Run the Cross-Process Lock Test on Every Platform

The test that checks the guard yields to a lock held elsewhere forked a child to hold it, so it was left out on Windows. The OS lock belongs to the handle on Windows and to the open file description elsewhere, so a second handle in the same process is refused like another instance would be. The test now holds the lock that way and runs everywhere.
Lock Config and Preset Files Across Instances and Write Them Atomically
2026-10-03 22:01:03 +00:00 · 2026-10-01 15:00:32 +08:00 · 2026-10-01 15:00:32 +08:00
27 changed files with 1218 additions and 536 deletions
@@ -5,6 +5,7 @@
 //BBS
 #include "Preset.hpp"
 #include "Exception.hpp"
+#include "InstanceLock.hpp"
 #include "LocalesUtils.hpp"
 #include "Thread.hpp"
 #include "format.hpp"
@@ -743,10 +744,13 @@ static bool verify_config_file_checksum(boost::nowide::ifstream &ifs)


 #ifdef USE_JSON_CONFIG
-std::string AppConfig::load()
+std::string AppConfig::load(bool read_only)
 {
    json j;

+    // Keep another instance from replacing or restoring the file mid-read.
+    InstanceLock instance_lock(read_only ? std::string() : lock_path());
+
    // 1) Read the complete config file into a boost::property_tree.
    namespace pt = boost::property_tree;
    pt::ptree tree;
@@ -996,7 +1000,6 @@ void AppConfig::save()
    // The config is first written to a file with a PID suffix and then moved
    // to avoid race conditions with multiple instances of Slic3r
    const auto path = config_path();
-    std::string path_pid = (boost::format("%1%.%2%") % path % get_current_pid()).str();

    json j;

@@ -1126,43 +1129,18 @@ void AppConfig::save()

        j["local_machines"][local_machine.first] = m_json;
    }
-    boost::nowide::ofstream c;
-    c.open(path_pid, std::ios::out | std::ios::trunc);
-    c << j.dump(1, '\t') << std::endl;
-
-#ifdef WIN32
-    // WIN32 specific: The final "rename_file()" call is not safe in case of an application crash, there is no atomic "rename file" API
-    // provided by Windows (sic!). Therefore we save a MD5 checksum to be able to verify file corruption. In addition,
-    // we save the config file into a backup first before moving it to the final destination.
-    c << appconfig_md5_hash_line(j.dump(1, '\t'));
-#endif
-
-    c.close();
-    if (c.fail()) {
-      BOOST_LOG_TRIVIAL(error) << "Failed to write new configuration to " << path_pid << "; aborting attempt to overwrite original configuration";
-      return;
-    }
-
-#ifdef WIN32
-    // Make a backup of the configuration file before copying it to the final destination.
-    std::string error_message;
-    std::string backup_path = (boost::format("%1%.bak") % path).str();
-    // Copy configuration file with PID suffix into the configuration file with "bak" suffix.
-    if (copy_file(path_pid, backup_path, error_message, false) != SUCCESS)
-        BOOST_LOG_TRIVIAL(error) << "Copying from " << path_pid << " to " << backup_path << " failed. Failed to create a backup configuration.";
-#endif
-
-    // Rename the config atomically.
-    // On Windows, the rename is likely NOT atomic, thus it may fail if PrusaSlicer crashes on another thread in the meanwhile.
-    // To cope with that, we already made a backup of the config on Windows.
-    rename_file(path_pid, path);
-    m_dirty = false;
+    const std::string config_str = j.dump(1, '\t');
+    if (write_config_file(path, config_str + "\n", config_str))
+        m_dirty = false;
 }

 #else

-std::string AppConfig::load()
+std::string AppConfig::load(bool read_only)
 {
+    // Keep another instance from replacing or restoring the file mid-read.
+    InstanceLock instance_lock(read_only ? std::string() : lock_path());
+
    // 1) Read the complete config file into a boost::property_tree.
    namespace pt = boost::property_tree;
    pt::ptree tree;
@@ -1300,7 +1278,6 @@ void AppConfig::save()
    // The config is first written to a file with a PID suffix and then moved
    // to avoid race conditions with multiple instances of Slic3r
    const auto path = config_path();
-    std::string path_pid = (boost::format("%1%.%2%") % path % get_current_pid()).str();

    std::stringstream config_ss;
    if (m_mode == EAppMode::Editor)
@@ -1336,39 +1313,39 @@ void AppConfig::save()
    // One empty line before the MD5 sum.
    config_ss << std::endl;

-    std::string config_str = config_ss.str();
-    boost::nowide::ofstream c;
-    c.open(path_pid, std::ios::out | std::ios::trunc);
-    c << config_str;
-#ifdef WIN32
-    // WIN32 specific: The final "rename_file()" call is not safe in case of an application crash, there is no atomic "rename file" API
-    // provided by Windows (sic!). Therefore we save a MD5 checksum to be able to verify file corruption. In addition,
-    // we save the config file into a backup first before moving it to the final destination.
-    c << appconfig_md5_hash_line(config_str);
-#endif
-    c.close();
-    if (c.fail()) {
-      BOOST_LOG_TRIVIAL(error) << "Failed to write new configuration to " << path_pid << "; aborting attempt to overwrite original configuration";
-      return;
-    }
-
-#ifdef WIN32
-    // Make a backup of the configuration file before copying it to the final destination.
-    std::string error_message;
-    std::string backup_path = (boost::format("%1%.bak") % path).str();
-    // Copy configuration file with PID suffix into the configuration file with "bak" suffix.
-    if (copy_file(path_pid, backup_path, error_message, false) != SUCCESS)
-        BOOST_LOG_TRIVIAL(error) << "Copying from " << path_pid << " to " << backup_path << " failed. Failed to create a backup configuration.";
-#endif
-
-    // Rename the config atomically.
-    // On Windows, the rename is likely NOT atomic, thus it may fail if PrusaSlicer crashes on another thread in the meanwhile.
-    // To cope with that, we already made a backup of the config on Windows.
-    rename_file(path_pid, path);
-    m_dirty = false;
+    const std::string config_str = config_ss.str();
+    if (write_config_file(path, config_str, config_str))
+        m_dirty = false;
 }
 #endif

+bool AppConfig::write_config_file(const std::string &path, std::string body, const std::string &checksum_source)
+{
+    // Everything before this is assembly; only the writes need the other instances kept out.
+    InstanceLock instance_lock(lock_path());
+#ifdef WIN32
+    // WIN32 specific: the final replace is not safe in case of an application crash, there is no atomic "rename file" API
+    // provided by Windows (sic!). Therefore we save a MD5 checksum to be able to verify file corruption. In addition,
+    // we save the config file into a backup first before moving it to the final destination.
+    body += appconfig_md5_hash_line(checksum_source);
+#endif
+    // Not flushed to the device: the idle handler saves on the GUI thread after
+    // any change, and the rename already gives a complete old or new file.
+    if (const std::error_code ec = write_file_atomically(path, body)) {
+        BOOST_LOG_TRIVIAL(error) << "Failed to write the configuration " << path << ": " << ec.message() << "; trying again in 10 s";
+        m_retry_save_at = std::chrono::steady_clock::now() + std::chrono::seconds(10);
+        return false;
+    }
+    m_retry_save_at = {};
+#ifdef WIN32
+    // Written after the config, so the backup never holds a state that was not confirmed written.
+    const std::string backup_path = (boost::format("%1%.bak") % path).str();
+    if (const std::error_code ec = write_file_atomically(backup_path, body))
+        BOOST_LOG_TRIVIAL(error) << "Failed to write the backup configuration " << backup_path << ": " << ec.message();
+#endif
+    return true;
+}
+
 bool AppConfig::get_variant(const std::string &vendor, const std::string &model, const std::string &variant) const
 {
    const auto it_v = m_vendors.find(vendor);
@@ -1857,6 +1834,11 @@ void AppConfig::reset_selections()
    }
 }

+std::string AppConfig::lock_path()
+{
+    return Slic3r::data_dir().empty() ? std::string() : config_path() + ".lock";
+}
+
 std::string AppConfig::config_path()
 {
 #ifdef USE_JSON_CONFIG
@@ -1893,7 +1875,7 @@ bool AppConfig::exists()

 std::string AppConfig::load_if_exists()
 {
-    return boost::filesystem::exists(loading_path()) ? load() : std::string();
+    return boost::filesystem::exists(loading_path()) ? load(/*read_only=*/true) : std::string();
 }

 }; // namespace Slic3r
@@ -2,6 +2,7 @@
 #define slic3r_AppConfig_hpp_

 #include <set>
+#include <chrono>
 #include <map>
 #include <string>
 #include "nlohmann/json.hpp"
@@ -122,14 +123,18 @@ public:

 	// Load the slic3r.ini from a user profile directory (or a datadir, if configured).
 	// Return an error string, or an empty string on success.
-	std::string         load();
+	std::string         load(bool read_only = false);
 	// Treat a missing config as default state; otherwise load it normally.
+	// The CLI's load: it never saves, so it takes no lock and creates no lock file.
 	std::string         load_if_exists();
 	// Store the slic3r.ini into a user profile directory (or a datadir, if configured).
 	void 			   	save();

 	// Does this config need to be saved?
 	bool 				dirty() const { return m_dirty; }
+	// False for ten seconds after a failed write, so the idle handler does not
+	// repeat a hopeless attempt on every event; an explicit save() always tries.
+	bool 				save_due() const { return std::chrono::steady_clock::now() >= m_retry_save_at; }


 	void				set_dirty() { m_dirty = true; }
@@ -339,6 +344,8 @@ public:

 	// Get the default config path from Slic3r::data_dir().
 	std::string			config_path();
+	// Lock file guarding config_path() against other running instances; empty without a data dir.
+	std::string			lock_path();

 	// Returns true if the user's data directory comes from before Slic3r 1.40.0 (no updating)
 	bool 				legacy_datadir() const { return m_legacy_datadir; }
@@ -449,8 +456,16 @@ private:

 	// Preset for each machine
 	MachineSettingMap											m_printer_settings;
+	// Writes the assembled config text, and on Windows its checksum and a backup copy; false when the
+	// config itself could not be written, in which case the caller stays dirty and retries. `checksum_source`
+	// is the text load() will verify, which for the JSON config ends before the trailing newline.
+	bool												write_config_file(const std::string &path, std::string body, const std::string &checksum_source);
+
 	// Has any value been modified since the config.ini has been last saved or loaded?
 	bool														m_dirty;
+	// After a failed write, save_due() is false for the next ten seconds, so the
+	// idle handler does not repeat a hopeless write on every event.
+	std::chrono::steady_clock::time_point						m_retry_save_at{};
 	// Original version found in the ini file before it was overwritten
 	Semver                                                      m_orig_version;
 	// Whether the existing version is before system profiles & configuration updating
@@ -306,6 +306,8 @@ set(lisbslic3r_sources
    Geometry/VoronoiUtils.cpp
    Geometry/VoronoiUtils.hpp
    Geometry/VoronoiVisualUtils.hpp
+    InstanceLock.cpp
+    InstanceLock.hpp
    Int128.hpp
    KDTreeIndirect.hpp
    Layer.cpp
@@ -873,10 +873,10 @@ int ConfigBase::load_from_json(const std::string &file, ConfigSubstitutionContex

    CNumericLocalesSetter locales_setter;

-    std::function<bool(const json&, const char,const char,const bool,std::string&)> parse_str_arr = [&parse_str_arr](const json& arr, const char single_sep,const char array_sep,const bool escape_string_style,std::string& value_str)->bool {
+    std::function<bool(const json::const_iterator&, const char,const char,const bool,std::string&)> parse_str_arr = [&parse_str_arr](const json::const_iterator& it, const char single_sep,const char array_sep,const bool escape_string_style,std::string& value_str)->bool {
        // must have consistent type name
        std::string consistent_type;
-        for (auto iter = arr.begin(); iter != arr.end(); ++iter) {
+        for (auto iter = it.value().begin(); iter != it.value().end(); ++iter) {
            if (consistent_type.empty())
                consistent_type = iter.value().type_name();
            else {
@@ -886,13 +886,13 @@ int ConfigBase::load_from_json(const std::string &file, ConfigSubstitutionContex
        }

        bool first = true;
-        for (auto iter = arr.begin(); iter != arr.end(); iter++) {
+        for (auto iter = it.value().begin(); iter != it.value().end(); iter++) {
            if (iter.value().is_array()) {
                if (!first)
                    value_str += array_sep;
                else
                    first = false;
-                bool success = parse_str_arr(iter.value(), single_sep, array_sep,escape_string_style, value_str);
+                bool success = parse_str_arr(iter, single_sep, array_sep,escape_string_style, value_str);
                if (!success)
                    return false;
            }
@@ -1038,39 +1038,8 @@ int ConfigBase::load_from_json(const std::string &file, ConfigSubstitutionContex
                        }
                    }

-                    // BambuStudio and its forks save a nozzle variant that matches the parent preset as "nil".
-                    // An option that can't hold nil gets its default in that slot, and the slot is reported so
-                    // the merge onto the parent keeps the parent's value. All slots nil means the key is not set.
-                    const json *values = &it.value();
-                    json values_with_defaults;
-                    if (substitution_context.accept_nil && optdef && !optdef->nullable && optdef->default_value &&
-                        (optdef->type == coFloats || optdef->type == coPercents || optdef->type == coFloatsOrPercents ||
-                         optdef->type == coInts || optdef->type == coEnums || optdef->type == coBools)) {
-                        auto is_nil = [](const json &v) { return v.is_string() && v.get<std::string>() == "nil"; };
-                        std::vector<size_t> nil_slots;
-                        for (size_t i = 0; i < values->size(); ++i)
-                            if (is_nil((*values)[i]))
-                                nil_slots.push_back(i);
-                        if (!nil_slots.empty()) {
-                            BOOST_LOG_TRIVIAL(warning) << __FUNCTION__ << ": " << file << ": " << it.key() << " is nil in "
-                                                       << nil_slots.size() << " of " << values->size()
-                                                       << " slots, read as not set (the parent preset's value, or the default)";
-                            if (nil_slots.size() == values->size())
-                                continue;
-                            // create_default_option() gives enums their names, which vserialize() needs.
-                            std::unique_ptr<ConfigOption> default_option(optdef->create_default_option());
-                            const std::vector<std::string> defaults = static_cast<const ConfigOptionVectorBase*>(default_option.get())->vserialize();
-                            values_with_defaults = *values;
-                            const json first_value = *std::find_if_not(values->begin(), values->end(), is_nil);
-                            for (size_t i : nil_slots)
-                                values_with_defaults[i] = defaults.empty() ? first_value : json(defaults[i % defaults.size()]);
-                            values = &values_with_defaults;
-                            substitution_context.nil_slots[opt_key] = std::move(nil_slots);
-                        }
-                    }
-
                    // BBS: we only support 2 depth array
-                    valid = parse_str_arr(*values, single_sep, array_sep,escape_string_type, value_str);
+                    valid = parse_str_arr(it, single_sep, array_sep,escape_string_type, value_str);
                    if (!valid) {
                        BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << ": parse " << file << " error, invalid json array for " << it.key();
                        break;
@@ -1569,12 +1538,10 @@ void ConfigBase::save_to_json(const std::string &file, const std::string &name,
    // Serialize first: if that throws (invalid UTF-8), the existing file stays untouched.
    std::ostringstream ss;
    this->save_to_json(ss, name, from, version);
-    boost::nowide::ofstream c;
-    c.open(file, std::ios::out | std::ios::trunc);
-    c << ss.str();
-    c.close();
-
-    BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << ":" <<__LINE__ << boost::format(", saved config to %1%\n")%file;
+    if (const std::error_code ec = write_file_atomically(file, ss.str()))
+        BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << boost::format(": failed to save config to %1%: %2%") % file % ec.message();
+    else
+        BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << ":" <<__LINE__ << boost::format(", saved config to %1%\n")%file;
 }

 void ConfigBase::save_to_json(std::ostream &os, const std::string &name, const std::string &from, const std::string &version, bool replace_invalid_utf8) const
@@ -267,11 +267,6 @@ struct ConfigSubstitutionContext
    ForwardCompatibilitySubstitutionRule 	rule;
    ConfigSubstitutions					    substitutions;
    std::vector<std::string>                unrecogized_keys;
-    // Read "nil" in an option that can't hold it as not set instead of failing. Set by callers that hand
-    // nil_slots to the merge onto the parent preset, or for which the option default is the right fallback.
-    bool                                    accept_nil = false;
-    // Slots of options that can't hold nil but were "nil" in the file; they hold the option default.
-    std::map<std::string, std::vector<size_t>> nil_slots;
 };

