test(windows): prove permanent readonly fixture rejects missing fallback

test(windows): probe readonly files with no other attributes
test(windows): release parent write guard before admission validation
2026-10-15 09:06:49 +08:00 · 2026-10-15 08:48:44 +08:00 · 2026-10-15 08:34:44 +08:00 · 2026-10-15 08:29:01 +08:00 · 2026-10-15 08:21:01 +08:00
5 changed files with 350 additions and 956 deletions
@@ -1,959 +1,51 @@
-name: CI
-
+name: Experimental Windows readonly fixture mutation oracle
 on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main, "release/*"]
-  schedule:
-    - cron: "23 0-2,4-23 * * *"
-    - cron: "23 3 * * *"
  workflow_dispatch:
-  workflow_call:
-    inputs:
-      source_sha:
-        description: Exact qualification source; must match the caller revision.
-        required: true
-        type: string
-
 permissions:
  contents: read
-
-concurrency:
-  # Complete qualification finishes even while main receives more pushes.
-  # Main feedback also finishes, coalescing newer pushes to one pending run.
-  # Scheduled/manual main runs coalesce to one active and the latest pending;
-  # release and label-triggered qualification use exact-revision groups.
-  group: ci-${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || inputs.source_sha != '' || contains(github.event.pull_request.labels.*.name, 'ci:full')) && 'qualification' || 'feedback' }}-${{ inputs.source_sha || github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' && inputs.source_sha == '' && !contains(github.event.pull_request.labels.*.name, 'ci:full') }}
-
-env:
-  HUSKY: "0"
-
+  actions: read
 jobs:
-  changes:
-    name: Classify changes
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      actions: read
-    outputs:
-      tier: ${{ steps.plan.outputs.tier }}
-      qualification_run_id: ${{ steps.qualification.outputs.run_id }}
-      code: ${{ steps.plan.outputs.code }}
-      reverse_tools: ${{ steps.plan.outputs.reverse_tools }}
-      sqlite: ${{ steps.plan.outputs.sqlite }}
-      runtime: ${{ steps.plan.outputs.runtime }}
-      package: ${{ steps.plan.outputs.package }}
-      apple: ${{ steps.plan.outputs.apple }}
-      fixtures: ${{ steps.plan.outputs.fixtures }}
-      readiness: ${{ steps.plan.outputs.readiness }}
-      docs: ${{ steps.plan.outputs.docs }}
-      workflows: ${{ steps.plan.outputs.workflows }}
-      browser: ${{ steps.plan.outputs.browser }}
-      binary_layout: ${{ steps.plan.outputs.binary_layout }}
-      evm: ${{ steps.plan.outputs.evm }}
-      javascript_recovery: ${{ steps.plan.outputs.javascript_recovery }}
-      recorded_crash: ${{ steps.plan.outputs.recorded_crash }}
-      web_network: ${{ steps.plan.outputs.web_network }}
-      web_runtime: ${{ steps.plan.outputs.web_runtime }}
-      web_source_map: ${{ steps.plan.outputs.web_source_map }}
-      nativeaot: ${{ steps.plan.outputs.nativeaot }}
-      website: ${{ steps.plan.outputs.website }}
-      matrix: ${{ steps.plan.outputs.matrix }}
-      test_selection: ${{ steps.plan.outputs.test_selection }}
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-        with:
-          ref: ${{ inputs.source_sha || github.sha }}
-          fetch-depth: 0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version-file: .nvmrc
-      - name: Bind qualification to the caller revision
-        if: inputs.source_sha != ''
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          test "${SOURCE_SHA}" = "${GITHUB_SHA}"
-          test "${SOURCE_SHA}" = "$(git rev-parse HEAD)"
-      - name: Find a verified ancestor for push selection
-        id: baseline
-        if: github.event_name == 'push' && inputs.source_sha == ''
-        env:
-          GH_TOKEN: ${{ github.token }}
-          HEAD_SHA: ${{ github.sha }}
-          CI_REPOSITORY: ${{ github.repository }}
-          CI_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-        run: node scripts/ci/baseline.mjs
-      - name: Admit scheduled full qualification
-        id: qualification
-        if: github.event_name == 'schedule' && inputs.source_sha == ''
-        env:
-          GH_TOKEN: ${{ github.token }}
-          HEAD_SHA: ${{ github.sha }}
-          CI_REPOSITORY: ${{ github.repository }}
-          CI_REPOSITORY_ID: ${{ github.repository_id }}
-          CI_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-          CI_FORCE_FULL: ${{ github.event.schedule == '23 3 * * *' }}
