Run the Cross-Process Lock Test on Every Platform

The test that checks the guard yields to a lock held elsewhere forked a child to hold it, so it was left out on Windows. The OS lock belongs to the handle on Windows and to the open file description elsewhere, so a second handle in the same process is refused like another instance would be. The test now holds the lock that way and runs everywhere.
Lock Config and Preset Files Across Instances and Write Them Atomically
2026-10-02 21:31:16 +00:00 · 2026-10-01 15:00:32 +08:00 · 2026-10-01 15:00:32 +08:00 · 2026-10-01 14:57:30 +08:00 · 2026-10-01 14:42:20 +08:00 · 2026-10-01 14:41:50 +08:00
39 changed files with 1390 additions and 285 deletions
@@ -151,6 +151,12 @@ elseif(APPLE)
    # the post-install -add_rpath below.
    set(_python_ldflags "${_python_arch_flags} -Wl,-headerpad_max_install_names")

+    # The macOS 27 SDK declares pipe2() and dup3() as available from macOS 27, so
+    # configure finds them and CPython 3.12 calls them without a runtime check.
+    # Below a macOS 27 deployment target they are weak-linked and resolve to NULL
+    # on older systems, where os.pipe() then segfaults -- in `make install`
+    # (compileall, ensurepip) and in the shipped app alike. Every configure below
+    # keeps the pipe()/dup2() fallbacks (python/cpython#153711).
    if(IS_CROSS_COMPILE)
        set(_python_build_tgt --build=${_python_build_arch}-apple-darwin --host=${_python_host_arch}-apple-darwin)
        set(_python_build_arch_flags "-arch ${_python_build_arch_flag} -mmacosx-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET}")
@@ -174,7 +180,8 @@ elseif(APPLE)
                 --enable-shared \
                 --without-static-libpython \
                 --disable-test-modules \
-                 --build=${_python_build_arch}-apple-darwin && \
+                 --build=${_python_build_arch}-apple-darwin \
+                 ac_cv_func_pipe2=no ac_cv_func_dup3=no && \
             make -j${NPROC} python && \
             cd '<SOURCE_DIR>' && \
             env \
@@ -191,6 +198,7 @@ elseif(APPLE)
                 --without-static-libpython \
                 --with-openssl='${DESTDIR}' \
                 --disable-test-modules \
+                 ac_cv_func_pipe2=no ac_cv_func_dup3=no \
                 ${_python_build_tgt} \
                 --with-build-python='${_python_build_python}' \
                 py_cv_module__tkinter=n/a"
@@ -213,6 +221,8 @@ elseif(APPLE)
            --with-openssl=${DESTDIR}
            --disable-test-modules
            ${_python_build_tgt}
+            ac_cv_func_pipe2=no
+            ac_cv_func_dup3=no
            # Tcl/Tk 9.0 (e.g. from Homebrew) is incompatible with CPython 3.12's
            # _tkinter; OrcaSlicer's embedded Python does not need tkinter anyway.
            py_cv_module__tkinter=n/a
@@ -5,6 +5,7 @@
 //BBS
 #include "Preset.hpp"
 #include "Exception.hpp"
+#include "InstanceLock.hpp"
 #include "LocalesUtils.hpp"
 #include "Thread.hpp"
 #include "format.hpp"
@@ -743,10 +744,13 @@ static bool verify_config_file_checksum(boost::nowide::ifstream &ifs)


 #ifdef USE_JSON_CONFIG
-std::string AppConfig::load()
+std::string AppConfig::load(bool read_only)
 {
    json j;

+    // Keep another instance from replacing or restoring the file mid-read.
+    InstanceLock instance_lock(read_only ? std::string() : lock_path());
+
    // 1) Read the complete config file into a boost::property_tree.
    namespace pt = boost::property_tree;
    pt::ptree tree;
@@ -996,7 +1000,6 @@ void AppConfig::save()
    // The config is first written to a file with a PID suffix and then moved
    // to avoid race conditions with multiple instances of Slic3r
    const auto path = config_path();
-    std::string path_pid = (boost::format("%1%.%2%") % path % get_current_pid()).str();

    json j;

@@ -1126,43 +1129,18 @@ void AppConfig::save()

        j["local_machines"][local_machine.first] = m_json;
    }
-    boost::nowide::ofstream c;
-    c.open(path_pid, std::ios::out | std::ios::trunc);
-    c << j.dump(1, '\t') << std::endl;
-
-#ifdef WIN32
-    // WIN32 specific: The final "rename_file()" call is not safe in case of an application crash, there is no atomic "rename file" API
-    // provided by Windows (sic!). Therefore we save a MD5 checksum to be able to verify file corruption. In addition,
-    // we save the config file into a backup first before moving it to the final destination.
-    c << appconfig_md5_hash_line(j.dump(1, '\t'));
-#endif
-
-    c.close();
-    if (c.fail()) {
-      BOOST_LOG_TRIVIAL(error) << "Failed to write new configuration to " << path_pid << "; aborting attempt to overwrite original configuration";
-      return;
-    }
-
-#ifdef WIN32
-    // Make a backup of the configuration file before copying it to the final destination.
-    std::string error_message;
-    std::string backup_path = (boost::format("%1%.bak") % path).str();
-    // Copy configuration file with PID suffix into the configuration file with "bak" suffix.
-    if (copy_file(path_pid, backup_path, error_message, false) != SUCCESS)
-        BOOST_LOG_TRIVIAL(error) << "Copying from " << path_pid << " to " << backup_path << " failed. Failed to create a backup configuration.";
-#endif
-
-    // Rename the config atomically.
-    // On Windows, the rename is likely NOT atomic, thus it may fail if PrusaSlicer crashes on another thread in the meanwhile.
-    // To cope with that, we already made a backup of the config on Windows.
-    rename_file(path_pid, path);
-    m_dirty = false;
+    const std::string config_str = j.dump(1, '\t');
+    if (write_config_file(path, config_str + "\n", config_str))
+        m_dirty = false;
 }

 #else

-std::string AppConfig::load()
+std::string AppConfig::load(bool read_only)
 {
+    // Keep another instance from replacing or restoring the file mid-read.
+    InstanceLock instance_lock(read_only ? std::string() : lock_path());
+
    // 1) Read the complete config file into a boost::property_tree.
    namespace pt = boost::property_tree;
    pt::ptree tree;
@@ -1300,7 +1278,6 @@ void AppConfig::save()
    // The config is first written to a file with a PID suffix and then moved
    // to avoid race conditions with multiple instances of Slic3r
    const auto path = config_path();
-    std::string path_pid = (boost::format("%1%.%2%") % path % get_current_pid()).str();

    std::stringstream config_ss;
    if (m_mode == EAppMode::Editor)
@@ -1336,39 +1313,39 @@ void AppConfig::save()
    // One empty line before the MD5 sum.
    config_ss << std::endl;

-    std::string config_str = config_ss.str();
-    boost::nowide::ofstream c;
-    c.open(path_pid, std::ios::out | std::ios::trunc);
-    c << config_str;
-#ifdef WIN32
-    // WIN32 specific: The final "rename_file()" call is not safe in case of an application crash, there is no atomic "rename file" API
-    // provided by Windows (sic!). Therefore we save a MD5 checksum to be able to verify file corruption. In addition,
-    // we save the config file into a backup first before moving it to the final destination.
-    c << appconfig_md5_hash_line(config_str);
-#endif
-    c.close();
-    if (c.fail()) {
-      BOOST_LOG_TRIVIAL(error) << "Failed to write new configuration to " << path_pid << "; aborting attempt to overwrite original configuration";
-      return;
-    }
-
-#ifdef WIN32
-    // Make a backup of the configuration file before copying it to the final destination.
-    std::string error_message;
-    std::string backup_path = (boost::format("%1%.bak") % path).str();
-    // Copy configuration file with PID suffix into the configuration file with "bak" suffix.
-    if (copy_file(path_pid, backup_path, error_message, false) != SUCCESS)
-        BOOST_LOG_TRIVIAL(error) << "Copying from " << path_pid << " to " << backup_path << " failed. Failed to create a backup configuration.";
-#endif
-
-    // Rename the config atomically.
-    // On Windows, the rename is likely NOT atomic, thus it may fail if PrusaSlicer crashes on another thread in the meanwhile.
-    // To cope with that, we already made a backup of the config on Windows.
-    rename_file(path_pid, path);
-    m_dirty = false;
+    const std::string config_str = config_ss.str();
+    if (write_config_file(path, config_str, config_str))
+        m_dirty = false;
 }
 #endif

+bool AppConfig::write_config_file(const std::string &path, std::string body, const std::string &checksum_source)
+{
+    // Everything before this is assembly; only the writes need the other instances kept out.
+    InstanceLock instance_lock(lock_path());
+#ifdef WIN32
+    // WIN32 specific: the final replace is not safe in case of an application crash, there is no atomic "rename file" API
+    // provided by Windows (sic!). Therefore we save a MD5 checksum to be able to verify file corruption. In addition,
+    // we save the config file into a backup first before moving it to the final destination.
+    body += appconfig_md5_hash_line(checksum_source);
+#endif
+    // Not flushed to the device: the idle handler saves on the GUI thread after
+    // any change, and the rename already gives a complete old or new file.
+    if (const std::error_code ec = write_file_atomically(path, body)) {
+        BOOST_LOG_TRIVIAL(error) << "Failed to write the configuration " << path << ": " << ec.message() << "; trying again in 10 s";
+        m_retry_save_at = std::chrono::steady_clock::now() + std::chrono::seconds(10);
+        return false;
+    }
+    m_retry_save_at = {};
+#ifdef WIN32
+    // Written after the config, so the backup never holds a state that was not confirmed written.
+    const std::string backup_path = (boost::format("%1%.bak") % path).str();
+    if (const std::error_code ec = write_file_atomically(backup_path, body))
+        BOOST_LOG_TRIVIAL(error) << "Failed to write the backup configuration " << backup_path << ": " << ec.message();
+#endif
+    return true;
+}
+
 bool AppConfig::get_variant(const std::string &vendor, const std::string &model, const std::string &variant) const
 {
    const auto it_v = m_vendors.find(vendor);
@@ -1857,6 +1834,11 @@ void AppConfig::reset_selections()
    }
 }

+std::string AppConfig::lock_path()
+{
+    return Slic3r::data_dir().empty() ? std::string() : config_path() + ".lock";
+}
+
 std::string AppConfig::config_path()
 {
 #ifdef USE_JSON_CONFIG
@@ -1893,7 +1875,7 @@ bool AppConfig::exists()

 std::string AppConfig::load_if_exists()
 {
-    return boost::filesystem::exists(loading_path()) ? load() : std::string();
+    return boost::filesystem::exists(loading_path()) ? load(/*read_only=*/true) : std::string();
 }

 }; // namespace Slic3r
@@ -2,6 +2,7 @@
 #define slic3r_AppConfig_hpp_

 #include <set>
+#include <chrono>
 #include <map>
 #include <string>
 #include "nlohmann/json.hpp"
@@ -122,14 +123,18 @@ public:

 	// Load the slic3r.ini from a user profile directory (or a datadir, if configured).
 	// Return an error string, or an empty string on success.
-	std::string         load();
+	std::string         load(bool read_only = false);
 	// Treat a missing config as default state; otherwise load it normally.
+	// The CLI's load: it never saves, so it takes no lock and creates no lock file.
 	std::string         load_if_exists();
 	// Store the slic3r.ini into a user profile directory (or a datadir, if configured).
 	void 			   	save();

 	// Does this config need to be saved?
 	bool 				dirty() const { return m_dirty; }
+	// False for ten seconds after a failed write, so the idle handler does not
+	// repeat a hopeless attempt on every event; an explicit save() always tries.
+	bool 				save_due() const { return std::chrono::steady_clock::now() >= m_retry_save_at; }


 	void				set_dirty() { m_dirty = true; }
@@ -339,6 +344,8 @@ public:

 	// Get the default config path from Slic3r::data_dir().
 	std::string			config_path();
+	// Lock file guarding config_path() against other running instances; empty without a data dir.
+	std::string			lock_path();

 	// Returns true if the user's data directory comes from before Slic3r 1.40.0 (no updating)
 	bool 				legacy_datadir() const { return m_legacy_datadir; }
@@ -449,8 +456,16 @@ private:

 	// Preset for each machine
 	MachineSettingMap											m_printer_settings;
+	// Writes the assembled config text, and on Windows its checksum and a backup copy; false when the
+	// config itself could not be written, in which case the caller stays dirty and retries. `checksum_source`
+	// is the text load() will verify, which for the JSON config ends before the trailing newline.
+	bool												write_config_file(const std::string &path, std::string body, const std::string &checksum_source);
+
 	// Has any value been modified since the config.ini has been last saved or loaded?
 	bool														m_dirty;
+	// After a failed write, save_due() is false for the next ten seconds, so the
+	// idle handler does not repeat a hopeless write on every event.
+	std::chrono::steady_clock::time_point						m_retry_save_at{};
 	// Original version found in the ini file before it was overwritten
 	Semver                                                      m_orig_version;
 	// Whether the existing version is before system profiles & configuration updating
@@ -306,6 +306,8 @@ set(lisbslic3r_sources
    Geometry/VoronoiUtils.cpp
    Geometry/VoronoiUtils.hpp
    Geometry/VoronoiVisualUtils.hpp
+    InstanceLock.cpp
+    InstanceLock.hpp
    Int128.hpp
    KDTreeIndirect.hpp
    Layer.cpp
@@ -1538,12 +1538,10 @@ void ConfigBase::save_to_json(const std::string &file, const std::string &name,
    // Serialize first: if that throws (invalid UTF-8), the existing file stays untouched.
    std::ostringstream ss;
    this->save_to_json(ss, name, from, version);
-    boost::nowide::ofstream c;
-    c.open(file, std::ios::out | std::ios::trunc);
-    c << ss.str();
-    c.close();
-
-    BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << ":" <<__LINE__ << boost::format(", saved config to %1%\n")%file;
+    if (const std::error_code ec = write_file_atomically(file, ss.str()))
+        BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << boost::format(": failed to save config to %1%: %2%") % file % ec.message();
+    else
+        BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << ":" <<__LINE__ << boost::format(", saved config to %1%\n")%file;
 }

