anchor.diff:  Since this locks the fd table, it is very important to minimize the
   amount of work done in the body of this macro.  Ideally, you would
   do nothing exept spawn a new process."
  -  `(with-recursive-lock-held (%fd-retain-count-table-lock%)
  -     (let ((,fd-list-sym (hash-table-keys %fd-retain-count-table%)))
  +  `(with-safe-fd-manipulation
  +     (let ((,fd-list-sym (hash-table-keys %extant-fds%)))
          (declare (dynamic-extent ,fd-list-sym))
          ,@body)))
   
   (defun dup-retained (fd)
  -  (with-recursive-lock-held (%fd-retain-count-table-lock%)
  -    (let ((new-fd (dup fd)))
  +  (with-safe-fd-manipulation
  +    (let ((new-fd (track (dup fd))))
         (debug-log status "DUP ~A = ~A" new-fd fd)
  -      (%manage-new-fd new-fd))))
  +      (manage-new-fd new-fd))))
   
   (defun open-retained (pathname flags &optional mode)
     "This is a wrapper around the posix open function which
   atomically adds the new fd to the fd table and gives it a +1 retain
   count."
  -  (with-recursive-lock-held (%fd-retain-count-table-lock%)
  -    (let ((fd (posix-open pathname flags mode)))
  +  (with-safe-fd-manipulation
  +    (let ((fd (track (posix-open pathname flags mode))))
         (debug-log status "OPEN ~A = ~A" fd pathname)
  -      (%manage-new-fd fd))))
  +      (manage-new-fd fd))))
   
   (defun openat-retained (dir-fd pathname flags &optional mode)
  -  (with-recursive-lock-held (%fd-retain-count-table-lock%)
  -    (let ((fd (openat dir-fd pathname flags mode)))
  +  (with-safe-fd-manipulation
  +    (let ((fd (track (openat dir-fd pathname flags mode))))
         (debug-log status "OPENAT ~A, ~A = ~A" dir-fd fd pathname)
  -      (%manage-new-fd fd))))
  +      (manage-new-fd fd))))
   
   (defun pipe-retained ()
     "This is a wrapper around the posix pipe function which atomically
  
positive.code:         :shcl/core/shell-environment)
    (:shadowing-import-from :alexandria #:when-let #:when-let*)
    (:export
     #:fd-retain #:fd-release #:fd-autorelease
     #:with-fd-scope #:with-living-fds #:dup-retained #:open-retained
     #:openat-retained #:pipe-retained #:with-pipe #:bind-fd
  
negative.code:     :accessor fd-already-managed-fd))
    (:report (lambda (c s) (format s "Can't enter FD ~A into retain/release management again" (fd-already-managed-fd c)))))
  
  (defun manage-new-fd (fd)
    "Enter the given fd into the retain/release table.
  
  To safely use this function, you must
  1. Inside the body of a `with-safe-fd-manipulation' form, create and track a new fd
  2. Call this function
  
  Any other sequence of events has the potential to introduce a race.
  In particular, once an unmanaged fd is added to *fd-bindings*, it must
  not become a managed fd."
    (with-safe-fd-manipulation
      (when (gethash fd %fd-retain-count-table%)
        (error 'fd-already-managed :fd fd))
      (setf (gethash fd %fd-retain-count-table%) 1)
      fd))
  
  (define-condition fd-not-managed (error)
    ((fd
  