Fix AB-BA context/TestAccess lock deadlock in reduceHierarchy

[mansbernhardt]

Summary

AnyContext.reduce — the core of reduceHierarchy/mapHierarchy, and the path every @EnvironmentStorage read walks to resolve a value up the ancestor chain — acquired the TestAccess lock while already holding the context (hierarchy) lock, inverting the TestAccess → context lock order that Context._modify / Context.transaction enforce. That AB-BA inversion deadlocks a concurrent writer against a parent-observation traversal, so settle() / expect() hang (never reach a fixpoint).

The registration ran inside lock(observedParents):

parents = lock(observedParents)   // observedParents = { willAccessParents(); weakParents.compactMap(\.parent) }

willAccessParents() → TestAccess.willAccess → registerReadOnlyPathWake takes the TestAccess lock. The fix hoists it out of the lock:

willAccessParents()
parents = lock { weakParents.compactMap(\.parent) }

How it was found

Surfaced as a 100% hang in a downstream suite (ParallelEditorTests) after bumping to 1.0.5, whose concurrent swift-model.test-drain.shared queue runs two models' activation in parallel and exposed the latent inversion. Root-caused with lldb (process attach + thread backtrace all) on the wedged process:

Thread	Holds	Wants	Path
writer	TestAccess.lock (acquireWriteLock)	context.lock	Context._modify of a property
traversal	context.lock (lock(observedParents))	TestAccess.lock	environmentValue → reduceHierarchy(observeParents:) → observedParents → willAccessParents() → TestAccess.willAccess → registerReadOnlyPathWake

registerReadOnlyPathWake's own comment documents the opposite ("context → TestAccess") order — the two subsystems disagreed on lock order.

Audit for sibling inversions

Checked every willAccess* synthetic-path site that takes the TestAccess lock (via registerReadOnlyPathWake):

• parents (reduce) — the inversion, fixed here.
• storage (AnyContext[storage] getter + environmentValue traversal) — already registers observation before/outside the lock.
• preference (AnyContext[preference] getter + preferenceValue traversal) — already outside the lock, and already carries explicit deadlock-avoidance comments for this exact "TestAccess lock held on another thread" hazard (isApplyingSnapshot guard, post-traversal willAccessPreferenceValue).

So the parents-in-reduce path was the unique remaining inversion.

Verification

• Downstream ParallelEditorTests: 504/504 pass, no hang (was a 100% wedge under the 1.0.5 bump).
• Full swift-model suite: 819 tests, no regression — the only failure is a pre-existing load-induced ClockTests.testImmediateClock flake that passes in 0.045s in isolation on main as well.
• Added HierarchyLockOrderDeadlockTests — a concurrency smoke test that drives the exact code path (concurrent deep environment-read traversals + Context._modify writes). Its file header documents honestly why a deterministic minimal repro isn't feasible (the window is too narrow synthetically, and TestAccess's locks can't be hooked to force the interleaving without adding production test seams); the authoritative reproduction is the downstream editor suite.

Locking-discipline change only — no behavior change, and a no-op outside .modelTesting.

🤖 Generated with Claude Code