Add timestamp filtering and per-project thread-safe isolation

This commit addresses reviewer concerns about:
1. Branch-switching scenario with stale artifacts
2. Thread safety in multi-threaded builds (mvn -T)

Changes:

**Timestamp Filtering:**
- Capture build start time from session.getRequest().getStartTime()
- Pass buildStartTime to attachGeneratedSources() and attachOutputs()
- Check directory last-modified time in attachDirIfNotEmpty()
- Skip directories with lastModified < buildStartTime (unless restored)

**Per-Project Thread-Safe Isolation:**
- Introduce ProjectCacheState inner class to hold per-project state:
  * attachedResourcesPathsById (resource path tracking)
  * attachedResourceCounter (unique classifier generation)
  * restoredOutputClassifiers (track restored outputs)
- Use ConcurrentHashMap<String, ProjectCacheState> for thread-safe access
- Track restored outputs in restoreProjectArtifacts()
- Include restored outputs even with old timestamps
- Cleanup project state after save() completes

**Thread Safety Benefits:**
- Each project gets isolated state (no cross-module interference)
- ConcurrentHashMap handles concurrent module builds
- Per-project cleanup prevents memory leaks
- Fixes existing thread safety bug with HashMap.clear()

**How Timestamp Filtering Works:**
```
Scenario: mvn package with compile cache hit
1. First build: mvn compile at 10:00:00
   - Compiles, caches outputs ✓
2. Second build: mvn package at 10:05:00
   - Compile phase: Restores from cache
   - Restoration tracked in state.restoredOutputClassifiers
   - save() phase: Checks timestamps
     * Fresh outputs: timestamp >= 10:05:00 → include ✓
     * Restored outputs: in restoredOutputClassifiers → include ✓
     * Stale outputs: timestamp < 10:05:00 AND not restored → exclude ✓
```

This prevents the branch-switching scenario:
```
1. mvn compile on Branch A → target/classes modified at 10:00:01
2. git checkout branch-b
3. mvn process-resources on Branch B starts at 10:01:00
4. Check target/classes: 10:00:01 < 10:01:00 AND not restored → SKIP ✓
```

Author: cowwoc

src/main/java/org/apache/maven/buildcache/CacheControllerImpl.java

@@ -40,6 +40,7 @@
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
@@ -135,13 +136,24 @@ public class CacheControllerImpl implements CacheController {
     private volatile Scm scm;
 
     /**
-     * A map dedicated to store the base path of resources stored to the cache which are not original artifacts
-     * (ex : generated source basedir).
-     * Used to link the resource to its path on disk
+     * Per-project cache state to ensure thread safety in multi-threaded builds.
+     * Each project gets isolated state for resource tracking, counters, and restored output tracking.
      */
-    private final Map<String, Path> attachedResourcesPathsById = new HashMap<>();
+    private static class ProjectCacheState {
+        final Map<String, Path> attachedResourcesPathsById = new HashMap<>();
+        int attachedResourceCounter = 0;
+        final Set<String> restoredOutputClassifiers = new HashSet<>();
+    }
+
+    private final ConcurrentMap<String, ProjectCacheState> projectStates = new ConcurrentHashMap<>();
 
-    private int attachedResourceCounter = 0;
+    /**
+     * Get or create cache state for the given project (thread-safe).
+     */
+    private ProjectCacheState getProjectState(MavenProject project) {
+        String key = getVersionlessProjectKey(project);
+        return projectStates.computeIfAbsent(key, k -> new ProjectCacheState());
+    }
     // CHECKSTYLE_OFF: ParameterNumber
     @Inject
     public CacheControllerImpl(
@@ -356,6 +368,7 @@ public ArtifactRestorationReport restoreProjectArtifacts(CacheResult cacheResult
         final Build build = cacheResult.getBuildInfo();
         final CacheContext context = cacheResult.getContext();
         final MavenProject project = context.getProject();
+        final ProjectCacheState state = getProjectState(project);
         ArtifactRestorationReport restorationReport = new ArtifactRestorationReport();
 
         try {
@@ -397,6 +410,8 @@ public ArtifactRestorationReport restoreProjectArtifacts(CacheResult cacheResult
                             final Path attachedArtifactFile =
                                     localCache.getArtifactFile(context, cacheResult.getSource(), attachedArtifactInfo);
                             restoreGeneratedSources(attachedArtifactInfo, attachedArtifactFile, project);
+                            // Track this classifier as restored so save() includes it even with old timestamp
+                            state.restoredOutputClassifiers.add(attachedArtifactInfo.getClassifier());
                         }
                     } else {
                         Future<File> downloadTask = createDownloadTask(
@@ -497,23 +512,27 @@ public void save(
 