 void ConfigBase::save_to_json(std::ostream &os, const std::string &name, const std::string &from, const std::string &version, bool replace_invalid_utf8) const
@@ -0,0 +1,165 @@
+#include "InstanceLock.hpp"
+
+#include <map>
+#include <memory>
+#include <system_error>
+#include <thread>
+
+#include <boost/filesystem.hpp>
+#include <boost/log/trivial.hpp>
+#include <boost/nowide/fstream.hpp>
+#ifdef _WIN32
+#include <boost/interprocess/sync/file_lock.hpp>
+#include <boost/nowide/convert.hpp>
+#else
+#include <cerrno>
+#include <fcntl.h>
+#include <sys/file.h>
+#include <unistd.h>
+#endif
+
+namespace Slic3r {
+
+#ifdef _WIN32
+// LockFileEx, held by this handle alone.
+using NativeFileLock = boost::interprocess::file_lock;
+#else
+// flock(2) rather than an fcntl lock: it belongs to this open file description,
+// so any other code in the process that opens and closes the lock file, as a
+// backup or an export walking the data dir might, cannot drop it. An fcntl
+// lock would go with the first such close.
+class NativeFileLock
+{
+public:
+    explicit NativeFileLock(const char *path) : m_fd(::open(path, O_RDWR | O_CREAT | O_CLOEXEC, 0644))
+    {
+        if (m_fd < 0)
+            throw std::system_error(errno, std::generic_category(), path);
+    }
+    ~NativeFileLock() { ::close(m_fd); }
+    bool try_lock()
+    {
+        if (::flock(m_fd, LOCK_EX | LOCK_NB) == 0)
+            return true;
+        // A signal (a child exiting, for one) interrupts the call like any other; the caller polls again.
+        if (errno == EWOULDBLOCK || errno == EINTR)
+            return false;
+        throw std::system_error(errno, std::generic_category(), "flock");
+    }
+    void unlock() { ::flock(m_fd, LOCK_UN); }
+private:
+    int m_fd;
+};
+#endif
+
+// One slot per lock file, shared by every guard in the process: one lock
+// object per path behind a mutex is what makes the guard re-entrant and safe
+// to use from the preset sync thread and the GUI thread at once. The lock
+// file is opened by the outermost guard and closed when it goes, so the file
+// is never held open between guards: whatever is at the path is what gets
+// locked, and a data dir can be removed once nothing is saving into it. The
+// file is kept rather than deleted on release because the lock state lives in
+// the kernel on the open file, and deleting it would let a third instance
+// lock a fresh file while the second still holds the old one.
+struct InstanceLock::Slot
+{
+    std::recursive_mutex mutex;
+    // Non-null exactly while this process holds the file lock.
+    std::unique_ptr<NativeFileLock> file_lock;
+    int  depth{0};
+    // Until this point, after a guard could not open, lock or wait out the
+    // file, guards do not touch it.
+    std::chrono::steady_clock::time_point cooldown_until{};
+};
+
+InstanceLock::Slot &InstanceLock::slot_for(const std::string &lock_file_path)
+{
+    // Never freed: a save during static destruction still needs its slot.
+    static auto *registry_mutex = new std::mutex();
+    static auto *registry       = new std::map<std::string, std::unique_ptr<Slot>>();
+
+    std::lock_guard<std::mutex> guard(*registry_mutex);
+    std::unique_ptr<Slot> &slot = (*registry)[lock_file_path];
+    if (! slot)
+        slot = std::make_unique<Slot>();
+    return *slot;
+}
+
+// Starts the cool-down. Called with the slot mutex held.
+void InstanceLock::defer(Slot &slot, const std::string &reason)
+{
+    slot.cooldown_until = std::chrono::steady_clock::now() + cooldown;
+    BOOST_LOG_TRIVIAL(warning) << reason << "; proceeding without the lock for the next " << cooldown.count() << " ms";
+}
+
+// Creates the lock file if needed and opens it, or starts the cool-down.
+// Called with the slot mutex held.
+bool InstanceLock::open_lock_file(Slot &slot, const std::string &lock_file_path)
+{
+    try {
+#ifdef _WIN32
+        // The lock opens an existing file; created once, on the first miss.
+        const std::wstring wide_path = boost::nowide::widen(lock_file_path);
+        try {
+            slot.file_lock = std::make_unique<NativeFileLock>(wide_path.c_str());
+        } catch (const std::exception &) {
+            boost::nowide::ofstream(lock_file_path, std::ios::app).close();
+            slot.file_lock = std::make_unique<NativeFileLock>(wide_path.c_str());
+        }
+#else
+        slot.file_lock = std::make_unique<NativeFileLock>(lock_file_path.c_str());
+#endif
+        return true;
+    } catch (const std::exception &e) {
+        defer(slot, "Cannot open lock file " + lock_file_path + ": " + e.what() + " (check its owner and permissions)");
+        return false;
+    }
+}
+
+InstanceLock::InstanceLock(const std::string &lock_file_path, std::chrono::milliseconds timeout)
+{
+    if (lock_file_path.empty())
+        return;
+    m_slot       = &slot_for(lock_file_path);
+    m_slot_guard = std::unique_lock<std::recursive_mutex>(m_slot->mutex);
+    const auto now = std::chrono::steady_clock::now();
+    if (m_slot->depth == 0 && now >= m_slot->cooldown_until && open_lock_file(*m_slot, lock_file_path)) {
+        const auto deadline = now + timeout;
+        bool       taken    = false;
+        for (;;) {
+            try {
+                if ((taken = m_slot->file_lock->try_lock()))
+                    break;
+            } catch (const std::exception &e) {
+                defer(*m_slot, "Cannot lock " + lock_file_path + ": " + e.what());
+                break;
+            }
+            if (std::chrono::steady_clock::now() >= deadline) {
+                defer(*m_slot, "Another instance has held " + lock_file_path + " for over " + std::to_string(timeout.count()) + " ms");
+                break;
+            }
+            std::this_thread::sleep_for(std::chrono::milliseconds(5));
+        }
+        if (! taken)
+            m_slot->file_lock.reset();
+    }
+    // Counted last, so a throw above leaves the slot exactly as it was found.
+    ++ m_slot->depth;
+    m_locked = m_slot->file_lock != nullptr;
+}
+
+InstanceLock::~InstanceLock()
+{
+    if (m_slot == nullptr)
+        return;
+    if (-- m_slot->depth == 0 && m_slot->file_lock) {
+        try {
+            m_slot->file_lock->unlock();
+        } catch (const std::exception &e) {
+            BOOST_LOG_TRIVIAL(warning) << "Cannot unlock instance lock: " << e.what();
+        }
+        m_slot->file_lock.reset();
+    }
+}
+
+} // namespace Slic3r
@@ -0,0 +1,60 @@
+#pragma once
+
+#include <chrono>
+#include <mutex>
+#include <string>
+
+namespace Slic3r {
+
+// Scoped write lock on a file shared by every running instance of the
+// application, such as the app config or the user preset directory: threads
+// of this process are serialised through a recursive mutex, other processes
+// through an advisory OS file lock on `lock_file_path`. The lock file is
+// created on first use and kept; the OS releases the lock when its holder
+// exits, so a crashed instance never leaves a stale lock behind.
+//
+// Best effort: when the lock file cannot be opened or locked, or another
+// instance still holds it after `timeout`, the guard keeps only the in-process
+// mutex, locked() reports false and the write proceeds, since a hung instance
+// must never block another one from saving. For `cooldown` afterwards guards
+// leave the file alone. The wait for the in-process mutex is bounded only by
+// the longest critical section, so a guard covers a few file operations and
+// nothing slower.
+//
+// Lock order: the preset collection mutex may be held when a guard is taken
+// (set_sync_info_and_save() calls save_info() under it), never the reverse;
+// that is why the guards sit at the leaf readers and writers and why a guard
+// must not be added around save_user_presets(), which takes the collection
+// mutex through delete_preset().
+class InstanceLock
+{
+public:
+    // Long against a critical section of milliseconds, short against the GUI
+    // thread, which is where most guards are taken.
+    static constexpr std::chrono::milliseconds default_timeout{1000};
+    // Long enough that a holder stuck in a debugger does not cost a stall per
+    // save; mutable so tests can shorten it.
+    static inline std::chrono::milliseconds cooldown{10000};
+
+    // An empty path makes the guard a no-op.
+    explicit InstanceLock(const std::string &lock_file_path, std::chrono::milliseconds timeout = default_timeout);
+    ~InstanceLock();
+
+    InstanceLock(const InstanceLock &) = delete;
+    InstanceLock &operator=(const InstanceLock &) = delete;
+
+    // True while this process holds the cross-process file lock.
+    bool locked() const { return m_locked; }
+
+private:
+    struct Slot;
+    static Slot &slot_for(const std::string &lock_file_path);
+    static bool  open_lock_file(Slot &slot, const std::string &lock_file_path);
+    static void  defer(Slot &slot, const std::string &reason);
+
+    Slot *m_slot{nullptr};
+    std::unique_lock<std::recursive_mutex> m_slot_guard;
+    bool  m_locked{false};
+};
+
+} // namespace Slic3r
@@ -360,7 +360,7 @@ void Layer::simplify_support_entity_collection(ExtrusionEntityCollection* entity
 //BBS: method to simplify support path
 void Layer::simplify_support_path(ExtrusionPath * path)
 {
-    const PrintConfig &print_config = this->object()->print()->config();
+    const auto print_config = this->object()->print()->config();
    const bool spiral_mode = print_config.spiral_mode;
    const bool enable_arc_fitting = print_config.enable_arc_fitting;
    const auto scaled_resolution = scaled<double>(print_config.resolution.value);
@@ -375,7 +375,7 @@ void Layer::simplify_support_path(ExtrusionPath * path)
 //BBS: method to simplify support path
 void Layer::simplify_support_multi_path(ExtrusionMultiPath* multipath)
 {
-    const PrintConfig &print_config = this->object()->print()->config();
+    const auto print_config = this->object()->print()->config();
    const bool spiral_mode = print_config.spiral_mode;
    const bool enable_arc_fitting = print_config.enable_arc_fitting;
    const auto scaled_resolution = scaled<double>(print_config.resolution.value);
@@ -392,7 +392,7 @@ void Layer::simplify_support_multi_path(ExtrusionMultiPath* multipath)
 //BBS: method to simplify support path
 void Layer::simplify_support_loop(ExtrusionLoop* loop)
 {
-    const PrintConfig &print_config = this->object()->print()->config();
+    const auto print_config = this->object()->print()->config();
    const bool spiral_mode = print_config.spiral_mode;
    const bool enable_arc_fitting = print_config.enable_arc_fitting;
    const auto scaled_resolution = scaled<double>(print_config.resolution.value);
@@ -1074,7 +1074,7 @@ void LayerRegion::simplify_entity_collection(ExtrusionEntityCollection* entity_c

 void LayerRegion::simplify_path(ExtrusionPath* path)
 {
-    const PrintConfig &print_config = this->layer()->object()->print()->config();
+    const auto print_config = this->layer()->object()->print()->config();
    const bool spiral_mode = print_config.spiral_mode;
    const bool enable_arc_fitting = print_config.enable_arc_fitting;
    const auto scaled_resolution = scaled<double>(print_config.resolution.value);
@@ -1092,7 +1092,7 @@ void LayerRegion::simplify_path(ExtrusionPath* path)

 void LayerRegion::simplify_multi_path(ExtrusionMultiPath* multipath)
 {
-    const PrintConfig &print_config = this->layer()->object()->print()->config();
+    const auto print_config = this->layer()->object()->print()->config();
    const bool spiral_mode = print_config.spiral_mode;
    const bool enable_arc_fitting = print_config.enable_arc_fitting;
    const auto scaled_resolution = scaled<double>(print_config.resolution.value);
@@ -1112,7 +1112,7 @@ void LayerRegion::simplify_multi_path(ExtrusionMultiPath* multipath)

 void LayerRegion::simplify_loop(ExtrusionLoop* loop)
 {
-    const PrintConfig &print_config = this->layer()->object()->print()->config();
+    const auto print_config = this->layer()->object()->print()->config();
    const bool spiral_mode = print_config.spiral_mode;
    const bool enable_arc_fitting = print_config.enable_arc_fitting;
    const auto scaled_resolution = scaled<double>(print_config.resolution.value);
@@ -51,6 +51,9 @@
 #include "libslic3r.h"
 #include "LifecycleEvents.hpp"
 #include "Utils.hpp"
+#include "InstanceLock.hpp"
+
+#include <sstream>
 #include "Time.hpp"
 #include "PlaceholderParser.hpp"
 #include "libslic3r/GCode/Thumbnails.hpp"
@@ -107,6 +110,32 @@ std::string get_preset_canonical_name(const std::string &preset_bare_name, const
    }
 }

+std::string user_presets_lock_path(bool read_only)
+{
+    return read_only || data_dir().empty() ? std::string() : (fs::path(data_dir()) / (PRESET_USER_DIR ".lock")).string();
+}
+
+// Removes a preset file the scan could not load, and its .info, under the lock.
+// The scan passes read_only when it could not take the lock, since the file may
+// then be another instance's fresh write that it merely raced.
+static void remove_preset_files(const std::string &preset_file, bool read_only)
+{
+    if (read_only)
+        return;
+    InstanceLock instance_lock(user_presets_lock_path());
+    // A symlink whose target is missing stays, since the target may come back; one
+    // that cannot even be followed is removed like any other unreadable file.
+    auto remove = [](const fs::path &file) {
+        boost::system::error_code ec;
+        if (fs::status(file, ec).type() != fs::file_not_found)
+            fs::remove(file, ec);
+    };
+    fs::path file_path(preset_file);
+    remove(file_path);
+    file_path.replace_extension(".info");
+    remove(file_path);
+}
+
 std::string get_preset_bare_name(const std::string &canonical_name)
 {
    const auto pos = canonical_name.find_last_of('/');
@@ -649,18 +678,20 @@ void Preset::save_info(std::string file)
        file = idx_file.string();
    }

-    boost::nowide::ofstream c;
-    c.open(file, std::ios::out | std::ios::trunc);
    std::string sync_info_to_save;
    //BBS: hold is used for stop requesting to server this time
    if (this->sync_info.compare("hold") != 0)
        sync_info_to_save = this->sync_info;
+    std::ostringstream c;
    c << "sync_info" << " = " << sync_info_to_save << std::endl;
    c << "user_id" << " = " << this->user_id << std::endl;
    c << "setting_id" << " = " << this->setting_id << std::endl;
    c << "base_id" << " = " << this->base_id << std::endl;
    c << "updated_time" << " = " << std::to_string(this->updated_time) << std::endl;
-    c.close();
+
+    InstanceLock instance_lock(user_presets_lock_path());
+    if (const std::error_code ec = write_file_atomically(file, c.str()))
+        BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << ": failed to save " << file << ": " << ec.message();
 }

 void Preset::remove_files(bool cloud_already_deleted)
@@ -669,6 +700,7 @@ void Preset::remove_files(bool cloud_already_deleted)
    if (this->is_project_embedded) {
        return;
    }
+    InstanceLock instance_lock(user_presets_lock_path());
    // Erase the preset file.
    boost::nowide::remove(this->file.c_str());
    fs::path idx_path(this->file);
@@ -686,11 +718,11 @@ void Preset::remove_files(bool cloud_already_deleted)
 }

 //BBS: add logic for only difference save
-void Preset::save(DynamicPrintConfig* parent_config)
+bool Preset::save(DynamicPrintConfig* parent_config)
 {
    //BBS: add project embedded preset logic
    if (this->is_project_embedded)
-        return;
+        return true;
    //BBS: change to json format
    //this->config.save(this->file);
    std::string from_str;
@@ -705,12 +737,16 @@ void Preset::save(DynamicPrintConfig* parent_config)
    else
        from_str = std::string("Default");

-    boost::filesystem::create_directories(fs::path(this->file).parent_path());
    const std::string bare_name = get_preset_bare_name(this->name);

