fix: harden operations and configuration recovery

internal/operationlock/lock.go

@@ -13,6 +13,10 @@ import (
 	"proxyctl/internal/securefs"
 )
 
+type Locker interface {
+	Lock(context.Context) (func(), error)
+}
+
 type Lock struct {
 	path  string
 	uid   int
@@ -20,6 +24,29 @@ type Lock struct {
 	owned bool
 }
 
+type Group struct{ locks []Locker }
+
+func NewGroup(locks ...Locker) *Group { return &Group{locks: append([]Locker(nil), locks...)} }
+
+func (g *Group) Lock(ctx context.Context) (func(), error) {
+	var unlocks []func()
+	for _, lock := range g.locks {
+		unlock, err := lock.Lock(ctx)
+		if err != nil {
+			for i := len(unlocks) - 1; i >= 0; i-- {
+				unlocks[i]()
+			}
+			return nil, err
+		}
+		unlocks = append(unlocks, unlock)
+	}
+	return func() {
+		for i := len(unlocks) - 1; i >= 0; i-- {
+			unlocks[i]()
+		}
+	}, nil
+}
+
 func New(path string) *Lock { return &Lock{path: path} }
 func NewOwned(path string, uid, gid int) *Lock {
 	return &Lock{path: path, uid: uid, gid: gid, owned: true}

internal/operationlock/lock_test.go

@@ -10,6 +10,42 @@ import (
 	"proxyctl/internal/operationlock"
 )
 
+type recordingLocker struct {
+	name   string
+	events *[]string
+	err    error
+}
+
+func (l recordingLocker) Lock(context.Context) (func(), error) {
+	*l.events = append(*l.events, "lock "+l.name)
+	if l.err != nil {
+		return nil, l.err
+	}
+	return func() { *l.events = append(*l.events, "unlock "+l.name) }, nil
+}
+
+func TestGroupAcquiresInOrderAndReleasesInReverse(t *testing.T) {
+	var events []string
+	group := operationlock.NewGroup(
+		recordingLocker{name: "system", events: &events},
+		recordingLocker{name: "user", events: &events},
+	)
+	unlock, err := group.Lock(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	unlock()
+	want := []string{"lock system", "lock user", "unlock user", "unlock system"}
+	if len(events) != len(want) {
+		t.Fatalf("events = %v, want %v", events, want)
+	}
+	for i := range want {
+		if events[i] != want[i] {
+			t.Fatalf("events = %v, want %v", events, want)
+		}
+	}
+}
+
 func TestLockRejectsSymlinkedStateAncestor(t *testing.T) {
 	root := t.TempDir()
 	victim := filepath.Join(root, "victim")