 // A generic value of a configuration option.
@@ -2696,8 +2696,6 @@ void PlateData::parse_filament_info(GCodeProcessorResult *result)
            }
            std::map<std::string, std::string> key_values;
            std::string reason;
-            // No parent preset here: a nil slot keeps the option default.
-            config_substitutions.accept_nil = true;
            int ret = config.load_from_json(dest_file, config_substitutions, true, key_values, reason);
            if (ret) {
                add_error("Error load config from json:"+reason);
@@ -2738,13 +2736,7 @@ void PlateData::parse_filament_info(GCodeProcessorResult *result)
            //ConfigSubstitutions config_substitutions = config.load_from_ini(dest_file, Enable);
            std::map<std::string, std::string> key_values;
            std::string reason;
-            ConfigSubstitutionContext load_context(Enable);
-            load_context.accept_nil = true;
-            if (use_json)
-                config.load_from_json(dest_file, load_context, true, key_values, reason);
-            else
-                load_context.substitutions = config.load_from_ini(dest_file, Enable);
-            ConfigSubstitutions config_substitutions = std::move(load_context.substitutions);
+            ConfigSubstitutions config_substitutions = use_json? config.load_from_json(dest_file, Enable, key_values, reason) : config.load_from_ini(dest_file, Enable);
            if (!reason.empty()) {
                BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << boost::format(", load project embedded config from  %1% failed\n") % dest_file;
                //skip this file
@@ -2793,7 +2785,6 @@ void PlateData::parse_filament_info(GCodeProcessorResult *result)
            preset->is_project_embedded = true;
            preset->is_external = true;
            preset->is_dirty = false;
-            preset->nil_slots = std::move(load_context.nil_slots);

            std::string version_str = key_values[BBL_JSON_KEY_VERSION];
            boost::optional<Semver> version = Semver::parse(version_str);
@@ -0,0 +1,165 @@
+#include "InstanceLock.hpp"
+
+#include <map>
+#include <memory>
+#include <system_error>
+#include <thread>
+
+#include <boost/filesystem.hpp>
+#include <boost/log/trivial.hpp>
+#include <boost/nowide/fstream.hpp>
+#ifdef _WIN32
+#include <boost/interprocess/sync/file_lock.hpp>
+#include <boost/nowide/convert.hpp>
+#else
+#include <cerrno>
+#include <fcntl.h>
+#include <sys/file.h>
+#include <unistd.h>
+#endif
+
+namespace Slic3r {
+
+#ifdef _WIN32
+// LockFileEx, held by this handle alone.
+using NativeFileLock = boost::interprocess::file_lock;
+#else
+// flock(2) rather than an fcntl lock: it belongs to this open file description,
+// so any other code in the process that opens and closes the lock file, as a
+// backup or an export walking the data dir might, cannot drop it. An fcntl
+// lock would go with the first such close.
+class NativeFileLock
+{
+public:
+    explicit NativeFileLock(const char *path) : m_fd(::open(path, O_RDWR | O_CREAT | O_CLOEXEC, 0644))
+    {
+        if (m_fd < 0)
+            throw std::system_error(errno, std::generic_category(), path);
+    }
+    ~NativeFileLock() { ::close(m_fd); }
+    bool try_lock()
+    {
+        if (::flock(m_fd, LOCK_EX | LOCK_NB) == 0)
+            return true;
+        // A signal (a child exiting, for one) interrupts the call like any other; the caller polls again.
+        if (errno == EWOULDBLOCK || errno == EINTR)
+            return false;
+        throw std::system_error(errno, std::generic_category(), "flock");
+    }
+    void unlock() { ::flock(m_fd, LOCK_UN); }
+private:
+    int m_fd;
+};
+#endif
+
+// One slot per lock file, shared by every guard in the process: one lock
+// object per path behind a mutex is what makes the guard re-entrant and safe
+// to use from the preset sync thread and the GUI thread at once. The lock
+// file is opened by the outermost guard and closed when it goes, so the file
+// is never held open between guards: whatever is at the path is what gets
+// locked, and a data dir can be removed once nothing is saving into it. The
+// file is kept rather than deleted on release because the lock state lives in
+// the kernel on the open file, and deleting it would let a third instance
+// lock a fresh file while the second still holds the old one.
+struct InstanceLock::Slot
+{
+    std::recursive_mutex mutex;
+    // Non-null exactly while this process holds the file lock.
+    std::unique_ptr<NativeFileLock> file_lock;
+    int  depth{0};
+    // Until this point, after a guard could not open, lock or wait out the
+    // file, guards do not touch it.
+    std::chrono::steady_clock::time_point cooldown_until{};
+};
+
+InstanceLock::Slot &InstanceLock::slot_for(const std::string &lock_file_path)
+{
+    // Never freed: a save during static destruction still needs its slot.
+    static auto *registry_mutex = new std::mutex();
+    static auto *registry       = new std::map<std::string, std::unique_ptr<Slot>>();
+
+    std::lock_guard<std::mutex> guard(*registry_mutex);
+    std::unique_ptr<Slot> &slot = (*registry)[lock_file_path];
+    if (! slot)
+        slot = std::make_unique<Slot>();
+    return *slot;
+}
+
+// Starts the cool-down. Called with the slot mutex held.
+void InstanceLock::defer(Slot &slot, const std::string &reason)
+{
+    slot.cooldown_until = std::chrono::steady_clock::now() + cooldown;
+    BOOST_LOG_TRIVIAL(warning) << reason << "; proceeding without the lock for the next " << cooldown.count() << " ms";
+}
+
+// Creates the lock file if needed and opens it, or starts the cool-down.
+// Called with the slot mutex held.
+bool InstanceLock::open_lock_file(Slot &slot, const std::string &lock_file_path)
+{
+    try {
+#ifdef _WIN32
+        // The lock opens an existing file; created once, on the first miss.
+        const std::wstring wide_path = boost::nowide::widen(lock_file_path);
+        try {
+            slot.file_lock = std::make_unique<NativeFileLock>(wide_path.c_str());
+        } catch (const std::exception &) {
+            boost::nowide::ofstream(lock_file_path, std::ios::app).close();
+            slot.file_lock = std::make_unique<NativeFileLock>(wide_path.c_str());
+        }
+#else
+        slot.file_lock = std::make_unique<NativeFileLock>(lock_file_path.c_str());
+#endif
+        return true;
+    } catch (const std::exception &e) {
+        defer(slot, "Cannot open lock file " + lock_file_path + ": " + e.what() + " (check its owner and permissions)");
+        return false;
+    }
+}
+
+InstanceLock::InstanceLock(const std::string &lock_file_path, std::chrono::milliseconds timeout)
+{
+    if (lock_file_path.empty())
+        return;
+    m_slot       = &slot_for(lock_file_path);
+    m_slot_guard = std::unique_lock<std::recursive_mutex>(m_slot->mutex);
+    const auto now = std::chrono::steady_clock::now();
+    if (m_slot->depth == 0 && now >= m_slot->cooldown_until && open_lock_file(*m_slot, lock_file_path)) {
+        const auto deadline = now + timeout;
+        bool       taken    = false;
+        for (;;) {
+            try {
+                if ((taken = m_slot->file_lock->try_lock()))
+                    break;
+            } catch (const std::exception &e) {
+                defer(*m_slot, "Cannot lock " + lock_file_path + ": " + e.what());
+                break;
+            }
+            if (std::chrono::steady_clock::now() >= deadline) {
+                defer(*m_slot, "Another instance has held " + lock_file_path + " for over " + std::to_string(timeout.count()) + " ms");
+                break;
+            }
+            std::this_thread::sleep_for(std::chrono::milliseconds(5));
+        }
+        if (! taken)
+            m_slot->file_lock.reset();
+    }
+    // Counted last, so a throw above leaves the slot exactly as it was found.
+    ++ m_slot->depth;
+    m_locked = m_slot->file_lock != nullptr;
+}
+
+InstanceLock::~InstanceLock()
+{
+    if (m_slot == nullptr)
+        return;
+    if (-- m_slot->depth == 0 && m_slot->file_lock) {
+        try {
+            m_slot->file_lock->unlock();
+        } catch (const std::exception &e) {
+            BOOST_LOG_TRIVIAL(warning) << "Cannot unlock instance lock: " << e.what();
+        }
+        m_slot->file_lock.reset();
+    }
+}
+
+} // namespace Slic3r
@@ -0,0 +1,60 @@
+#pragma once
+
+#include <chrono>
+#include <mutex>
+#include <string>
+
+namespace Slic3r {
+
+// Scoped write lock on a file shared by every running instance of the
+// application, such as the app config or the user preset directory: threads
+// of this process are serialised through a recursive mutex, other processes
+// through an advisory OS file lock on `lock_file_path`. The lock file is
+// created on first use and kept; the OS releases the lock when its holder
+// exits, so a crashed instance never leaves a stale lock behind.
+//
+// Best effort: when the lock file cannot be opened or locked, or another
+// instance still holds it after `timeout`, the guard keeps only the in-process
+// mutex, locked() reports false and the write proceeds, since a hung instance
+// must never block another one from saving. For `cooldown` afterwards guards
+// leave the file alone. The wait for the in-process mutex is bounded only by
+// the longest critical section, so a guard covers a few file operations and
+// nothing slower.
+//
+// Lock order: the preset collection mutex may be held when a guard is taken
+// (set_sync_info_and_save() calls save_info() under it), never the reverse;
+// that is why the guards sit at the leaf readers and writers and why a guard
+// must not be added around save_user_presets(), which takes the collection
+// mutex through delete_preset().
+class InstanceLock
+{
+public:
+    // Long against a critical section of milliseconds, short against the GUI
+    // thread, which is where most guards are taken.
+    static constexpr std::chrono::milliseconds default_timeout{1000};
+    // Long enough that a holder stuck in a debugger does not cost a stall per
+    // save; mutable so tests can shorten it.
+    static inline std::chrono::milliseconds cooldown{10000};
+
+    // An empty path makes the guard a no-op.
+    explicit InstanceLock(const std::string &lock_file_path, std::chrono::milliseconds timeout = default_timeout);
+    ~InstanceLock();
+
+    InstanceLock(const InstanceLock &) = delete;
+    InstanceLock &operator=(const InstanceLock &) = delete;
+
+    // True while this process holds the cross-process file lock.
+    bool locked() const { return m_locked; }
+
+private:
+    struct Slot;
+    static Slot &slot_for(const std::string &lock_file_path);
+    static bool  open_lock_file(Slot &slot, const std::string &lock_file_path);
+    static void  defer(Slot &slot, const std::string &reason);
+
+    Slot *m_slot{nullptr};
+    std::unique_lock<std::recursive_mutex> m_slot_guard;
+    bool  m_locked{false};
+};
+
+} // namespace Slic3r
@@ -51,6 +51,9 @@
 #include "libslic3r.h"
 #include "LifecycleEvents.hpp"
 #include "Utils.hpp"
+#include "InstanceLock.hpp"
+
+#include <sstream>
 #include "Time.hpp"
 #include "PlaceholderParser.hpp"
 #include "libslic3r/GCode/Thumbnails.hpp"
@@ -107,6 +110,32 @@ std::string get_preset_canonical_name(const std::string &preset_bare_name, const
    }
 }

+std::string user_presets_lock_path(bool read_only)
+{
+    return read_only || data_dir().empty() ? std::string() : (fs::path(data_dir()) / (PRESET_USER_DIR ".lock")).string();
+}
+
+// Removes a preset file the scan could not load, and its .info, under the lock.
+// The scan passes read_only when it could not take the lock, since the file may
+// then be another instance's fresh write that it merely raced.
+static void remove_preset_files(const std::string &preset_file, bool read_only)
+{
+    if (read_only)
+        return;
+    InstanceLock instance_lock(user_presets_lock_path());
+    // A symlink whose target is missing stays, since the target may come back; one
+    // that cannot even be followed is removed like any other unreadable file.
+    auto remove = [](const fs::path &file) {
+        boost::system::error_code ec;
+        if (fs::status(file, ec).type() != fs::file_not_found)
+            fs::remove(file, ec);
+    };
+    fs::path file_path(preset_file);
+    remove(file_path);
+    file_path.replace_extension(".info");
+    remove(file_path);
+}
+
 std::string get_preset_bare_name(const std::string &canonical_name)
 {
    const auto pos = canonical_name.find_last_of('/');
@@ -649,18 +678,20 @@ void Preset::save_info(std::string file)
        file = idx_file.string();
    }

-    boost::nowide::ofstream c;
-    c.open(file, std::ios::out | std::ios::trunc);
    std::string sync_info_to_save;
    //BBS: hold is used for stop requesting to server this time
    if (this->sync_info.compare("hold") != 0)
        sync_info_to_save = this->sync_info;
+    std::ostringstream c;
    c << "sync_info" << " = " << sync_info_to_save << std::endl;
    c << "user_id" << " = " << this->user_id << std::endl;
    c << "setting_id" << " = " << this->setting_id << std::endl;
    c << "base_id" << " = " << this->base_id << std::endl;
    c << "updated_time" << " = " << std::to_string(this->updated_time) << std::endl;
-    c.close();
+
+    InstanceLock instance_lock(user_presets_lock_path());
+    if (const std::error_code ec = write_file_atomically(file, c.str()))
+        BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << ": failed to save " << file << ": " << ec.message();
 }

 void Preset::remove_files(bool cloud_already_deleted)
@@ -669,6 +700,7 @@ void Preset::remove_files(bool cloud_already_deleted)
    if (this->is_project_embedded) {
        return;
    }
+    InstanceLock instance_lock(user_presets_lock_path());
    // Erase the preset file.
    boost::nowide::remove(this->file.c_str());
    fs::path idx_path(this->file);
@@ -686,11 +718,11 @@ void Preset::remove_files(bool cloud_already_deleted)
 }

