fix(agentcompat): retain reconnect sentinel handles

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

integration/agentcompat/internal/scenario/reconnect_operations.go

@@ -110,17 +110,35 @@ func runReconnectRead(ctx context.Context, mcpClient *client.Client, serverID ui
 	return nil
 }
 
-func prepareReconnectSentinel(agentRoot string) (fixturePath, sentinelPath string, err error) {
+type reconnectSentinel struct {
+	root *os.Root
+	name string
+}
+
+func (sentinel reconnectSentinel) read() ([]byte, error) {
+	return sentinel.root.ReadFile(sentinel.name)
+}
+
+func (sentinel reconnectSentinel) close() error { return sentinel.root.Close() }
+
+func prepareReconnectSentinel(agentRoot string) (fixturePath string, sentinel reconnectSentinel, err error) {
 	root, err := fixture.NewAgentRoot(agentRoot, "reconnect-files")
 	if err != nil {
-		return "", "", err
+		return "", reconnectSentinel{}, err
 	}
 	path, err := root.Path("runtime.txt")
 	if err != nil {
-		return "", "", err
+		return "", reconnectSentinel{}, err
 	}
 	fixturePath = path.String()
-	sentinelPath = agentRoot + "/outside-reconnect-sentinel"
+	workspace, err := os.OpenRoot(agentRoot)
-	err = os.WriteFile(sentinelPath, []byte("outside-reconnect-root-sentinel"), 0o600)
+	if err != nil {
-	return fixturePath, sentinelPath, err
+		return "", reconnectSentinel{}, err
+	}
+	sentinel = reconnectSentinel{root: workspace, name: "outside-reconnect-sentinel"}
+	if err := workspace.WriteFile(sentinel.name, []byte("outside-reconnect-root-sentinel"), 0o600); err != nil {
+		_ = workspace.Close()
+		return "", reconnectSentinel{}, err
+	}
+	return fixturePath, sentinel, nil
 }

integration/agentcompat/internal/scenario/reconnect_run.go

@@ -64,11 +64,12 @@ func (Reconnect) RunWithEvidence(ctx context.Context, input ReconnectInput) (res
 	if err != nil {
 		return reconnectFinish(assertions, err, reconnectEvidence)
 	}
-	fixturePath, sentinelPath, err := prepareReconnectSentinel(agentRoot)
+	fixturePath, sentinel, err := prepareReconnectSentinel(agentRoot)
 	if err != nil {
 		return reconnectFinish(assertions, err, reconnectEvidence)
 	}
-	sentinelBytes, err := os.ReadFile(sentinelPath)
+	defer sentinel.close()
+	sentinelBytes, err := sentinel.read()
 	if err != nil {
 		return reconnectFinish(assertions, err, reconnectEvidence)
 	}
@@ -98,7 +99,7 @@ func (Reconnect) RunWithEvidence(ctx context.Context, input ReconnectInput) (res
 	assertions.Record("Dashboard disconnect barrier stopped generation one", stoppedRuntime == runtimeBefore && dashboardInstance.RuntimeIdentity().PID == 0, "")
 	if input.DashboardFault == "dashboard-exit" {
 		// This fault returns before the normal lifecycle evidence finalization below.
-		sentinelAfter, sentinelErr := os.ReadFile(sentinelPath)
+		sentinelAfter, sentinelErr := sentinel.read()
 		sentinelUnchanged := sentinelErr == nil && bytes.Equal(sentinelBytes, sentinelAfter)
 		reconnectEvidence.Lifecycle.DisconnectAt = disconnectAt
 		reconnectEvidence.Lifecycle.OutsideRootSentinelUnchanged = sentinelUnchanged
@@ -171,7 +172,7 @@ func (Reconnect) RunWithEvidence(ctx context.Context, input ReconnectInput) (res
 	}
 	taskIDs, resultIDs, duplicates, lost := reconnectReceiptSummary(dashboardPairs, agentPairs)
 	stale := staleReconnectReceiptCount(runtimeBefore.Generation, dashboardPairs, agentPairs)
-	sentinelAfter, err := os.ReadFile(sentinelPath)
+	sentinelAfter, err := sentinel.read()
 	if err != nil {
 		return reconnectFinish(assertions, err, reconnectEvidence)
 	}