+    // What gets written: the diff against the parent, the config plus its
+    // filament id, or the config as is. Built before the lock is taken so the
+    // exclusive window covers only the file writes.
+    DynamicPrintConfig        temp_config;
+    const DynamicPrintConfig *to_save = &this->config;
+
    //BBS: only save difference if it has parent
    if (parent_config) {
-        DynamicPrintConfig temp_config;
        std::vector<std::string> dirty_options = config.diff(*parent_config);

        std::string extruder_id_name, extruder_variant_name;
@@ -746,13 +782,22 @@ void Preset::save(DynamicPrintConfig* parent_config)
                    opt_dst->set(opt_src);
            }
        }
-        temp_config.save_to_json(this->file, bare_name, from_str, this->version.to_string());
+        to_save = &temp_config;
    } else if (!filament_id.empty() && inherits().empty()) {
-        DynamicPrintConfig temp_config = config;
+        temp_config = config;
        temp_config.set_key_value(BBL_JSON_KEY_FILAMENT_ID, new ConfigOptionString(filament_id));
-        temp_config.save_to_json(this->file, bare_name, from_str, this->version.to_string());
-    } else {
-        this->config.save_to_json(this->file, bare_name, from_str, this->version.to_string());
+        to_save = &temp_config;
+    }
+
+    std::ostringstream json;
+    to_save->save_to_json(json, bare_name, from_str, this->version.to_string());
+
+    InstanceLock instance_lock(user_presets_lock_path());
+    boost::filesystem::create_directories(fs::path(this->file).parent_path());
+    if (const std::error_code ec = write_file_atomically(this->file, json.str())) {
+        // No .info either: one without its preset reads as a cloud deletion request.
+        BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << ": failed to save " << this->file << ": " << ec.message();
+        return false;
    }
    BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << " save config for: " << this->name << " and filament_id: " << filament_id << " and base_id: " << this->base_id;

@@ -762,6 +807,7 @@ void Preset::save(DynamicPrintConfig* parent_config)
        idx_file.replace_extension(".info");
        this->save_info(idx_file.string());
    }
+    return true;
 }

 void Preset::reload(Preset const &parent)
@@ -773,6 +819,7 @@ void Preset::reload(Preset const &parent)
    std::string                        reason;
    ForwardCompatibilitySubstitutionRule substitution_rule    = ForwardCompatibilitySubstitutionRule::Disable;
    try {
+        InstanceLock instance_lock(user_presets_lock_path());
        ConfigSubstitutions                config_substitutions = config.load_from_json(file, substitution_rule, key_values, reason);
        this->config = parent.config;
        this->config.apply(std::move(config));
@@ -1702,6 +1749,22 @@ std::string PresetCollection::canonical_preset_name(const std::string &name, con
    return get_preset_canonical_name(parsed.bare, origin);
 }

+PresetCollection::PresetFilesOnDisk PresetCollection::PresetFilesOnDisk::read(const boost::filesystem::path &file)
+{
+    auto read_if_present = [](const fs::path &path) -> std::optional<std::string> {
+        std::string bytes;
+        try {
+            load_string_file(path, bytes);
+        } catch (const std::exception &) {
+            return std::nullopt;
+        }
+        return bytes;
+    };
+    fs::path info_path(file);
+    info_path.replace_extension(".info");
+    return { read_if_present(file), read_if_present(info_path) };
+}
+
 PresetCollection::UserPresetLoad PresetCollection::resolve_user_preset(
    const boost::filesystem::path &file, const std::string &canonical_name,
    const PresetOrigin &load_origin, ForwardCompatibilitySubstitutionRule substitution_rule,
@@ -1713,6 +1776,9 @@ PresetCollection::UserPresetLoad PresetCollection::resolve_user_preset(
    Preset &preset = out.preset;
    preset.bundle_id = load_origin.bundle_id;
    preset.file = file.string();
+    // Before either file is parsed, so a save that lands during the parse still shows
+    // up as a difference when commit compares.
+    out.on_disk = PresetFilesOnDisk::read(file);
    // Load the preset file, apply preset values on top of defaults.
    try {
        fs::path idx_path(preset.file);
@@ -1825,14 +1891,8 @@ void PresetCollection::commit_user_preset(UserPresetLoad &&loaded, std::deque<Pr
        ++m_errors;
        BOOST_LOG_TRIVIAL(error) << error;
    }
-    if (loaded.discard_file && !read_only) {
-        fs::path file_path(loaded.preset.file);
-        if (fs::exists(file_path))
-            fs::remove(file_path);
-        file_path.replace_extension(".info");
-        if (fs::exists(file_path))
-            fs::remove(file_path);
-    }
+    if (loaded.discard_file)
+        remove_preset_files(loaded.preset.file, read_only);
    if (!loaded.install)
        return;

@@ -1840,9 +1900,12 @@ void PresetCollection::commit_user_preset(UserPresetLoad &&loaded, std::deque<Pr
        if (loaded.save_compatible_printers) {
            // A filesystem error from the rewrite is counted, and the preset still loads.
            try {
-                if (!read_only)
-                    preset.save(nullptr);
-                BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << " added compatible_printers for preset: " << preset.name;
+                if (read_only)
+                    BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << " added compatible_printers for preset: " << preset.name << " (not written back)";
+                else if (preset.save(nullptr))
+                    BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << " added compatible_printers for preset: " << preset.name;
+                else
+                    ++m_errors; // save() logged why
            } catch (const std::runtime_error &err) {
                ++m_errors;
                BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << " can not write compatible_printers back to " << preset.file << ": " << err.what();
@@ -1928,11 +1991,32 @@ void PresetCollection::load_presets(
            return this->resolve_user_preset(files[i].path, files[i].canonical_name, resolved_origin, substitution_rule,
                                             extruder_id_name, extruder_variant_name, key_set1, key_set2);
        },
-        [&](size_t, UserPresetLoad &&loaded) {
+        [&](size_t i, UserPresetLoad &&loaded) {
+            // Resolve read the files without the lock, so another instance may have saved
+            // over them since. A file that changed is resolved again under the lock before
+            // commit removes or rewrites it, which also keeps its .json and .info from two
+            // different saves apart. Without the lock nothing is checked, so commit leaves
+            // the files alone.
+            const std::string lock_path = user_presets_lock_path(read_only);
+            InstanceLock      instance_lock(lock_path);
+            if (instance_lock.locked()) {
+                const PresetFilesOnDisk   on_disk = PresetFilesOnDisk::read(files[i].path);
+                boost::system::error_code ec;
+                // The link itself, and a stat error counts as present, so a file that is
+                // there but cannot be read is still counted and removed by commit.
+                if (! on_disk.json && fs::symlink_status(files[i].path, ec).type() == fs::file_not_found)
+                    return; // removed by another instance since it was read
+                if (! (on_disk == loaded.on_disk)) {
+                    CNumericLocalesSetter locales_setter;
+                    loaded = this->resolve_user_preset(files[i].path, files[i].canonical_name, resolved_origin, substitution_rule,
+                                                       extruder_id_name, extruder_variant_name, key_set1, key_set2);
+                }
+            }
+            const bool leave_files = read_only || (! lock_path.empty() && ! instance_lock.locked());
            // Committing can remove an unreadable preset's file, and a filesystem error
            // there is reported without stopping the rest of the directory.
            try {
-                this->commit_user_preset(std::move(loaded), presets_loaded, substitutions, preset_loaded_fn, read_only);
+                this->commit_user_preset(std::move(loaded), presets_loaded, substitutions, preset_loaded_fn, leave_files);
            } catch (const std::runtime_error &err) {
                errors_cummulative += err.what();
                errors_cummulative += "\n";
@@ -2242,7 +2326,10 @@ void PresetCollection::set_sync_info_and_save(std::string name, std::string sett
            preset->setting_id = setting_id;
            if (update_time > 0)
                preset->updated_time = update_time;
-            preset->sync_info == "update" ? preset->save(nullptr) : preset->save_info();
+            if (preset->sync_info == "update")
+                preset->save(nullptr);
+            else
+                preset->save_info();
            break;
        }
    }
@@ -4311,8 +4398,15 @@ void PhysicalPrinter::update_preset_names_in_config()
    }
 }

+void PhysicalPrinter::save(DynamicPrintConfig* /* parent_config */)
+{
+    InstanceLock instance_lock(user_presets_lock_path());
+    this->config.save_to_json(this->file, std::string("Physical_Printer"), std::string("User"), std::string(SLIC3R_VERSION));
+}
+
 void PhysicalPrinter::save(const std::string& file_name_from, const std::string& file_name_to)
 {
+    InstanceLock instance_lock(user_presets_lock_path());
    // rename the file
    boost::nowide::rename(file_name_from.data(), file_name_to.data());
    this->file = file_name_to;
@@ -4444,6 +4538,7 @@ void PhysicalPrinterCollection::load_printers(
                continue;
            }
            try {
+                InstanceLock instance_lock(user_presets_lock_path());
                PhysicalPrinter printer(name, this->default_config());
                printer.file = dir_entry.path().string();
                // Load the preset file, apply preset values on top of defaults.
@@ -4636,7 +4731,10 @@ bool PhysicalPrinterCollection::delete_printer(const std::string& name)

    const PhysicalPrinter& printer = *it;
    // Erase the preset file.
-    boost::nowide::remove(printer.file.c_str());
+    {
+        InstanceLock instance_lock(user_presets_lock_path());
+        boost::nowide::remove(printer.file.c_str());
+    }
    m_printers.erase(it);
    return true;
 }
@@ -4648,7 +4746,10 @@ bool PhysicalPrinterCollection::delete_selected_printer()
    const PhysicalPrinter& printer = this->get_selected_printer();

    // Erase the preset file.
-    boost::nowide::remove(printer.file.c_str());
+    {
+        InstanceLock instance_lock(user_presets_lock_path());
+        boost::nowide::remove(printer.file.c_str());
+    }
    // Remove the preset from the list.
    m_printers.erase(m_printers.begin() + m_idx_selected);
    // unselect all printers
@@ -8,6 +8,7 @@
 #include <unordered_set>
 #include <functional>
 #include <mutex>
+#include <optional>
 #include <boost/algorithm/string/predicate.hpp>
 #include <boost/filesystem/path.hpp>
 #include <boost/property_tree/ptree_fwd.hpp>
@@ -330,7 +331,8 @@ public:

    //BBS: add logic for only difference save
    //if parent_config is null, save all keys, otherwise, only save difference
-    void                save(DynamicPrintConfig* parent_config);
+    // Returns false when the preset file could not be written.
+    bool                save(DynamicPrintConfig* parent_config);
    void                reload(Preset const & parent);

    // Return a label of this preset, consisting of a name and a "(modified)" suffix, if this preset is dirty.
@@ -497,6 +499,12 @@ std::string get_preset_canonical_name(const std::string &preset_bare_name, const
 // Tail segment of a canonical name — what's written to the bundle's .json filename and JSON "name" field.
 std::string get_preset_bare_name(const std::string &canonical_name);

+// Lock file guarding every user preset file under data_dir() against other
+// running instances and the preset sync thread. Empty without a data dir, and
+// for a read-only load (the CLI), which never rewrites or deletes and may run
+// many jobs on one data dir.
+std::string user_presets_lock_path(bool read_only = false);
+
 // Resolve an origin from a directory path when the caller passes Kind::Auto.
 PresetOrigin detect_origin_from_path(const boost::filesystem::path &path, const PresetOrigin &explicit_origin = PresetOrigin());

@@ -906,6 +914,16 @@ protected:
    void            set_custom_preset_alias(Preset &preset);

 private:
+    // A preset file and its .info as read from disk, std::nullopt for one that is missing.
+    struct PresetFilesOnDisk
+    {
+        std::optional<std::string> json;
+        std::optional<std::string> info;
+
+        static PresetFilesOnDisk read(const boost::filesystem::path &file);
+        bool operator==(const PresetFilesOnDisk &rhs) const { return json == rhs.json && info == rhs.info; }
+    };
+
    // One preset file read and flattened against the presets already in this
    // collection, before anything the collection shares has been touched.
    struct UserPresetLoad
@@ -923,6 +941,9 @@ private:
        bool        discard_file { false };
        // The .info file read beside the preset, which commit logs.
        std::string info_file;
+        // Both files as they were before the preset was read from them. Resolve runs
+        // without the instance lock, so commit compares this with the disk under it.
+        PresetFilesOnDisk on_disk;
        // Counted and logged by commit, in the order the directory listed the files.
        std::vector<std::string>   errors;
        PresetsConfigSubstitutions substitutions;
@@ -1111,7 +1132,7 @@ public:

    //BBS: change to json format
    //void                save() { this->config.save(this->file); }
-    void                save(DynamicPrintConfig* parent_config) { this->config.save_to_json(this->file, std::string("Physical_Printer"), std::string("User"), std::string(SLIC3R_VERSION)); }
+    void                save(DynamicPrintConfig* parent_config);
    void                save(const std::string& file_name_from, const std::string& file_name_to);

    void                update_from_preset(const Preset& preset);
@@ -1,3 +1,4 @@
+#include <atomic>
 #include <cassert>
 #include <chrono>
 #include <ctime>
@@ -13,6 +14,7 @@
 #include "libslic3r.h"
 #include "I18N.hpp"
 #include "Utils.hpp"
+#include "InstanceLock.hpp"
 #include "LocalesUtils.hpp"
 #include "Model.hpp"
 #include "TriangleSelector.hpp"
@@ -1272,6 +1274,13 @@ PresetsConfigSubstitutions PresetBundle::load_user_presets(std::string user, For

    const auto user_load_t0 = std::chrono::steady_clock::now();

+    // Reads one bundle's metadata under the lock, per file, so the lock is never
+    // held when bundles.WriteLock() is taken afterwards.
+    auto load_bundle_metadata = [read_only](const fs::path &metadata_file, BundleMetadata &metadata) {
+        InstanceLock instance_lock(user_presets_lock_path(read_only));
+        return metadata.load_from_json(metadata_file.string());
+    };
+
    // Load bundle metadata from _local directory first
    fs::path local_dir(folder / PRESET_LOCAL_DIR);
    if (fs::exists(local_dir)) {
@@ -1285,7 +1294,7 @@ PresetsConfigSubstitutions PresetBundle::load_user_presets(std::string user, For
            if (!fs::exists(metadata_file)) continue;

            BundleMetadata metadata;
-            if (!metadata.load_from_json(metadata_file.string())) continue;
+            if (!load_bundle_metadata(metadata_file, metadata)) continue;
            metadata.print_presets.clear();
            metadata.filament_presets.clear();
            metadata.printer_presets.clear();
@@ -1320,7 +1329,7 @@ PresetsConfigSubstitutions PresetBundle::load_user_presets(std::string user, For
            if (!fs::exists(metadata_file)) continue;

