fix(auth): fail closed on unreadable stale locks

src/infra/stale-lock-file.ts

@@ -62,7 +62,7 @@ export function shouldRemoveDeadOwnerOrExpiredLock(params: {
     const createdAt = Date.parse(payload.createdAt);
     return !Number.isFinite(createdAt) || (params.nowMs ?? Date.now()) - createdAt > params.staleMs;
   }
-  return true;
+  return false;
 }
 
 export async function removeLockFileIfSnapshotMatches(params: {

src/plugin-sdk/file-lock.test.ts

@@ -69,9 +69,10 @@ describe("acquireFileLock", () => {
       stale: 10,
     } as const;
 
+    const deadPid = Number.MAX_SAFE_INTEGER;
     await fs.writeFile(
       lockPath,
-      JSON.stringify({ pid: 999_999, createdAt: new Date(Date.now() - 60_000).toISOString() }),
+      JSON.stringify({ pid: deadPid, createdAt: new Date(Date.now() - 60_000).toISOString() }),
       "utf8",
     );
 
@@ -84,6 +85,38 @@ describe("acquireFileLock", () => {
     }
   });
 
+  it("keeps a reported stale lock when its payload is not readable", async () => {
+    const filePath = path.join(tempDir, "payload-pending");
+    const lockPath = `${filePath}.lock`;
+    const options = {
+      retries: {
+        retries: 0,
+        factor: 1,
+        minTimeout: 1,
+        maxTimeout: 1,
+      },
+      stale: 10,
+    } as const;
+
+    await fs.writeFile(lockPath, "{", "utf8");
+
+    let caught: { lockPath?: string } | undefined;
+    await expect(
+      (async () => {
+        try {
+          await acquireFileLock(filePath, options);
+        } catch (err) {
+          caught = err as { lockPath?: string };
+          throw err;
+        }
+      })(),
+    ).rejects.toMatchObject({
+      code: FILE_LOCK_TIMEOUT_ERROR_CODE,
+    });
+    await expect(fs.realpath(caught?.lockPath ?? "")).resolves.toBe(await fs.realpath(lockPath));
+    await expect(fs.readFile(lockPath, "utf8")).resolves.toBe("{");
+  });
+
   it("keeps a reported stale lock when its owner pid is alive", async () => {
     const filePath = path.join(tempDir, "live-owner");
     const lockPath = `${filePath}.lock`;

src/plugin-sdk/file-lock.ts

@@ -56,7 +56,7 @@ async function shouldReclaimPluginLock(params: {
     const createdAt = Date.parse(payload.createdAt);
     return !Number.isFinite(createdAt) || params.nowMs - createdAt > params.staleMs;
   }
-  return true;
+  return false;
 }
 
 function isFileLockError(error: unknown, code: string): boolean {