-        run: node scripts/ci/qualification.mjs
-      - name: Select verification lanes
-        id: plan
-        env:
-          BASE_SHA: ${{ steps.baseline.outputs.base || github.event.pull_request.base.sha }}
-          BASELINE_REASON: ${{ steps.baseline.outputs.reason }}
-          HEAD_SHA: ${{ inputs.source_sha || github.event.pull_request.head.sha || github.sha }}
-          CI_FULL: ${{ inputs.source_sha != '' || contains(github.event.pull_request.labels.*.name, 'ci:full') }}
-          CI_SKIP_FULL: ${{ steps.qualification.outputs.run_full == 'false' }}
-        run: node scripts/ci/plan.mjs
-
-  static:
-    name: Static checks
-    needs: changes
-    if: ${{ !cancelled() && needs.changes.outputs.tier != 'reused' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Require successful change classification
-        env:
-          CHANGES_RESULT: ${{ needs.changes.result }}
-        run: test "${CHANGES_RESULT}" = "success"
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version-file: .nvmrc
-      - name: Cache npm package downloads
-        id: npm-cache
-        uses: ./.github/actions/npm-cache
-      - run: npm ci
-      - name: Restore static task cache
-        if: needs.changes.outputs.code == 'true'
-        id: static-cache
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: .turbo/cache/
-          key: rea-static-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('.nvmrc', '.npmrc', 'package-lock.json') }}-${{ github.sha }}
-          # Turbo validates each task's inputs after restoring this snapshot.
-          restore-keys: rea-static-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('.nvmrc', '.npmrc', 'package-lock.json') }}-
-      - name: Validate workflow syntax and expressions
-        if: needs.changes.outputs.workflows == 'true'
-        run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 -shellcheck= -pyflakes=
-      - name: Record static task source and execution identity
-        continue-on-error: true
-        if: needs.changes.outputs.code == 'true'
-        env:
-          CI_PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: npm run ci:static-context
-      - if: needs.changes.outputs.code == 'true'
-        run: npm run check:ci
-      - if: needs.changes.outputs.code == 'true'
-        run: npm run verify:test-discovery
-      - name: Check LLDB producer retention and launch contracts
-        if: needs.changes.outputs.code == 'true'
-        run: npm run test:python
-      - if: needs.changes.outputs.code != 'true'
-        run: npm run format:check
-      - name: Save validated static task cache
-        if: >-
-          success() && needs.changes.outputs.code == 'true' &&
-          steps.npm-cache.outputs.can-save == 'true' &&
-          steps.static-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: .turbo/cache/
-          key: ${{ steps.static-cache.outputs.cache-primary-key }}
-      - name: Upload complete static diagnostics
-        if: always() && needs.changes.outputs.code == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: static-check-reports
-          path: .cache/static-checks/
-          include-hidden-files: true
-          if-no-files-found: ignore
-          retention-days: 7
-
-  test-source:
-    name: Source tests
-    needs: changes
-    if: needs.changes.outputs.code == 'true' && needs.changes.outputs.tier == 'fast'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version-file: .nvmrc
-      - name: Cache npm package downloads
-        id: npm-cache
-        uses: ./.github/actions/npm-cache
-      - run: npm ci
-      - name: Run source tests without waiting for build
-        run: npm run test:fast -- --reporter=default --reporter=blob
-        env:
-          VITEST_BLOB_LABEL: source
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        if: ${{ !cancelled() }}
-        with:
-          name: vitest-report-source
-          path: .vitest/blob/*
-          include-hidden-files: true
-          if-no-files-found: error
-          retention-days: 7
-
-  test-shard:
-    name: Test shard (${{ matrix.shard }})
-    needs: [changes, build]
-    if: needs.changes.outputs.code == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    strategy:
-      # Failed PRs release the remaining matrix slots; qualification retains
-      # every shard's diagnostics and coverage. Passing PRs run the full suite.
