[AbirAbbas]

Why

Found while building a real app with the desktop app on Windows. Every engine started furrow serve --socket <per-user dir>/e-<build hash>.sock, and that name doesn't depend on the home. So two engines with different homes (desktop and terminal, or two homes) bound one socket and broke each other's seals ("use of closed network connection").

The same run found a crew whose workspace was the home folder; saved history then walked the whole user profile. #2009 has since landed its own home-folder policy upstream. This PR drops its earlier version of that and keeps only two gaps the policy still had.

Change

One saving daemon per home.

• The socket address now carries the absolute home and the build. Clients of the same home share one daemon; different homes never collide.
• Stale e-*.sock endpoints are pruned only while holding that daemon's lifetime lock, inside the existing per-socket start gate.
• The client already dials once per operation, so the next seal recovers after a dropped connection. A lost answer is never replayed.

The address stays under the AF_UNIX limit:

• Unix: a home whose own address fits keeps it, the same file earlier engines used. A long home keeps the short temporary alias earlier engines used, as long as it is a private directory owned by this user (current uid, 0700, no symlinks). An upgraded engine therefore shares the daemon an older one started. Only a preclaimed or foreign alias falls back, to $XDG_RUNTIME_DIR and then to other validated private temporary directories.
• Windows: falls back only to the user's own temp folder, with a private ACL. If no private endpoint fits within the limit, saved file history turns off with one sentence instead of every seal failing.

Two holes in the home-folder policy are closed:

• With HOME unset, the check falls back to the login home.
• With a symlinked home, the ancestors of the original path are now covered, not only those of the resolved target.

Verified

• Linux: the whole internal/cellstore package passes with the pinned furrow fixture. That includes a regression that starts a daemon on the old long-home address, upgrades the client, and checks that both seals reach the same daemon PID. go vet (Linux and GOOS=windows) and gofmt are clean.
• Native Windows (cellstore.test.exe, real furrow): 171 tests passed, 12 skipped (Unix-only fixtures). That covers the home/build socket identity, the user-temp-only fallback, a deep LOCALAPPDATA, case and trailing-separator homes, two homes sealing concurrently and restarting, pruning only dead sockets, recovery after an interrupted answer, and the no-private-socket fallback.
  • 3 tests failed, and they fail identically on an app/v3 build of the package: TestGoldenWALRecords (relative testdata), TestL2OnlyNewTurnConstructsATurn (temp-dir access) and TestComposedDirIsNamedOnlyWhenTheTreeIsAWorkspace (\\?\ prefix). Those come from running the binary outside the package directory, not from this change.
• Adversarial reviews covered symlinked-home ancestors, Windows socket length, missing HOME, Unix socket preclaim/impersonation, the permanent Windows failure, a drive-root fallback, a test that could pass vacuously, and upgrade sharing. Their findings are fixed and covered by tests.

Not run here: the macOS runtime.

---

🤖 Generated with Claude Code