            BundleMetadata metadata;
-            if (!metadata.load_from_json(metadata_file.string())) continue;
+            if (!load_bundle_metadata(metadata_file, metadata)) continue;
            metadata.print_presets.clear();
            metadata.filament_presets.clear();
            metadata.printer_presets.clear();
@@ -1654,10 +1663,12 @@ PresetsConfigSubstitutions PresetBundle::import_presets(std::vector<std::string>
            if (ec) BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << " create directory failed: " << ec.message();
            //create temp folder
            //std::string user_default_temp_dir = data_dir() + "/" + PRESET_USER_DIR + "/" + DEFAULT_USER_FOLDER_NAME + "/" + "temp";
-            fs::path temp_folder(configs_folder / "temp");
+            // Under cache/, per process and per import, so two instances importing
+            // at once do not clear each other's extraction and no preset scan reads it.
+            static std::atomic<unsigned> import_counter{0};
+            fs::path temp_folder(fs::path(data_dir()) / "cache" / ("import." + std::to_string(get_current_pid()) + "." + std::to_string(import_counter++)));
            std::string user_default_temp_dir = temp_folder.make_preferred().string();
-            if (fs::exists(temp_folder)) fs::remove_all(temp_folder);
-            fs::create_directory(temp_folder, ec);
+            fs::create_directories(temp_folder, ec);
            if (ec) BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << " create directory failed: " << ec.message();

            file = boost::filesystem::path(file).make_preferred().string();
@@ -1669,6 +1680,9 @@ PresetsConfigSubstitutions PresetBundle::import_presets(std::vector<std::string>
            status        = mz_zip_reader_init_cfile(&zip_archive, zipFile, 0, MZ_ZIP_FLAG_CASE_SENSITIVE | MZ_ZIP_FLAG_IGNORE_PATH);
            if (MZ_FALSE == status) {
                BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << " Failed to initialize reader ZIP archive";
+                if (zipFile != nullptr)
+                    std::fclose(zipFile);
+                fs::remove_all(temp_folder, ec);
                return substitutions;
            } else {
                BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << " Success to initialize reader ZIP archive";
@@ -2276,10 +2290,9 @@ void PresetBundle::remove_user_presets_directory(const std::string preset_folder
        return;
    }
    BOOST_LOG_TRIVIAL(debug) << __FUNCTION__ << boost::format(" enter, delete directory : %1%") % dir_user_presets;
-    fs::path folder(dir_user_presets);
-    if (fs::exists(folder)) {
-        fs::remove_all(folder);
-    }
+    boost::system::error_code ec;
+    InstanceLock instance_lock(user_presets_lock_path());
+    fs::remove_all(fs::path(dir_user_presets), ec);
 }

 void PresetBundle::update_system_preset_setting_ids(std::map<std::string, std::map<std::string, std::string>>& system_presets)
@@ -8213,9 +8226,13 @@ bool BundleMetadata::save_to_json(const std::string& path) const
        j["filament_presets"] = strip_prefix(this->filament_presets);                                                                                                                                                                                                                       
        j["printer_presets"] = strip_prefix(this->printer_presets);

-        boost::nowide::ofstream ofs(path);
-        ofs << j.dump(4);
-        return ofs.good();
+        const std::string content = j.dump(4);
+        InstanceLock instance_lock(user_presets_lock_path());
+        if (const std::error_code ec = write_file_atomically(path, content)) {
+            BOOST_LOG_TRIVIAL(error) << "Failed to save bundle metadata to " << path << ": " << ec.message();
+            return false;
+        }
+        return true;
    } catch (const std::exception& e) {
        BOOST_LOG_TRIVIAL(error) << "Failed to save bundle metadata to " << path << ": " << e.what();
        return false;
@@ -400,46 +400,24 @@ bool write_cache_blob(const std::string& path, const std::string& blob)
 {
    boost::crc_32_type crc;
    crc.process_bytes(blob.data(), blob.size());
-    // Written beside the target and moved into place, as AppConfig::save does:
-    // a cache is truncated and rewritten in full, so a write that dies partway
-    // would otherwise leave a header claiming more body than the file holds.
-    // The PID suffix also keeps two instances writing the same vendor from
-    // interleaving.
-    const std::string tmp_path = path + "." + std::to_string(get_current_pid()) + ".tmp";
+    // Written beside the target and moved into place: a cache is truncated and
+    // rewritten in full, so a write that dies partway would otherwise leave a
+    // header claiming more body than the file holds.
    try {
        boost::filesystem::create_directories(boost::filesystem::path(path).parent_path());
-        {
-            boost::nowide::ofstream ofs(tmp_path, std::ios::binary | std::ios::trunc);
-            if (!ofs.is_open()) {
-                BOOST_LOG_TRIVIAL(warning) << "VendorCacheFile: cannot open for writing: " << tmp_path;
-                return false;
-            }
-            CacheFileHeader fhdr;
-            fhdr.magic     = CACHE_MAGIC;
-            fhdr.version   = CACHE_VERSION;
-            fhdr.data_size = static_cast<uint64_t>(blob.size());
-            fhdr.crc32     = crc.checksum();
-            ofs.write(reinterpret_cast<const char*>(&fhdr), sizeof(fhdr));
-            ofs.write(blob.data(), static_cast<std::streamsize>(blob.size()));
-            ofs.close();   // flush; close() raises failbit on error
-            if (! ofs.good()) {
-                BOOST_LOG_TRIVIAL(warning) << "VendorCacheFile: write failed (" << tmp_path << ")";
-                boost::system::error_code ec;
-                boost::filesystem::remove(tmp_path, ec);
-                return false;
-            }
-        }
-        if (const std::error_code ec = rename_file(tmp_path, path)) {
-            BOOST_LOG_TRIVIAL(warning) << "VendorCacheFile: could not move " << tmp_path << " into place: " << ec.message();
-            boost::system::error_code rm;
-            boost::filesystem::remove(tmp_path, rm);
+        CacheFileHeader fhdr;
+        fhdr.magic     = CACHE_MAGIC;
+        fhdr.version   = CACHE_VERSION;
+        fhdr.data_size = static_cast<uint64_t>(blob.size());
+        fhdr.crc32     = crc.checksum();
+        const std::string_view header(reinterpret_cast<const char*>(&fhdr), sizeof(fhdr));
+        if (const std::error_code ec = write_file_atomically(path, { header, std::string_view(blob) }, /*binary=*/true)) {
+            BOOST_LOG_TRIVIAL(warning) << "VendorCacheFile: write failed (" << path << "): " << ec.message();
            return false;
        }
        return true;
    } catch (const std::exception& e) {
        BOOST_LOG_TRIVIAL(warning) << "VendorCacheFile: write failed (" << path << "): " << e.what();
-        boost::system::error_code ec;
-        boost::filesystem::remove(tmp_path, ec);
        return false;
    }
 }
@@ -2604,11 +2604,6 @@ void Print::auto_assign_extruders(ModelObject* model_object) const

 void  PrintObject::set_shared_object(PrintObject *object)
 {
-    // Orca: from now on m_layers / m_support_layers only alias the shared object's layers, so release the
-    // ones this object still owns (it may have sliced itself before it became shareable again).
-    // Both are no-ops once m_shared_object is set, so this cannot free layers owned by another object.
-    clear_support_layers();
-    clear_layers();
    m_shared_object = object;
    BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << boost::format(": this=%1%, found shared object from %2%")%this%m_shared_object;
 }
@@ -4334,9 +4329,9 @@ bool Print::is_dynamic_group_reorder() const
    return true;
 }

-int Print::get_filament_config_indx(int filament_id, int layer_id)
+int Print::get_filament_config_indx(int filament_id, int layer_id, bool use_cache)
 {
-    return get_config_index(filament_id, layer_id, m_config.filament_extruder_variant.values, m_filament_self_index, m_filament_index_map);
+    return get_config_index(filament_id, layer_id, m_config.filament_extruder_variant.values, m_filament_self_index, use_cache ? &m_filament_index_map : nullptr);
 }

 void Print::update_filament_self_index_cache()
@@ -4379,7 +4374,7 @@ int Print::get_nozzle_config_index(int filament_id, int layer_id)
    return get_config_index(filament_id, layer_id, m_default_region_config.print_extruder_variant.values, m_default_region_config.print_extruder_id.values, m_nozzle_index_map);
 }

-int Print::get_config_index(int filament_id, int layer_id, const std::vector<std::string> &variant_list, const std::vector<int>& self_index_list, FilamentIndexMap &index_map)
+int Print::get_config_index(int filament_id, int layer_id, const std::vector<std::string> &variant_list, const std::vector<int>& self_index_list, FilamentIndexMap *index_map)
 {
    auto group_result = get_layered_nozzle_group_result();
    // Orca: defensive — when no grouping producer has published a result yet, fall back to the
@@ -4390,7 +4385,8 @@ int Print::get_config_index(int filament_id, int layer_id, const std::vector<std
    if (!nozzle_info.has_value()) {
        // Orca: this fallback runs per-filament/per-layer in the g-code hot path — log once per filament
        // (reset each slice) instead of flooding thousands of identical lines that bury the real error.
-        if (m_missing_nozzle_group_logged.insert(filament_id).second)
+        // Without the cache, the log set is left alone too; the cached caller reports the same filament.
+        if (index_map && m_missing_nozzle_group_logged.insert(filament_id).second)
            BOOST_LOG_TRIVIAL(error) << __FUNCTION__
                                     << boost::format(", Line %1%: could not found group_nozzle_info corresponding to filament_id %2%, layer_id %3% (further occurrences for this filament suppressed)") % __LINE__ % filament_id %
                                            layer_id;
@@ -4399,15 +4395,17 @@ int Print::get_config_index(int filament_id, int layer_id, const std::vector<std

    ExtruderType     extruder_type      = ExtruderType(m_config.extruder_type.get_at(nozzle_info->extruder_id));
    NozzleVolumeType nozzle_volume_type = nozzle_info->volume_type;
+    if (!index_map)
+        return get_config_index_base(nozzle_volume_type, extruder_type, filament_id + 1, variant_list, self_index_list);

    FilamentIndexKey key{filament_id, extruder_type, nozzle_volume_type};
-    auto             iter = index_map.find(key);
-    if (iter == index_map.end()) {
+    auto             iter = index_map->find(key);
+    if (iter == index_map->end()) {
        int index = get_config_index_base(nozzle_volume_type, extruder_type, filament_id + 1, variant_list, self_index_list);
-        index_map[key] = index;
+        (*index_map)[key] = index;
        return index;
    } else {
-        return index_map[key];
+        return iter->second;
    }
 }

@@ -987,9 +987,6 @@ void PrintObject::generate_support_material()
            this->_generate_support_material();
            m_print->throw_if_canceled();
        }
-        // Orca: the tree support collision/avoidance caches and support nodes are only used while this step runs
-        // (detect_overhangs() rebuilds them from scratch), so don't keep them resident until the next slice.
-        this->clear_tree_support_preview_cache();
        this->set_done(posSupportMaterial);
    }
 }
@@ -1346,7 +1346,7 @@ void PrintObject::slice_volumes()
                        if (min_growth < 0.f || elfoot > 0.f) {
                            // Apply the negative XY compensation. (the ones that is <0)
                            ExPolygons trimming;
-                            const float eps = float(scale_(m_config.slice_closing_radius.value) * 1.5);
+                            static const float eps = float(scale_(m_config.slice_closing_radius.value) * 1.5);
                            if (elfoot > 0.f) {
                                ExPolygons expolygons_to_compensate = offset_ex(layer->merged(eps), -eps);
                                lslices_elfoot_uncompensated[layer_id] = expolygons_to_compensate;
@@ -1820,15 +1820,37 @@ coordf_t TreeSupport::get_radius(const SupportNode* node)
    return node->radius;
 }

-// Orca: these are hit up to several times per node per layer in drop_nodes(), so hand out a
-// reference into the TreeSupportData cache instead of copying the ExPolygons out of it.
-const ExPolygons& TreeSupport::get_avoidance(coordf_t radius, size_t obj_layer_nr)
+ExPolygons TreeSupport::get_avoidance(coordf_t radius, size_t obj_layer_nr)
 {
+#if USE_SUPPORT_3D
+    if (m_model_volumes) {
+        bool on_build_plate = m_object_config->support_on_build_plate_only.value;
+        const Polygons& avoid_polys = m_model_volumes->getAvoidance(radius, obj_layer_nr, TreeSupport3D::TreeModelVolumes::AvoidanceType::FastSafe, on_build_plate, true);
+        ExPolygons expolys;
+        for (auto& poly : avoid_polys)
+            expolys.emplace_back(std::move(poly));
+        return expolys;
+    }
+    return ExPolygons();
+#else
    return m_ts_data->get_avoidance(radius, obj_layer_nr);
+#endif
 }
-const ExPolygons& TreeSupport::get_collision(coordf_t radius, size_t layer_nr)
+ExPolygons TreeSupport::get_collision(coordf_t radius, size_t layer_nr)
 {
+#if USE_SUPPORT_3D
+    if (m_model_volumes) {
+        bool on_build_plate = m_object_config->support_on_build_plate_only.value;
+        const Polygons& collision_polys = m_model_volumes->getCollision(radius, layer_nr, true);
+        ExPolygons expolys;
+        for (auto& poly : collision_polys)
+            expolys.emplace_back(std::move(poly));
+        return expolys;
+    }
+#else
    return m_ts_data->get_collision(radius, layer_nr);
+#endif
+    return ExPolygons();
 }
 Polygons TreeSupport::get_collision_polys(coordf_t radius, size_t layer_nr)
 {
@@ -2617,11 +2639,7 @@ void TreeSupport::draw_circles()
 #endif  // SUPPORT_TREE_DEBUG_TO_SVG

    SupportLayerPtrs& ts_layers = m_object->support_layers();
-    // Orca: the vector owns its layers, so the dropped ones have to be deleted, not just unlinked.
-    // std::stable_partition (unlike std::remove_if) leaves exactly the dropped layers in the tail.
-    auto iter = std::stable_partition(ts_layers.begin(), ts_layers.end(), [](SupportLayer* ts_layer) { return ts_layer->height >= EPSILON; });
-    for (auto it = iter; it != ts_layers.end(); ++it)
-        delete *it;
+    auto iter = std::remove_if(ts_layers.begin(), ts_layers.end(), [](SupportLayer* ts_layer) { return ts_layer->height < EPSILON; });
    ts_layers.erase(iter, ts_layers.end());
    for (int layer_nr = 0; layer_nr < ts_layers.size(); layer_nr++) {
        ts_layers[layer_nr]->upper_layer = layer_nr != ts_layers.size() - 1 ? ts_layers[layer_nr + 1] : nullptr;
@@ -2864,7 +2882,7 @@ void TreeSupport::drop_nodes()
                    //Insert a completely new node and let both original nodes fade.
                    Point next_position = (node.position + neighbours[0]) / 2; //Average position of the two nodes.
                    coordf_t next_radius = calc_radius(node.dist_mm_to_top+height_next);
-                    const ExPolygons& avoid_layer = get_avoidance(next_radius, obj_layer_nr_next);
+                    auto avoid_layer = get_avoidance(next_radius, obj_layer_nr_next);
                    if (group_index == 0)
                    {
                        //Avoid collisions.
@@ -3051,7 +3069,7 @@ void TreeSupport::drop_nodes()
                }
 #endif
                coordf_t next_radius = calc_radius(node.dist_mm_to_top + height_next);
-                const ExPolygons& avoidance_next = get_avoidance(next_radius, obj_layer_nr_next);
+                auto avoidance_next = get_avoidance(next_radius, obj_layer_nr_next);

                Point  to_outside         = projection_onto(avoidance_next, node.position);
                Point  direction_to_outer = to_outside - node.position;
@@ -3105,7 +3123,7 @@ void TreeSupport::drop_nodes()
                        if (is_outside) { next_layer_vertex = candidate_vertex; }
                    }
                }
-                const ExPolygons& next_collision = get_collision(0, obj_layer_nr_next);
+                auto              next_collision = get_collision(0, obj_layer_nr_next);
                const bool   to_buildplate  = !is_inside_ex(m_ts_data->m_layer_outlines[obj_layer_nr_next], next_layer_vertex);
                // don't increase radius if next node will collide partially with the object (STUDIO-7883)
                to_outside             = projection_onto(next_collision, next_layer_vertex);
@@ -511,9 +511,9 @@ private:
    coordf_t calc_branch_radius(coordf_t base_radius, coordf_t mm_to_top, double diameter_angle_scale_factor, bool use_min_distance=true);
    coordf_t   calc_radius(coordf_t mm_to_top);
    coordf_t get_radius(const SupportNode* node);
-    const ExPolygons& get_avoidance(coordf_t radius, size_t obj_layer_nr);
+    ExPolygons get_avoidance(coordf_t radius, size_t obj_layer_nr);
    // layer's expolygon expanded by radius+m_xy_distance
-    const ExPolygons& get_collision(coordf_t radius, size_t layer_nr);
+    ExPolygons get_collision(coordf_t radius, size_t layer_nr);
    // get Polygons instead of ExPolygons
    Polygons get_collision_polys(coordf_t radius, size_t layer_nr);