 //BBS: add logic for only difference save
-void Preset::save(DynamicPrintConfig* parent_config)
+bool Preset::save(DynamicPrintConfig* parent_config)
 {
    //BBS: add project embedded preset logic
    if (this->is_project_embedded)
-        return;
+        return true;
    //BBS: change to json format
    //this->config.save(this->file);
    std::string from_str;
@@ -705,12 +737,16 @@ void Preset::save(DynamicPrintConfig* parent_config)
    else
        from_str = std::string("Default");

-    boost::filesystem::create_directories(fs::path(this->file).parent_path());
    const std::string bare_name = get_preset_bare_name(this->name);

+    // What gets written: the diff against the parent, the config plus its
+    // filament id, or the config as is. Built before the lock is taken so the
+    // exclusive window covers only the file writes.
+    DynamicPrintConfig        temp_config;
+    const DynamicPrintConfig *to_save = &this->config;
+
    //BBS: only save difference if it has parent
    if (parent_config) {
-        DynamicPrintConfig temp_config;
        std::vector<std::string> dirty_options = config.diff(*parent_config);

        std::string extruder_id_name, extruder_variant_name;
@@ -746,13 +782,22 @@ void Preset::save(DynamicPrintConfig* parent_config)
                    opt_dst->set(opt_src);
            }
        }
-        temp_config.save_to_json(this->file, bare_name, from_str, this->version.to_string());
+        to_save = &temp_config;
    } else if (!filament_id.empty() && inherits().empty()) {
-        DynamicPrintConfig temp_config = config;
+        temp_config = config;
        temp_config.set_key_value(BBL_JSON_KEY_FILAMENT_ID, new ConfigOptionString(filament_id));
-        temp_config.save_to_json(this->file, bare_name, from_str, this->version.to_string());
-    } else {
-        this->config.save_to_json(this->file, bare_name, from_str, this->version.to_string());
+        to_save = &temp_config;
+    }
+
+    std::ostringstream json;
+    to_save->save_to_json(json, bare_name, from_str, this->version.to_string());
+
+    InstanceLock instance_lock(user_presets_lock_path());
+    boost::filesystem::create_directories(fs::path(this->file).parent_path());
+    if (const std::error_code ec = write_file_atomically(this->file, json.str())) {
+        // No .info either: one without its preset reads as a cloud deletion request.
+        BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << ": failed to save " << this->file << ": " << ec.message();
+        return false;
    }
    BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << " save config for: " << this->name << " and filament_id: " << filament_id << " and base_id: " << this->base_id;

@@ -762,6 +807,7 @@ void Preset::save(DynamicPrintConfig* parent_config)
        idx_file.replace_extension(".info");
        this->save_info(idx_file.string());
    }
+    return true;
 }

 void Preset::reload(Preset const &parent)
@@ -773,6 +819,7 @@ void Preset::reload(Preset const &parent)
    std::string                        reason;
    ForwardCompatibilitySubstitutionRule substitution_rule    = ForwardCompatibilitySubstitutionRule::Disable;
    try {
+        InstanceLock instance_lock(user_presets_lock_path());
        ConfigSubstitutions                config_substitutions = config.load_from_json(file, substitution_rule, key_values, reason);
        this->config = parent.config;
        this->config.apply(std::move(config));
@@ -1702,6 +1749,22 @@ std::string PresetCollection::canonical_preset_name(const std::string &name, con
    return get_preset_canonical_name(parsed.bare, origin);
 }

+PresetCollection::PresetFilesOnDisk PresetCollection::PresetFilesOnDisk::read(const boost::filesystem::path &file)
+{
+    auto read_if_present = [](const fs::path &path) -> std::optional<std::string> {
+        std::string bytes;
+        try {
+            load_string_file(path, bytes);
+        } catch (const std::exception &) {
+            return std::nullopt;
+        }
+        return bytes;
+    };
+    fs::path info_path(file);
+    info_path.replace_extension(".info");
+    return { read_if_present(file), read_if_present(info_path) };
+}
+
 PresetCollection::UserPresetLoad PresetCollection::resolve_user_preset(
    const boost::filesystem::path &file, const std::string &canonical_name,
    const PresetOrigin &load_origin, ForwardCompatibilitySubstitutionRule substitution_rule,
@@ -1713,6 +1776,9 @@ PresetCollection::UserPresetLoad PresetCollection::resolve_user_preset(
    Preset &preset = out.preset;
    preset.bundle_id = load_origin.bundle_id;
    preset.file = file.string();
+    // Before either file is parsed, so a save that lands during the parse still shows
+    // up as a difference when commit compares.
+    out.on_disk = PresetFilesOnDisk::read(file);
    // Load the preset file, apply preset values on top of defaults.
    try {
        fs::path idx_path(preset.file);
@@ -1726,11 +1792,9 @@ PresetCollection::UserPresetLoad PresetCollection::resolve_user_preset(
        //ConfigSubstitutions config_substitutions = config.load_from_ini(preset.file, substitution_rule);
        std::map<std::string, std::string> key_values;
        std::string reason;
-        ConfigSubstitutionContext load_context(substitution_rule);
-        load_context.accept_nil = true;
-        config.load_from_json(preset.file, load_context, true, key_values, reason);
-        if (! load_context.substitutions.empty())
-            out.substitutions.push_back({ preset.name, m_type, PresetConfigSubstitutions::Source::UserFile, preset.file, std::move(load_context.substitutions) });
+        ConfigSubstitutions config_substitutions = config.load_from_json(preset.file, substitution_rule, key_values, reason);
+        if (! config_substitutions.empty())
+            out.substitutions.push_back({ preset.name, m_type, PresetConfigSubstitutions::Source::UserFile, preset.file, std::move(config_substitutions) });
        if (!reason.empty()) {
            out.discard_file = true;
            out.errors.push_back((boost::format("parse config %1% failed") % preset.file).str());
@@ -1766,7 +1830,7 @@ PresetCollection::UserPresetLoad PresetCollection::resolve_user_preset(
            preset.config = inherit_preset->config;
            preset.filament_id = inherit_preset->filament_id;
            extend_default_config_length(config, false, {});
-            preset.config.update_diff_values_to_child_config(config, extruder_id_name, extruder_variant_name, *key_set1, *key_set2, &load_context.nil_slots);
+            preset.config.update_diff_values_to_child_config(config, extruder_id_name, extruder_variant_name, *key_set1, *key_set2);
        }
        else {
            auto inherits_config2 = dynamic_cast<ConfigOptionString *>(inherits_config);
@@ -1827,14 +1891,8 @@ void PresetCollection::commit_user_preset(UserPresetLoad &&loaded, std::deque<Pr
        ++m_errors;
        BOOST_LOG_TRIVIAL(error) << error;
    }
-    if (loaded.discard_file && !read_only) {
-        fs::path file_path(loaded.preset.file);
-        if (fs::exists(file_path))
-            fs::remove(file_path);
-        file_path.replace_extension(".info");
-        if (fs::exists(file_path))
-            fs::remove(file_path);
-    }
+    if (loaded.discard_file)
+        remove_preset_files(loaded.preset.file, read_only);
    if (!loaded.install)
        return;

@@ -1842,9 +1900,12 @@ void PresetCollection::commit_user_preset(UserPresetLoad &&loaded, std::deque<Pr
        if (loaded.save_compatible_printers) {
            // A filesystem error from the rewrite is counted, and the preset still loads.
            try {
-                if (!read_only)
-                    preset.save(nullptr);
-                BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << " added compatible_printers for preset: " << preset.name;
+                if (read_only)
+                    BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << " added compatible_printers for preset: " << preset.name << " (not written back)";
+                else if (preset.save(nullptr))
+                    BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << " added compatible_printers for preset: " << preset.name;
+                else
+                    ++m_errors; // save() logged why
            } catch (const std::runtime_error &err) {
                ++m_errors;
                BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << " can not write compatible_printers back to " << preset.file << ": " << err.what();
@@ -1930,11 +1991,32 @@ void PresetCollection::load_presets(
            return this->resolve_user_preset(files[i].path, files[i].canonical_name, resolved_origin, substitution_rule,
                                             extruder_id_name, extruder_variant_name, key_set1, key_set2);
        },
-        [&](size_t, UserPresetLoad &&loaded) {
+        [&](size_t i, UserPresetLoad &&loaded) {
+            // Resolve read the files without the lock, so another instance may have saved
+            // over them since. A file that changed is resolved again under the lock before
+            // commit removes or rewrites it, which also keeps its .json and .info from two
+            // different saves apart. Without the lock nothing is checked, so commit leaves
+            // the files alone.
+            const std::string lock_path = user_presets_lock_path(read_only);
+            InstanceLock      instance_lock(lock_path);
+            if (instance_lock.locked()) {
+                const PresetFilesOnDisk   on_disk = PresetFilesOnDisk::read(files[i].path);
+                boost::system::error_code ec;
+                // The link itself, and a stat error counts as present, so a file that is
+                // there but cannot be read is still counted and removed by commit.
+                if (! on_disk.json && fs::symlink_status(files[i].path, ec).type() == fs::file_not_found)
+                    return; // removed by another instance since it was read
+                if (! (on_disk == loaded.on_disk)) {
+                    CNumericLocalesSetter locales_setter;
+                    loaded = this->resolve_user_preset(files[i].path, files[i].canonical_name, resolved_origin, substitution_rule,
+                                                       extruder_id_name, extruder_variant_name, key_set1, key_set2);
+                }
+            }
+            const bool leave_files = read_only || (! lock_path.empty() && ! instance_lock.locked());
            // Committing can remove an unreadable preset's file, and a filesystem error
            // there is reported without stopping the rest of the directory.
            try {
-                this->commit_user_preset(std::move(loaded), presets_loaded, substitutions, preset_loaded_fn, read_only);
+                this->commit_user_preset(std::move(loaded), presets_loaded, substitutions, preset_loaded_fn, leave_files);
            } catch (const std::runtime_error &err) {
                errors_cummulative += err.what();
                errors_cummulative += "\n";
@@ -2139,8 +2221,7 @@ void PresetCollection::load_project_embedded_presets(std::vector<Preset*>& proje
                BOOST_LOG_TRIVIAL(error) << boost::format("can not find parent for config %1%!")%preset->file;
                continue;
            }
-            preset->config.update_diff_values_to_child_config(config, extruder_id_name, extruder_variant_name, *key_set1, *key_set2, &preset->nil_slots);
-            preset->nil_slots.clear();
+            preset->config.update_diff_values_to_child_config(config, extruder_id_name, extruder_variant_name, *key_set1, *key_set2);
            //preset->config.apply(std::move(config));
            Preset::normalize(preset->config);
            // Report configuration fields, which are misplaced into a wrong group.
@@ -2245,7 +2326,10 @@ void PresetCollection::set_sync_info_and_save(std::string name, std::string sett
            preset->setting_id = setting_id;
            if (update_time > 0)
                preset->updated_time = update_time;
-            preset->sync_info == "update" ? preset->save(nullptr) : preset->save_info();
+            if (preset->sync_info == "update")
+                preset->save(nullptr);
+            else
+                preset->save_info();
            break;
        }
    }
@@ -4314,8 +4398,15 @@ void PhysicalPrinter::update_preset_names_in_config()
    }
 }

+void PhysicalPrinter::save(DynamicPrintConfig* /* parent_config */)
+{
+    InstanceLock instance_lock(user_presets_lock_path());
+    this->config.save_to_json(this->file, std::string("Physical_Printer"), std::string("User"), std::string(SLIC3R_VERSION));
+}
+
 void PhysicalPrinter::save(const std::string& file_name_from, const std::string& file_name_to)
 {
+    InstanceLock instance_lock(user_presets_lock_path());
    // rename the file
    boost::nowide::rename(file_name_from.data(), file_name_to.data());
    this->file = file_name_to;
@@ -4447,6 +4538,7 @@ void PhysicalPrinterCollection::load_printers(
                continue;
            }
            try {
+                InstanceLock instance_lock(user_presets_lock_path());
                PhysicalPrinter printer(name, this->default_config());
                printer.file = dir_entry.path().string();
                // Load the preset file, apply preset values on top of defaults.
@@ -4639,7 +4731,10 @@ bool PhysicalPrinterCollection::delete_printer(const std::string& name)

    const PhysicalPrinter& printer = *it;
    // Erase the preset file.
-    boost::nowide::remove(printer.file.c_str());
+    {
+        InstanceLock instance_lock(user_presets_lock_path());
+        boost::nowide::remove(printer.file.c_str());
+    }
    m_printers.erase(it);
    return true;
 }
@@ -4651,7 +4746,10 @@ bool PhysicalPrinterCollection::delete_selected_printer()
    const PhysicalPrinter& printer = this->get_selected_printer();

    // Erase the preset file.
-    boost::nowide::remove(printer.file.c_str());
+    {
+        InstanceLock instance_lock(user_presets_lock_path());
+        boost::nowide::remove(printer.file.c_str());
+    }
    // Remove the preset from the list.
    m_printers.erase(m_printers.begin() + m_idx_selected);
    // unselect all printers
@@ -8,6 +8,7 @@
 #include <unordered_set>
 #include <functional>
 #include <mutex>
+#include <optional>
 #include <boost/algorithm/string/predicate.hpp>
 #include <boost/filesystem/path.hpp>
 #include <boost/property_tree/ptree_fwd.hpp>
@@ -269,8 +270,6 @@ public:
    //BBS: add type for project-embedded
    bool                is_project_embedded = false;
    ConfigSubstitutions *loading_substitutions{nullptr};
-    // Slots that were nil in the embedded preset's file, see ConfigSubstitutionContext::nil_slots.
-    std::map<std::string, std::vector<size_t>> nil_slots;
    bool                is_user() const { return ! this->is_default && ! this->is_system && ! this->is_project_embedded && ! this->is_from_bundle(); }
    bool                can_overwrite() const { return ! this->is_default && ! this->is_system && ! this->is_from_bundle(); }
    //bool                is_user() const { return ! this->is_default && ! this->is_system; }
@@ -332,7 +331,8 @@ public:

    //BBS: add logic for only difference save
    //if parent_config is null, save all keys, otherwise, only save difference
-    void                save(DynamicPrintConfig* parent_config);
+    // Returns false when the preset file could not be written.
+    bool                save(DynamicPrintConfig* parent_config);
    void                reload(Preset const & parent);

    // Return a label of this preset, consisting of a name and a "(modified)" suffix, if this preset is dirty.
@@ -499,6 +499,12 @@ std::string get_preset_canonical_name(const std::string &preset_bare_name, const
 // Tail segment of a canonical name — what's written to the bundle's .json filename and JSON "name" field.
 std::string get_preset_bare_name(const std::string &canonical_name);