-      fail-fast: ${{ github.event_name == 'pull_request' && needs.changes.outputs.tier == 'fast' }}
-      matrix:
-        # Fast feedback spends the same six test jobs on one source group and
-        # five built groups; full qualification retains six complete shards.
-        shard: ${{ fromJSON(needs.changes.outputs.tier == 'fast' && '["1/5","2/5","3/5","4/5","5/5"]' || '["1/6","2/6","3/6","4/6","5/6","6/6"]') }}
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version-file: .nvmrc
-      - name: Cache npm package downloads
-        id: npm-cache
-        uses: ./.github/actions/npm-cache
-      - run: npm ci
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: rea-test-runtime
-          path: .
-      - name: Run complete portable suite with coverage
-        if: needs.changes.outputs.tier == 'full'
-        run: npm run test:ci:shard:run -- --shard=${{ matrix.shard }}
-        env:
-          REA_CI_TEST_HISTORY: .cache/ci-test-history/test-results.json
-      - name: Run built-dependent tests for fast feedback
-        if: needs.changes.outputs.tier == 'fast'
-        run: npm run test:built -- --reporter=default --reporter=blob --shard=${{ matrix.shard }}
-        env:
-          VITEST_BLOB_LABEL: built
-          REA_CI_TEST_HISTORY: .cache/ci-test-history/test-results.json
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        if: ${{ !cancelled() }}
-        with:
-          name: vitest-report-built-${{ strategy.job-index }}
-          path: .vitest/blob/*
-          include-hidden-files: true
-          if-no-files-found: error
-          overwrite: true
-          retention-days: 7
-
-  reverse-tools-quality:
-    name: Reverse tools quality
-    needs: [changes, static]
-    if: needs.changes.outputs.reverse_tools == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version-file: .nvmrc
-      - name: Cache npm package downloads
-        id: npm-cache
-        uses: ./.github/actions/npm-cache
-      - run: npm ci
-      - name: Run reverse tools tests with coverage
-        run: npm run test:coverage:reverse-tools
-      - name: Preflight both reverse tools mutation configurations
-        run: |
-          node scripts/prepare-reverse-tools-mutation.mjs
-          npx --no-install stryker run stryker.config.mjs --dryRunOnly
-          npx --no-install stryker run stryker.semantics.config.mjs --dryRunOnly
-      - name: Retain available reverse tools diagnostics
-        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: reverse-tools-quality-${{ needs.changes.outputs.tier }}-${{ github.run_attempt }}
-          path: |
-            coverage/reverse-tools/
-            reports/mutation/
-          if-no-files-found: warn
-          retention-days: 7
-
-  build:
-    name: Build package
-    needs: changes
-    # Reusable provider workflows consume this run's portable build artifact,
-    # even when a workflow-only edit selects the lane without portable tests.