         final MavenProject project = context.getProject();
         final MavenSession session = context.getSession();
+        final ProjectCacheState state = getProjectState(project);
         try {
-            attachedResourcesPathsById.clear();
-            attachedResourceCounter = 0;
+            state.attachedResourcesPathsById.clear();
+            state.attachedResourceCounter = 0;
+
+            // Get build start time to filter out stale artifacts from previous builds
+            final long buildStartTime = session.getRequest().getStartTime().getTime();
 
             final HashFactory hashFactory = cacheConfig.getHashFactory();
             final HashAlgorithm algorithm = hashFactory.createAlgorithm();
             final org.apache.maven.artifact.Artifact projectArtifact = project.getArtifact();
             final boolean hasPackagePhase = project.hasLifecyclePhase("package");
 
-            attachGeneratedSources(project);
-            attachOutputs(project);
+            attachGeneratedSources(project, state, buildStartTime);
+            attachOutputs(project, state, buildStartTime);
 
             final List<org.apache.maven.artifact.Artifact> attachedArtifacts = project.getAttachedArtifacts() != null
                     ? project.getAttachedArtifacts()
                     : Collections.emptyList();
-            final List<Artifact> attachedArtifactDtos = artifactDtos(attachedArtifacts, algorithm, project);
-            final Artifact projectArtifactDto = hasPackagePhase ? artifactDto(project.getArtifact(), algorithm, project)
+            final List<Artifact> attachedArtifactDtos = artifactDtos(attachedArtifacts, algorithm, project, state);
+            final Artifact projectArtifactDto = hasPackagePhase ? artifactDto(project.getArtifact(), algorithm, project, state)
                     : null;
 
             List<CompletedExecution> completedExecution = buildExecutionInfo(mojoExecutions, executionEvents);
@@ -562,6 +581,10 @@ public void save(
             } catch (Exception ex) {
                 LOGGER.error("Failed to clean cache due to unexpected error:", ex);
             }
+        } finally {
+            // Cleanup project state to free memory (thread-safe removal)
+            String key = getVersionlessProjectKey(project);
+            projectStates.remove(key);
         }
     }
 
@@ -619,20 +642,22 @@ public void produceDiffReport(CacheResult cacheResult, Build build) {
     }
 
     private List<Artifact> artifactDtos(
-            List<org.apache.maven.artifact.Artifact> attachedArtifacts, HashAlgorithm digest, MavenProject project)
+            List<org.apache.maven.artifact.Artifact> attachedArtifacts, HashAlgorithm digest, MavenProject project,
+            ProjectCacheState state)
             throws IOException {
         List<Artifact> result = new ArrayList<>();
         for (org.apache.maven.artifact.Artifact attachedArtifact : attachedArtifacts) {
             if (attachedArtifact.getFile() != null
                     && isOutputArtifact(attachedArtifact.getFile().getName())) {
-                result.add(artifactDto(attachedArtifact, digest, project));
+                result.add(artifactDto(attachedArtifact, digest, project, state));
             }
         }
         return result;
     }
 
     private Artifact artifactDto(
-            org.apache.maven.artifact.Artifact projectArtifact, HashAlgorithm algorithm, MavenProject project)
+            org.apache.maven.artifact.Artifact projectArtifact, HashAlgorithm algorithm, MavenProject project,
+            ProjectCacheState state)
             throws IOException {
         final Artifact dto = DtoUtils.createDto(projectArtifact);
         if (projectArtifact.getFile() != null && projectArtifact.getFile().isFile()) {
@@ -641,7 +666,7 @@ private Artifact artifactDto(
             dto.setFileSize(Files.size(file));
 
             // Get the relative path of any extra zip directory added to the cache
-            Path relativePath = attachedResourcesPathsById.get(projectArtifact.getClassifier());
+            Path relativePath = state.attachedResourcesPathsById.get(projectArtifact.getClassifier());
             if (relativePath == null) {
                 // If the path was not a member of this map, we are in presence of an original artifact.
                 // we get its location on the disk
@@ -895,15 +920,15 @@ private void restoreGeneratedSources(Artifact artifact, Path artifactFilePath, M
     }
 
