src/server/server.c

@@ -231,7 +231,7 @@ static bool configure_authorization(const char* root) {
     return false;
   }
   if (!utils_set_authorized_root(root_fd, resolved)) {
-    utils_set_authorized_root(-1, NULL);
+    /* The setter already cleared the fd/path state on allocation failure. */
     close(root_fd);
     return false;
   }

src/shared/utils.c

@@ -36,6 +36,9 @@ void utils_set_authorized_root_fd(int fd) {
   (void)utils_set_authorized_root(fd, NULL);
 }
 
+/* Accessors for the process-global authorized root.  The path pointer is
+ * borrowed and valid until the next setter call; the root is a single-threaded,
+ * set-before-worker-threads value (see server.c), so these carry no locking. */
 int utils_get_authorized_root_fd(void) {
   return authorized_root_fd;
 }

src/shared/utils.h

@@ -131,7 +131,15 @@ void utils_set_authorized_root_fd(int fd);
  * site consumes the single shared state instead of keeping its own copy.  The
  * fd is caller-owned (see the setters): it is returned verbatim, never dup'd,
  * and the caller that opened it is responsible for closing it.  With no root
- * configured the fd accessor returns -1 and the path accessor returns NULL. */
+ * configured the fd accessor returns -1 and the path accessor returns NULL.
+ *
+ * The pointer returned by utils_get_authorized_root_path() is borrowed into
+ * process-global state and is invalidated by the next
+ * utils_set_authorized_root() / utils_set_authorized_root_fd() call.  The fd
+ * and path are stored separately and read independently, so the pair is NOT
+ * observed atomically together; the accessors are non-reentrant and callers
+ * must serialize configuration (the server installs the root before any worker
+ * threads spawn; see utils.c). */
 int utils_get_authorized_root_fd(void);
 const char* utils_get_authorized_root_path(void);
 /* True when `path` is `root` itself or lies directly beneath it: a lexical