The previous comment claimed "rmdir-on-non-empty is a no-op" — that is
factually wrong. fs.rmdirSync throws ENOTEMPTY on non-empty directories.
The actual race-safety mechanism is:
1. fs.readdirSync(STAGE_DIR) -> leftovers
2. fs.rmdirSync(STAGE_DIR) only when leftovers.length === 0
3. Outer try/catch swallows TOCTOU ENOTEMPTY (peer added a file
between readdir and rmdir) and ENOENT (peer already cleaned up).
Comment now references the leftovers variable and both fs calls so a
future reader can map narrative to code without reverse-engineering it.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
f4c4ec6211