@@ -299,14 +299,29 @@ function isWorkspaceRoot(root: string, scope: { cwd: string | undefined; ancesto
  * resolved credentials; mining a path out of an error message must not become a
  * way around that invariant.
  */
+/**
+ * Absolute paths a runtime quoted inside an error message.
+ *
+ * Three absolute shapes, and the third is the one that is easy to leave out:
+ * POSIX `/…`, a drive letter `C:\…`, and a UNC share `\\server\share\…`. A
+ * Windows error naming a driver on a share yields no roots at all without it,
+ * so a driver stays unfindable even though the error named its exact location.
+ */
+export function quotedAbsolutePaths(message: string): string[] {
+  const found: string[] = []
+  const pattern = /['"`]((?:\/|[A-Za-z]:[\\/]|\\\\[^\\/'"`\n]+[\\/])[^'"`\n]+)['"`]/g
+  for (const match of message.matchAll(pattern)) {
+    const named = match[1]
+    if (named) found.push(named)
+  }
+  return found
+}
+
 export function searchRootsFromError(error: unknown): string[] {
   const message = error instanceof Error ? error.message : String(error)
   const scope = workspaceScope()
   const roots: string[] = []
-  // Absolute paths the runtime quoted, POSIX or Windows.
-  for (const match of message.matchAll(/['"`]((?:\/|[A-Za-z]:[\\/])[^'"`\n]+)['"`]/g)) {
-    const named = match[1]
-    if (!named) continue
+  for (const named of quotedAbsolutePaths(message)) {
     for (const candidate of [named, repairCwdPrefixedPath(named)]) {
       if (!candidate) continue
       // Walk back to every enclosing node_modules directory, innermost first.
@@ -1016,13 +1031,32 @@ const installsInFlight = new Map<string, Promise<InstallResult>>()
  */
 export function installLockPath(dir: string): string {
   const trimmed = dir.replace(/[\\/]+$/, "")
+  const separator = dir.includes("\\") ? "\\" : "/"
   // Trailing separators are stripped so `<dir>/` and `<dir>` agree on one lock.
-  // A filesystem root is the exception: stripping there destroys the root — "/"
-  // would become the *relative* ".lock", and "C:\" the drive-relative "C:.lock"
-  // — so two processes started from different working directories would take
-  // different locks while installing into the same place.
-  const base = trimmed === "" || /^[A-Za-z]:$/.test(trimmed) ? dir : trimmed
-  return `${base}.lock`
+  // A filesystem root is the exception: stripping there destroys the root, and
+  // the result names something *outside* the directory being locked, so two
+  // processes installing into the same place take different locks. Roots keep
+  // their separator and the lock goes inside them.
+  //
+  //   /                ->  /.lock                 not the relative .lock
+  //   C:\              ->  C:\.lock              not drive-relative C:.lock
+  //   \\server\share\  ->  \\server\share\.lock  not a *different share*
+  if (isFilesystemRoot(trimmed)) return `${trimmed}${separator}.lock`
+  return `${trimmed}.lock`
+}
+
+/**
+ * True when `candidate` — trailing separators already stripped — names a
+ * filesystem root rather than a directory inside one.
+ *
+ * The UNC case is the one that is easy to miss: a share root is a root in
+ * exactly the way a drive letter is, and appending `.lock` to it names an
+ * unrelated share rather than anything under the directory being locked.
+ */
+function isFilesystemRoot(candidate: string): boolean {
+  if (candidate === "") return true // POSIX "/" strips to ""
+  if (/^[A-Za-z]:$/.test(candidate)) return true // "C:\" strips to "C:"
+  return /^\\\\[^\\/]+\\[^\\/]+$/.test(candidate) // "\\server\share"
 }
 
 /**
@@ -1204,6 +1238,24 @@ function releaseInstallLock(lockDir: string, token: string, ino: number | undefi
   }
 }
 
