#22955 cmux NEXT: acpmux checked line never blocks main behind a socket send; lint dlopen and whole-file signature checks

Split from #22814: the parts that need no person. The acpmux trust cache and the updater rollback stay in #22814, which waits for an approving review.

• Cross-process timeout (class 4): AcpmuxCheckedLine.personProof has main-actor callers (AcpmuxPersonLine, AcpmuxPermissionFeedBridge, MobileHostApproverSync). It read its state with queue.sync on the queue that does a blocking send with no send timeout, so if acpmux stopped reading, the main thread waited forever. It now reads an atomic, and the socket has SO_SNDTIMEO 5 s. A peer that stops reading ends the connection.
• Lint (class 1): check-concurrency.sh requires a reviewed // concurrency-allow: for dlopen( and SecStaticCodeCheckValidity(.
  • dlopen holds dyld's loader lock, and every main-thread dlopen or dladdr waits on it, even when the load runs on another thread. This caused the CEF launch hang fixed in #22813.
  • Static signature validation hashes the whole file.
  • Each existing site states its thread. The two real main-thread sites (AcpmuxServerPeer.swift and UpdateDropBack.swift) are KNOWN pending entries that #22814 removes.
  • SimulatorKitRuntime is a KNOWN one-time stall at the first live simulator screen.

The review findings from #22814 apply here: the regex catches Darwin.dlopen and dlopen (, and the CEF allow reasons name the dead startBlocking path.

Changelog

none

Observed / Not run

• Observed: check-concurrency ok; prepush-gate no new violations; cmux-ci step (see comment) compiles CmuxNext with tests and runs AcpmuxLaunchSecurityTests and AcpmuxRefusedDaemonTests. The same AcpmuxCheckedLine change passed step 3376fe7661a1 inside #22814.
• Not run: a live acpmux peer that stops reading.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Prevents AcpmuxCheckedLine.personProof from blocking the main thread behind a socket send: it read its state with queue.sync on a queue whose blocking send had no timeout, so a peer that stopped reading hung the main thread forever. It now reads an atomic, and the socket has SO_SNDTIMEO 5 s, so a stalled peer ends the connection. check-concurrency.sh now also requires a reviewed // concurrency-allow: comment for dlopen( and SecStaticCodeCheckValidity(.

Lint

• dlopen holds dyld's loader lock; every main-thread dlopen or dladdr waits on it even when the load runs on another thread. This caused the CEF launch hang fixed in #22813.
• SecStaticCodeCheckValidity hashes the whole file, so it must never run on the main thread.
• Existing sites now name their thread; the two main-thread sites are KNOWN pending entries that #22814 removes.