+// Lock file guarding every user preset file under data_dir() against other
+// running instances and the preset sync thread. Empty without a data dir, and
+// for a read-only load (the CLI), which never rewrites or deletes and may run
+// many jobs on one data dir.
+std::string user_presets_lock_path(bool read_only = false);
+
 // Resolve an origin from a directory path when the caller passes Kind::Auto.
 PresetOrigin detect_origin_from_path(const boost::filesystem::path &path, const PresetOrigin &explicit_origin = PresetOrigin());

@@ -908,6 +914,16 @@ protected:
    void            set_custom_preset_alias(Preset &preset);

 private:
+    // A preset file and its .info as read from disk, std::nullopt for one that is missing.
+    struct PresetFilesOnDisk
+    {
+        std::optional<std::string> json;
+        std::optional<std::string> info;
+
+        static PresetFilesOnDisk read(const boost::filesystem::path &file);
+        bool operator==(const PresetFilesOnDisk &rhs) const { return json == rhs.json && info == rhs.info; }
+    };
+
    // One preset file read and flattened against the presets already in this
    // collection, before anything the collection shares has been touched.
    struct UserPresetLoad
@@ -925,6 +941,9 @@ private:
        bool        discard_file { false };
        // The .info file read beside the preset, which commit logs.
        std::string info_file;
+        // Both files as they were before the preset was read from them. Resolve runs
+        // without the instance lock, so commit compares this with the disk under it.
+        PresetFilesOnDisk on_disk;
        // Counted and logged by commit, in the order the directory listed the files.
        std::vector<std::string>   errors;
        PresetsConfigSubstitutions substitutions;
@@ -1113,7 +1132,7 @@ public:

    //BBS: change to json format
    //void                save() { this->config.save(this->file); }
-    void                save(DynamicPrintConfig* parent_config) { this->config.save_to_json(this->file, std::string("Physical_Printer"), std::string("User"), std::string(SLIC3R_VERSION)); }
+    void                save(DynamicPrintConfig* parent_config);
    void                save(const std::string& file_name_from, const std::string& file_name_to);

    void                update_from_preset(const Preset& preset);
@@ -1,3 +1,4 @@
+#include <atomic>
 #include <cassert>
 #include <chrono>
 #include <ctime>
@@ -13,6 +14,7 @@
 #include "libslic3r.h"
 #include "I18N.hpp"
 #include "Utils.hpp"
+#include "InstanceLock.hpp"
 #include "LocalesUtils.hpp"
 #include "Model.hpp"
 #include "TriangleSelector.hpp"
@@ -1272,6 +1274,13 @@ PresetsConfigSubstitutions PresetBundle::load_user_presets(std::string user, For

    const auto user_load_t0 = std::chrono::steady_clock::now();

+    // Reads one bundle's metadata under the lock, per file, so the lock is never
+    // held when bundles.WriteLock() is taken afterwards.
+    auto load_bundle_metadata = [read_only](const fs::path &metadata_file, BundleMetadata &metadata) {
+        InstanceLock instance_lock(user_presets_lock_path(read_only));
+        return metadata.load_from_json(metadata_file.string());
+    };
+
    // Load bundle metadata from _local directory first
    fs::path local_dir(folder / PRESET_LOCAL_DIR);
    if (fs::exists(local_dir)) {
@@ -1285,7 +1294,7 @@ PresetsConfigSubstitutions PresetBundle::load_user_presets(std::string user, For
            if (!fs::exists(metadata_file)) continue;

            BundleMetadata metadata;
-            if (!metadata.load_from_json(metadata_file.string())) continue;
+            if (!load_bundle_metadata(metadata_file, metadata)) continue;
            metadata.print_presets.clear();
            metadata.filament_presets.clear();
            metadata.printer_presets.clear();
@@ -1320,7 +1329,7 @@ PresetsConfigSubstitutions PresetBundle::load_user_presets(std::string user, For
            if (!fs::exists(metadata_file)) continue;

            BundleMetadata metadata;
-            if (!metadata.load_from_json(metadata_file.string())) continue;
+            if (!load_bundle_metadata(metadata_file, metadata)) continue;
            metadata.print_presets.clear();
            metadata.filament_presets.clear();
            metadata.printer_presets.clear();
@@ -1654,10 +1663,12 @@ PresetsConfigSubstitutions PresetBundle::import_presets(std::vector<std::string>
            if (ec) BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << " create directory failed: " << ec.message();
            //create temp folder
            //std::string user_default_temp_dir = data_dir() + "/" + PRESET_USER_DIR + "/" + DEFAULT_USER_FOLDER_NAME + "/" + "temp";
-            fs::path temp_folder(configs_folder / "temp");
+            // Under cache/, per process and per import, so two instances importing
+            // at once do not clear each other's extraction and no preset scan reads it.
+            static std::atomic<unsigned> import_counter{0};
+            fs::path temp_folder(fs::path(data_dir()) / "cache" / ("import." + std::to_string(get_current_pid()) + "." + std::to_string(import_counter++)));
            std::string user_default_temp_dir = temp_folder.make_preferred().string();
-            if (fs::exists(temp_folder)) fs::remove_all(temp_folder);
-            fs::create_directory(temp_folder, ec);
+            fs::create_directories(temp_folder, ec);
            if (ec) BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << " create directory failed: " << ec.message();

            file = boost::filesystem::path(file).make_preferred().string();
@@ -1669,6 +1680,9 @@ PresetsConfigSubstitutions PresetBundle::import_presets(std::vector<std::string>
            status        = mz_zip_reader_init_cfile(&zip_archive, zipFile, 0, MZ_ZIP_FLAG_CASE_SENSITIVE | MZ_ZIP_FLAG_IGNORE_PATH);
            if (MZ_FALSE == status) {
                BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << " Failed to initialize reader ZIP archive";
+                if (zipFile != nullptr)
+                    std::fclose(zipFile);
+                fs::remove_all(temp_folder, ec);
                return substitutions;
            } else {
                BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << " Success to initialize reader ZIP archive";
@@ -2276,10 +2290,9 @@ void PresetBundle::remove_user_presets_directory(const std::string preset_folder
        return;
    }
    BOOST_LOG_TRIVIAL(debug) << __FUNCTION__ << boost::format(" enter, delete directory : %1%") % dir_user_presets;
-    fs::path folder(dir_user_presets);
-    if (fs::exists(folder)) {
-        fs::remove_all(folder);
-    }
+    boost::system::error_code ec;
+    InstanceLock instance_lock(user_presets_lock_path());
+    fs::remove_all(fs::path(dir_user_presets), ec);
 }

 void PresetBundle::update_system_preset_setting_ids(std::map<std::string, std::map<std::string, std::string>>& system_presets)
@@ -8213,9 +8226,13 @@ bool BundleMetadata::save_to_json(const std::string& path) const
        j["filament_presets"] = strip_prefix(this->filament_presets);                                                                                                                                                                                                                       
        j["printer_presets"] = strip_prefix(this->printer_presets);

-        boost::nowide::ofstream ofs(path);
-        ofs << j.dump(4);
-        return ofs.good();
+        const std::string content = j.dump(4);
+        InstanceLock instance_lock(user_presets_lock_path());
+        if (const std::error_code ec = write_file_atomically(path, content)) {
+            BOOST_LOG_TRIVIAL(error) << "Failed to save bundle metadata to " << path << ": " << ec.message();
+            return false;
+        }
+        return true;
    } catch (const std::exception& e) {
        BOOST_LOG_TRIVIAL(error) << "Failed to save bundle metadata to " << path << ": " << e.what();
        return false;
@@ -400,46 +400,24 @@ bool write_cache_blob(const std::string& path, const std::string& blob)
 {
    boost::crc_32_type crc;
    crc.process_bytes(blob.data(), blob.size());
-    // Written beside the target and moved into place, as AppConfig::save does:
-    // a cache is truncated and rewritten in full, so a write that dies partway
-    // would otherwise leave a header claiming more body than the file holds.
-    // The PID suffix also keeps two instances writing the same vendor from
-    // interleaving.
-    const std::string tmp_path = path + "." + std::to_string(get_current_pid()) + ".tmp";
+    // Written beside the target and moved into place: a cache is truncated and
+    // rewritten in full, so a write that dies partway would otherwise leave a
+    // header claiming more body than the file holds.
    try {
        boost::filesystem::create_directories(boost::filesystem::path(path).parent_path());
-        {
-            boost::nowide::ofstream ofs(tmp_path, std::ios::binary | std::ios::trunc);
-            if (!ofs.is_open()) {
-                BOOST_LOG_TRIVIAL(warning) << "VendorCacheFile: cannot open for writing: " << tmp_path;
-                return false;
-            }
-            CacheFileHeader fhdr;
-            fhdr.magic     = CACHE_MAGIC;
-            fhdr.version   = CACHE_VERSION;
-            fhdr.data_size = static_cast<uint64_t>(blob.size());
-            fhdr.crc32     = crc.checksum();
-            ofs.write(reinterpret_cast<const char*>(&fhdr), sizeof(fhdr));
-            ofs.write(blob.data(), static_cast<std::streamsize>(blob.size()));
-            ofs.close();   // flush; close() raises failbit on error
-            if (! ofs.good()) {
-                BOOST_LOG_TRIVIAL(warning) << "VendorCacheFile: write failed (" << tmp_path << ")";
-                boost::system::error_code ec;
-                boost::filesystem::remove(tmp_path, ec);
-                return false;
-            }
-        }
-        if (const std::error_code ec = rename_file(tmp_path, path)) {
-            BOOST_LOG_TRIVIAL(warning) << "VendorCacheFile: could not move " << tmp_path << " into place: " << ec.message();
-            boost::system::error_code rm;
-            boost::filesystem::remove(tmp_path, rm);
+        CacheFileHeader fhdr;
+        fhdr.magic     = CACHE_MAGIC;
+        fhdr.version   = CACHE_VERSION;
+        fhdr.data_size = static_cast<uint64_t>(blob.size());
+        fhdr.crc32     = crc.checksum();
+        const std::string_view header(reinterpret_cast<const char*>(&fhdr), sizeof(fhdr));
+        if (const std::error_code ec = write_file_atomically(path, { header, std::string_view(blob) }, /*binary=*/true)) {
+            BOOST_LOG_TRIVIAL(warning) << "VendorCacheFile: write failed (" << path << "): " << ec.message();
            return false;
        }
        return true;
    } catch (const std::exception& e) {
        BOOST_LOG_TRIVIAL(warning) << "VendorCacheFile: write failed (" << path << "): " << e.what();
-        boost::system::error_code ec;
-        boost::filesystem::remove(tmp_path, ec);
        return false;
    }
 }
@@ -10,8 +10,6 @@
 #include "GCode/Thumbnails.hpp"
 #include <set>
 #include <boost/algorithm/string/case_conv.hpp>
-#include <boost/algorithm/string/classification.hpp>
-#include <boost/algorithm/string/join.hpp>
 #include <boost/algorithm/string/replace.hpp>
 #include <boost/algorithm/string/split.hpp>
 #include <boost/algorithm/string/trim.hpp>
@@ -9187,18 +9185,16 @@ void PrintConfigDef::handle_legacy(t_config_option_key &opt_key, std::string &va
    } else if (opt_key == "tree_support_wall_count" && value == "-1") {
        value = "0";
    } else if (opt_key == "different_settings_to_system") {
-        // Rename whole entries: a substring rename would also hit longer keys that contain the old name.
-        std::vector<std::string> entries;
-        boost::split(entries, value, boost::is_any_of(";"));
-        for (std::string &entry : entries) {
-            std::string key = entry, unused_value;
-            key.erase(std::remove(key.begin(), key.end(), '\"'), key.end());
-            std::string new_key = key;
-            handle_legacy(new_key, unused_value);
-            if (new_key != key)
-                ReplaceString(entry, key, new_key);
+        std::string copy_value = value;
+        copy_value.erase(std::remove(copy_value.begin(), copy_value.end(), '\"'), copy_value.end()); // remove '"' in string
+        std::set<std::string> split_keys = SplitStringAndRemoveDuplicateElement(copy_value, ";");
+        for (std::string split_key : split_keys) {
+            std::string copy_key = split_key, copy_value = "";
+            handle_legacy(copy_key, copy_value);
+            if (copy_key != split_key) {
+                ReplaceString(value, split_key, copy_key);
+            }
        }
-        value = boost::algorithm::join(entries, ";");
    } else if (opt_key == "overhang_fan_threshold" && value == "5%") {
        value = "10%";
    } else if( opt_key == "wall_infill_order" ) {
@@ -9240,13 +9236,6 @@ void PrintConfigDef::handle_legacy(t_config_option_key &opt_key, std::string &va
        else if (value == "0"){
            value = "ensure_moderate";
        }
-        // BambuStudio's levels
-        else if (value == "enabled")
-            value = "ensure_all";
-        else if (value == "partial")
-            value = "ensure_moderate";
-        else if (value == "disabled")
-            value = "none";
    } else if (opt_key == "rotate_solid_infill_direction") {
        opt_key = "solid_infill_rotate_template";
        if (value == "1") {
@@ -9262,11 +9251,9 @@ void PrintConfigDef::handle_legacy(t_config_option_key &opt_key, std::string &va
        opt_key = "chamber_temperature";
    } else if (opt_key == "thumbnail_size") {
        opt_key = "thumbnails";
-    } else if (opt_key == "top_one_wall_type") {
-        // BambuStudio's "topmost" (one wall on the topmost layer only) widens to every top surface.
+    } else if (opt_key == "top_one_wall_type" && value != "none") {
        opt_key = "only_one_wall_top";
-        if (!value.empty())
-            value = (value == "not apply" || value == "none") ? "0" : "1";
+        value = "1";
    } else if (opt_key == "initial_layer_flow_ratio") {
        opt_key = "bottom_solid_infill_flow_ratio";
    } else if (opt_key == "ironing_direction") {
@@ -9284,20 +9271,6 @@ void PrintConfigDef::handle_legacy(t_config_option_key &opt_key, std::string &va
                opt_key == "ironing_pattern"               ||
                opt_key == "support_ironing_pattern") && value == "zig-zag") {
        value = "rectilinear";
-    } else if (opt_key == "sparse_infill_pattern" && value == "2dlattice") {
-        // BambuStudio's name, and OrcaSlicer's before the lateral patterns were renamed
-        value = "lateral-lattice";
-    } else if (opt_key == "sparse_infill_pattern" && value == "2dhoneycomb") {
-        value = "lateral-honeycomb";
-    } else if (opt_key == "sparse_infill_lattice_angle_1" || opt_key == "lattice_angle_1") {
-        opt_key = "lateral_lattice_angle_1";
-    } else if (opt_key == "sparse_infill_lattice_angle_2" || opt_key == "lattice_angle_2") {
-        opt_key = "lateral_lattice_angle_2";
-    } else if (opt_key == "support_style" && value == "tree_organic") {
-        value = "organic";
-    } else if (opt_key == "raft_first_layer_expansion" && !value.empty() && value.front() == '-') {
-        // BambuStudio's auto: 2 mm for normal supports and rafts. Tree branches use tree_support_auto_brim here.
-        value = "2";
    } else if (opt_key == "filament_map_mode") {
        if (value == "Auto") value = "Auto For Flush";
    }
@@ -9326,11 +9299,12 @@ void PrintConfigDef::handle_legacy(t_config_option_key &opt_key, std::string &va
    }
    // Orca: Rename wipe tower ribs related options
    else if (opt_key == "prime_tower_rib_wall") {
-        opt_key = "wipe_tower_wall_type";
-        if (value == "1" || value == "true")
-            value = "rib";
-        else if (!value.empty())
-            value = "rectangle";
+        if (value == "1") {
+            opt_key = "wipe_tower_wall_type";
+            value   = "rib";
+        } else {
+            opt_key = "";
+        }
    } else if (opt_key == "prime_tower_extra_rib_length") {
        opt_key = "wipe_tower_extra_rib_length";
    } else if (opt_key == "prime_tower_rib_width") {
@@ -9342,18 +9316,6 @@ void PrintConfigDef::handle_legacy(t_config_option_key &opt_key, std::string &va
    } else if (opt_key == "machine_switch_extruder_time") {
        opt_key = "machine_tool_change_time";
    }
-    // BambuStudio names of OrcaSlicer options
-    else if (opt_key == "role_base_wipe_speed") {
-        opt_key = "role_based_wipe_speed";
-    } else if (opt_key == "no_slow_down_for_cooling_on_outwalls") {
-        opt_key = "dont_slow_down_outer_wall";
-    } else if (opt_key == "process_notes") {
-        opt_key = "notes";
-    } else if (opt_key == "prime_tower_max_speed") {
-        opt_key = "wipe_tower_max_purge_speed";
-    } else if (opt_key == "enable_support_ironing") {
-        opt_key = "support_ironing";
-    }
    else if (opt_key == "wall_direction" && value == "auto") {
        value = "ccw";
    }
@@ -11596,8 +11558,7 @@ void DynamicPrintConfig::update_non_diff_values_to_base_config(DynamicPrintConfi
    return;
 }