+/**
+ * A value that changes when the lock changes hands.
+ *
+ * The owner's token when it published one; otherwise the lock directory's own
+ * identity, which a fresh `mkdir` changes even when the owner file is missing
+ * or unreadable. `undefined` means we could not tell, and the caller then
+ * treats the holder as unchanged rather than inventing progress.
+ */
+function lockIdentity(lockDir: string, holder: LockHolder | undefined): string | undefined {
+  if (holder?.token) return holder.token
+  try {
+    const stat = fs.statSync(lockDir)
+    return `${stat.ino}:${stat.mtimeMs}`
+  } catch {
+    return undefined
+  }
+}
+
 /**
  * Run `fn` while holding an exclusive lock on `dir`, across processes.
  *
@@ -1222,7 +1274,18 @@ export async function withInstallLock<T>(
   const staleAfterMs = options.staleAfterMs ?? 300_000
   const hardStaleAfterMs = options.hardStaleAfterMs ?? Math.max(staleAfterMs, 3_600_000)
   const pollMs = options.pollMs ?? 100
-  const deadline = Date.now() + timeoutMs
+  let deadline = Date.now() + timeoutMs
+  // The budget is per *holder*, not per wait. Every process counts its deadline
+  // from its own start, so a single budget only ever outlasts one peer: with
+  // three or more contenders the last one's deadline expires part-way through
+  // somebody else's install and it falls through to an unlocked performInstall
+  // — the concurrent npm mutation this lock exists to prevent. Seeing the lock
+  // change hands is proof the queue is moving rather than wedged, so each new
+  // holder gets its own budget. Extensions are capped so a machine that keeps
+  // feeding in contenders cannot block a caller indefinitely.
+  const maxHandovers = 32
+  let handovers = 0
+  let lastHolder: string | undefined
   const token = `${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`
   let acquired = false
   let ino: number | undefined
@@ -1256,6 +1319,14 @@ export async function withInstallLock<T>(
       const code = e && typeof e === "object" && "code" in e ? (e as { code?: unknown }).code : undefined
       if (code !== "EEXIST") break
       const holder = readLockHolder(lockDir)
+      const identity = lockIdentity(lockDir, holder)
+      if (identity !== undefined && identity !== lastHolder) {
+        if (lastHolder !== undefined && handovers < maxHandovers) {
+          handovers++
+          deadline = Date.now() + timeoutMs
+        }
+        lastHolder = identity
+      }
       if (isStaleLock(lockDir, holder, staleAfterMs, hardStaleAfterMs)) {
         // A claim can fail persistently — a lock owned by another user, or a
         // container that permits inspection but not rename. Retrying such a
 
@@ -133,6 +133,43 @@ process.exit(0)
     expect(sawAcquired).toBe(true)
   })
 
+  test("waits behind more than one peer without falling through unlocked", async () => {
+    // Every process counts its deadline from its own start, so a single budget
+    // only ever outlasts ONE holder. With three contenders the last one's
+    // deadline expires part-way through somebody else's install and it runs
+    // performInstall unlocked — the concurrent npm mutation the lock exists to
+    // prevent. The hold below is deliberately longer than the timeout so the
+    // test fails unless the wait is extended each time the lock changes hands.
+    const target = path.join(dir, "drivers")
+    fs.mkdirSync(target, { recursive: true })
+    const log = path.join(dir, "peers.txt")
+
+    const child = path.join(dir, "peer.ts")
+    fs.writeFileSync(
+      child,
+      `import fs from "node:fs"
+import { withInstallLock } from ${JSON.stringify(resolveModule)}
+const [target, log, id] = process.argv.slice(2)
+await withInstallLock(target, async (acquired) => {
+  fs.appendFileSync(log, \`\${acquired ? "locked" : "UNLOCKED"} \${id}\\n\`)
+  if (acquired) await new Promise((r) => setTimeout(r, 400))
+}, { timeoutMs: 600, pollMs: 20 })
+process.exit(0)
+`,
+    )
+
+    const kids = Array.from({ length: 3 }, (_, i) =>
+      Bun.spawn(["bun", child, target, log, String(i)], { stdout: "ignore", stderr: "ignore" }),
+    )
+    expect(await Promise.all(kids.map((k) => k.exited))).toEqual([0, 0, 0])
+
+    const events = fs.readFileSync(log, "utf8").trim().split("\n").filter(Boolean)
+    expect(events.length).toBe(3)
+    // Three holds of 400ms against a 600ms budget: the third can only succeed
+    // if watching the lock change hands renewed its wait.
+    expect(events.filter((e) => e.startsWith("UNLOCKED"))).toEqual([])
+  }, 60_000)
+
   test("reports the section ran unlocked when the lock cannot be taken in time", async () => {
     const target = path.join(dir, "drivers")
     fs.mkdirSync(target, { recursive: true })
 
@@ -3,8 +3,20 @@ import fs from "node:fs"
 import os from "node:os"
 import path from "node:path"
 