@@ -8,6 +8,8 @@
 #include <functional>
 #include <type_traits>
 #include <system_error>
+#include <initializer_list>
+#include <string_view>
 #include <regex>

 #include <boost/system/error_code.hpp>
@@ -224,6 +226,21 @@ extern std::vector<std::string> split_string(const std::string &str, char delimi
 // On Windows, the file explorer (or anti-virus or whatever else) often locks the file
 // for a short while, so the file may not be movable. Retry while we see recoverable errors.
 extern std::error_code rename_file(const std::string &from, const std::string &to);
+// Write `chunks`, in order, to `path` through a temporary file beside it that is
+// then renamed over the target, so a concurrent reader sees the old or the new
+// file, never a partial one. The temporary is removed on failure and an existing
+// target keeps its permissions. Text mode unless `binary`, so Windows writes CRLF
+// as the streams this replaces did. A target that is not a regular file (a
+// device or pipe) is written in place, since replacing it would change what it
+// is, and so is an existing target beside which no temporary can be created or
+// whose replace the filesystem refuses; a symlink is followed and the file it
+// names is replaced. On Windows a reader holding the
+// target open without sharing its deletion, which the C runtime does not, makes
+// the replace fall back to the in-place write too, so an unlocked reader there
+// can still see a partial file.
+extern std::error_code write_file_atomically(const std::string &path, std::initializer_list<std::string_view> chunks, bool binary = false);
+inline std::error_code write_file_atomically(const std::string &path, const std::string &content, bool binary = false)
+	{ return write_file_atomically(path, { std::string_view(content) }, binary); }

 enum CopyFileResult {
 	SUCCESS = 0,
@@ -9,6 +9,8 @@
 #include <stdio.h>
 #include <filesystem>
 #include <sstream>
+#include <cerrno>
+#include <mutex>
 #include <iomanip>
 #include <algorithm>
 #include <cmath>
@@ -703,13 +705,99 @@ namespace WindowsSupport
 std::error_code rename_file(const std::string &from, const std::string &to)
 {
 #ifdef _WIN32
+	// Retries and moves an open destination aside itself.
 	return WindowsSupport::rename(from, to);
 #else
-	boost::nowide::remove(to.c_str());
-	return std::make_error_code(static_cast<std::errc>(boost::nowide::rename(from.c_str(), to.c_str())));
+	// rename(2) replaces an existing target atomically; removing it first would
+	// leave a window in which the file does not exist at all.
+	if (boost::nowide::rename(from.c_str(), to.c_str()) == 0)
+		return {};
+	const int err = errno;
+	// Some mounts (sshfs, gvfs, MTP and a few SMB setups) refuse to replace an
+	// existing target in one step, each with the error it sees fit; every error
+	// is worth the remove-then-rename this always did, except the ones no retry
+	// can help: nothing at the source, a different device, or a directory where
+	// a file was expected and the reverse.
+	const bool worth_retrying = err != ENOENT && err != EXDEV && err != ENOTDIR && err != EISDIR;
+	if (worth_retrying && boost::nowide::remove(to.c_str()) == 0 && boost::nowide::rename(from.c_str(), to.c_str()) == 0)
+		return {};
+	return std::make_error_code(static_cast<std::errc>(err));
 #endif
 }

+static std::error_code write_whole_file(const std::string &path, std::initializer_list<std::string_view> chunks, bool binary)
+{
+	errno = 0;
+	FILE *file = boost::nowide::fopen(path.c_str(), binary ? "wb" : "w");
+	if (file == nullptr)
+		return std::make_error_code(errno != 0 ? static_cast<std::errc>(errno) : std::errc::io_error);
+	bool ok = true;
+	for (const std::string_view chunk : chunks)
+		ok = ok && std::fwrite(chunk.data(), 1, chunk.size(), file) == chunk.size();
+	ok = ok && std::fflush(file) == 0;
+	const int err = ok ? 0 : errno;
+	ok = std::fclose(file) == 0 && ok;
+	if (ok)
+		return {};
+	return std::make_error_code(err != 0 ? static_cast<std::errc>(err) : std::errc::io_error);
+}
+
+// The in-place fallback truncates the target, so two threads of this process
+// on the same file must not both be in it. One mutex for all such writes: they
+// are the rare case. Never freed, like the InstanceLock registry, so a save
+// during static destruction still finds it.
+static std::error_code write_in_place(const std::string &path, std::initializer_list<std::string_view> chunks, bool binary)
+{
+	static auto *mutex = new std::mutex();
+	std::lock_guard<std::mutex> guard(*mutex);
+	return write_whole_file(path, chunks, binary);
+}
+
+std::error_code write_file_atomically(const std::string &path, std::initializer_list<std::string_view> chunks, bool binary)
+{
+	boost::system::error_code bec;
+	const boost::filesystem::file_status target = boost::filesystem::symlink_status(path, bec);
+	const bool target_exists = ! bec && boost::filesystem::exists(target);
+	if (target_exists && boost::filesystem::is_symlink(target)) {
+		// A config or preset kept in a dotfiles repository: the link stays,
+		// the file it points to is replaced like any other.
+		const boost::filesystem::path resolved = boost::filesystem::canonical(path, bec);
+		if (! bec && boost::filesystem::is_regular_file(resolved, bec))
+			return write_file_atomically(resolved.string(), chunks, binary);
+	}
+	if (target_exists && ! boost::filesystem::is_regular_file(target))
+		return write_in_place(path, chunks, binary);
+
+	// Unique per process and per call, so two threads writing one target
+	// without a lock never share a temporary.
+	static std::atomic<unsigned> counter{0};
+	const std::string tmp_path = path + "." + std::to_string(get_current_pid()) + "." + std::to_string(counter++) + ".tmp";
+	if (const std::error_code ec = write_whole_file(tmp_path, chunks, binary)) {
+		boost::nowide::remove(tmp_path.c_str());
+		if (! target_exists)
+			return ec;
+		// A directory that lets this process write its files but not create
+		// one: losing the save is worse than a reader seeing a partial file.
+		BOOST_LOG_TRIVIAL(warning) << "Cannot create a temporary beside " << path << " (" << ec.message() << "); writing in place";
+		return write_in_place(path, chunks, binary);
+	}
+#ifndef _WIN32
+	// Not on Windows, where a read-only bit on the temporary would stop the rename itself.
+	if (target_exists)
+		boost::filesystem::permissions(tmp_path, target.permissions(), bec);
+#endif
+	if (const std::error_code ec = rename_file(tmp_path, path)) {
+		boost::nowide::remove(tmp_path.c_str());
+		// A reader on Windows holding the target open without FILE_SHARE_DELETE,
+		// or a mount that cannot replace a file at all. Losing the save is worse
+		// than a reader seeing a partial file, so write in place the way this
+		// used to work before the atomic path existed.
+		BOOST_LOG_TRIVIAL(warning) << "Cannot replace " << path << " (" << ec.message() << "); writing in place";
+		return write_in_place(path, chunks, binary);
+	}
+	return {};
+}
+
 #ifdef __linux__
 // Copied from boost::filesystem.
 // Called by copy_file_linux() in case linux sendfile() API is not supported.
@@ -87,6 +87,7 @@
 #include "libslic3r/Model.hpp"
 #include "libslic3r/I18N.hpp"
 #include "libslic3r/PresetBundle.hpp"
+#include "libslic3r/InstanceLock.hpp"
 #include "libslic3r/Thread.hpp"
 #include "libslic3r/miniz_extension.hpp"
 #include "libslic3r/Utils.hpp"
@@ -3556,7 +3557,7 @@ bool GUI_App::on_init_inner()
            update_publish_status();
        }

-        if (m_post_initialized && app_config->dirty())
+        if (m_post_initialized && app_config->dirty() && app_config->save_due())
            app_config->save();

    });
@@ -7651,8 +7652,11 @@ void GUI_App::start_sync_user_preset(bool with_progress_dlg)

                            // Delete the bundle folder and bundle
                            fs::path bundle_folder = fs::path(bundle.path.c_str()).parent_path();
-                            boost::system::error_code ec;
-                            boost::filesystem::remove_all(bundle_folder, ec);
+                            {
+                                boost::system::error_code ec;
+                                InstanceLock instance_lock(user_presets_lock_path());
+                                boost::filesystem::remove_all(bundle_folder, ec);
+                            }

                            preset_bundle->bundles.WriteLock();
                            preset_bundle->bundles.m_bundles.erase(bundle.id);
@@ -8944,6 +8948,7 @@ void GUI_App::preset_deleted_from_cloud(std::string setting_id)

    // Delete the .info file after cloud deletion is confirmed
    if (!preset_file_path.empty() && fs::exists(fs::path(preset_file_path))) {
+        InstanceLock instance_lock(user_presets_lock_path());
        boost::nowide::remove(preset_file_path.c_str());
        BOOST_LOG_TRIVIAL(info) << "Deleted .info file after cloud confirmation: " << preset_file_path;
    }
@@ -9006,15 +9011,19 @@ void GUI_App::scan_orphaned_info_files()
            fs::path preset_file = info_file;
            preset_file.replace_extension(".json");

-            // If .json doesn't exist, .info is orphaned
-            if (!fs::exists(preset_file)) {
-                // Extract setting_id from .info file
-                std::string setting_id = extract_setting_id_from_info(info_file.string());
-                if (!setting_id.empty()) {
-                    // Add to need_delete_presets
-                    delete_preset_from_cloud(setting_id, info_file.string());
-                    BOOST_LOG_TRIVIAL(info) << "Found orphaned .info file on startup: " << info_file.string();
-                }
+            // If .json doesn't exist, .info is orphaned. Read under the lock, so a
+            // remove_files() in another instance is seen whole or not at all; the
+            // delete queue's own mutex is taken after the lock is released.
+            std::string setting_id;
+            {
+                InstanceLock instance_lock(user_presets_lock_path());
+                if (!fs::exists(preset_file))
+                    setting_id = extract_setting_id_from_info(info_file.string());
+            }
+            if (!setting_id.empty()) {
+                // Add to need_delete_presets
+                delete_preset_from_cloud(setting_id, info_file.string());
+                BOOST_LOG_TRIVIAL(info) << "Found orphaned .info file on startup: " << info_file.string();
            }
        }
        if (ec)
@@ -1478,9 +1478,7 @@ bool GuideFrame::BuildProfileDataFromVendors()
            return false;

        // Written through a temp file and moved into place, as the preset caches
-        // are: half a cache must never be readable, and the PID suffix keeps two
-        // instances from interleaving on one temp file.
-        const std::string tmp_path = cache_file.string() + "." + std::to_string(get_current_pid()) + ".tmp";
+        // are: half a cache must never be readable.
        try {
            json out;
            out["format"]  = 1;
@@ -1489,18 +1487,9 @@ bool GuideFrame::BuildProfileDataFromVendors()
            for (const char* key : { "model", "machine", "filament", "process" })
                profile[key] = m_ProfileJson[key];
            boost::filesystem::create_directories(cache_file.parent_path());
-            {
-                boost::nowide::ofstream ofs(tmp_path, std::ios::binary | std::ios::trunc);
-                ofs << out.dump(-1, ' ', false, json::error_handler_t::ignore);
-                ofs.close();
-                if (! ofs.good())
-                    throw std::runtime_error("write failed");
-            }
-            if (const std::error_code ec = rename_file(tmp_path, cache_file.string()))
+            if (const std::error_code ec = write_file_atomically(cache_file.string(), out.dump(-1, ' ', false, json::error_handler_t::ignore), /*binary=*/true))
                throw std::runtime_error(ec.message());
        } catch (const std::exception& e) {
-            boost::system::error_code rm;
-            boost::filesystem::remove(tmp_path, rm);
            BOOST_LOG_TRIVIAL(warning) << "GuideFrame: could not write the profile data cache: " << e.what();
        }
        return true;
@@ -2,6 +2,7 @@

 #include <algorithm>
 #include <sstream>
+#include <system_error>
 #include <exception>
 #include <boost/format.hpp>
 #include <boost/log/trivial.hpp>
@@ -580,9 +581,10 @@ bool C3DPrinterOS::save_api_session(const std::string &session, const std::strin
    j.put("session", session);
    j.put("email", email);
    try {
-        auto temp_path = m_api_session_file_path + ".tmp";
-        pt::write_json(temp_path, j);
-        boost::filesystem::rename(temp_path, m_api_session_file_path);
+        std::ostringstream json;
+        pt::write_json(json, j);
+        if (const std::error_code ec = write_file_atomically(m_api_session_file_path, json.str()))
+            throw std::system_error(ec);
    } catch (const std::exception &err) {
        BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << ": failed to write json to file. Path = "
                                 << m_api_session_file_path
@@ -819,7 +819,9 @@ int OrcaCloudServiceAgent::user_logout(bool request)
        }
    }

-    clear_session();
+    // An explicit logout also wipes the backend the token storage option is not using, so a token
+    // stranded by switching that option cannot sign the account back in later.
+    clear_session(/*all_backends=*/request);
    return BAMBU_NETWORK_SUCCESS;
 }

@@ -1476,15 +1478,8 @@ void OrcaCloudServiceAgent::save_sync_state()
    if (sync_state_path.empty())
        return;

-    try {
-        std::string tmp_path = sync_state_path + ".tmp";
-        std::ofstream ofs(tmp_path, std::ios::out | std::ios::trunc);
-        if (ofs.good()) {
-            ofs << std::to_string(sync_state.last_sync_timestamp);
-            ofs.close();
-            boost::filesystem::rename(tmp_path, sync_state_path);
-        }
-    } catch (...) {}
+    if (const std::error_code ec = write_file_atomically(sync_state_path, std::to_string(sync_state.last_sync_timestamp)))
+        BOOST_LOG_TRIVIAL(warning) << "OrcaCloudServiceAgent: failed to save the sync state: " << ec.message();
 }

 void OrcaCloudServiceAgent::clear_sync_state()
@@ -1573,22 +1568,10 @@ void OrcaCloudServiceAgent::persist_user_secret(const std::string& secret)
            wxFileName::Mkdir(path.GetPath(), wxS_DIR_DEFAULT, wxPATH_MKDIR_FULL);
        }

-        const std::string tmp_path = secret_fallback_path + ".tmp";
-        std::ofstream ofs(tmp_path, std::ios::out | std::ios::trunc | std::ios::binary);
-        if (ofs.good()) {
-            ofs << signed_payload;
-            ofs.flush();
-            ofs.close();
-
-            if (wxRenameFile(wxString::FromUTF8(tmp_path.c_str()), wxString::FromUTF8(secret_fallback_path.c_str()), true)) {
-                stored = true;
-            } else {
-                wxRemoveFile(wxString::FromUTF8(tmp_path.c_str()));
-                BOOST_LOG_TRIVIAL(warning) << "OrcaCloudServiceAgent: failed to atomically replace user secret file";
-            }
-        } else {
-            BOOST_LOG_TRIVIAL(warning) << "OrcaCloudServiceAgent: cannot open user secret file for write - " << secret_fallback_path;
-        }
+        if (const std::error_code ec = write_file_atomically(secret_fallback_path, signed_payload, /*binary=*/true))
+            BOOST_LOG_TRIVIAL(warning) << "OrcaCloudServiceAgent: cannot write user secret file " << secret_fallback_path << ": " << ec.message();
+        else
+            stored = true;
    } else {
        // Use wxSecretStore only
        wxSecretStore store = wxSecretStore::GetDefault();
@@ -1604,7 +1587,9 @@ void OrcaCloudServiceAgent::persist_user_secret(const std::string& secret)
        }
    }

