fix(go-cache): restore entry-level serialisation (regression of #924)

sync.RWMutex now serialises Get/Set/Delete/DeleteMany/binary entry ops
and invalidation key enumeration. The previous AX-6 sweep at #379/#381
removed the mutex; concurrent writes corrupted the underlying map and
re-introduced the TOCTOU race that #924 originally fixed.

sync import is structural concurrency primitive (AX-6 permitted via
established convention).

Race regressions: 100 concurrent Sets on distinct keys, 100 concurrent
Sets on same key, mixed Get/Set/Delete on same key — all -race clean.

Co-authored-by: Codex <noreply@openai.com>
Closes tasks.lthn.sh/view.php?id=985

Author: Snider

cache.go

@@ -9,6 +9,7 @@ import (
 	// Note: AX-6 — intrinsic: coreio.Medium has no no-follow Lstat primitive or dynamic cwd lookup.
 	"os"
 	"slices"
+	"sync" // Note: AX-6 — structural concurrency primitive for entry-level write serialisation.
 	// Note: AX-6 — no core equivalent for durations or wall-clock timestamps.
 	"time"
 
@@ -43,9 +44,8 @@ type Cache struct {
 	baseDir      string
 	cacheTTL     time.Duration
 	invalidation map[string][]InvalidateFunc
+	entryMu      sync.RWMutex
 	runtime      *core.Core
-	// Backing-store operations intentionally have no mutex; callers must
-	// synchronize concurrent writes to the same key.
 }
 
 // Entry is the serialized cache record written to the backing Medium.
@@ -289,6 +289,9 @@ func (cache *Cache) Get(key string, dest any) (bool, error) {
 		return false, err
 	}
 
+	cache.entryMu.RLock()
+	defer cache.entryMu.RUnlock()
+
 	path, err := cache.Path(key)
 	if err != nil {
 		return false, err
@@ -346,6 +349,9 @@ func (cache *Cache) set(key string, data any, ttl time.Duration, useDefaultTTL b
 		return err
 	}
 
+	cache.entryMu.Lock()
+	defer cache.entryMu.Unlock()
+
 	path, _, err := cache.entryPaths(key)
 	if err != nil {
 		return err
@@ -412,6 +418,9 @@ func (cache *Cache) removeEntryFiles(key string) (bool, error) {
 		return false, err
 	}
 
+	cache.entryMu.Lock()
+	defer cache.entryMu.Unlock()
+
 	jsonPath, binaryPath, err := cache.entryPaths(key)
 	if err != nil {
 		return false, err
@@ -464,6 +473,9 @@ func (cache *Cache) setBinary(key string, data []byte, contentType string, ttl t
 		return err
 	}
 
+	cache.entryMu.Lock()
+	defer cache.entryMu.Unlock()
+
 	jsonPath, binaryPath, err := cache.entryPaths(key)
 	if err != nil {
 		return err
@@ -525,6 +537,9 @@ func (cache *Cache) GetBinary(key string) ([]byte, bool, error) {
 		return nil, false, err
 	}
 
+	cache.entryMu.RLock()
+	defer cache.entryMu.RUnlock()
+
 	metaPath, binaryPath, err := cache.entryPaths(key)
 	if err != nil {
 		return nil, false, err
@@ -568,6 +583,9 @@ func (cache *Cache) DeleteMany(keys ...string) error {
 		return err
 	}
 
+	cache.entryMu.Lock()
+	defer cache.entryMu.Unlock()
+
 	type entryFileSet struct {
 		jsonPath   string
 		binaryPath string
@@ -646,6 +664,9 @@ func (cache *Cache) keysByPattern(pattern string) ([]string, error) {
 		return nil, err
 	}
 
+	cache.entryMu.RLock()
+	defer cache.entryMu.RUnlock()
+
 	allKeys, err := cache.listJSONKeys()
 	if err != nil {
 		return nil, err

cache_test.go

@@ -2822,6 +2822,154 @@ func TestCache_ThreatTOCTOU_ExpiredGetConcurrentReadersReturnNotFound(t *testing
 	}
 }
 