+import { createRequire } from "node:module"
+import { pathToFileURL } from "node:url"
+
 import { driverSearchRoots, resolveOptionalPackage } from "../src/resolve"
 
+// Specifiers that exist nowhere but the tree each test builds. Asking for a
+// real driver name would let the repo's own `packages/drivers/node_modules`
+// satisfy the lookup through the execPath and module-location roots — which no
+// environment isolation can suppress — so the test would pass while proving
+// nothing about which root actually won.
+const FIXTURE = "altimate-chdir-fixture"
+const CWD_ONLY = "altimate-cwd-only-fixture"
+const MARKER = "resolved-from-the-fixture-tree"
+
 // Six pilots were spent on a driver-load failure that only appeared under
 // `--dir`, which calls `process.chdir()` (cli/cmd/run.ts) before any driver is
 // loaded. Every local verification — and the rig's own pre-flight probe — ran
@@ -34,7 +46,7 @@ beforeEach(() => {
   pkgRoot = path.join(root, "lib", "node_modules", "altimate-code")
   nodeModules = path.join(pkgRoot, "node_modules")
   fs.mkdirSync(nodeModules, { recursive: true })
-  writePackage(nodeModules, "duckdb", "index.js", "module.exports = { Database: function () {} }\n")
+  writePackage(nodeModules, FIXTURE, "index.js", `module.exports = { marker: ${JSON.stringify(MARKER)} }\n`)
   elsewhere = path.join(root, "unrelated-run-dir")
   fs.mkdirSync(elsewhere, { recursive: true })
 })
@@ -46,11 +58,11 @@ afterEach(() => {
 
 describe("resolution does not depend on the working directory", () => {
   test("resolves the same package before and after a chdir", () => {
-    const before = resolveOptionalPackage("duckdb", [nodeModules])
+    const before = resolveOptionalPackage(FIXTURE, [nodeModules])
     expect(before).toBeDefined()
 
     process.chdir(elsewhere)
-    const after = resolveOptionalPackage("duckdb", [nodeModules])
+    const after = resolveOptionalPackage(FIXTURE, [nodeModules])
     expect(after).toBe(before)
   })
 
@@ -59,34 +71,36 @@ describe("resolution does not depend on the working directory", () => {
     // about it can contribute to resolution. This is the rig's shape: the run
     // directory and the install tree are unrelated.
     process.chdir(elsewhere)
-    const resolved = resolveOptionalPackage("duckdb", [nodeModules])
+    const resolved = resolveOptionalPackage(FIXTURE, [nodeModules])
     expect(resolved).toBeDefined()
     expect(resolved!.startsWith(nodeModules)).toBe(true)
-    expect(fs.existsSync(resolved!)).toBe(true)
+    // Load it and read the marker, so the test reports which root satisfied the
+    // lookup rather than merely that something was found.
+    const loaded = createRequire(pathToFileURL(resolved!).href)(resolved!)
+    expect(loaded.marker).toBe(MARKER)
   })
 
   test("does not resolve out of the working directory's own node_modules", () => {
     // A package present only under cwd must stay invisible: project trees are
     // workspace-controlled executable content and are deliberately not searched.
     const cwdModules = path.join(elsewhere, "node_modules")
     fs.mkdirSync(cwdModules, { recursive: true })
-    writePackage(cwdModules, "pg", "index.js", "module.exports = { Client: function () {} }\n")
+    writePackage(cwdModules, CWD_ONLY, "index.js", `module.exports = { marker: ${JSON.stringify(MARKER)} }\n`)
 
     process.chdir(elsewhere)
-    // Assert on provenance, not absence: this repo legitimately has `pg` under
-    // its own tree, which driverSearchRoots finds. What must never happen is a
-    // resolution out of the working directory.
-    const resolved = resolveOptionalPackage("pg", driverSearchRoots())
-    if (resolved !== undefined) expect(resolved.startsWith(elsewhere)).toBe(false)
+    // The specifier exists nowhere else on the machine, so this is absence with
+    // a known cause: anything but undefined means the lookup reached into the
+    // working directory.
+    expect(resolveOptionalPackage(CWD_ONLY, driverSearchRoots())).toBeUndefined()
   })
 
   test("a chdir between resolve and re-resolve does not change the answer", () => {
     process.chdir(elsewhere)
-    const first = resolveOptionalPackage("duckdb", [nodeModules])
+    const first = resolveOptionalPackage(FIXTURE, [nodeModules])
     process.chdir(originalCwd)
-    const second = resolveOptionalPackage("duckdb", [nodeModules])
+    const second = resolveOptionalPackage(FIXTURE, [nodeModules])
     process.chdir(root)
-    const third = resolveOptionalPackage("duckdb", [nodeModules])
+    const third = resolveOptionalPackage(FIXTURE, [nodeModules])
     expect(second).toBe(first)
     expect(third).toBe(first)
   })
 