-void DynamicPrintConfig::update_diff_values_to_child_config(DynamicPrintConfig& new_config, std::string extruder_id_name, std::string extruder_variant_name, std::set<std::string>& key_set1, std::set<std::string>& key_set2,
-    const std::map<std::string, std::vector<size_t>>* nil_slots)
+void DynamicPrintConfig::update_diff_values_to_child_config(DynamicPrintConfig& new_config, std::string extruder_id_name, std::string extruder_variant_name, std::set<std::string>& key_set1, std::set<std::string>& key_set2)
 {
    std::vector<int> cur_extruder_ids, target_extruder_ids, variant_index;
    std::vector<std::string> cur_extruder_variants, target_extruder_variants;
@@ -11658,13 +11619,6 @@ void DynamicPrintConfig::update_diff_values_to_child_config(DynamicPrintConfig&
        if (opt_src && opt_target && (*opt_src != *opt_target)) {
            BOOST_LOG_TRIVIAL(debug) << __FUNCTION__ << boost::format(" change key %1% from base_value %2% to child's value %3%")
                    %opt %(opt_src->serialize()) %(opt_target->serialize());
-            const std::vector<size_t> *unset_slots = nullptr;
-            if (nil_slots && opt_src->is_vector())
-                if (auto it = nil_slots->find(opt); it != nil_slots->end())
-                    unset_slots = &it->second;
-            std::unique_ptr<ConfigOption> base_value(unset_slots ? opt_src->clone() : nullptr);
-            int  stride            = 1;
-            bool merged_by_variant = false;
            if (opt_target->is_scalar()
                || ((key_set1.find(opt) == key_set1.end()) && (key_set2.empty() || (key_set2.find(opt) == key_set2.end())))) {
                //nothing to do, keep the original one
@@ -11673,6 +11627,7 @@ void DynamicPrintConfig::update_diff_values_to_child_config(DynamicPrintConfig&
            else {
                ConfigOptionVectorBase* opt_vec_src = static_cast<ConfigOptionVectorBase*>(opt_src);
                const ConfigOptionVectorBase* opt_vec_dest = static_cast<const ConfigOptionVectorBase*>(opt_target);
+                int stride = 1;
                if (key_set2.find(opt) != key_set2.end())
                    stride = 2;
                // set_only_diff() requires the base vector length to equal variant_index.size()*stride, where
@@ -11686,26 +11641,8 @@ void DynamicPrintConfig::update_diff_values_to_child_config(DynamicPrintConfig&
                if (opt_vec_src->size() != variant_index.size() * size_t(stride)) {
                    opt_src->set(opt_target);
                }
-                else {
+                else
                    opt_vec_src->set_only_diff(opt_vec_dest, variant_index, stride);
-                    merged_by_variant = true;
-                }
-            }
-            // A slot that was nil in the child's file is not set there, so it keeps this config's value.
-            if (unset_slots) {
-                auto       *merged    = static_cast<ConfigOptionVectorBase*>(opt_src);
-                const size_t base_size = static_cast<const ConfigOptionVectorBase*>(base_value.get())->size();
-                for (size_t slot = 0; slot < merged->size() && slot < base_size; ++slot) {
-                    size_t child_slot = slot;
-                    if (merged_by_variant) {
-                        const int child_variant = variant_index[slot / stride];
-                        if (child_variant == -1)
-                            continue;
-                        child_slot = size_t(child_variant) * stride + slot % stride;
-                    }
-                    if (std::find(unset_slots->begin(), unset_slots->end(), child_slot) != unset_slots->end())
-                        merged->set_at(base_value.get(), slot, slot);
-                }
            }
        }
    }
@@ -859,10 +859,7 @@ public:

    void update_non_diff_values_to_base_config(DynamicPrintConfig& new_config, const t_config_option_keys& keys, const std::set<std::string>& different_keys, std::string extruder_id_name, std::string extruder_variant_name,
        std::set<std::string>& key_set1, std::set<std::string>& key_set2);
-    // nil_slots: per option, the slots of new_config that were nil in its file (see ConfigSubstitutionContext::nil_slots);
-    // those variants keep this config's value.
-    void update_diff_values_to_child_config(DynamicPrintConfig& new_config, std::string extruder_id_name, std::string extruder_variant_name, std::set<std::string>& key_set1, std::set<std::string>& key_set2,
-        const std::map<std::string, std::vector<size_t>>* nil_slots = nullptr);
+    void update_diff_values_to_child_config(DynamicPrintConfig& new_config, std::string extruder_id_name, std::string extruder_variant_name, std::set<std::string>& key_set1, std::set<std::string>& key_set2);

    int update_values_from_single_to_multi(DynamicPrintConfig& multi_config, std::set<std::string>& key_set, std::string id_name, std::string variant_name);
    int update_values_from_multi_to_multi(DynamicPrintConfig& new_config, std::set<std::string>& key_set, std::string id_name, std::string variant_name, std::vector<std::string>& extruder_variants);
@@ -8,6 +8,8 @@
 #include <functional>
 #include <type_traits>
 #include <system_error>
+#include <initializer_list>
+#include <string_view>
 #include <regex>

 #include <boost/system/error_code.hpp>
@@ -224,6 +226,21 @@ extern std::vector<std::string> split_string(const std::string &str, char delimi
 // On Windows, the file explorer (or anti-virus or whatever else) often locks the file
 // for a short while, so the file may not be movable. Retry while we see recoverable errors.
 extern std::error_code rename_file(const std::string &from, const std::string &to);
+// Write `chunks`, in order, to `path` through a temporary file beside it that is
+// then renamed over the target, so a concurrent reader sees the old or the new
+// file, never a partial one. The temporary is removed on failure and an existing
+// target keeps its permissions. Text mode unless `binary`, so Windows writes CRLF
+// as the streams this replaces did. A target that is not a regular file (a
+// device or pipe) is written in place, since replacing it would change what it
+// is, and so is an existing target beside which no temporary can be created or
+// whose replace the filesystem refuses; a symlink is followed and the file it
+// names is replaced. On Windows a reader holding the
+// target open without sharing its deletion, which the C runtime does not, makes
+// the replace fall back to the in-place write too, so an unlocked reader there
+// can still see a partial file.
+extern std::error_code write_file_atomically(const std::string &path, std::initializer_list<std::string_view> chunks, bool binary = false);
+inline std::error_code write_file_atomically(const std::string &path, const std::string &content, bool binary = false)
+	{ return write_file_atomically(path, { std::string_view(content) }, binary); }

 enum CopyFileResult {
 	SUCCESS = 0,
@@ -9,6 +9,8 @@
 #include <stdio.h>
 #include <filesystem>
 #include <sstream>
+#include <cerrno>
+#include <mutex>
 #include <iomanip>
 #include <algorithm>
 #include <cmath>
@@ -703,13 +705,99 @@ namespace WindowsSupport
 std::error_code rename_file(const std::string &from, const std::string &to)
 {
 #ifdef _WIN32
+	// Retries and moves an open destination aside itself.
 	return WindowsSupport::rename(from, to);
 #else
-	boost::nowide::remove(to.c_str());
-	return std::make_error_code(static_cast<std::errc>(boost::nowide::rename(from.c_str(), to.c_str())));
+	// rename(2) replaces an existing target atomically; removing it first would
+	// leave a window in which the file does not exist at all.
+	if (boost::nowide::rename(from.c_str(), to.c_str()) == 0)
+		return {};
+	const int err = errno;
+	// Some mounts (sshfs, gvfs, MTP and a few SMB setups) refuse to replace an
+	// existing target in one step, each with the error it sees fit; every error
+	// is worth the remove-then-rename this always did, except the ones no retry
+	// can help: nothing at the source, a different device, or a directory where
+	// a file was expected and the reverse.
+	const bool worth_retrying = err != ENOENT && err != EXDEV && err != ENOTDIR && err != EISDIR;
+	if (worth_retrying && boost::nowide::remove(to.c_str()) == 0 && boost::nowide::rename(from.c_str(), to.c_str()) == 0)
+		return {};
+	return std::make_error_code(static_cast<std::errc>(err));
 #endif
 }

+static std::error_code write_whole_file(const std::string &path, std::initializer_list<std::string_view> chunks, bool binary)
+{
+	errno = 0;
+	FILE *file = boost::nowide::fopen(path.c_str(), binary ? "wb" : "w");
+	if (file == nullptr)
+		return std::make_error_code(errno != 0 ? static_cast<std::errc>(errno) : std::errc::io_error);
+	bool ok = true;
+	for (const std::string_view chunk : chunks)
+		ok = ok && std::fwrite(chunk.data(), 1, chunk.size(), file) == chunk.size();
+	ok = ok && std::fflush(file) == 0;
+	const int err = ok ? 0 : errno;
+	ok = std::fclose(file) == 0 && ok;
+	if (ok)
+		return {};
+	return std::make_error_code(err != 0 ? static_cast<std::errc>(err) : std::errc::io_error);
+}
+
+// The in-place fallback truncates the target, so two threads of this process
+// on the same file must not both be in it. One mutex for all such writes: they
+// are the rare case. Never freed, like the InstanceLock registry, so a save
+// during static destruction still finds it.
+static std::error_code write_in_place(const std::string &path, std::initializer_list<std::string_view> chunks, bool binary)
+{
+	static auto *mutex = new std::mutex();
+	std::lock_guard<std::mutex> guard(*mutex);
+	return write_whole_file(path, chunks, binary);
+}
+
+std::error_code write_file_atomically(const std::string &path, std::initializer_list<std::string_view> chunks, bool binary)
+{
+	boost::system::error_code bec;
+	const boost::filesystem::file_status target = boost::filesystem::symlink_status(path, bec);
+	const bool target_exists = ! bec && boost::filesystem::exists(target);
+	if (target_exists && boost::filesystem::is_symlink(target)) {
+		// A config or preset kept in a dotfiles repository: the link stays,
+		// the file it points to is replaced like any other.
+		const boost::filesystem::path resolved = boost::filesystem::canonical(path, bec);
+		if (! bec && boost::filesystem::is_regular_file(resolved, bec))
+			return write_file_atomically(resolved.string(), chunks, binary);
+	}
+	if (target_exists && ! boost::filesystem::is_regular_file(target))
+		return write_in_place(path, chunks, binary);
+
+	// Unique per process and per call, so two threads writing one target
+	// without a lock never share a temporary.
+	static std::atomic<unsigned> counter{0};
+	const std::string tmp_path = path + "." + std::to_string(get_current_pid()) + "." + std::to_string(counter++) + ".tmp";
+	if (const std::error_code ec = write_whole_file(tmp_path, chunks, binary)) {
+		boost::nowide::remove(tmp_path.c_str());
+		if (! target_exists)
+			return ec;
+		// A directory that lets this process write its files but not create
+		// one: losing the save is worse than a reader seeing a partial file.
+		BOOST_LOG_TRIVIAL(warning) << "Cannot create a temporary beside " << path << " (" << ec.message() << "); writing in place";
+		return write_in_place(path, chunks, binary);
+	}
+#ifndef _WIN32
+	// Not on Windows, where a read-only bit on the temporary would stop the rename itself.
+	if (target_exists)
+		boost::filesystem::permissions(tmp_path, target.permissions(), bec);
+#endif
+	if (const std::error_code ec = rename_file(tmp_path, path)) {
+		boost::nowide::remove(tmp_path.c_str());
+		// A reader on Windows holding the target open without FILE_SHARE_DELETE,
+		// or a mount that cannot replace a file at all. Losing the save is worse
+		// than a reader seeing a partial file, so write in place the way this
+		// used to work before the atomic path existed.
+		BOOST_LOG_TRIVIAL(warning) << "Cannot replace " << path << " (" << ec.message() << "); writing in place";
+		return write_in_place(path, chunks, binary);
+	}
+	return {};
+}
+
 #ifdef __linux__
 // Copied from boost::filesystem.
 // Called by copy_file_linux() in case linux sendfile() API is not supported.
@@ -87,6 +87,7 @@
 #include "libslic3r/Model.hpp"
 #include "libslic3r/I18N.hpp"
 #include "libslic3r/PresetBundle.hpp"
+#include "libslic3r/InstanceLock.hpp"
 #include "libslic3r/Thread.hpp"
 #include "libslic3r/miniz_extension.hpp"
 #include "libslic3r/Utils.hpp"
@@ -3556,7 +3557,7 @@ bool GUI_App::on_init_inner()
            update_publish_status();
        }

-        if (m_post_initialized && app_config->dirty())
+        if (m_post_initialized && app_config->dirty() && app_config->save_due())
            app_config->save();

    });
@@ -7651,8 +7652,11 @@ void GUI_App::start_sync_user_preset(bool with_progress_dlg)

                            // Delete the bundle folder and bundle
                            fs::path bundle_folder = fs::path(bundle.path.c_str()).parent_path();
-                            boost::system::error_code ec;
-                            boost::filesystem::remove_all(bundle_folder, ec);
+                            {
+                                boost::system::error_code ec;
+                                InstanceLock instance_lock(user_presets_lock_path());
+                                boost::filesystem::remove_all(bundle_folder, ec);
+                            }

                            preset_bundle->bundles.WriteLock();
                            preset_bundle->bundles.m_bundles.erase(bundle.id);
@@ -8944,6 +8948,7 @@ void GUI_App::preset_deleted_from_cloud(std::string setting_id)

