14 @@ func readSessionDeletionGenerationLinux(file *os.File) (uint64, error) {
 	return generation, nil
 }
 
-func invokeSessionDeletionIoctlLinux(fileDescriptor uintptr, request uintptr, argument uintptr) unix.Errno {
-	_, _, errno := unix.Syscall(unix.SYS_IOCTL, fileDescriptor, request, argument)
+// invokeSessionDeletionIoctlLinux takes the argument as a pointer rather than a
+// uintptr so no caller has to round-trip one back into a pointer. Only the
+// syscall itself may hold the address as an integer, and only inside the call
+// expression, where the compiler keeps the object alive; a uintptr that crosses
+// a function boundary is not a valid pointer and `checkptr` rejects converting
+// it back.
+func invokeSessionDeletionIoctlLinux(fileDescriptor uintptr, request uintptr, argument unsafe.Pointer) unix.Errno {
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, fileDescriptor, request, uintptr(argument))
 	return errno
 }
 

internal/vfs/session_deletion_object_linux_test.go

@@ -145,11 +145,11 @@ func TestReadSessionDeletionGenerationLinux(t *testing.T) {
 	t.Cleanup(func() { sessionDeletionIoctlLinux = oldIoctl })
 
 	t.Run("unsigned generation", func(t *testing.T) {
-		sessionDeletionIoctlLinux = func(fd uintptr, request uintptr, argument uintptr) unix.Errno {
+		sessionDeletionIoctlLinux = func(fd uintptr, request uintptr, argument unsafe.Pointer) unix.Errno {
 			if fd != file.Fd() || request != sessionDeletionFSIOCGetVersionRequestLinux() {
 				t.Fatalf("unexpected ioctl request: fd=%d request=%#x", fd, request)
 			}
-			*(*int32)(unsafe.Pointer(argument)) = -1
+			*(*int32)(argument) = -1
 			return 0
 		}
 		generation, err := readSessionDeletionGenerationLinux(file)
@@ -159,15 +159,15 @@ func TestReadSessionDeletionGenerationLinux(t *testing.T) {
 	})
 
 	t.Run("unsupported", func(t *testing.T) {
-		sessionDeletionIoctlLinux = func(uintptr, uintptr, uintptr) unix.Errno { return unix.ENOTTY }
+		sessionDeletionIoctlLinux = func(uintptr, uintptr, unsafe.Pointer) unix.Errno { return unix.ENOTTY }
 		if _, err := readSessionDeletionGenerationLinux(file); err == nil || !errors.Is(err, unix.ENOTTY) {
 			t.Fatalf("readSessionDeletionGenerationLinux() error=%v, want ENOTTY", err)
 		}
 	})
 
 	t.Run("zero", func(t *testing.T) {
-		sessionDeletionIoctlLinux = func(_ uintptr, _ uintptr, argument uintptr) unix.Errno {
-			*(*int32)(unsafe.Pointer(argument)) = 0
+		sessionDeletionIoctlLinux = func(_ uintptr, _ uintptr, argument unsafe.Pointer) unix.Errno {
+			*(*int32)(argument) = 0
 			return 0
 		}
 		if _, err := readSessionDeletionGenerationLinux(file); err == nil {