fix: close coverage evidence races

scripts/lib/risk-coverage.ts

@@ -96,6 +96,8 @@ type InventoryOptions = Readonly<{
   openFile?: (target: string, flags: number) => Promise<ReadableFileHandle>;
 }>;
 
+class FileIdentityChangedError extends Error {}
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -327,6 +329,22 @@ function isWithin(root: string, target: string): boolean {
   );
 }
 
+function hasStableIdentity(metadata: Stats): boolean {
+  return (
+    Number.isSafeInteger(metadata.dev) &&
+    Number.isSafeInteger(metadata.ino) &&
+    (metadata.dev !== 0 || metadata.ino !== 0)
+  );
+}
+
+function sameFileIdentity(before: Stats, after: Stats): boolean {
+  return (
+    !hasStableIdentity(before) ||
+    !hasStableIdentity(after) ||
+    (before.dev === after.dev && before.ino === after.ino)
+  );
+}
+
 export function isProductionModulePath(relativePath: string): boolean {
   return (
     /\.tsx?$/u.test(relativePath) &&
@@ -394,7 +412,16 @@ export async function buildProductionModuleInventory(
         if (!openedMetadata.isFile()) {
           throw new TypeError("opened target is not a regular file");
         }
+        if (!sameFileIdentity(metadata, openedMetadata)) {
+          throw new FileIdentityChangedError("opened file identity changed");
+        }
       } catch (error) {
+        if (error instanceof FileIdentityChangedError) {
+          throw new Error(
+            `production inventory file changed during validation: ${relativeTarget}`,
+            { cause: error },
+          );
+        }
         throw new Error(`production inventory file is unreadable: ${relativeTarget}`, {
           cause: error,
         });