-    if: >-
-      needs.changes.outputs.code == 'true' ||
-      needs.changes.outputs.browser == 'true' ||
-      needs.changes.outputs.binary_layout == 'true' ||
-      needs.changes.outputs.evm == 'true' ||
-      needs.changes.outputs.javascript_recovery == 'true' ||
-      needs.changes.outputs.recorded_crash == 'true' ||
-      needs.changes.outputs.web_network == 'true' ||
-      needs.changes.outputs.web_runtime == 'true' ||
-      needs.changes.outputs.web_source_map == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-      actions: read
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version-file: .nvmrc
-      - name: Cache npm package downloads
-        id: npm-cache
-        uses: ./.github/actions/npm-cache
-      - run: npm ci
-      - name: Reuse portable build outputs across runs
-        uses: ./.github/actions/portable-build-cache
-        with:
-          save: ${{ github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
-      - run: npm run test:prepare
-      - name: Find available trusted full-suite timing history
-        id: history
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ github.token }}
-          CI_REPOSITORY: ${{ github.repository }}
-          CI_REPOSITORY_ID: ${{ github.repository_id }}
-          CI_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-        run: node scripts/ci/test-history.mjs
-      - name: Download previous timing report
-        if: steps.history.outputs.run-id != ''
-        continue-on-error: true
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: test-timings
-          run-id: ${{ steps.history.outputs.run-id }}
-          github-token: ${{ github.token }}
-          path: .cache/ci-test-history
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: rea-test-runtime
-          path: |
-            dist/
-            skills/
-            .cache/mcp-tool-catalog.json
-            .cache/ci-test-history/test-results.json
-            docs/public/product-catalog.json
-            docs/verification/managed-conformance-*.json
-          include-hidden-files: true
-          if-no-files-found: error
-          retention-days: 7
-
-      # test:prepare caches only portable JS, skill, and catalog outputs.
-      # Native package jobs still run their build and prepack checks; Turbo
-      # restores matching outputs or rebuilds when their inputs differ.
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: rea-build-cache
-          path: .turbo/cache/
-          include-hidden-files: true
-          if-no-files-found: error
-          retention-days: 7
-
-  sqlite-runtime:
-    # Preserve all selected coverage, but admit expensive host/provider work
-    # only after static validation. Portable tests still provide early feedback.
-    needs: [changes, static, build]
-    if: needs.changes.outputs.sqlite == 'true'
-    uses: ./.github/workflows/sqlite-runtime.yml
-
-  test:
-    name: Portable tests
-    needs: [changes, test-source, test-shard]
-    if: ${{ !cancelled() && needs.changes.outputs.tier != 'reused' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Require successful change classification
-        env:
-          CHANGES_RESULT: ${{ needs.changes.result }}
-        run: test "${CHANGES_RESULT}" = "success"
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-        if: needs.changes.outputs.code == 'true' && success()
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        if: needs.changes.outputs.code == 'true' && success()
-        with:
-          node-version-file: .nvmrc
-      - name: Cache npm package downloads
-        if: needs.changes.outputs.code == 'true' && success()
-        id: npm-cache
-        uses: ./.github/actions/npm-cache
-      - if: needs.changes.outputs.code == 'true' && success()
-        run: npm ci
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        if: >-
-          !cancelled() && needs.changes.outputs.code == 'true' &&
-          (needs.test-shard.result == 'success' || needs.test-shard.result == 'failure' ||
-           (needs.changes.outputs.tier == 'fast' &&
-            (needs.test-source.result == 'success' || needs.test-source.result == 'failure')))
-        with:
-          path: .vitest/blob
-          pattern: vitest-report-*
-          merge-multiple: true
-      - name: Merge coverage, JUnit, and timing reports
-        id: merge
-        if: >-
-          !cancelled() && needs.changes.outputs.code == 'true' &&
-          needs.changes.outputs.tier == 'full' &&
-          (needs.test-shard.result == 'success' || needs.test-shard.result == 'failure')
-        run: >-
-          npm run test:ci:merge --
-          --coverage.reportsDirectory=coverage
-          --coverage.reporter=text
-          --coverage.reporter=json-summary
-          --coverage.reporter=lcov
-          --reporter=default