-    (void) stored;
+    if (stored) {
+        secret_stored = true;
+    }
 }

 bool OrcaCloudServiceAgent::load_user_secret(std::string& out_secret)
@@ -1644,6 +1629,7 @@ bool OrcaCloudServiceAgent::load_user_secret(std::string& out_secret)
                }

                if (integrity_ok && aes256gcm_decrypt(encoded_payload, key, plain) && !plain.empty()) {
+                    secret_stored = true;
                    out_secret = plain;
                    // Upgrade legacy payloads to signed format
                    if (payload.rfind("v2:", 0) != 0) {
@@ -1661,6 +1647,7 @@ bool OrcaCloudServiceAgent::load_user_secret(std::string& out_secret)
            if (store.Load(SECRET_STORE_SERVICE, username, secret) && secret.IsOk()) {
                out_secret.assign(static_cast<const char*>(secret.GetData()), secret.GetSize());
                if (!out_secret.empty()) {
+                    secret_stored = true;
                    return true;
                }
            }
@@ -1670,11 +1657,20 @@ bool OrcaCloudServiceAgent::load_user_secret(std::string& out_secret)
    return false;
 }

-void OrcaCloudServiceAgent::clear_user_secret()
+void OrcaCloudServiceAgent::clear_user_secret(bool all_backends)
 {
-    wxSecretStore store = wxSecretStore::GetDefault();
-    if (store.IsOk()) {
-        store.Delete(SECRET_STORE_SERVICE);
+    // Nothing this process loaded or saved: leave the store alone. Deleting would only cost a
+    // keychain round trip (or a hang while the keychain is unresponsive) and could remove a
+    // login another instance just saved.
+    if (!secret_stored.exchange(false) && !all_backends) {
+        return;
+    }
+
+    if (all_backends || !m_use_encrypted_token_file) {
+        wxSecretStore store = wxSecretStore::GetDefault();
+        if (store.IsOk()) {
+            store.Delete(SECRET_STORE_SERVICE);
+        }
    }

    compute_fallback_path();
@@ -2023,13 +2019,13 @@ bool OrcaCloudServiceAgent::set_user_session(const json& session_json, bool noti
    return success;
 }

-void OrcaCloudServiceAgent::clear_session()
+void OrcaCloudServiceAgent::clear_session(bool all_backends)
 {
    {
        std::lock_guard<std::mutex> lock(session_mutex);
        session = SessionInfo{};
    }
-    clear_user_secret();
+    clear_user_secret(all_backends);
 }

 // ============================================================================
@@ -326,7 +326,7 @@ public:

    void persist_user_secret(const std::string& secret);
    bool load_user_secret(std::string& out_secret);
-    void clear_user_secret();
+    void clear_user_secret(bool all_backends = false);

    // Token refresh helpers
    bool          refresh_if_expiring(std::chrono::seconds skew, const std::string& reason);
@@ -344,7 +344,7 @@ public:
                          bool persist = true);
    // Accepts either nested Orca cloud / GoTrue session JSON or flat WebView token JSON.
    bool set_user_session(const nlohmann::json& session_json, bool notify_login = true);
-    void clear_session();
+    void clear_session(bool all_backends = false);

    static std::string generate_uuid_for_setting_id(const std::string& name, const std::string& user_id = "");

@@ -413,6 +413,11 @@ private:
    // Member variables - auth state
    PkceBundle pkce_bundle;
    std::string secret_fallback_path;
+    // Set once this process has read a secret from the store or written one. Unless the user logs
+    // out explicitly, clear_user_secret() only touches the store while it is set, so a logged-out
+    // instance (the GUI polls the login status every 2 s) makes no keychain calls and cannot wipe
+    // a login another instance saved.
+    std::atomic_bool secret_stored{false};
    SessionHandler session_handler;
    OnLoginCompleteHandler on_login_complete_handler;
    SessionInfo session;
@@ -249,21 +249,10 @@ bool PluginConfig::save()
        return false;
    }

-    // Write to a PID-suffixed file and rename it into place, so a crash mid-write cannot truncate an
-    // existing config. Same approach as AppConfig::save().
-    const std::string path_pid = (boost::format("%1%.%2%") % path % get_current_pid()).str();
-
-    boost::nowide::ofstream file;
-    file.open(path_pid, std::ios::out | std::ios::trunc);
-    file << root.dump(1, '\t') << std::endl;
-    file.close();
-    if (file.fail()) {
-        BOOST_LOG_TRIVIAL(error) << "PluginConfig: failed to write " << path_pid << "; keeping the existing config";
-        return false;
-    }
-
-    if (const std::error_code rename_ec = rename_file(path_pid, path)) {
-        BOOST_LOG_TRIVIAL(error) << "PluginConfig: failed to move " << path_pid << " onto " << path << ": " << rename_ec.message();
+    // Written beside the target and moved into place, so a crash mid-write cannot truncate an
+    // existing config.
+    if (const std::error_code ec = write_file_atomically(path, root.dump(1, '\t') + "\n")) {
+        BOOST_LOG_TRIVIAL(error) << "PluginConfig: failed to write " << path << ": " << ec.message() << "; keeping the existing config";
        return false;
    }

@@ -57,6 +57,7 @@ add_executable(${_TEST_NAME}_tests
    # test_png_io.cpp
    test_indexed_triangle_set.cpp
    test_texture_displacement.cpp
+    test_instance_lock.cpp
    ../libnest2d/printer_parts.cpp
    )

@@ -0,0 +1,228 @@
+#include <catch2/catch_all.hpp>
+
+#include <atomic>
+#include <chrono>
+#include <thread>
+
+#include <boost/filesystem.hpp>
+
+#include "libslic3r/InstanceLock.hpp"
+#include "test_utils.hpp"
+
+#ifdef _WIN32
+#include <boost/interprocess/sync/file_lock.hpp>
+#include <boost/nowide/convert.hpp>
+#include <boost/nowide/fstream.hpp>
+#else
+#include <fcntl.h>
+#include <sys/file.h>
+#include <unistd.h>
+#endif
+
+using namespace Slic3r;
+using namespace std::chrono_literals;
+
+// Sets a process-wide knob for one test and restores it however the test ends.
+template<typename T> struct ScopedStaticValue
+{
+    T &ref;
+    T  saved;
+    ScopedStaticValue(T &ref, T value) : ref(ref), saved(ref) { ref = value; }
+    ~ScopedStaticValue() { ref = saved; }
+};
+
+TEST_CASE("InstanceLock creates its lock file and holds it for the guard's scope", "[InstanceLock]")
+{
+    ScopedTemporaryFile lock_file(".lock");
+    const std::string   path = lock_file.string();
+
+    {
+        InstanceLock lock(path);
+        REQUIRE(lock.locked());
+        REQUIRE(boost::filesystem::exists(path));
+    }
+    // Released: a fresh guard gets the lock at once instead of waiting out a timeout.
+    const auto   started = std::chrono::steady_clock::now();
+    InstanceLock again(path, 5000ms);
+    REQUIRE(again.locked());
+    // Well inside the timeout it would otherwise have waited out; loose enough for a loaded runner.
+    REQUIRE(std::chrono::steady_clock::now() - started < 4000ms);
+}
+
+TEST_CASE("InstanceLock nests within one thread", "[InstanceLock]")
+{
+    ScopedTemporaryFile lock_file(".lock");
+    const std::string   path = lock_file.string();
+
+    InstanceLock outer(path);
+    {
+        InstanceLock inner(path, 100ms);
+        REQUIRE(inner.locked());
+    }
+    // The inner guard leaving does not release the outer one.
+    REQUIRE(outer.locked());
+}
+
+TEST_CASE("InstanceLock is a no-op for an empty path and survives an unwritable one", "[InstanceLock]")
+{
+    ScopedTemporaryDir dir;
+
+    InstanceLock none("");
+    REQUIRE_FALSE(none.locked());
+
+    // The directory does not exist, so the lock file cannot be created; the
+    // guard still constructs and the write it guards can go ahead.
+    InstanceLock unwritable((dir.path() / "missing" / "shared.lock").string(), 100ms);
+    REQUIRE_FALSE(unwritable.locked());
+}
+
+TEST_CASE("InstanceLock retries a lock file it could not open once the cool-down passes", "[InstanceLock]")
+{
+    ScopedTemporaryDir dir;
+    const std::string  path = (dir.path() / "later" / "shared.lock").string();
+    ScopedStaticValue  cooldown(InstanceLock::cooldown, 300ms);
+
+    bool before_dir, during_cooldown, after_cooldown;
+    const auto started = std::chrono::steady_clock::now();
+    {
+        InstanceLock lock(path, 100ms);
+        before_dir = lock.locked();
+    }
+    boost::filesystem::create_directories(dir.path() / "later");
+    {
+        InstanceLock lock(path, 100ms);
+        during_cooldown = lock.locked();
+    }
+    const bool second_guard_inside_cooldown = std::chrono::steady_clock::now() - started < InstanceLock::cooldown;
+    std::this_thread::sleep_for(400ms);
+    {
+        InstanceLock lock(path, 100ms);
+        after_cooldown = lock.locked();
+    }
+
+    REQUIRE_FALSE(before_dir);
+    // A loaded runner may take longer than the cool-down to get here; then the
+    // second guard legitimately retried, so only assert when the timing held.
+    if (second_guard_inside_cooldown)
+        REQUIRE_FALSE(during_cooldown);
+    REQUIRE(after_cooldown);
+}
+
+TEST_CASE("InstanceLock reopens a lock file that was replaced on disk", "[InstanceLock]")
+{
+    ScopedTemporaryFile lock_file(".lock");
+    const std::string   path = lock_file.string();
+    {
+        InstanceLock lock(path);
+        REQUIRE(lock.locked());
+    }
+
+    boost::filesystem::remove(path);
+    InstanceLock lock(path);
+    REQUIRE(lock.locked());
+    // Each outermost guard opens the file afresh, so the deleted path is back.
+    REQUIRE(boost::filesystem::exists(path));
+}
+
+TEST_CASE("InstanceLock serialises the threads of one process", "[InstanceLock]")
+{
+    ScopedTemporaryFile lock_file(".lock");
+    const std::string   path = lock_file.string();
+
+    std::atomic<bool> holder_ready{false};
+    std::atomic<bool> holder_released{false};
+    std::thread holder([&] {
+        InstanceLock lock(path);
+        holder_ready = true;
+        std::this_thread::sleep_for(150ms);
+        holder_released = true;
+    });
+    while (! holder_ready)
+        std::this_thread::yield();
+
+    bool released_before_acquire = false;
+    {
+        InstanceLock lock(path);
+        released_before_acquire = holder_released;
+    }
+    holder.join();
+    REQUIRE(released_before_acquire);
+}
+
+// Holds the OS lock on a file through a handle of its own, as another instance would. The lock
+// belongs to the handle on Windows and to the open file description elsewhere, so the guard's
+// handle is refused while this one holds it.
+class OtherHolder
+{
+public:
+    explicit OtherHolder(const std::string &path)
+    {
+#ifdef _WIN32
+        boost::nowide::ofstream(path, std::ios::app).close();
+        m_lock = boost::interprocess::file_lock(boost::nowide::widen(path).c_str());
+        m_held = m_lock.try_lock();
+#else
+        m_fd   = ::open(path.c_str(), O_RDWR | O_CREAT, 0644);
+        m_held = m_fd >= 0 && ::flock(m_fd, LOCK_EX | LOCK_NB) == 0;
+#endif
+    }
+    ~OtherHolder() { release(); }
+    OtherHolder(const OtherHolder &) = delete;
+    OtherHolder &operator=(const OtherHolder &) = delete;
+
+    bool held() const { return m_held; }
+    void release()
+    {
+#ifdef _WIN32
+        if (m_held)
+            m_lock.unlock();
+        m_lock = boost::interprocess::file_lock();
+#else
+        if (m_fd >= 0)
+            ::close(m_fd);
+        m_fd = -1;
+#endif
+        m_held = false;
+    }
+
+private:
+#ifdef _WIN32
+    boost::interprocess::file_lock m_lock;
+#else
+    int m_fd{-1};
+#endif
+    bool m_held{false};
+};
+
+TEST_CASE("InstanceLock yields to a lock held through another handle and reports it", "[InstanceLock]")
+{
+    ScopedTemporaryFile lock_file(".lock");
+    const std::string   path = lock_file.string();
+    ScopedStaticValue   cooldown(InstanceLock::cooldown, 300ms);
+
+    OtherHolder other(path);
+    REQUIRE(other.held());
+
+    bool locked_while_other_holds;
+    {
+        InstanceLock lock(path, 100ms);
+        locked_while_other_holds = lock.locked();
+    }
+    // The timed-out wait starts a cool-down: the next guard does not touch the file.
+    const auto started = std::chrono::steady_clock::now();
+    bool       locked_during_cooldown;
+    {
+        InstanceLock lock(path, 5000ms);
+        locked_during_cooldown = lock.locked();
+    }
+    const auto cooldown_wait = std::chrono::steady_clock::now() - started;
+    other.release();
+
+    REQUIRE_FALSE(locked_while_other_holds);
+    REQUIRE_FALSE(locked_during_cooldown);
+    REQUIRE(cooldown_wait < 4000ms);
+    // Once the cool-down passes, the lock the other holder released is taken again.
+    std::this_thread::sleep_for(400ms);
+    InstanceLock lock(path);
+    REQUIRE(lock.locked());
+}
@@ -5,6 +5,7 @@
 #include <fstream>

 #include "libslic3r/PresetBundle.hpp"
+#include "libslic3r/ParallelResolve.hpp"
 #include "libslic3r/AppConfig.hpp"
 #include "libslic3r/Model.hpp"
 #include "libslic3r/TriangleMesh.hpp"
@@ -17,6 +18,10 @@
 #include <iostream>
 #include <initializer_list>

