The second watcher that never started
A silent host-sleep protection gap surfaces when two devcontainers run at once, traced to a lock file scoped by project instead of by workspace, and fixed by mirroring a sibling repository that had already solved it.
The devcontainer runs a small host-side script, keep-awake.sh, that keeps the Mac from sleeping while the container is up, so a long agent run does not stall mid-task. It guards against stacking up duplicate watchers across rebuilds with a lock file, and that lock file’s name was static: the same path every time, regardless of which project or worktree started it. Running a second devcontainer on the same host, whether a second worktree of this repository or the separate blog repository’s own devcontainer, meant the second one found the lock already held and exited immediately. No error, no warning, just a watcher that silently never started while its container ran unprotected.
The gap turned up during a live audit comparing this repository’s .devcontainer/ directory against the blog repository’s, and the blog repository’s copy of the same script had already solved it: a workspace hash, derived by hashing the workspace folder path, scoped into the lock filename so two projects (or two worktrees of one project) can never collide. Porting that exact approach back, same hashing algorithm, same sixteen-character prefix, closed the gap here too:
WORKSPACE_HASH=$(printf '%s' "$WORKSPACE_FOLDER" | shasum -a 256 | cut -c1-16)
LOCK_FILE="/tmp/keep-awake-${WORKSPACE_HASH}.pid"The fix reached one path further than its source did. The blog repository’s log redirect never needed the same scoping, since its log filename was already repository-specific. This repository’s was not, so the same workspace hash extended into devcontainer.json’s log path as well, closing a second, quieter version of the same collision that would otherwise have kept the wrong container’s watcher logging over the other’s.
Porting the fix rather than sharing the script was a deliberate choice. The two copies of keep-awake.sh are hand-synced across the two repositories, which is exactly how this collision was noticed in the first place, a manual diff catching a fix one side had and the other did not. Extracting a shared script across two independent repositories was ruled out as a larger architectural question than the bug at hand; a cross-reference comment pointing at the sibling copy is the insurance against the next drift instead, cheap enough to write and cheap enough to keep reading on the next audit.