From 23f4b48537482384d726a745ca697207a1df3f55 Mon Sep 17 00:00:00 2001
From: Mitko Vasilev <43349905+mitkox@users.noreply.github.com>
Date: Mon, 5 Oct 2026 22:16:58 +0300
Subject: [PATCH 1/2] ci: report agent updates without failing

---
 scripts/check-agent-updates.py | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/scripts/check-agent-updates.py b/scripts/check-agent-updates.py
index 811fece..a50b1b7 100644
--- a/scripts/check-agent-updates.py
+++ b/scripts/check-agent-updates.py
@@ -1,7 +1,8 @@
 #!/usr/bin/env python3
-"""Report upstream agent releases that need a separate compatibility review."""
+"""Report upstream agent releases needing compatibility review as warnings."""
 
 import json
+import os
 from pathlib import Path
 import sys
 from urllib.request import Request, urlopen
@@ -28,8 +29,18 @@ def main():
         if version != pinned[agent]:
             changed = True
     if changed:
-        print("A compatibility-sensitive agent update needs qualification and new hashes.", file=sys.stderr)
-        return 1
+        message = (
+            "An upstream agent release needs compatibility review and new hashes; "
+            "qualified pins were left unchanged. See the step log for version details."
+        )
+        print(f"::warning title=Agent update needs qualification::{message}")
+        summary_path = os.environ.get("GITHUB_STEP_SUMMARY")
+        if summary_path:
+            with open(summary_path, "a", encoding="utf-8") as summary:
+                summary.write(
+                    "### Agent update needs qualification\n\n"
+                    f"{message}\n"
+                )
     return 0
 
 

From 759e718355c10674a28f948802f49005de080576 Mon Sep 17 00:00:00 2001
From: Mitko Vasilev <43349905+mitkox@users.noreply.github.com>
Date: Mon, 5 Oct 2026 22:42:40 +0300
Subject: [PATCH 2/2] fix: retry transient change lock open errors

---
 internal/factory/change.go | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/internal/factory/change.go b/internal/factory/change.go
index a922ec9..85c57a7 100644
--- a/internal/factory/change.go
+++ b/internal/factory/change.go
@@ -206,7 +206,16 @@ func (s *ChangeStore) lockChange(changeID string) (func(), error) {
 		return nil, err
 	}
 	defer root.Close()
-	lock, err := root.OpenFile(changeID+".lock", os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+	var lock *os.File
+	for attempt := 0; ; attempt++ {
+		lock, err = root.OpenFile(changeID+".lock", os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+		if err == nil || !errors.Is(err, os.ErrNotExist) || attempt == 4 {
+			break
+		}
+		// Concurrent first opens can briefly see ENOENT on macOS while another
+		// worker creates the lock file. Retry only that transient condition.
+		time.Sleep(time.Duration(attempt+1) * time.Millisecond)
+	}
 	if err != nil {
 		return nil, err
 	}