The desired set (assignment lock) and the worker map (workerAccess)
were updated in separate critical sections, so a concurrent resync
could observe one but not the other: the same busid ended up with two
workers (leaking the first cancel), and stop decisions ran against
half-applied state. allWorkers is now the single source of truth,
diffed, started, and stopped in one workerAccess section; workers
remove themselves on exit with an identity check and restart in place
if their busid became desired again meanwhile.
The per-busid active flag also became a count: during matched-mode
handoff two workers briefly reference one busid, and a failing worker's
deactivation must not erase the mark of the genuinely attached one
(which made ApplyAll detach live devices, oscillating).
世界
badd50f511