Summary

Fix two distinct pre-existing failures that keep CI red on main and block every open decrating PR (#48-#58). These failures exist independently of any code change — they fail on doc-only PRs too.

Root cause analysis

1. Coverage (llvm-cov) — snapshot mismatch on Linux

Failing test: publish_invalid_manifest_content_snapshot in crates/shipper-cli/tests/e2e_expanded.rs.

On GitHub's Ubuntu runners, cargo metadata reports the invalid manifest using a path relative to the workspace CWD (/home/runner/work/shipper/shipper/), producing something like:

--> ../../../tmp/.tmpXXX/Cargo.toml:1:6

The test's tempdir replacement (/tmp/.tmpXXX → <TMPDIR>) consumed the leading /, leaving ../../..<TMPDIR>/.... The old single-pass .replace("../", "") could only strip the first two ../, leaving behind ..<TMPDIR>/Cargo.toml — which did not match the snapshot (<TMPDIR>\Cargo.toml, committed from a Windows-side run).

2. Tests (nextest) on ubuntu-latest / macos-latest — concurrency race

Failing test: tests::concurrent_reads_and_writes_same_file in crates/shipper-storage/src/lib.rs (already #[cfg_attr(target_os = "windows", ignore)]).

Error:

write: failed to rename file to: /tmp/.tmpXXX/shared.txt
Caused by: No such file or directory (os error 2)

FileStorage::write built its scratch tmp path with full_path.with_extension("tmp"), so every concurrent write to shared.txt reused the single path shared.tmp. The interleaving

T1: write(shared.tmp)
T2: write(shared.tmp)   // overwrites
T1: rename(shared.tmp → shared.txt)  // removes tmp
T2: rename(shared.tmp → shared.txt)  // ENOENT

is a legitimate bug, not a test artifact — concurrent callers of the public write API can race on macOS/Linux (Windows's rename-into-existing semantics masked it).

Fixes

crates/shipper-cli/tests/e2e_expanded.rs

normalize_stderr now:

• converts backslashes to forward slashes so path separators are platform-independent in snapshots; and
• iteratively strips ../ prefixes and residual ..<TMPDIR> fragments until stable.

crates/shipper-cli/tests/snapshots/e2e_expanded__publish_invalid_manifest_content.snap

Committed snapshot updated to the canonical forward-slash form (<TMPDIR>/Cargo.toml).

crates/shipper-storage/src/lib.rs

Each write call builds a unique scratch filename from pid + thread id + subsecond nanos, so concurrent writes never collide on the tmp path. Two local tests that asserted the old fixed .tmp name were adapted to the more general invariant ("no .tmp extension files remain after a successful write"); atomic_write_overwrites_stale_tmp_from_prior_crash now only asserts the new write succeeds (the new impl intentionally does not clobber unrelated stale .tmp files).

Validation

Locally on Windows:

• cargo test -p shipper-storage -- --include-ignored → 93 lib + 33 integration + 1 doctest pass, including concurrent_reads_and_writes_same_file which can now be un-#[cfg_attr(..., ignore)]'d in a follow-up (kept ignored on Windows for this minimal PR).
• cargo test -p shipper-cli --test e2e_expanded → 126/126 pass.
• cargo fmt --all -- --check clean.
• cargo clippy -p shipper-storage -p shipper-cli --all-targets --all-features -- -D warnings clean.

Coverage-job-specific validation (cargo llvm-cov) is deferred to CI since it requires the coverage tool.

Impact

Unblocks green CI for the decrating PR queue (#48-#58) and restores main to a publishable state.

Test plan

• Coverage (llvm-cov) job turns green
• Tests (nextest) (ubuntu-latest) turns green
• Tests (nextest) (macos-latest) turns green
• Tests (nextest) (windows-latest) remains green
• All other CI jobs remain green