-          --reporter=junit
-          --reporter=json
-          --reporter=./scripts/ci/test-timing-reporter.mjs
-          --outputFile.junit=test-results.xml
-          --outputFile.json=test-results.json
-      - name: Merge fast-suite JUnit and timing reports
-        id: merge-fast
-        if: >-
-          !cancelled() && needs.changes.outputs.code == 'true' &&
-          needs.changes.outputs.tier == 'fast' &&
-          (needs.test-shard.result == 'success' || needs.test-shard.result == 'failure' ||
-           needs.test-source.result == 'success' || needs.test-source.result == 'failure')
-        run: >-
-          npm exec -- vitest --merge-reports
-          --reporter=default
-          --reporter=junit
-          --reporter=json
-          --reporter=./scripts/ci/test-timing-reporter.mjs
-          --outputFile.junit=test-results.xml
-          --outputFile.json=test-results.json
-      - name: Summarize slowest test files
-        if: needs.changes.outputs.code == 'true' && !cancelled()
-        env:
-          SHARD_RESULT: ${{ needs.test-shard.result }}
-          SOURCE_REQUIRED: ${{ needs.changes.outputs.tier == 'fast' }}
-          SOURCE_RESULT: ${{ needs.test-source.result }}
-          MERGE_RESULT: ${{ needs.changes.outputs.tier == 'full' && steps.merge.outcome || steps.merge-fast.outcome }}
-          CI_VERIFY_TEST_INVENTORY: "true"
-          CI_TEST_SELECTION: ${{ needs.changes.outputs.test_selection }}
-          CI_PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: node scripts/ci/test-report.mjs
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        if: needs.changes.outputs.code == 'true' && !cancelled() && hashFiles('test-results.json') != ''
-        with:
-          name: test-results
-          path: |
-            test-results.xml
-            test-results.json
-            test-timings.json
-            coverage/
-            .cache/ci-test-selection/report.json
-          include-hidden-files: true
-          if-no-files-found: error
-          retention-days: 30
-      - name: Publish successful timing history
-        if: needs.changes.outputs.code == 'true' && needs.changes.outputs.tier == 'full' && success() && needs.test-shard.result == 'success'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: test-timings
-          path: .cache/ci-test-history/test-results.json
-          include-hidden-files: true
-          if-no-files-found: error
-          retention-days: 30
-      - name: Require successful test shards
-        if: ${{ !cancelled() }}
-        env:
-          CODE_REQUIRED: ${{ needs.changes.outputs.code }}
-          SHARD_RESULT: ${{ needs.test-shard.result }}
-          SOURCE_REQUIRED: ${{ needs.changes.outputs.tier == 'fast' }}
-          SOURCE_RESULT: ${{ needs.test-source.result }}
-        run: |
-          if [ "${CODE_REQUIRED}" = "true" ]; then
-            test "${SHARD_RESULT}" = "success" || exit 1
-            test "${SOURCE_REQUIRED}" != "true" || test "${SOURCE_RESULT}" = "success"
-          fi
-
-  conformance-fixtures:
-    name: Source-built conformance fixtures
-    needs: [changes, static]
-    if: needs.changes.outputs.fixtures == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - name: Verify fixtures from a clean checkout
-        run: npm run verify:fixtures
-
-  windows-native-build:
-    name: Build bundled Windows x64 native controls
-    needs: [changes, static]
-    if: needs.changes.outputs.runtime == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version-file: .nvmrc
-      - name: Prepare cross compiler
-        run: |
-          # Slow Azure archive transfers can exhaust the job before compilation.
-          # Keep the same signed packages and avoid slow HTTP mirror fallback.
-          for source in /etc/apt/apt-mirrors.txt /etc/apt/sources.list /etc/apt/sources.list.d/ubuntu.sources; do
-            if [ -f "$source" ]; then
-              sudo sed -i 's|azure.archive.ubuntu.com|archive.ubuntu.com|g; s|http://archive.ubuntu.com|https://archive.ubuntu.com|g' "$source"
-            fi
-          done
-          sudo apt-get update
-          sudo apt-get install --no-install-recommends -y g++-mingw-w64-x86-64
-      - run: npm run build:windows-native
-      - run: npm run verify:windows-native:artifact
-      - run: node scripts/build-windows-native.mjs --inspection-fixture
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: windows-native-inspection-fixture
-          path: .cache/windows-native-inspection-fixture/
-          if-no-files-found: error
-      # The process boundary observations are independent of the addon: they
-      # report the caller's and child's own token, environment and breakaway
-      # results from a separate executable. Cross-build it in the lane that
-      # already has MinGW so the Windows job can observe them too.