+#ifndef _WIN32
+#include <unistd.h> // geteuid
+#endif
+
 using namespace Slic3r;

 namespace {
@@ -5956,3 +5961,214 @@ TEST_CASE("A filament's variant index follows the extruder type and nozzle volum
    // the filament defines no Bowden High Flow variant
    CHECK(PresetBundle::get_filament_variant_index(filament, printer, 1, nvtHighFlow) == 0);
 }
+
+TEST_CASE("A user preset saved over by another instance while its directory loads is read again under the lock", "[Preset][Bundle][InstanceLock]")
+{
+    ScopedTemporaryDir   temp_dir;
+    ScopedDataDir        data_dir_scope(temp_dir.path());
+    RenameTestCollection coll;
+
+    Preset &parent = add_inmemory_preset(coll, "Parent Process");
+    parent.config.option<ConfigOptionFloat>("layer_height", true)->value = 0.24;
+    parent.is_system = true;
+
+    // Fewer than one batch, so every file is read before the first one is committed.
+    constexpr int  children = 8;
+    static_assert(children <= int(resolve_batch_size));
+    const fs::path dir      = temp_dir.path() / PRESET_PRINT_NAME;
+    for (int i = 0; i < children; ++ i)
+        write_minimal_child(dir / ("Child " + std::to_string(i) + ".json"), "Child " + std::to_string(i), "Parent Process");
+
+    // The first commit stands in for another instance saving every other preset after
+    // they were read and before they are committed.
+    std::string first;
+    auto save_the_others = [&](Preset &preset) {
+        if (! first.empty())
+            return;
+        first = preset.name;
+        for (int i = 0; i < children; ++ i) {
+            const std::string name = "Child " + std::to_string(i);
+            if (name != first)
+                std::ofstream((dir / (name + ".json")).string())
+                    << R"({"type":"process","name":")" << name
+                    << R"(","from":"User","version":"1.0.0","inherits":"Parent Process","layer_height":"0.3"})";
+        }
+    };
+    PresetsConfigSubstitutions substitutions;
+    coll.load_presets(temp_dir.path().string(), PRESET_PRINT_NAME, substitutions,
+                      ForwardCompatibilitySubstitutionRule::Disable, save_the_others);
+
+    REQUIRE_FALSE(first.empty());
+    CHECK(coll.error_count() == 0);
+    for (int i = 0; i < children; ++ i) {
+        const std::string name  = "Child " + std::to_string(i);
+        const Preset     *child = coll.find_preset(name);
+        REQUIRE(child != nullptr);
+        CHECK_THAT(child->config.opt_float("layer_height"), Catch::Matchers::WithinAbs(name == first ? 0.24 : 0.3, 1e-9));
+    }
+}
+
+TEST_CASE("A user preset removed by another instance while its directory loads is not installed", "[Preset][Bundle][InstanceLock]")
+{
+    ScopedTemporaryDir   temp_dir;
+    ScopedDataDir        data_dir_scope(temp_dir.path());
+    RenameTestCollection coll;
+
+    Preset &parent = add_inmemory_preset(coll, "Parent Process");
+    parent.is_system = true;
+
+    // Fewer than one batch, so every file is read before the first one is committed.
+    constexpr int  children = 8;
+    static_assert(children <= int(resolve_batch_size));
+    const fs::path dir      = temp_dir.path() / PRESET_PRINT_NAME;
+    for (int i = 0; i < children; ++ i)
+        write_minimal_child(dir / ("Child " + std::to_string(i) + ".json"), "Child " + std::to_string(i), "Parent Process");
+
+    std::string first;
+    auto remove_the_others = [&](Preset &preset) {
+        if (! first.empty())
+            return;
+        first = preset.name;
+        for (int i = 0; i < children; ++ i)
+            if (const std::string name = "Child " + std::to_string(i); name != first)
+                fs::remove(dir / (name + ".json"));
+    };
+    PresetsConfigSubstitutions substitutions;
+    coll.load_presets(temp_dir.path().string(), PRESET_PRINT_NAME, substitutions,
+                      ForwardCompatibilitySubstitutionRule::Disable, remove_the_others);
+
+    REQUIRE_FALSE(first.empty());
+    CHECK(coll.error_count() == 0);
+    CHECK(coll.size() == 3); // the default preset, the parent and the first child
+    CHECK(coll.find_preset(first) != nullptr);
+}
+
+TEST_CASE("Without the instance lock a user preset loads but its file is not written back", "[Preset][Bundle][InstanceLock]")
+{
+    ScopedTemporaryDir temp_dir;
+    ScopedDataDir      data_dir_scope(temp_dir.path());
+    // A directory where the lock file belongs, so the lock cannot be taken.
+    fs::create_directories(fs::path(user_presets_lock_path()));
+    PresetBundle       bundle;
+    const fs::path     file = temp_dir.path() / PRESET_FILAMENT_NAME / "My PLA @Test Printer.json";
+    write_preset_with_inherits(bundle.filaments.default_preset().config, file, "My PLA @Test Printer", std::string());
+    const std::string before = read_file(file);
+
+    PresetsConfigSubstitutions substitutions;
+    bundle.filaments.load_presets(temp_dir.path().string(), PRESET_FILAMENT_NAME, substitutions,
+                                  ForwardCompatibilitySubstitutionRule::EnableSilent);
+
+    const Preset *preset = bundle.filaments.find_preset("My PLA @Test Printer");
+    REQUIRE(preset != nullptr);
+    CHECK(preset->config.option<ConfigOptionStrings>("compatible_printers")->values == std::vector<std::string>{ "Test Printer" });
+    CHECK(read_file(file) == before);
+}
+
+#ifndef _WIN32
+// File permissions stop reading only on POSIX.
+TEST_CASE("A user preset that cannot be read under the instance lock is counted and removed", "[Preset][Bundle][InstanceLock]")
+{
+    if (::geteuid() == 0)
+        SKIP("file permissions do not stop root");
+    ScopedTemporaryDir   temp_dir;
+    ScopedDataDir        data_dir_scope(temp_dir.path());
+    RenameTestCollection coll;
+
+    Preset &parent = add_inmemory_preset(coll, "Parent Process");
+    parent.is_system = true;
+    const fs::path file = temp_dir.path() / PRESET_PRINT_NAME / "Unreadable.json";
+    write_minimal_child(file, "Unreadable", "Parent Process");
+    fs::permissions(file, fs::no_perms);
+
+    PresetsConfigSubstitutions substitutions;
+    coll.load_presets(temp_dir.path().string(), PRESET_PRINT_NAME, substitutions,
+                      ForwardCompatibilitySubstitutionRule::Disable);
+
+    CHECK(coll.error_count() == 1);
+    CHECK(coll.find_preset("Unreadable") == nullptr);
+    CHECK_FALSE(fs::exists(file));
+}
+#endif
+
+#ifndef _WIN32
+// Creating a symlink needs no privilege only on POSIX.
+TEST_CASE("A user preset that is a symlink to itself is counted and removed while the rest still load", "[Preset][Bundle][InstanceLock]")
+{
+    ScopedTemporaryDir   temp_dir;
+    ScopedDataDir        data_dir_scope(temp_dir.path());
+    RenameTestCollection coll;
+
+    Preset &parent = add_inmemory_preset(coll, "Parent Process");
+    parent.is_system = true;
+    const fs::path dir = temp_dir.path() / PRESET_PRINT_NAME;
+    write_minimal_child(dir / "Good A.json", "Good A", "Parent Process");
+    write_minimal_child(dir / "Good B.json", "Good B", "Parent Process");
+    const fs::path loop = dir / "Loop.json";
+    fs::create_symlink(loop.filename(), loop);
+
+    PresetsConfigSubstitutions substitutions;
+    REQUIRE_NOTHROW(coll.load_presets(temp_dir.path().string(), PRESET_PRINT_NAME, substitutions,
+                                      ForwardCompatibilitySubstitutionRule::Disable));
+
+    CHECK(coll.error_count() == 1);
+    CHECK(coll.find_preset("Good A") != nullptr);
+    CHECK(coll.find_preset("Good B") != nullptr);
+    CHECK(coll.find_preset("Loop") == nullptr);
+    boost::system::error_code ec;
+    CHECK(fs::symlink_status(loop, ec).type() == fs::file_not_found);
+}
+#endif
+
+#ifndef _WIN32
+// Creating a symlink needs no privilege only on POSIX.
+TEST_CASE("A user preset symlinked to a missing target is counted but the link is kept", "[Preset][Bundle][InstanceLock]")
+{
+    ScopedTemporaryDir   temp_dir;
+    ScopedDataDir        data_dir_scope(temp_dir.path());
+    RenameTestCollection coll;
+
+    const fs::path dir  = temp_dir.path() / PRESET_PRINT_NAME;
+    const fs::path link = dir / "Linked.json";
+    fs::create_directories(dir);
+    fs::create_symlink(temp_dir.path() / "unmounted" / "Linked.json", link);
+
+    PresetsConfigSubstitutions substitutions;
+    coll.load_presets(temp_dir.path().string(), PRESET_PRINT_NAME, substitutions,
+                      ForwardCompatibilitySubstitutionRule::Disable);
+
+    CHECK(coll.error_count() == 1);
+    CHECK(coll.find_preset("Linked") == nullptr);
+    boost::system::error_code ec;
+    CHECK(fs::symlink_status(link, ec).type() == fs::symlink_file);
+}
+#endif
+
+#ifndef _WIN32
+// The read-only bit on a directory stops file creation only on POSIX.
+TEST_CASE("A user filament whose derived compatible printer cannot be written back still loads with the failure counted", "[Preset][Bundle]")
+{
+    if (::geteuid() == 0)
+        SKIP("a read-only directory does not stop root");
+    ScopedTemporaryDir temp_dir;
+    PresetBundle       bundle;
+    const fs::path     dir  = temp_dir.path() / PRESET_FILAMENT_NAME;
+    const fs::path     file = dir / "My PLA @Test Printer.json";
+    write_preset_with_inherits(bundle.filaments.default_preset().config, file, "My PLA @Test Printer", std::string());
+    const std::string before = read_file(file);
+
+    fs::permissions(file, fs::owner_read);
+    fs::permissions(dir, fs::owner_read | fs::owner_exe);
+    PresetsConfigSubstitutions substitutions;
+    bundle.filaments.load_presets(temp_dir.path().string(), PRESET_FILAMENT_NAME, substitutions,
+                                  ForwardCompatibilitySubstitutionRule::EnableSilent);
+    // Restored before any assertion, so a failure never leaves an unremovable directory behind.
+    fs::permissions(dir, fs::owner_all);
+    fs::permissions(file, fs::owner_read | fs::owner_write);
+
+    const Preset *preset = bundle.filaments.find_preset("My PLA @Test Printer");
+    REQUIRE(preset != nullptr);
+    CHECK(preset->config.option<ConfigOptionStrings>("compatible_printers")->values == std::vector<std::string>{ "Test Printer" });
+    CHECK(bundle.filaments.error_count() == 1);
+    CHECK(read_file(file) == before);
+}
+#endif
@@ -10,6 +10,8 @@
 #include <cctype>
 #include <fstream>
 #include <string>
+#include <thread>
+#include <system_error>

 #ifndef _WIN32
 #include <unistd.h>     // getuid
@@ -62,6 +64,113 @@ TEST_CASE("per-user temp root is unchanged on Windows, isolated elsewhere", "[ut
 #endif
 }

+TEST_CASE("write_file_atomically replaces the target and leaves no temporary file", "[utils]") {
+    ScopedTemporaryDir dir;
+    const boost::filesystem::path target = dir.path() / "preset.json";
+
+    REQUIRE_FALSE(write_file_atomically(target.string(), "first"));
+    REQUIRE_FALSE(write_file_atomically(target.string(), "second"));
+
+    std::string content;
+    load_string_file(target, content);
+    REQUIRE(content == "second");
+    size_t entries = 0;
+    for (auto &entry : boost::filesystem::directory_iterator(dir.path())) {
+        (void) entry;
+        ++entries;
+    }
+    REQUIRE(entries == 1);
+}
+
+TEST_CASE("write_file_atomically reports a missing directory and writes nothing", "[utils]") {
+    ScopedTemporaryDir dir;
+    const boost::filesystem::path target = dir.path() / "missing" / "preset.json";
+
+    const std::error_code ec = write_file_atomically(target.string(), "x");
+    REQUIRE(ec == std::errc::no_such_file_or_directory);
+    REQUIRE_FALSE(boost::filesystem::exists(target));
+}
+
+#ifndef _WIN32
+// The read-only bit on a directory stops file creation only on POSIX.
+TEST_CASE("write_file_atomically writes in place when no temporary can be created beside an existing target", "[utils]") {
+    if (::geteuid() == 0)
+        SKIP("a read-only directory does not stop root");
+    ScopedTemporaryDir dir;
+    const boost::filesystem::path target = dir.path() / "preset.json";
+    REQUIRE_FALSE(write_file_atomically(target.string(), "first"));
+    boost::filesystem::permissions(dir.path(), boost::filesystem::owner_read | boost::filesystem::owner_exe);
+
+    const std::error_code replaced = write_file_atomically(target.string(), "second");
+    const std::error_code created  = write_file_atomically((dir.path() / "new.json").string(), "x");
+    // Restored before any assertion, so a failure never leaves an unremovable directory behind.
+    boost::filesystem::permissions(dir.path(), boost::filesystem::owner_all);
+
+    REQUIRE_FALSE(replaced);
+    REQUIRE(created == std::errc::permission_denied);
+    std::string content;
+    load_string_file(target, content);
+    REQUIRE(content == "second");
+}
+#endif
+
+TEST_CASE("write_file_atomically keeps bytes intact in binary mode", "[utils]") {
+    ScopedTemporaryDir dir;
+    const boost::filesystem::path target = dir.path() / "blob.bin";
+    const std::string bytes("a\r\nb\0c", 6);
+
+    REQUIRE_FALSE(write_file_atomically(target.string(), bytes, /*binary=*/true));
+    REQUIRE(boost::filesystem::file_size(target) == bytes.size());
+}
+
+#ifndef _WIN32
+TEST_CASE("write_file_atomically writes through a symlink and keeps the target's permissions", "[utils]") {
+    ScopedTemporaryDir dir;
+    const boost::filesystem::path real = dir.path() / "real.json";
+    const boost::filesystem::path link = dir.path() / "link.json";
+    REQUIRE_FALSE(write_file_atomically(real.string(), "first"));
+    boost::filesystem::permissions(real, boost::filesystem::owner_read | boost::filesystem::owner_write);
+    boost::filesystem::create_symlink(real, link);
+
+    REQUIRE_FALSE(write_file_atomically(link.string(), "second"));
+
+    REQUIRE(boost::filesystem::is_symlink(boost::filesystem::symlink_status(link)));
+    std::string content;
+    load_string_file(real, content);
+    REQUIRE(content == "second");
+
+    REQUIRE_FALSE(write_file_atomically(real.string(), "third"));
+    const auto perms = boost::filesystem::status(real).permissions() & boost::filesystem::all_all;
+    REQUIRE(perms == (boost::filesystem::owner_read | boost::filesystem::owner_write));
+}
+#endif
+
+TEST_CASE("write_file_atomically survives two threads writing one target", "[utils]") {
+    ScopedTemporaryDir dir;
+    const boost::filesystem::path target = dir.path() / "shared.json";
+    const std::string a(20000, 'a'), b(20000, 'b');
+
+    std::thread other([&] {
+        for (int i = 0; i < 50; ++i)
+            write_file_atomically(target.string(), a);
+    });
+    for (int i = 0; i < 50; ++i)
+        write_file_atomically(target.string(), b);
+    other.join();
+
+    std::string content;
+    load_string_file(target, content);
+    const bool whole = content == a || content == b;
+    REQUIRE(whole);
+    // No temporary may be left; a scanner on Windows may briefly hold the old
+    // file under another name, so only the temporaries are counted.
+    size_t temporaries = 0;
+    for (auto &entry : boost::filesystem::directory_iterator(dir.path()))
+        if (entry.path().extension() == ".tmp")
+            ++temporaries;
+    REQUIRE(temporaries == 0);
+}
+
 TEST_CASE("copy_file reports the OS error when the destination cannot be written", "[utils]") {
    ScopedTemporaryFile source(".txt");
    {
@@ -1804,24 +1804,6 @@ TEST_CASE("a header claiming more body than the file holds is rejected", "[Vendo
    REQUIRE_FALSE(bundle.load_vendor_cache(cache, "Bounded", Semver(1, 0, 0)));
 }

