fix(tbtc/signer): serialize initial state loading

[mswilkison]

Stack

Rust signer review-fix stack 3 of 3.

• Depends on: fix(tbtc/signer): zeroize DKG wire secrets #4158, which depends on fix(tbtc/signer): bound interactive session persistence #4157
• Ultimate base: extraction/frost-signer-mirror-2026-05-26 (feat(tbtc/signer): Rust FROST/ROAST signer (distributed DKG, interactive-only signing, FFI ABI 2.0) #4005)

Merge #4157 and #4158 first, then retarget this PR down the stack.

What changed

• Serialize the complete first fallible state load and migration behind a dedicated process-local initialization mutex.
• Double-check the OnceLock after acquiring the initializer mutex so concurrent first callers invoke the loader and any in-place migration only once.
• Keep the initializer separate from STATE_FILE_LOCK, avoiding lock-order recursion when the loader resolves the active state path.
• Recover the initializer token after mutex poisoning and leave the OnceLock unset after load errors so later calls can retry.
• Add deterministic concurrency and failure-retry regressions against the same helper used by production state().

Review finding addressed

• P2: serialize first-time state loading and migration.

Verification

• cargo fmt --manifest-path pkg/tbtc/signer/Cargo.toml -- --check
• cargo check --locked --manifest-path pkg/tbtc/signer/Cargo.toml --all-targets
• cargo clippy --locked --manifest-path pkg/tbtc/signer/Cargo.toml --all-targets -- -D warnings
• cargo test --locked --manifest-path pkg/tbtc/signer/Cargo.toml (263 passed, 1 ignored; the ignored multiprocess helper passes in its child process; 28 binary and 1 integration test passed)
• cargo test --locked --manifest-path pkg/tbtc/signer/Cargo.toml formal_verification_
• pkg/tbtc/signer/scripts/run_phase5_chaos_suite.sh (all 6 scenarios passed)
• git diff --check

CI is authoritative for the TLA+ model and dependency-audit gates.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2d050f8a-653c-4c40-82c2-a6604de4f5b9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/signer-state-load-serialization-2026-07-13

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}