-      - name: Build Windows process boundary fixture
-        run: |
-          mkdir -p .cache/windows-process-boundary
-          x86_64-w64-mingw32-g++ -municode -std=c++17 -O2 -static -Wall -Wextra \
-            -o .cache/windows-process-boundary/process-boundary.exe \
-            tests/fixtures/windows/processBoundary.cc -ladvapi32
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: windows-process-boundary-fixture
-          path: .cache/windows-process-boundary/
-          if-no-files-found: error
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: windows-native-controls
-          path: native/windows/build/
-          if-no-files-found: error
-
-  package-e2e:
-    name: Native package baseline (${{ matrix.platform }} ${{ matrix.architecture }})
-    needs: [changes, static, build, windows-native-build]
-    if: needs.changes.outputs.runtime == 'true'
+  verify:
+    runs-on: windows-latest
+    timeout-minutes: 15
    strategy:
      fail-fast: false
-      # The four platform jobs use independent hosted runners; keep each
-      # runner's existing heap and threadpool limits while avoiding a queued
-      # second platform wave.
-      max-parallel: 4
-      matrix: ${{ fromJSON(needs.changes.outputs.matrix) }}
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 20
-    env:
-      NODE_OPTIONS: "--max-old-space-size=1024"
-      UV_THREADPOOL_SIZE: "2"
+      matrix:
+        variant: [without-normal-fix, fixed]
    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version-file: .nvmrc
-      - name: Cache npm package downloads
-        id: npm-cache
-        uses: ./.github/actions/npm-cache
-      - name: Verify native runtime identity
-        env:
-          EXPECTED_CI_PLATFORM: ${{ matrix.platform }}
-          EXPECTED_CI_ARCHITECTURE: ${{ matrix.architecture }}
-        run: >-
-          node -e "const assert = require('node:assert/strict');
-          assert.equal(process.platform, process.env.EXPECTED_CI_PLATFORM);
-          assert.equal(process.arch, process.env.EXPECTED_CI_ARCHITECTURE);
-          console.log(JSON.stringify({ platform: process.platform, architecture: process.arch, node: process.version }));"
      - run: npm ci
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: rea-build-cache
-          path: .turbo/cache/
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: windows-native-controls
-          path: native/windows/build/
-      - run: npm run verify:windows-native:artifact
-      - name: Verify NativeAOT diagnostic applicability on this host
-        run: npm run test:focused -- tests/evaluation/package/nativeAotDiagnostics.test.ts
-      - run: npm run verify:package
-        env:
-          npm_config_cache: ${{ steps.npm-cache.outputs.path }}
-          REA_VERIFIED_PACKAGE_DIRECTORY: ${{ needs.changes.outputs.tier == 'full' && matrix.platform == 'linux' && matrix.architecture == 'x64' && '.cache/verified-package' || '' }}
-      - name: Verify real Node Inspector discovery and observation
-        timeout-minutes: 10
-        run: npm run verify:inspector
-      - name: Retain the exact qualified release package
-        if: needs.changes.outputs.tier == 'full' && matrix.platform == 'linux' && matrix.architecture == 'x64'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: verified-release-package
-          path: .cache/verified-package/
-          include-hidden-files: true
-          if-no-files-found: error
-          overwrite: true
-          retention-days: 7
-
-  apple-artifacts:
-    name: Real Apple artifact CLI/MCP E2E
-    needs: [changes, static, build]
-    if: needs.changes.outputs.apple == 'true'
-    runs-on: macos-15
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version-file: .nvmrc
-      - name: Cache npm package downloads
-        id: npm-cache
-        uses: ./.github/actions/npm-cache
-      - run: npm ci
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: rea-build-cache
-          path: .turbo/cache/
-      - name: Verify Apple artifact formats and metadata
-        env:
-          REA_ARTIFACT_NODE_COMPILE_CACHE: ${{ runner.temp }}/rea-artifact-node-cache
