cherry-pick: Restrict the UDS mirror sockets directory to its owner and publish mirror metadata atomically (conflicts → v5.3)

[github-actions]

Cherry-pick of PR #3019 onto `v5.3` produced conflicts on commit(s): `396ab5ffcf7f78578407e9c2054e31a50d0440f5 7b26d4c 5970700 cd6eff0`.

Resolve the conflict markers on branch `cherry-pick/v5.3/pr-3019` and merge this PR.

@claude please review branch `cherry-pick/v5.3/pr-3019` and suggest a patch that resolves the conflict markers (<<<<<<< / ======= / >>>>>>>) introduced by cherry-picking PR #3019 onto `v5.3`. Post the suggested patch as a comment here — do not push.

---

Conflict resolution

Resolved in b3f4a9cfd (new commit on top of the action's history; nothing rewritten).

• Conflicted: the UDS mirror gate in getHTTPServer (server/http.ts) and in onSocket's raw-TLS mirror (server/threads/threadServer.js).
• Chosen: Restrict the UDS mirror sockets directory to its owner and publish mirror metadata atomically (#3019)'s ensureSocketsDirectory()-gated shape, with v5.3's own condition. Main's side also carried shouldBindListenerHere(...), which came from Run replication on dedicated worker threads that load no application code (#3035) and does not exist on v5.3. It is dropped, so v5.3's listener binding is unchanged.
• Equivalence: the net diff against v5.3 matches Restrict the UDS mirror sockets directory to its owner and publish mirror metadata atomically #3019's squash on main (4a6bd28) line for line, except for that one term.

❓ Your call: if #3035 is ever backported to v5.3, add shouldBindListenerHere(...) back into both gates. Otherwise nothing is open.

Verification

• Local: build passes. mocha unitTests/server/**: 1182 passing, 0 failing, including all 10 new udsMirrorDirectory tests. integrationTests/server/uds-mirror-overlapping-restart.test.ts passes, including the 0700 assertions after startup and after restart.
• Dispatched on b3f4a9c: Integration Tests (Node 24) ✅ and Unit Test (Node 24) ✅.
• PR-triggered Unit Test has two red jobs. Both fail on v5.3 without this PR:
  • Node.js v26: withNodeAdapter ×4 and install_node_modules ×3. These are the same 7 failures as v5.3's own push run at f884898 (run 37829350392).
  • Windows, Node.js v24: logGenerationCoordinator.test.js:172. The test computes held.ino + 1, and a Windows file ID above 2^53 rounds that back to ino. Main fixed this in Compare log-file identities as BigInt, so Windows file IDs past 2^53 stop matching neighbouring files (#3036), which has no milestone and is not on v5.3. The same job passed in the dispatched run at the same SHA.
• Pre-push review (codex, gemini, cursor-composer, adjudicated by harper-domain): 4 nits. All concern Restrict the UDS mirror sockets directory to its owner and publish mirror metadata atomically #3019's original content, which is identical on main, or pre-existing code, so none was changed in this backport.

_{🤖 Resolution by Claude Opus 5.5 (Claude Code); posted via @kriszyp.}

🤖 Generated with Claude Code

https://claude.ai/code/session_01WTjjN5aimb5AwUhHUrm2Vg

Related PRs: #3019 overlaps, #3035 overlaps, 18 others independent

_{Review-Coverage: authored=claude; ran=gemini,codex,cursor-composer; adjudicated=domain; blocked=cursor-grok(failed); declined=cursor-kimi,cursor-muse; rounds=1; full=1 @ b3f4a9c}

_{Review-Attention: study ~14m (hot: http.ts, threadServer.js; decisions: owner-only-0700, fail-soft-pool; raised: degraded review) @ b3f4a9c}