    // Delete the .info file after cloud deletion is confirmed
    if (!preset_file_path.empty() && fs::exists(fs::path(preset_file_path))) {
+        InstanceLock instance_lock(user_presets_lock_path());
        boost::nowide::remove(preset_file_path.c_str());
        BOOST_LOG_TRIVIAL(info) << "Deleted .info file after cloud confirmation: " << preset_file_path;
    }
@@ -9006,15 +9011,19 @@ void GUI_App::scan_orphaned_info_files()
            fs::path preset_file = info_file;
            preset_file.replace_extension(".json");

-            // If .json doesn't exist, .info is orphaned
-            if (!fs::exists(preset_file)) {
-                // Extract setting_id from .info file
-                std::string setting_id = extract_setting_id_from_info(info_file.string());
-                if (!setting_id.empty()) {
-                    // Add to need_delete_presets
-                    delete_preset_from_cloud(setting_id, info_file.string());
-                    BOOST_LOG_TRIVIAL(info) << "Found orphaned .info file on startup: " << info_file.string();
-                }
+            // If .json doesn't exist, .info is orphaned. Read under the lock, so a
+            // remove_files() in another instance is seen whole or not at all; the
+            // delete queue's own mutex is taken after the lock is released.
+            std::string setting_id;
+            {
+                InstanceLock instance_lock(user_presets_lock_path());
+                if (!fs::exists(preset_file))
+                    setting_id = extract_setting_id_from_info(info_file.string());
+            }
+            if (!setting_id.empty()) {
+                // Add to need_delete_presets
+                delete_preset_from_cloud(setting_id, info_file.string());
+                BOOST_LOG_TRIVIAL(info) << "Found orphaned .info file on startup: " << info_file.string();
            }
        }
        if (ec)
@@ -1478,9 +1478,7 @@ bool GuideFrame::BuildProfileDataFromVendors()
            return false;

        // Written through a temp file and moved into place, as the preset caches
-        // are: half a cache must never be readable, and the PID suffix keeps two
-        // instances from interleaving on one temp file.
-        const std::string tmp_path = cache_file.string() + "." + std::to_string(get_current_pid()) + ".tmp";
+        // are: half a cache must never be readable.
        try {
            json out;
            out["format"]  = 1;
@@ -1489,18 +1487,9 @@ bool GuideFrame::BuildProfileDataFromVendors()
            for (const char* key : { "model", "machine", "filament", "process" })
                profile[key] = m_ProfileJson[key];
            boost::filesystem::create_directories(cache_file.parent_path());
-            {
-                boost::nowide::ofstream ofs(tmp_path, std::ios::binary | std::ios::trunc);
-                ofs << out.dump(-1, ' ', false, json::error_handler_t::ignore);
-                ofs.close();
-                if (! ofs.good())
-                    throw std::runtime_error("write failed");
-            }
-            if (const std::error_code ec = rename_file(tmp_path, cache_file.string()))
+            if (const std::error_code ec = write_file_atomically(cache_file.string(), out.dump(-1, ' ', false, json::error_handler_t::ignore), /*binary=*/true))
                throw std::runtime_error(ec.message());
        } catch (const std::exception& e) {
-            boost::system::error_code rm;
-            boost::filesystem::remove(tmp_path, rm);
            BOOST_LOG_TRIVIAL(warning) << "GuideFrame: could not write the profile data cache: " << e.what();
        }
        return true;
@@ -2,6 +2,7 @@

 #include <algorithm>
 #include <sstream>
+#include <system_error>
 #include <exception>
 #include <boost/format.hpp>
 #include <boost/log/trivial.hpp>
@@ -580,9 +581,10 @@ bool C3DPrinterOS::save_api_session(const std::string &session, const std::strin
    j.put("session", session);
    j.put("email", email);
    try {
-        auto temp_path = m_api_session_file_path + ".tmp";
-        pt::write_json(temp_path, j);
-        boost::filesystem::rename(temp_path, m_api_session_file_path);
+        std::ostringstream json;
+        pt::write_json(json, j);
+        if (const std::error_code ec = write_file_atomically(m_api_session_file_path, json.str()))
+            throw std::system_error(ec);
    } catch (const std::exception &err) {
        BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << ": failed to write json to file. Path = "
                                 << m_api_session_file_path
@@ -1478,15 +1478,8 @@ void OrcaCloudServiceAgent::save_sync_state()
    if (sync_state_path.empty())
        return;

-    try {
-        std::string tmp_path = sync_state_path + ".tmp";
-        std::ofstream ofs(tmp_path, std::ios::out | std::ios::trunc);
-        if (ofs.good()) {
-            ofs << std::to_string(sync_state.last_sync_timestamp);
-            ofs.close();
-            boost::filesystem::rename(tmp_path, sync_state_path);
-        }
-    } catch (...) {}
+    if (const std::error_code ec = write_file_atomically(sync_state_path, std::to_string(sync_state.last_sync_timestamp)))
+        BOOST_LOG_TRIVIAL(warning) << "OrcaCloudServiceAgent: failed to save the sync state: " << ec.message();
 }

 void OrcaCloudServiceAgent::clear_sync_state()
@@ -1575,22 +1568,10 @@ void OrcaCloudServiceAgent::persist_user_secret(const std::string& secret)
            wxFileName::Mkdir(path.GetPath(), wxS_DIR_DEFAULT, wxPATH_MKDIR_FULL);
        }

-        const std::string tmp_path = secret_fallback_path + ".tmp";
-        std::ofstream ofs(tmp_path, std::ios::out | std::ios::trunc | std::ios::binary);
-        if (ofs.good()) {
-            ofs << signed_payload;
-            ofs.flush();
-            ofs.close();
-
-            if (wxRenameFile(wxString::FromUTF8(tmp_path.c_str()), wxString::FromUTF8(secret_fallback_path.c_str()), true)) {
-                stored = true;
-            } else {
-                wxRemoveFile(wxString::FromUTF8(tmp_path.c_str()));
-                BOOST_LOG_TRIVIAL(warning) << "OrcaCloudServiceAgent: failed to atomically replace user secret file";
-            }
-        } else {
-            BOOST_LOG_TRIVIAL(warning) << "OrcaCloudServiceAgent: cannot open user secret file for write - " << secret_fallback_path;
-        }
+        if (const std::error_code ec = write_file_atomically(secret_fallback_path, signed_payload, /*binary=*/true))
+            BOOST_LOG_TRIVIAL(warning) << "OrcaCloudServiceAgent: cannot write user secret file " << secret_fallback_path << ": " << ec.message();
+        else
+            stored = true;
    } else {
        // Use wxSecretStore only
        wxSecretStore store = wxSecretStore::GetDefault();
@@ -249,21 +249,10 @@ bool PluginConfig::save()
        return false;
    }

-    // Write to a PID-suffixed file and rename it into place, so a crash mid-write cannot truncate an
-    // existing config. Same approach as AppConfig::save().
-    const std::string path_pid = (boost::format("%1%.%2%") % path % get_current_pid()).str();
-
-    boost::nowide::ofstream file;
-    file.open(path_pid, std::ios::out | std::ios::trunc);
-    file << root.dump(1, '\t') << std::endl;
-    file.close();
-    if (file.fail()) {
-        BOOST_LOG_TRIVIAL(error) << "PluginConfig: failed to write " << path_pid << "; keeping the existing config";
-        return false;
-    }
-
-    if (const std::error_code rename_ec = rename_file(path_pid, path)) {
-        BOOST_LOG_TRIVIAL(error) << "PluginConfig: failed to move " << path_pid << " onto " << path << ": " << rename_ec.message();
+    // Written beside the target and moved into place, so a crash mid-write cannot truncate an
+    // existing config.
+    if (const std::error_code ec = write_file_atomically(path, root.dump(1, '\t') + "\n")) {
+        BOOST_LOG_TRIVIAL(error) << "PluginConfig: failed to write " << path << ": " << ec.message() << "; keeping the existing config";
        return false;
    }

@@ -57,6 +57,7 @@ add_executable(${_TEST_NAME}_tests
    # test_png_io.cpp
    test_indexed_triangle_set.cpp
    test_texture_displacement.cpp
+    test_instance_lock.cpp
    ../libnest2d/printer_parts.cpp
    )

@@ -508,158 +508,6 @@ TEST_CASE("load_from_json hands a preset's include list to the caller instead of
    CHECK(config.opt_string("machine_end_gcode") == "M84");
 }

