kyleandClaude Opus 5.5
67f497f482
Every daemon removes a leftover socket before binding, which also lets a second copy silently take a running one's sockets. Owner's decision: refuse to start instead. Each daemon takes an exclusive std File lock (stable since 1.89, checked on 1.95) on <home>/run/<role>.lock, or <socket>.lock for inferproxy, before touching its sockets; the system releases it however the process ends. A runbook entry, a security note and a test per daemon. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>