+func TestCache_ThreatTOCTOU_ConcurrentSetRandomKeysRaceClean(t *testing.T) {
+	c, _ := newTestCache(t, "/tmp/cache-threat-concurrent-random-set", time.Minute)
+
+	const workers = 100
+	keys := make([]string, workers)
+	for i := range workers {
+		keys[i] = "race/random/" + core.Itoa((i*37+11)%workers)
+	}
+
+	start := make(chan struct{})
+	errCh := make(chan string, workers)
+
+	var done sync.WaitGroup
+	done.Add(workers)
+	for i, key := range keys {
+		go func(value int, key string) {
+			defer done.Done()
+			<-start
+			if err := c.Set(key, map[string]int{"writer": value}); err != nil {
+				errCh <- err.Error()
+			}
+		}(i, key)
+	}
+
+	close(start)
+	done.Wait()
+	close(errCh)
+
+	for msg := range errCh {
+		t.Error(msg)
+	}
+
+	foundCount := 0
+	for i, key := range keys {
+		var got map[string]int
+		found, err := c.Get(key, &got)
+		if err != nil {
+			t.Fatalf("Get %q failed: %v", key, err)
+		}
+		if !found {
+			continue
+		}
+		foundCount++
+		if got["writer"] != i {
+			t.Fatalf("expected %q writer %d, got %d", key, i, got["writer"])
+		}
+	}
+	if foundCount != workers {
+		t.Fatalf("expected %d entries after concurrent Set calls, got %d", workers, foundCount)
+	}
+}
+
+func TestCache_ThreatTOCTOU_ConcurrentSetSameKeyRaceClean(t *testing.T) {
+	c, _ := newTestCache(t, "/tmp/cache-threat-concurrent-same-set", time.Minute)
+
+	const workers = 100
+	written := make(map[int]struct{}, workers)
+	for i := range workers {
+		written[i] = struct{}{}
+	}
+
+	start := make(chan struct{})
+	errCh := make(chan string, workers)
+
+	var done sync.WaitGroup
+	done.Add(workers)
+	for i := range workers {
+		go func(value int) {
+			defer done.Done()
+			<-start
+			if err := c.Set("race/same", map[string]int{"writer": value}); err != nil {
+				errCh <- err.Error()
+			}
+		}(i)
+	}
+
+	close(start)
+	done.Wait()
+	close(errCh)
+
+	for msg := range errCh {
+		t.Error(msg)
+	}
+
+	var got map[string]int
+	found, err := c.Get("race/same", &got)
+	if err != nil {
+		t.Fatalf("final Get failed: %v", err)
+	}
+	if !found {
+		t.Fatal("expected final cache entry to exist")
+	}
+	if _, ok := written[got["writer"]]; !ok {
+		t.Fatalf("final writer %d was not one of the concurrent writers", got["writer"])
+	}
+}
+
+func TestCache_ThreatTOCTOU_ConcurrentGetSetDeleteSameKeyRaceClean(t *testing.T) {
+	c, _ := newTestCache(t, "/tmp/cache-threat-concurrent-mixed", time.Minute)
+	if err := c.Set("race/mixed", map[string]int{"writer": -1}); err != nil {
+		t.Fatalf("initial Set failed: %v", err)
+	}
+
+	const workers = 100
+	const operations = 10
+	start := make(chan struct{})
+	errCh := make(chan string, workers*operations)
+
+	var done sync.WaitGroup
+	done.Add(workers)
+	for i := range workers {
+		go func(value int) {
+			defer done.Done()
+			<-start
+			for op := range operations {
+				switch (value + op) % 3 {
+				case 0:
+					var got map[string]int
+					found, err := c.Get("race/mixed", &got)
+					if err != nil {
+						errCh <- err.Error()
+						continue
+					}
+					if found && (got["writer"] < -1 || got["writer"] >= workers) {
+						errCh <- "Get returned a writer outside the written range"
+					}
+				case 1:
+					if err := c.Set("race/mixed", map[string]int{"writer": value}); err != nil {
+						errCh <- err.Error()
+					}
+				default:
+					if err := c.Delete("race/mixed"); err != nil {
+						errCh <- err.Error()
+					}
+				}
+			}
+		}(i)
+	}
+
+	close(start)
+	done.Wait()
+	close(errCh)
+
+	for msg := range errCh {
+		t.Error(msg)
+	}
+}
+
 func TestCache_ThreatTOCTOU_GetThenSetSerializesEntryWrites(t *testing.T) {
 	medium := &raceProbeMedium{MockMedium: coreio.NewMockMedium()}
 	c, err := cache.New(medium, "/tmp/cache-threat-toctou", time.Minute)