-TEST_CASE("handle_legacy maps BambuStudio keys and values to their OrcaSlicer equivalents", "[Config]") {
-    struct Row { std::string key, value, expected_key, expected_value; };
-    const Row row = GENERATE(values<Row>({
-        {"role_base_wipe_speed", "0", "role_based_wipe_speed", "0"},
-        {"no_slow_down_for_cooling_on_outwalls", "1", "dont_slow_down_outer_wall", "1"},
-        {"process_notes", "note", "notes", "note"},
-        {"prime_tower_max_speed", "70", "wipe_tower_max_purge_speed", "70"},
-        {"enable_support_ironing", "1", "support_ironing", "1"},
-        {"sparse_infill_lattice_angle_1", "-30", "lateral_lattice_angle_1", "-30"},
-        {"sparse_infill_lattice_angle_2", "20", "lateral_lattice_angle_2", "20"},
-        {"lattice_angle_1", "-30", "lateral_lattice_angle_1", "-30"},
-        {"lattice_angle_2", "20", "lateral_lattice_angle_2", "20"},
-        {"sparse_infill_pattern", "2dlattice", "sparse_infill_pattern", "lateral-lattice"},
-        {"sparse_infill_pattern", "2dhoneycomb", "sparse_infill_pattern", "lateral-honeycomb"},
-        {"support_style", "tree_organic", "support_style", "organic"},
-        {"raft_first_layer_expansion", "-1", "raft_first_layer_expansion", "2"},
-        {"raft_first_layer_expansion", "3.5", "raft_first_layer_expansion", "3.5"},
-        {"ensure_vertical_shell_thickness", "enabled", "ensure_vertical_shell_thickness", "ensure_all"},
-        {"ensure_vertical_shell_thickness", "partial", "ensure_vertical_shell_thickness", "ensure_moderate"},
-        {"ensure_vertical_shell_thickness", "disabled", "ensure_vertical_shell_thickness", "none"},
-        {"top_one_wall_type", "not apply", "only_one_wall_top", "0"},
-        {"top_one_wall_type", "all top", "only_one_wall_top", "1"},
-        {"top_one_wall_type", "topmost", "only_one_wall_top", "1"},
-        {"prime_tower_rib_wall", "1", "wipe_tower_wall_type", "rib"},
-        {"prime_tower_rib_wall", "0", "wipe_tower_wall_type", "rectangle"},
-        {"prime_tower_rib_wall", "true", "wipe_tower_wall_type", "rib"},
-        // A rename touches whole entries, not keys that contain the old name.
-        {"different_settings_to_system", "lattice_angle_1;sparse_infill_lattice_angle_1;wall_loops", "different_settings_to_system",
-         "lateral_lattice_angle_1;lateral_lattice_angle_1;wall_loops"},
-        // different_settings_to_system and JSON arrays pass the key alone
-        {"prime_tower_rib_wall", "", "wipe_tower_wall_type", ""},
-        {"top_one_wall_type", "", "only_one_wall_top", ""},
-        {"enable_height_slowdown", "1", "", "1"},
-        {"counter_coef_2", "0.025", "", "0.025"},
-    }));
-    t_config_option_key key = row.key;
-    std::string value = row.value;
-    PrintConfigDef::handle_legacy(key, value);
-    INFO(row.key << " = " << row.value);
-    CHECK(key == row.expected_key);
-    CHECK(value == row.expected_value);
-}
-
-TEST_CASE("A BambuStudio project config loads its renamed settings without substitutions", "[Config]") {
-    ScopedTemporaryFile tmp(".json");
-    {
-        boost::nowide::ofstream ofs(tmp.string());
-        ofs << R"({"role_base_wipe_speed":"0","no_slow_down_for_cooling_on_outwalls":["1","0"],)"
-               R"("process_notes":"note","prime_tower_max_speed":"70","enable_support_ironing":"1",)"
-               R"("sparse_infill_pattern":"2dlattice","sparse_infill_lattice_angle_1":"-30",)"
-               R"("support_style":"tree_organic","ensure_vertical_shell_thickness":"partial",)"
-               R"("top_one_wall_type":"not apply","prime_tower_rib_wall":"0","raft_first_layer_expansion":"-1",)"
-               R"("enable_height_slowdown":["1"]})";
-    }
-    DynamicPrintConfig config = DynamicPrintConfig::full_print_config();
-    ConfigSubstitutionContext substitutions(ForwardCompatibilitySubstitutionRule::Disable);
-    std::map<std::string, std::string> key_values;
-    std::string reason;
-    REQUIRE(config.load_from_json(tmp.string(), substitutions, true, key_values, reason) == 0);
-    CHECK(substitutions.substitutions.empty());
-    CHECK(substitutions.unrecogized_keys == std::vector<std::string>{"enable_height_slowdown"});
-
-    CHECK_FALSE(config.opt_bool("role_based_wipe_speed"));
-    CHECK(config.option<ConfigOptionBools>("dont_slow_down_outer_wall")->values == std::vector<unsigned char>{1, 0});
-    CHECK(config.opt_string("notes") == "note");
-    CHECK_THAT(config.opt_float("wipe_tower_max_purge_speed"), Catch::Matchers::WithinAbs(70., 1e-9));
-    CHECK(config.opt_bool("support_ironing"));
-    CHECK(config.opt_enum<InfillPattern>("sparse_infill_pattern") == ipLateralLattice);
-    CHECK_THAT(config.opt_float("lateral_lattice_angle_1"), Catch::Matchers::WithinAbs(-30., 1e-9));
-    CHECK(config.opt_enum<SupportMaterialStyle>("support_style") == smsTreeOrganic);
-    CHECK(config.opt_enum<EnsureVerticalShellThickness>("ensure_vertical_shell_thickness") == evstModerate);
-    CHECK_FALSE(config.opt_bool("only_one_wall_top"));
-    CHECK(config.opt_enum<WipeTowerWallType>("wipe_tower_wall_type") == wtwRectangle);
-    CHECK_THAT(config.opt_float("raft_first_layer_expansion"), Catch::Matchers::WithinAbs(2., 1e-9));
-    CHECK(config.validate().count("raft_first_layer_expansion") == 0);
-}
-
-TEST_CASE("load_from_json reads a BambuStudio nil slot as not set", "[Config]") {
-    ScopedTemporaryFile tmp(".json");
-    {
-        boost::nowide::ofstream ofs(tmp.string());
-        // Keys after retraction_length in file order must still load.
-        ofs << R"({"layer_height":"0.2","retraction_length":["0.8","nil"],"wall_loops":"3","z_hop":["nil","nil"],)"
-               R"("z_hop_types":["Spiral Lift","nil"]})";
-    }
-    std::map<std::string, std::string> key_values;
-    std::string reason;
-
-    SECTION("a loader that doesn't merge onto a parent still rejects nil") {
-        DynamicPrintConfig config;
-        ConfigSubstitutionContext context(ForwardCompatibilitySubstitutionRule::Enable);
-        config.load_from_json(tmp.string(), context, true, key_values, reason);
-        CHECK_FALSE(reason.empty());
-    }
-
-    SECTION("a loader that opts in reads it as not set") {
-        DynamicPrintConfig config;
-        ConfigSubstitutionContext context(ForwardCompatibilitySubstitutionRule::Enable);
-        context.accept_nil = true;
-        REQUIRE(config.load_from_json(tmp.string(), context, true, key_values, reason) == 0);
-        CHECK(reason.empty());
-
-        const auto *default_length = static_cast<const ConfigOptionFloats*>(print_config_def.get("retraction_length")->default_value.get());
-        const auto &retraction_length = config.option<ConfigOptionFloats>("retraction_length")->values;
-        REQUIRE(retraction_length.size() == 2);
-        CHECK_THAT(retraction_length[0], Catch::Matchers::WithinAbs(0.8, 1e-9));
-        CHECK_THAT(retraction_length[1], Catch::Matchers::WithinAbs(default_length->get_at(1), 1e-9));
-
-        std::unique_ptr<ConfigOption> default_types(print_config_def.get("z_hop_types")->create_default_option());
-        const std::vector<std::string> type_defaults = static_cast<const ConfigOptionVectorBase*>(default_types.get())->vserialize();
-        CHECK(static_cast<const ConfigOptionVectorBase*>(config.option("z_hop_types"))->vserialize() ==
-              std::vector<std::string>{"Spiral Lift", type_defaults[1 % type_defaults.size()]});
-
-        CHECK(context.nil_slots == std::map<std::string, std::vector<size_t>>{{"retraction_length", {1}}, {"z_hop_types", {1}}});
-        CHECK_FALSE(config.has("z_hop"));
-        CHECK(config.opt_int("wall_loops") == 3);
-    }
-}
-
-TEST_CASE("A nozzle variant that was nil keeps the parent preset's value", "[Config]") {
-    auto printer = [](std::vector<double> nozzle_diameter, std::vector<double> retraction_length, std::vector<double> max_speed_x) {
-        DynamicPrintConfig config;
-        config.set_key_value("printer_extruder_variant", new ConfigOptionStrings({"Direct Drive Standard", "Direct Drive High Flow"}));
-        config.set_key_value("printer_extruder_id", new ConfigOptionInts({1, 1}));
-        // Not a per-variant key, so the merge copies it whole.
-        config.set_key_value("nozzle_diameter", new ConfigOptionFloats(nozzle_diameter));
-        config.set_key_value("retraction_length", new ConfigOptionFloats(retraction_length));
-        // Two values per variant: normal and silent mode.
-        config.set_key_value("machine_max_speed_x", new ConfigOptionFloats(max_speed_x));
-        return config;
-    };
-    auto check_values = [](const DynamicPrintConfig &config, const char *key, const std::vector<double> &expected) {
-        const std::vector<double> &values = config.option<ConfigOptionFloats>(key)->values;
-        INFO(key);
-        REQUIRE(values.size() == expected.size());
-        for (size_t i = 0; i < expected.size(); ++i)
-            CHECK_THAT(values[i], Catch::Matchers::WithinAbs(expected[i], 1e-9));
-    };
-    DynamicPrintConfig parent = printer({0.4, 0.6}, {0.6, 0.5}, {500, 200, 400, 100});
-    // The nil slots of the child hold the option default after loading.
-    DynamicPrintConfig child = printer({0.2, 0.4}, {0.8, 0.4}, {500, 200, 300, 90});
-    const std::map<std::string, std::vector<size_t>> nil_slots{{"nozzle_diameter", {1}}, {"retraction_length", {1}}, {"machine_max_speed_x", {3}}};
-
-    parent.update_diff_values_to_child_config(child, "printer_extruder_id", "printer_extruder_variant",
-                                              printer_options_with_variant_1, printer_options_with_variant_2, &nil_slots);
-
-    check_values(parent, "nozzle_diameter", {0.2, 0.6});
-    check_values(parent, "retraction_length", {0.8, 0.5});
-    // Only the silent-mode value of the second variant was nil.
-    check_values(parent, "machine_max_speed_x", {500, 200, 300, 100});
-}
-
 TEST_CASE("save_to_json writes the same document to a stream as to a file", "[Config]") {
    DynamicPrintConfig config;
    config.set_key_value("layer_height", new ConfigOptionFloat(0.2));
@@ -0,0 +1,228 @@
+#include <catch2/catch_all.hpp>
+
+#include <atomic>
+#include <chrono>
+#include <thread>
+
+#include <boost/filesystem.hpp>
+
+#include "libslic3r/InstanceLock.hpp"
+#include "test_utils.hpp"
+
+#ifdef _WIN32
+#include <boost/interprocess/sync/file_lock.hpp>
+#include <boost/nowide/convert.hpp>
+#include <boost/nowide/fstream.hpp>
+#else
+#include <fcntl.h>
+#include <sys/file.h>
+#include <unistd.h>
+#endif
+
+using namespace Slic3r;
+using namespace std::chrono_literals;
+
+// Sets a process-wide knob for one test and restores it however the test ends.
+template<typename T> struct ScopedStaticValue
+{
+    T &ref;
+    T  saved;
+    ScopedStaticValue(T &ref, T value) : ref(ref), saved(ref) { ref = value; }
+    ~ScopedStaticValue() { ref = saved; }
+};
+
+TEST_CASE("InstanceLock creates its lock file and holds it for the guard's scope", "[InstanceLock]")
+{
+    ScopedTemporaryFile lock_file(".lock");
+    const std::string   path = lock_file.string();
+
+    {
+        InstanceLock lock(path);
+        REQUIRE(lock.locked());
+        REQUIRE(boost::filesystem::exists(path));
+    }
+    // Released: a fresh guard gets the lock at once instead of waiting out a timeout.
+    const auto   started = std::chrono::steady_clock::now();
+    InstanceLock again(path, 5000ms);
+    REQUIRE(again.locked());
+    // Well inside the timeout it would otherwise have waited out; loose enough for a loaded runner.
+    REQUIRE(std::chrono::steady_clock::now() - started < 4000ms);
+}
+
+TEST_CASE("InstanceLock nests within one thread", "[InstanceLock]")
+{
+    ScopedTemporaryFile lock_file(".lock");
+    const std::string   path = lock_file.string();
+
+    InstanceLock outer(path);
+    {
+        InstanceLock inner(path, 100ms);
+        REQUIRE(inner.locked());
+    }
+    // The inner guard leaving does not release the outer one.
+    REQUIRE(outer.locked());
+}
+
+TEST_CASE("InstanceLock is a no-op for an empty path and survives an unwritable one", "[InstanceLock]")
+{
+    ScopedTemporaryDir dir;
+
+    InstanceLock none("");
+    REQUIRE_FALSE(none.locked());
+
+    // The directory does not exist, so the lock file cannot be created; the
+    // guard still constructs and the write it guards can go ahead.
+    InstanceLock unwritable((dir.path() / "missing" / "shared.lock").string(), 100ms);
+    REQUIRE_FALSE(unwritable.locked());
+}
+
+TEST_CASE("InstanceLock retries a lock file it could not open once the cool-down passes", "[InstanceLock]")
+{
+    ScopedTemporaryDir dir;
+    const std::string  path = (dir.path() / "later" / "shared.lock").string();
+    ScopedStaticValue  cooldown(InstanceLock::cooldown, 300ms);
+
+    bool before_dir, during_cooldown, after_cooldown;
+    const auto started = std::chrono::steady_clock::now();
+    {
+        InstanceLock lock(path, 100ms);
+        before_dir = lock.locked();
+    }
+    boost::filesystem::create_directories(dir.path() / "later");
+    {
+        InstanceLock lock(path, 100ms);
+        during_cooldown = lock.locked();
+    }
+    const bool second_guard_inside_cooldown = std::chrono::steady_clock::now() - started < InstanceLock::cooldown;
+    std::this_thread::sleep_for(400ms);
+    {
+        InstanceLock lock(path, 100ms);
+        after_cooldown = lock.locked();
+    }
+
+    REQUIRE_FALSE(before_dir);
+    // A loaded runner may take longer than the cool-down to get here; then the
+    // second guard legitimately retried, so only assert when the timing held.
+    if (second_guard_inside_cooldown)
+        REQUIRE_FALSE(during_cooldown);
+    REQUIRE(after_cooldown);
+}
+
+TEST_CASE("InstanceLock reopens a lock file that was replaced on disk", "[InstanceLock]")
+{
+    ScopedTemporaryFile lock_file(".lock");
+    const std::string   path = lock_file.string();
+    {
+        InstanceLock lock(path);
+        REQUIRE(lock.locked());
+    }
+
+    boost::filesystem::remove(path);
+    InstanceLock lock(path);
+    REQUIRE(lock.locked());
+    // Each outermost guard opens the file afresh, so the deleted path is back.
+    REQUIRE(boost::filesystem::exists(path));
+}
+
+TEST_CASE("InstanceLock serialises the threads of one process", "[InstanceLock]")
+{
+    ScopedTemporaryFile lock_file(".lock");
+    const std::string   path = lock_file.string();
+
+    std::atomic<bool> holder_ready{false};
+    std::atomic<bool> holder_released{false};
+    std::thread holder([&] {
+        InstanceLock lock(path);
+        holder_ready = true;
+        std::this_thread::sleep_for(150ms);
+        holder_released = true;
+    });
+    while (! holder_ready)
+        std::this_thread::yield();
+
+    bool released_before_acquire = false;
+    {
+        InstanceLock lock(path);
+        released_before_acquire = holder_released;
+    }
+    holder.join();
+    REQUIRE(released_before_acquire);
+}
+
+// Holds the OS lock on a file through a handle of its own, as another instance would. The lock
+// belongs to the handle on Windows and to the open file description elsewhere, so the guard's
+// handle is refused while this one holds it.
+class OtherHolder
+{
+public:
+    explicit OtherHolder(const std::string &path)
+    {
+#ifdef _WIN32
+        boost::nowide::ofstream(path, std::ios::app).close();
+        m_lock = boost::interprocess::file_lock(boost::nowide::widen(path).c_str());
+        m_held = m_lock.try_lock();
+#else
+        m_fd   = ::open(path.c_str(), O_RDWR | O_CREAT, 0644);
+        m_held = m_fd >= 0 && ::flock(m_fd, LOCK_EX | LOCK_NB) == 0;
+#endif
+    }
+    ~OtherHolder() { release(); }
+    OtherHolder(const OtherHolder &) = delete;
+    OtherHolder &operator=(const OtherHolder &) = delete;
+
+    bool held() const { return m_held; }
+    void release()
+    {
+#ifdef _WIN32
+        if (m_held)
+            m_lock.unlock();
+        m_lock = boost::interprocess::file_lock();
+#else
+        if (m_fd >= 0)
+            ::close(m_fd);
+        m_fd = -1;
+#endif
+        m_held = false;
+    }
+
+private:
+#ifdef _WIN32
+    boost::interprocess::file_lock m_lock;
+#else
+    int m_fd{-1};
+#endif
+    bool m_held{false};
+};
+
+TEST_CASE("InstanceLock yields to a lock held through another handle and reports it", "[InstanceLock]")
+{
+    ScopedTemporaryFile lock_file(".lock");
+    const std::string   path = lock_file.string();
+    ScopedStaticValue   cooldown(InstanceLock::cooldown, 300ms);
+
+    OtherHolder other(path);
+    REQUIRE(other.held());
+
+    bool locked_while_other_holds;
+    {
+        InstanceLock lock(path, 100ms);
+        locked_while_other_holds = lock.locked();
+    }
+    // The timed-out wait starts a cool-down: the next guard does not touch the file.
+    const auto started = std::chrono::steady_clock::now();
+    bool       locked_during_cooldown;
+    {
+        InstanceLock lock(path, 5000ms);
+        locked_during_cooldown = lock.locked();
+    }
+    const auto cooldown_wait = std::chrono::steady_clock::now() - started;
+    other.release();
+
+    REQUIRE_FALSE(locked_while_other_holds);
+    REQUIRE_FALSE(locked_during_cooldown);
+    REQUIRE(cooldown_wait < 4000ms);
+    // Once the cool-down passes, the lock the other holder released is taken again.
+    std::this_thread::sleep_for(400ms);
+    InstanceLock lock(path);
+    REQUIRE(lock.locked());
+}
@@ -5,6 +5,7 @@
 #include <fstream>

 #include "libslic3r/PresetBundle.hpp"
+#include "libslic3r/ParallelResolve.hpp"
 #include "libslic3r/AppConfig.hpp"
 #include "libslic3r/Model.hpp"
 #include "libslic3r/TriangleMesh.hpp"
@@ -17,6 +18,10 @@
 #include <iostream>
 #include <initializer_list>

+#ifndef _WIN32
+#include <unistd.h> // geteuid
+#endif
+
 using namespace Slic3r;