-TEST_CASE("a failed write leaves the previous cache in place", "[VendorCache]")
-{
-    TempDir tmp;
-    const std::string cache = (tmp.path / "Durable.opc").string();
-    REQUIRE(save_one_vendor(cache, one_vendor("Durable"), "Durable", "1.0.0"));
-    const std::string before = slurp(cache);
-
-    // A directory where the temp file wants to go: the write cannot complete,
-    // and must not have destroyed what was already there to find that out.
-    const fs::path blocker = fs::path(cache + "." + std::to_string(get_current_pid()) + ".tmp");
-    fs::create_directories(blocker);
-
-    REQUIRE_FALSE(save_one_vendor(cache, one_vendor("Durable"), "Durable", "2.0.0"));
-    CHECK(slurp(cache) == before);
-
-    fs::remove_all(blocker);
-}
-
 TEST_CASE("a cache written by another build's option ordering still loads", "[VendorCache]")
 {
    // The regression the fingerprint used to prevent by refusing the file
@@ -13,6 +13,7 @@ add_executable(${_TEST_NAME}_tests
    test_prebuild_queue.cpp
    test_staged_build.cpp
    test_network_versions.cpp
+    test_orca_cloud_agent.cpp
    test_action_source.cpp
    test_plugin_host_api.cpp
    # Exercise seam enums and predicates through the embedded Python host API.
@@ -6,6 +6,7 @@
 #include <boost/filesystem.hpp>
 #include <memory.h>
 #include <stdexcept>
+#include <string>
 #include <pybind11/embed.h>
 #include <pybind11/pybind11.h>

@@ -25,8 +26,15 @@ void ensure_python_initialized()
    config.parse_argv = 0;

    const auto python_home = boost::dll::program_location().parent_path() / "python";
+#ifdef _WIN32
+    const auto stdlib = python_home / "Lib";
+#else
+    const auto stdlib = python_home / "lib" /
+                        ("python" + std::to_string(PY_MAJOR_VERSION) + "." + std::to_string(PY_MINOR_VERSION));
+#endif

-    if (boost::filesystem::exists(python_home)) {
+    // Only a real runtime: a stray python/ folder (packages a test left behind) is not a home.
+    if (boost::filesystem::exists(stdlib / "encodings")) {
        const std::string home = python_home.string();
        const PyStatus status  = PyConfig_SetBytesString(&config, &config.home, home.c_str());

@@ -0,0 +1,86 @@
+#include <catch2/catch_all.hpp>
+
+#include <boost/filesystem.hpp>
+#include <boost/filesystem/fstream.hpp>
+
+#include <memory>
+#include <string>
+
+#include "slic3r/Utils/OrcaCloudServiceAgent.hpp"
+#include "test_utils.hpp"
+
+using namespace Slic3r;
+namespace fs = boost::filesystem;
+
+namespace {
+
+// The encrypted token file is the one secret backend a test can observe without a system
+// keychain. Every agent pointed at the same directory shares it, like separate app instances
+// share the keychain entry.
+std::unique_ptr<OrcaCloudServiceAgent> make_file_backed_agent(const fs::path& dir)
+{
+    auto agent = std::make_unique<OrcaCloudServiceAgent>(dir.string());
+    agent->set_use_encrypted_token_file(true);
+    agent->set_config_dir(dir.string());
+    return agent;
+}
+
+fs::path secret_file(const fs::path& dir) { return dir / secret_constants::USER_SECRET_FILENAME; }
+
+} // namespace
+
+TEST_CASE("Logging out removes the secret this instance saved", "[OrcaCloudServiceAgent]")
+{
+    ScopedTemporaryDir dir("orca-secret");
+    auto agent = make_file_backed_agent(dir.path());
+
+    agent->persist_user_secret("refresh-token");
+    REQUIRE(fs::exists(secret_file(dir.path())));
+
+    agent->user_logout(false);
+    CHECK_FALSE(fs::exists(secret_file(dir.path())));
+}
+
+TEST_CASE("Logging out removes a secret this instance loaded from the store", "[OrcaCloudServiceAgent]")
+{
+    ScopedTemporaryDir dir("orca-secret");
+    make_file_backed_agent(dir.path())->persist_user_secret("refresh-token");
+
+    auto        agent = make_file_backed_agent(dir.path());
+    std::string secret;
+    REQUIRE(agent->load_user_secret(secret));
+    CHECK(secret == "refresh-token");
+
+    agent->user_logout(false);
+    CHECK_FALSE(fs::exists(secret_file(dir.path())));
+}
+
+TEST_CASE("Logging out leaves a secret this instance never loaded or saved alone", "[OrcaCloudServiceAgent]")
+{
+    ScopedTemporaryDir dir("orca-secret");
+    make_file_backed_agent(dir.path())->persist_user_secret("refresh-token");
+
+    // A logged-out instance is asked to log out on every login-status poll.
+    auto other = make_file_backed_agent(dir.path());
+    other->user_logout(false);
+    other->user_logout(false);
+    CHECK(fs::exists(secret_file(dir.path())));
+
+    std::string secret;
+    REQUIRE(make_file_backed_agent(dir.path())->load_user_secret(secret));
+    CHECK(secret == "refresh-token");
+}
+
+TEST_CASE("Logging out leaves a secret this instance could not read alone", "[OrcaCloudServiceAgent]")
+{
+    ScopedTemporaryDir dir("orca-secret");
+    // Written under another encryption key, e.g. by another OS user sharing the data directory.
+    fs::ofstream(secret_file(dir.path())) << "v2:0000:not-a-payload-this-user-can-decrypt";
+
+    auto        agent = make_file_backed_agent(dir.path());
+    std::string secret;
+    REQUIRE_FALSE(agent->load_user_secret(secret));
+
+    agent->user_logout(false);
+    CHECK(fs::exists(secret_file(dir.path())));
+}
@@ -38,6 +38,9 @@ namespace {
 // before this destructor's shutdown() runs.
 struct ScopedPluginManager
 {
+    // Before initialize(): the interpreter creates {data_dir}/python/packages and {data_dir}/log,
+    // which would otherwise land in the working directory.
+    ScopedDataDir python_data_dir{"plugin-python"};
    bool initialized = PluginManager::instance().initialize();

    ~ScopedPluginManager()
@@ -31,6 +31,9 @@ namespace {
 // same as any other plugin.
 struct ScopedManagerShutdown
 {
+    // Before initialize(): the interpreter creates {data_dir}/python/packages and {data_dir}/log,
+    // which would otherwise land in the working directory.
+    ScopedDataDir python_data_dir{"plugin-python"};
    bool initialized = PluginManager::instance().initialize();

    ~ScopedManagerShutdown()
@@ -42,6 +42,9 @@ namespace {
 // Declare this FIRST in a test so it is destroyed last.
 struct ScopedPluginManager
 {
+    // Before initialize(): the interpreter creates {data_dir}/python/packages and {data_dir}/log,
+    // which would otherwise land in the working directory.
+    ScopedDataDir python_data_dir{"plugin-python"};
    bool initialized = false;

    ScopedPluginManager() { initialized = PluginManager::instance().initialize(); }
@@ -12,6 +12,8 @@
 #include <memory>
 #include <string>

+#include "plugin_test_utils.hpp"
+
 namespace py = pybind11;
 using namespace Slic3r;

@@ -21,6 +23,9 @@ namespace {
 // into Python unless PythonInterpreter::instance() reports initialized.
 struct ScopedPluginManager
 {
+    // Before initialize(): the interpreter creates {data_dir}/python/packages and {data_dir}/log,
+    // which would otherwise land in the working directory.
+    ScopedDataDir python_data_dir{"plugin-python"};
    bool initialized = PluginManager::instance().initialize();

    ~ScopedPluginManager()
@@ -35,6 +35,9 @@ namespace {

 struct ScopedPluginManager
 {
+    // Before initialize(): the interpreter creates {data_dir}/python/packages and {data_dir}/log,
+    // which would otherwise land in the working directory.
+    ScopedDataDir python_data_dir{"plugin-python"};
    bool initialized = false;

    ScopedPluginManager() { initialized = PluginManager::instance().initialize(); }
Author	SHA1	Message	Date
Hanif Koh	da353c2fed	Run the Cross-Process Lock Test on Every Platform The test that checks the guard yields to a lock held elsewhere forked a child to hold it, so it was left out on Windows. The OS lock belongs to the handle on Windows and to the open file description elsewhere, so a second handle in the same process is refused like another instance would be. The test now holds the lock that way and runs everywhere.	2026-10-01 15:00:32 +08:00
Hanif Koh	e00c3a3f26	Lock Config and Preset Files Across Instances and Write Them Atomically Every running instance shares one OrcaSlicer.conf and one user preset tree, and nothing kept their writers apart. Two instances saving at the same moment, or the cloud preset sync thread writing while the GUI thread saved, could interleave, and a reader in another instance could open a preset JSON or .info file between truncate and close and get a partial file, dropping that preset for the session with a parse error. Add InstanceLock, a scoped guard that serialises the threads of one process through a recursive mutex and other processes through an advisory OS file lock: flock on POSIX, held on the guard's own descriptor so no other close in the process can drop it, and LockFileEx on Windows. The outermost guard opens the lock file and closes it on release, so nothing stays open between saves and a data dir can be removed once nothing is saving into it; the file itself is kept, since deleting it would let a third instance lock a fresh file while the second still holds the old one. It is best effort: when the lock file cannot be opened or locked, or another instance still holds it after a second, the guard logs once and lets the write proceed, then leaves the file alone for ten seconds, so a hung instance never blocks every other one and a holder stuck in a debugger does not cost a stall per save. The guard sits at the leaf readers and writers: set_sync_info_and_save() calls save_info() under the preset collection mutex, so a batch lock around save_user_presets() would invert the order against the sync thread. The user preset scan reads its files on worker threads without the guard, since the mutex would serialise them, and takes it per file in the serial commit step, so a save never waits for the whole scan. Each read keeps the bytes of the preset and its .info as they were before parsing; commit compares them with the disk under the guard and reads a file that changed again, so it never deletes or writes back over another instance's newer save, nor installs a .json and .info from two different saves; a preset another instance removed in the meantime is not installed. Without the guard, in a cool-down, the scan still loads the presets but leaves their files alone: an unreadable file stays for the next scan, and a derived compatible printer is not written back. Read-only scans, which is what the CLI does, take no lock and create no lock file. AppConfig holds OrcaSlicer.conf.lock in load() and save(); load is included because the Windows path restores from the .bak copy. Every user preset writer and reader holds user.lock: Preset::save(), which writes no .info when the preset itself could not be written, since an .info without its preset reads as a cloud deletion request, save_info(), reload() and remove_files(), each preset the scan commits, the bundle metadata reads and write, the .info removal after a cloud-confirmed delete, the orphaned-.info scan on the sync thread, the bundle folder removal on unsubscribe and the physical printer writers and delete paths. A bundle import extracts under cache/ into a folder per process and per import, where no scan reads. Preset JSON, .info, bundle metadata, physical printer and config files, and the caches and state files that already used a temporary by hand, now go through write_file_atomically(), which writes <file>.<pid>.<n>.tmp beside the target and renames it over, so a reader that never waits sees a complete old or new file. A symlink is followed; a target that is not a regular file is written in place; and when no temporary can be created beside an existing target, or the rename itself is refused, by a Windows reader holding the file open or a mount that cannot replace in one step, the helper writes in place as before, since losing the save is worse than a torn read. On POSIX the rename replaces the target atomically where the old code removed it first and left a window with no file at all; only a mount that refuses a one-step replace gets the old remove-then-rename. A crash between temporary and rename leaves the temporary behind, which no scan reads. Preset::save() returns whether it wrote the preset, so the scan counts a compatible printer it could not write back as an error. A failed config write keeps the config dirty, and the idle handler waits ten seconds before retrying while an explicit save always tries.	2026-10-01 15:00:32 +08:00
SoftFever	3384daa6bc	Fix bundled Python crashing on macOS 26 and older when built with Xcode 27 (#16035 ) # Description With Xcode 27, building deps on macOS 26 fails at the Python install step with a segfault, and a libpython built with Xcode 27 crashes on macOS 12–26 the first time anything calls `os.pipe()`, which every plugin `subprocess` call does. The macOS 27 SDK declares `pipe2()` and `dup3()` as macOS 27-only, and CPython 3.12 calls them without a runtime check once configure finds them, so on older systems they resolve to NULL. This keeps CPython on the `pipe()`/`dup2()` fallbacks it already uses with older SDKs; upstream fixed it in 3.13+ ([python/cpython#153711](https://github.com/python/cpython/issues/153711)) but not in 3.12. No change for builds with Xcode 26 or older, or on Linux and Windows. # Screenshots/Recordings/Graphs <!-- > Please attach relevant screenshots to showcase the UI changes. > Please attach images that can help explain the changes. --> ## Tests Rebuilt deps with Xcode 27 on macOS 26.6: the Python install step now completes, the installed libpython no longer imports `pipe2`/`dup3`, and CPython's `test_os`, `test_subprocess` and `test_posix` pass, apart from one test that needs `_testcapi`, which `--disable-test-modules` leaves out. Running CPython's configure against the macOS 26.5 and 27.0 SDKs gives a byte-identical `pyconfig.h` for 26.5 with and without this change, and for 27.0 with it. The x86_64 cross-build path was configured on arm64 to confirm both of its configure runs pick up the change. <!-- > A guide for users on how to download the artifacts from this PR. --> [How to Download Pull Requests Artifacts for Testing](https://www.orcaslicer.com/wiki/how_to_download_pr_artifacts)	2026-10-01 14:57:30 +08:00
HanifKoh	6842d9c778	Keep the Plugin Tests' Python Packages Out of the Working Directory (#15981 ) The plugin test fixtures start the interpreter before the test points data_dir at its temporary directory, so PythonInterpreter creates {data_dir}/python/packages and {data_dir}/log with an empty data_dir: a python/ and log/ folder in whatever directory the tests run from. When that is the test binary's folder, the next run's embedded-interpreter tests took the stray python/ as their home and failed to start Python. Give each fixture that initializes the plugin manager its own temporary data directory, set up before initialize(), and only use the python/ folder next to the test binary as the interpreter's home when it holds a standard library.	2026-10-01 14:42:20 +08:00
HanifKoh	1a5bc8982d	Stop Logged-Out Login Polling from Hitting the System Keychain (#15979 ) With stealth mode off the home page asks for the login status every 2 s, and while nobody is logged in that ends in clear_user_secret(), which opened the system keychain and deleted the OrcaSlicer/Auth entry on the UI thread every tick. A working keychain cost a D-Bus round trip per tick; a keychain that never answers blocked the UI for 25 s per tick. It also deleted a login another running instance had just saved, and ignored use_encrypted_token_file, so opting out of the keychain did not help. Remember whether this process read a secret from the store or wrote one, and only then touch the store when a logged-out poll asks for a logout. A logged-out instance never touches the keychain, and in encrypted-file mode the poll no longer opens the keychain at all. A secret this process cannot read, such as a token file encrypted for another OS user sharing the data directory, is left alone by the poll. An explicit logout still wipes both backends, so a token stranded by switching the token storage option cannot sign the account back in later.	2026-10-01 14:41:50 +08:00
SoftFever	2a9cb32c1f	Fix bundled Python crashing on macOS 26 and older when built with Xcode 27 Building deps with Xcode 27 on macOS 26 failed at the Python install step, and a libpython built with Xcode 27 segfaulted on macOS 12-26 whenever a plugin started a subprocess.	2026-10-01 12:29:57 +08:00