     // TODO: move to config
-    public void attachGeneratedSources(MavenProject project) throws IOException {
+    public void attachGeneratedSources(MavenProject project, ProjectCacheState state, long buildStartTime) throws IOException {
         final Path targetDir = Paths.get(project.getBuild().getDirectory());
 
         final Path generatedSourcesDir = targetDir.resolve("generated-sources");
-        attachDirIfNotEmpty(generatedSourcesDir, targetDir, project, OutputType.GENERATED_SOURCE, DEFAULT_FILE_GLOB);
+        attachDirIfNotEmpty(generatedSourcesDir, targetDir, project, state, OutputType.GENERATED_SOURCE, DEFAULT_FILE_GLOB, buildStartTime);
 
         final Path generatedTestSourcesDir = targetDir.resolve("generated-test-sources");
         attachDirIfNotEmpty(
-                generatedTestSourcesDir, targetDir, project, OutputType.GENERATED_SOURCE, DEFAULT_FILE_GLOB);
+                generatedTestSourcesDir, targetDir, project, state, OutputType.GENERATED_SOURCE, DEFAULT_FILE_GLOB, buildStartTime);
 
         Set<String> sourceRoots = new TreeSet<>();
         if (project.getCompileSourceRoots() != null) {
@@ -919,18 +944,18 @@ public void attachGeneratedSources(MavenProject project) throws IOException {
                     && sourceRootPath.startsWith(targetDir)
                     && !(sourceRootPath.startsWith(generatedSourcesDir)
                             || sourceRootPath.startsWith(generatedTestSourcesDir))) { // dir within target
-                attachDirIfNotEmpty(sourceRootPath, targetDir, project, OutputType.GENERATED_SOURCE, DEFAULT_FILE_GLOB);
+                attachDirIfNotEmpty(sourceRootPath, targetDir, project, state, OutputType.GENERATED_SOURCE, DEFAULT_FILE_GLOB, buildStartTime);
             }
         }
     }
 
-    private void attachOutputs(MavenProject project) throws IOException {
+    private void attachOutputs(MavenProject project, ProjectCacheState state, long buildStartTime) throws IOException {
         final List<DirName> attachedDirs = cacheConfig.getAttachedOutputs();
         for (DirName dir : attachedDirs) {
             final Path targetDir = Paths.get(project.getBuild().getDirectory());
             final Path outputDir = targetDir.resolve(dir.getValue());
             if (isPathInsideProject(project, outputDir)) {
-                attachDirIfNotEmpty(outputDir, targetDir, project, OutputType.EXTRA_OUTPUT, dir.getGlob());
+                attachDirIfNotEmpty(outputDir, targetDir, project, state, OutputType.EXTRA_OUTPUT, dir.getGlob(), buildStartTime);
             } else {
                 LOGGER.warn("Outside project output candidate directory discarded ({})", outputDir.normalize());
             }
@@ -941,16 +966,32 @@ private void attachDirIfNotEmpty(
             Path candidateSubDir,
             Path parentDir,
             MavenProject project,
+            ProjectCacheState state,
             final OutputType attachedOutputType,
-            final String glob)
+            final String glob,
+            final long buildStartTime)
             throws IOException {
         if (Files.isDirectory(candidateSubDir) && hasFiles(candidateSubDir)) {
             final Path relativePath = project.getBasedir().toPath().relativize(candidateSubDir);
-            attachedResourceCounter++;
-            final String classifier = attachedOutputType.getClassifierPrefix() + attachedResourceCounter;
+            state.attachedResourceCounter++;
+            final String classifier = attachedOutputType.getClassifierPrefix() + state.attachedResourceCounter;
+
+            // Check if directory was modified during this build OR was restored from cache
+            long lastModified = Files.getLastModifiedTime(candidateSubDir).toMillis();
+            boolean isRestoredThisBuild = state.restoredOutputClassifiers.contains(classifier);
+
+            if (lastModified < buildStartTime && !isRestoredThisBuild) {
+                LOGGER.debug(
+                        "Skipping stale directory: {} (modified at {}, build started at {}, not restored)",
+                        candidateSubDir,
+                        lastModified,
+                        buildStartTime);
+                return;
+            }
+
             boolean success = zipAndAttachArtifact(project, candidateSubDir, classifier, glob);
             if (success) {
-                attachedResourcesPathsById.put(classifier, relativePath);
+                state.attachedResourcesPathsById.put(classifier, relativePath);
                 LOGGER.debug("Attached directory: {}", candidateSubDir);
             }
         }