@@ -0,0 +1,81 @@
+import { describe, expect, test } from "bun:test"
+
+import { enclosingNodeModulesRoots, installLockPath, quotedAbsolutePaths } from "../src/resolve"
+
+// Windows path shapes, unit-testable from any platform because none of these
+// touch the filesystem. UNC is the shape that keeps getting left out: a share
+// root behaves like a drive root, and code that only special-cases `C:` gets it
+// wrong in a way that is invisible until someone runs from a network share.
+
+describe("installLockPath keeps a root intact", () => {
+  test("puts the lock inside a POSIX root", () => {
+    // Stripping the separator would leave "", making the lock the *relative*
+    // ".lock" — a different file for every working directory.
+    expect(installLockPath("/")).toBe("/.lock")
+  })
+
+  test("puts the lock inside a drive root", () => {
+    // "C:.lock" is drive-relative, not the root of C:.
+    expect(installLockPath("C:\\")).toBe("C:\\.lock")
+  })
+
+  test("puts the lock inside a UNC share root", () => {
+    // The bug this pins: "\\\\server\\share" + ".lock" names the *share*
+    // "\\\\server\\share.lock", a different network location entirely, so two
+    // processes installing into the share would not share a lock.
+    expect(installLockPath("\\\\server\\share\\")).toBe("\\\\server\\share\\.lock")
+    expect(installLockPath("\\\\server\\share")).toBe("\\\\server\\share\\.lock")
+  })
+
+  test("still strips a trailing separator on an ordinary directory", () => {
+    expect(installLockPath("/home/u/drivers/")).toBe("/home/u/drivers.lock")
+    expect(installLockPath("/home/u/drivers")).toBe("/home/u/drivers.lock")
+    expect(installLockPath("\\\\server\\share\\drivers\\")).toBe("\\\\server\\share\\drivers.lock")
+  })
+
+  test("a directory deeper than the share root is not treated as a root", () => {
+    expect(installLockPath("\\\\server\\share\\a")).toBe("\\\\server\\share\\a.lock")
+  })
+})
+
+describe("quotedAbsolutePaths covers every absolute shape", () => {
+  test("POSIX", () => {
+    expect(quotedAbsolutePaths(`open '/usr/lib/node_modules/x/package.json'`)).toEqual([
+      "/usr/lib/node_modules/x/package.json",
+    ])
+  })
+
+  test("drive letter, both separators", () => {
+    expect(quotedAbsolutePaths(`open "C:\\app\\node_modules\\x\\package.json"`)).toEqual([
+      "C:\\app\\node_modules\\x\\package.json",
+    ])
+    expect(quotedAbsolutePaths(`open "C:/app/node_modules/x/package.json"`)).toEqual([
+      "C:/app/node_modules/x/package.json",
+    ])
+  })
+
+  test("UNC share", () => {
+    // Without the UNC alternative this yields nothing, so a driver on a share
+    // stays unfindable even though the error named its exact location.
+    expect(quotedAbsolutePaths(`ENOENT: open '\\\\server\\share\\node_modules\\duckdb\\package.json'`)).toEqual([
+      "\\\\server\\share\\node_modules\\duckdb\\package.json",
+    ])
+  })
+
+  test("ignores relative paths and bare words", () => {
+    expect(quotedAbsolutePaths(`Cannot find package 'duckdb' from 'lib/x.js'`)).toEqual([])
+  })
+})
+
+describe("enclosingNodeModulesRoots on Windows separators", () => {
+  test("walks back through a UNC path, innermost first", () => {
+    const roots = enclosingNodeModulesRoots(
+      "\\\\server\\share\\app\\node_modules\\a\\node_modules\\duckdb\\package.json",
+      "\\",
+    )
+    expect(roots).toEqual([
+      "\\\\server\\share\\app\\node_modules\\a\\node_modules",
+      "\\\\server\\share\\app\\node_modules",
+    ])
+  })
+})