-        run: |
-          npm run verify:keyed-archive
-          npm run verify:asset-catalog
-          npm run verify:macos-bundle
-          npm run verify:legacy-simulator
-          npm run verify:apple-dispatch
-          npm run verify:interface-builder
-      - name: Run native Apple and process boundary regressions
-        run: >-
-          npm run test:focused --
-          tests/boundary/filesystem/installScript.test.ts
-          tests/boundary/filesystem/nibNativeHierarchy.test.ts
-          tests/boundary/filesystem/interfaceBuilderBundle.test.ts
-          tests/boundary/cli/nativePlistCli.test.ts
-          tests/boundary/cli/nativePlistPrototypeKeyCli.test.ts
-          tests/boundary/cli/nativePlistSelectionFailureCli.test.ts
-          tests/boundary/cli/nativeDemangleCli.test.ts
-          tests/boundary/mcp/nativeDemangleMcp.test.ts
-          tests/boundary/providers/native/nativeSignatureTargetBinding.test.ts
-          tests/boundary/cli/nativeSignatureCli.test.ts
-          tests/boundary/mcp/nativeSignatureTargetBindingMcp.test.ts
-          src/process/capture/FilesystemSnapshot.test.ts
-          tests/process-global/filesystemSnapshotFallbackCancellation.test.ts
-          tests/boundary/process/darwinProcessRunTokenReader.test.ts
-          tests/boundary/process/directAnalysisSignals.test.ts
-          tests/boundary/process/processCaptureLifecycle.test.ts
-          tests/boundary/process/processCli.test.ts
-          tests/boundary/mcp/sessionMcp.test.ts
-
-  reconstruction-readiness:
-    name: Reconstruction readiness
-    needs: [changes, static]
-    if: needs.changes.outputs.readiness == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version-file: .nvmrc
-      - name: Cache npm package downloads
-        id: npm-cache
-        uses: ./.github/actions/npm-cache
-      - run: npm ci
-      - name: Run the public CLI/MCP reconstruction journey
-        env:
-          REA_READINESS_REPORT_PATH: readiness-report.json
-        run: |
-          set -o pipefail
-          npm run verify:readiness | tee readiness-summary.json
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        if: ${{ !cancelled() }}
-        with:
-          name: reconstruction-readiness
-          path: |
-            readiness-summary.json
-            readiness-report.json
-          if-no-files-found: error
-          retention-days: 30
-
-  windows-curated:
-    name: Windows capability and package lane
-    needs: [changes, static, build, windows-native-build]
-    if: needs.changes.outputs.package == 'true'
-    runs-on: windows-latest
-    timeout-minutes: 25
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version-file: .nvmrc
-      - name: Cache npm package downloads
-        id: npm-cache
-        uses: ./.github/actions/npm-cache
-      - run: npm ci
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: rea-build-cache
-          path: .turbo/cache/
      - run: npm run build:cached
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
-          name: windows-native-controls
+          github-token: ${{ github.token }}
+          run-id: ${{ matrix.variant == 'fixed' && '38662148662' || '38660840144' }}
+          name: windows-creation-owner-native-fixed
          path: native/windows/build/
-      - run: npm run verify:windows-native:artifact
-      - name: Record named Windows host capabilities
-        run: node scripts/windows-capabilities.mjs | Out-File -Encoding utf8NoBOM windows-capabilities.json
-      - name: Validate Windows host capability report
-        run: >-
-          node -e "const report = JSON.parse(require('node:fs').readFileSync('windows-capabilities.json', 'utf8'));
-          if (report.platform !== 'win32' || report.architecture !== 'x64')
-          throw new Error('expected a Windows x64 capability report');"
-      # Keep this list aligned with tests/process-global/curatedWindowsLane.test.ts,
-      # which fails when any path below is renamed or removed. Vitest silently
-      # ignores unmatched paths, so a stale entry would otherwise report green
-      # while skipping coverage.