 namespace {
@@ -5956,3 +5961,214 @@ TEST_CASE("A filament's variant index follows the extruder type and nozzle volum
    // the filament defines no Bowden High Flow variant
    CHECK(PresetBundle::get_filament_variant_index(filament, printer, 1, nvtHighFlow) == 0);
 }
+
+TEST_CASE("A user preset saved over by another instance while its directory loads is read again under the lock", "[Preset][Bundle][InstanceLock]")
+{
+    ScopedTemporaryDir   temp_dir;
+    ScopedDataDir        data_dir_scope(temp_dir.path());
+    RenameTestCollection coll;
+
+    Preset &parent = add_inmemory_preset(coll, "Parent Process");
+    parent.config.option<ConfigOptionFloat>("layer_height", true)->value = 0.24;
+    parent.is_system = true;
+
+    // Fewer than one batch, so every file is read before the first one is committed.
+    constexpr int  children = 8;
+    static_assert(children <= int(resolve_batch_size));
+    const fs::path dir      = temp_dir.path() / PRESET_PRINT_NAME;
+    for (int i = 0; i < children; ++ i)
+        write_minimal_child(dir / ("Child " + std::to_string(i) + ".json"), "Child " + std::to_string(i), "Parent Process");
+
+    // The first commit stands in for another instance saving every other preset after
+    // they were read and before they are committed.
+    std::string first;
+    auto save_the_others = [&](Preset &preset) {
+        if (! first.empty())
+            return;
+        first = preset.name;
+        for (int i = 0; i < children; ++ i) {
+            const std::string name = "Child " + std::to_string(i);
+            if (name != first)
+                std::ofstream((dir / (name + ".json")).string())
+                    << R"({"type":"process","name":")" << name
+                    << R"(","from":"User","version":"1.0.0","inherits":"Parent Process","layer_height":"0.3"})";
+        }
+    };
+    PresetsConfigSubstitutions substitutions;
+    coll.load_presets(temp_dir.path().string(), PRESET_PRINT_NAME, substitutions,
+                      ForwardCompatibilitySubstitutionRule::Disable, save_the_others);
+
+    REQUIRE_FALSE(first.empty());
+    CHECK(coll.error_count() == 0);
+    for (int i = 0; i < children; ++ i) {
+        const std::string name  = "Child " + std::to_string(i);
+        const Preset     *child = coll.find_preset(name);
+        REQUIRE(child != nullptr);
+        CHECK_THAT(child->config.opt_float("layer_height"), Catch::Matchers::WithinAbs(name == first ? 0.24 : 0.3, 1e-9));
+    }
+}
+
+TEST_CASE("A user preset removed by another instance while its directory loads is not installed", "[Preset][Bundle][InstanceLock]")
+{
+    ScopedTemporaryDir   temp_dir;
+    ScopedDataDir        data_dir_scope(temp_dir.path());
+    RenameTestCollection coll;
+
+    Preset &parent = add_inmemory_preset(coll, "Parent Process");
+    parent.is_system = true;
+
+    // Fewer than one batch, so every file is read before the first one is committed.
+    constexpr int  children = 8;
+    static_assert(children <= int(resolve_batch_size));
+    const fs::path dir      = temp_dir.path() / PRESET_PRINT_NAME;
+    for (int i = 0; i < children; ++ i)
+        write_minimal_child(dir / ("Child " + std::to_string(i) + ".json"), "Child " + std::to_string(i), "Parent Process");
+
+    std::string first;
+    auto remove_the_others = [&](Preset &preset) {
+        if (! first.empty())
+            return;
+        first = preset.name;
+        for (int i = 0; i < children; ++ i)
+            if (const std::string name = "Child " + std::to_string(i); name != first)
+                fs::remove(dir / (name + ".json"));
+    };
+    PresetsConfigSubstitutions substitutions;
+    coll.load_presets(temp_dir.path().string(), PRESET_PRINT_NAME, substitutions,
+                      ForwardCompatibilitySubstitutionRule::Disable, remove_the_others);
+
+    REQUIRE_FALSE(first.empty());
+    CHECK(coll.error_count() == 0);
+    CHECK(coll.size() == 3); // the default preset, the parent and the first child
+    CHECK(coll.find_preset(first) != nullptr);
+}
+
+TEST_CASE("Without the instance lock a user preset loads but its file is not written back", "[Preset][Bundle][InstanceLock]")
+{
+    ScopedTemporaryDir temp_dir;
+    ScopedDataDir      data_dir_scope(temp_dir.path());
+    // A directory where the lock file belongs, so the lock cannot be taken.
+    fs::create_directories(fs::path(user_presets_lock_path()));
+    PresetBundle       bundle;
+    const fs::path     file = temp_dir.path() / PRESET_FILAMENT_NAME / "My PLA @Test Printer.json";
+    write_preset_with_inherits(bundle.filaments.default_preset().config, file, "My PLA @Test Printer", std::string());
+    const std::string before = read_file(file);
+
+    PresetsConfigSubstitutions substitutions;
+    bundle.filaments.load_presets(temp_dir.path().string(), PRESET_FILAMENT_NAME, substitutions,
+                                  ForwardCompatibilitySubstitutionRule::EnableSilent);
+
+    const Preset *preset = bundle.filaments.find_preset("My PLA @Test Printer");
+    REQUIRE(preset != nullptr);
+    CHECK(preset->config.option<ConfigOptionStrings>("compatible_printers")->values == std::vector<std::string>{ "Test Printer" });
+    CHECK(read_file(file) == before);
+}
+
+#ifndef _WIN32
+// File permissions stop reading only on POSIX.
+TEST_CASE("A user preset that cannot be read under the instance lock is counted and removed", "[Preset][Bundle][InstanceLock]")
+{
+    if (::geteuid() == 0)
+        SKIP("file permissions do not stop root");
+    ScopedTemporaryDir   temp_dir;
+    ScopedDataDir        data_dir_scope(temp_dir.path());
+    RenameTestCollection coll;
+
+    Preset &parent = add_inmemory_preset(coll, "Parent Process");
+    parent.is_system = true;
+    const fs::path file = temp_dir.path() / PRESET_PRINT_NAME / "Unreadable.json";
+    write_minimal_child(file, "Unreadable", "Parent Process");
+    fs::permissions(file, fs::no_perms);
+
+    PresetsConfigSubstitutions substitutions;
+    coll.load_presets(temp_dir.path().string(), PRESET_PRINT_NAME, substitutions,
+                      ForwardCompatibilitySubstitutionRule::Disable);
+
+    CHECK(coll.error_count() == 1);
+    CHECK(coll.find_preset("Unreadable") == nullptr);
+    CHECK_FALSE(fs::exists(file));
+}
+#endif
+
+#ifndef _WIN32
+// Creating a symlink needs no privilege only on POSIX.
+TEST_CASE("A user preset that is a symlink to itself is counted and removed while the rest still load", "[Preset][Bundle][InstanceLock]")
+{
+    ScopedTemporaryDir   temp_dir;
+    ScopedDataDir        data_dir_scope(temp_dir.path());
+    RenameTestCollection coll;
+
+    Preset &parent = add_inmemory_preset(coll, "Parent Process");
+    parent.is_system = true;
+    const fs::path dir = temp_dir.path() / PRESET_PRINT_NAME;
+    write_minimal_child(dir / "Good A.json", "Good A", "Parent Process");
+    write_minimal_child(dir / "Good B.json", "Good B", "Parent Process");
+    const fs::path loop = dir / "Loop.json";
+    fs::create_symlink(loop.filename(), loop);
+
+    PresetsConfigSubstitutions substitutions;
+    REQUIRE_NOTHROW(coll.load_presets(temp_dir.path().string(), PRESET_PRINT_NAME, substitutions,
+                                      ForwardCompatibilitySubstitutionRule::Disable));
+
+    CHECK(coll.error_count() == 1);
+    CHECK(coll.find_preset("Good A") != nullptr);
+    CHECK(coll.find_preset("Good B") != nullptr);
+    CHECK(coll.find_preset("Loop") == nullptr);
+    boost::system::error_code ec;
+    CHECK(fs::symlink_status(loop, ec).type() == fs::file_not_found);
+}
+#endif
+
+#ifndef _WIN32
+// Creating a symlink needs no privilege only on POSIX.
+TEST_CASE("A user preset symlinked to a missing target is counted but the link is kept", "[Preset][Bundle][InstanceLock]")
+{
+    ScopedTemporaryDir   temp_dir;
+    ScopedDataDir        data_dir_scope(temp_dir.path());
+    RenameTestCollection coll;
+
+    const fs::path dir  = temp_dir.path() / PRESET_PRINT_NAME;
+    const fs::path link = dir / "Linked.json";
+    fs::create_directories(dir);
+    fs::create_symlink(temp_dir.path() / "unmounted" / "Linked.json", link);
+
+    PresetsConfigSubstitutions substitutions;
+    coll.load_presets(temp_dir.path().string(), PRESET_PRINT_NAME, substitutions,
+                      ForwardCompatibilitySubstitutionRule::Disable);
+
+    CHECK(coll.error_count() == 1);
+    CHECK(coll.find_preset("Linked") == nullptr);
+    boost::system::error_code ec;
+    CHECK(fs::symlink_status(link, ec).type() == fs::symlink_file);
+}
+#endif
+
+#ifndef _WIN32
+// The read-only bit on a directory stops file creation only on POSIX.
+TEST_CASE("A user filament whose derived compatible printer cannot be written back still loads with the failure counted", "[Preset][Bundle]")
+{
+    if (::geteuid() == 0)
+        SKIP("a read-only directory does not stop root");
+    ScopedTemporaryDir temp_dir;
+    PresetBundle       bundle;
+    const fs::path     dir  = temp_dir.path() / PRESET_FILAMENT_NAME;
+    const fs::path     file = dir / "My PLA @Test Printer.json";
+    write_preset_with_inherits(bundle.filaments.default_preset().config, file, "My PLA @Test Printer", std::string());
+    const std::string before = read_file(file);
+
+    fs::permissions(file, fs::owner_read);
+    fs::permissions(dir, fs::owner_read | fs::owner_exe);
+    PresetsConfigSubstitutions substitutions;
+    bundle.filaments.load_presets(temp_dir.path().string(), PRESET_FILAMENT_NAME, substitutions,
+                                  ForwardCompatibilitySubstitutionRule::EnableSilent);
+    // Restored before any assertion, so a failure never leaves an unremovable directory behind.
+    fs::permissions(dir, fs::owner_all);
+    fs::permissions(file, fs::owner_read | fs::owner_write);
+
+    const Preset *preset = bundle.filaments.find_preset("My PLA @Test Printer");
+    REQUIRE(preset != nullptr);
+    CHECK(preset->config.option<ConfigOptionStrings>("compatible_printers")->values == std::vector<std::string>{ "Test Printer" });
+    CHECK(bundle.filaments.error_count() == 1);
+    CHECK(read_file(file) == before);
+}
+#endif
@@ -10,6 +10,8 @@
 #include <cctype>
 #include <fstream>
 #include <string>
+#include <thread>
+#include <system_error>

 #ifndef _WIN32
 #include <unistd.h>     // getuid
@@ -62,6 +64,113 @@ TEST_CASE("per-user temp root is unchanged on Windows, isolated elsewhere", "[ut
 #endif
 }

+TEST_CASE("write_file_atomically replaces the target and leaves no temporary file", "[utils]") {
+    ScopedTemporaryDir dir;
+    const boost::filesystem::path target = dir.path() / "preset.json";
+
+    REQUIRE_FALSE(write_file_atomically(target.string(), "first"));
+    REQUIRE_FALSE(write_file_atomically(target.string(), "second"));
+
+    std::string content;
+    load_string_file(target, content);
+    REQUIRE(content == "second");
+    size_t entries = 0;
+    for (auto &entry : boost::filesystem::directory_iterator(dir.path())) {
+        (void) entry;
+        ++entries;
+    }
+    REQUIRE(entries == 1);
+}
+
+TEST_CASE("write_file_atomically reports a missing directory and writes nothing", "[utils]") {
+    ScopedTemporaryDir dir;
+    const boost::filesystem::path target = dir.path() / "missing" / "preset.json";
+
+    const std::error_code ec = write_file_atomically(target.string(), "x");
+    REQUIRE(ec == std::errc::no_such_file_or_directory);
+    REQUIRE_FALSE(boost::filesystem::exists(target));
+}
+
+#ifndef _WIN32
+// The read-only bit on a directory stops file creation only on POSIX.
+TEST_CASE("write_file_atomically writes in place when no temporary can be created beside an existing target", "[utils]") {
+    if (::geteuid() == 0)
+        SKIP("a read-only directory does not stop root");
+    ScopedTemporaryDir dir;
+    const boost::filesystem::path target = dir.path() / "preset.json";
+    REQUIRE_FALSE(write_file_atomically(target.string(), "first"));
+    boost::filesystem::permissions(dir.path(), boost::filesystem::owner_read | boost::filesystem::owner_exe);
+
+    const std::error_code replaced = write_file_atomically(target.string(), "second");
+    const std::error_code created  = write_file_atomically((dir.path() / "new.json").string(), "x");
+    // Restored before any assertion, so a failure never leaves an unremovable directory behind.
+    boost::filesystem::permissions(dir.path(), boost::filesystem::owner_all);
+
+    REQUIRE_FALSE(replaced);
+    REQUIRE(created == std::errc::permission_denied);
+    std::string content;
+    load_string_file(target, content);
+    REQUIRE(content == "second");
+}
+#endif
+
+TEST_CASE("write_file_atomically keeps bytes intact in binary mode", "[utils]") {
+    ScopedTemporaryDir dir;
+    const boost::filesystem::path target = dir.path() / "blob.bin";
+    const std::string bytes("a\r\nb\0c", 6);
+
+    REQUIRE_FALSE(write_file_atomically(target.string(), bytes, /*binary=*/true));
+    REQUIRE(boost::filesystem::file_size(target) == bytes.size());
+}
+
+#ifndef _WIN32
+TEST_CASE("write_file_atomically writes through a symlink and keeps the target's permissions", "[utils]") {
+    ScopedTemporaryDir dir;
+    const boost::filesystem::path real = dir.path() / "real.json";
+    const boost::filesystem::path link = dir.path() / "link.json";
+    REQUIRE_FALSE(write_file_atomically(real.string(), "first"));
+    boost::filesystem::permissions(real, boost::filesystem::owner_read | boost::filesystem::owner_write);
+    boost::filesystem::create_symlink(real, link);
+
+    REQUIRE_FALSE(write_file_atomically(link.string(), "second"));
+
+    REQUIRE(boost::filesystem::is_symlink(boost::filesystem::symlink_status(link)));
+    std::string content;
+    load_string_file(real, content);
+    REQUIRE(content == "second");
+
+    REQUIRE_FALSE(write_file_atomically(real.string(), "third"));
+    const auto perms = boost::filesystem::status(real).permissions() & boost::filesystem::all_all;
+    REQUIRE(perms == (boost::filesystem::owner_read | boost::filesystem::owner_write));
+}
+#endif
+
+TEST_CASE("write_file_atomically survives two threads writing one target", "[utils]") {
+    ScopedTemporaryDir dir;
+    const boost::filesystem::path target = dir.path() / "shared.json";
+    const std::string a(20000, 'a'), b(20000, 'b');
+
+    std::thread other([&] {
+        for (int i = 0; i < 50; ++i)
+            write_file_atomically(target.string(), a);
+    });
+    for (int i = 0; i < 50; ++i)
+        write_file_atomically(target.string(), b);
+    other.join();
+
+    std::string content;
+    load_string_file(target, content);
+    const bool whole = content == a || content == b;
+    REQUIRE(whole);
+    // No temporary may be left; a scanner on Windows may briefly hold the old
+    // file under another name, so only the temporaries are counted.
+    size_t temporaries = 0;
+    for (auto &entry : boost::filesystem::directory_iterator(dir.path()))
+        if (entry.path().extension() == ".tmp")
+            ++temporaries;
+    REQUIRE(temporaries == 0);
+}
+
 TEST_CASE("copy_file reports the OS error when the destination cannot be written", "[utils]") {
    ScopedTemporaryFile source(".txt");
    {
@@ -1804,24 +1804,6 @@ TEST_CASE("a header claiming more body than the file holds is rejected", "[Vendo
    REQUIRE_FALSE(bundle.load_vendor_cache(cache, "Bounded", Semver(1, 0, 0)));
 }

-TEST_CASE("a failed write leaves the previous cache in place", "[VendorCache]")
-{
-    TempDir tmp;
-    const std::string cache = (tmp.path / "Durable.opc").string();
-    REQUIRE(save_one_vendor(cache, one_vendor("Durable"), "Durable", "1.0.0"));
-    const std::string before = slurp(cache);
-
-    // A directory where the temp file wants to go: the write cannot complete,
-    // and must not have destroyed what was already there to find that out.
-    const fs::path blocker = fs::path(cache + "." + std::to_string(get_current_pid()) + ".tmp");
-    fs::create_directories(blocker);
-
-    REQUIRE_FALSE(save_one_vendor(cache, one_vendor("Durable"), "Durable", "2.0.0"));
-    CHECK(slurp(cache) == before);
-
-    fs::remove_all(blocker);
-}
-
 TEST_CASE("a cache written by another build's option ordering still loads", "[VendorCache]")
 {
    // The regression the fingerprint used to prevent by refusing the file