-      #
-      # The matching native artifact establishes real Job Object and private
-      # runtime boundaries for these fixtures. Ghidra and Java are not needed;
-      # real engine claims remain in the separate controlled-provider workflow.
-      - name: Run curated Windows capability tests
-        run: >-
-          npx vitest run --coverage.enabled=false
-          src/process/capture/FilesystemSnapshot.test.ts
-          tests/process-global/filesystemSnapshotFallbackCancellation.test.ts
-          tests/boundary/filesystem/binaryTarget.test.ts
-          tests/boundary/filesystem/safeOutputTree.test.ts
-          tests/boundary/providers/native/artifactProvider.archiveSafety.test.ts
-          tests/boundary/providers/native/artifactProvider.extractionCompleteness.test.ts
-          tests/boundary/filesystem/setupUnavailableProvider.test.ts
-          tests/boundary/filesystem/windowsNpxRegistration.test.ts
-          tests/boundary/android/workspaceGuardianRetry.test.ts
-          tests/acceptance/setup/homeDirectoryFallback.test.ts
-          tests/boundary/filesystem/javascriptApplicationWorkflows.test.ts
-          tests/boundary/filesystem/webScriptManifestPaths.test.ts
-          tests/boundary/process/ProcessEvidence.host.test.ts
-          tests/boundary/process/windowsOutputCapture.test.ts
-          tests/acceptance/webModuleCli.test.ts
-          tests/acceptance/webSourceLocationCli.test.ts
-          tests/boundary/cli/referenceSourceImportStatus.test.ts
-          tests/boundary/filesystem/asarInventoryFreshness.test.ts
-          tests/boundary/filesystem/javascript-applications/javascriptArtifactReconstruction.test.ts
-          tests/conformance/providers/ghidra/windowsCapabilities.test.ts
-          src/ghidra/GhidraInstallation.test.ts
-          tests/boundary/filesystem/ghidraJavaProbe.test.ts
-          tests/boundary/providers/ghidra/ghidraTransport.test.ts
-          tests/boundary/providers/ghidra/ghidraTargetSnapshot.test.ts
-          tests/boundary/providers/ghidra/ghidraLauncher.test.ts
-          tests/boundary/providers/hopper/hopperClient.cleanupRetry.test.ts
-          src/windows/WindowsNativeLoader.test.ts
-          src/windows/WindowsOwnedProcess.test.ts
-          src/ghidra/GhidraLauncherEnvironment.test.ts
-          src/process/ProcessOwnership.test.ts
-          src/process/ProcessOwnership.part2.test.ts
-          src/process/ProcessOwnership.part3.test.ts
-          src/process/ProcessOwnership.validation.test.ts
-          src/application/Update.test.ts
-          tests/process-global/updateMaintenance.test.ts
-          tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: windows-process-boundary-fixture
-          path: .cache/windows-process-boundary/
-      # Passing the fixture adds the breakaway, caller/child token, environment
-      # semantics and ancestor reparse observations, which the lane skips
-      # entirely when it is absent.
-      - run: >-
-          npm run verify:windows-native -- .
-          "${{ github.workspace }}\.cache\windows-process-boundary\process-boundary.exe"
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: windows-native-inspection-fixture
-          path: .cache/windows-native-inspection-fixture/
-      - name: Verify native inspection failure ownership and recovery
-        run: node scripts/verify-windows-native-inspection.mjs
-      - name: Verify real Node Inspector discovery and observation
-        timeout-minutes: 10
+      - name: Verify permanent fixture detects missing NORMAL fallback
+        shell: bash
        env:
-          NODE_OPTIONS: "--max-old-space-size=1024"
-          UV_THREADPOOL_SIZE: "2"
-        run: npm run verify:inspector
-      - run: npm run verify:package:windows
-      - name: Verify native directory identity on Node 24
-        run: >-
-          npx vitest run --coverage.enabled=false
-          tests/boundary/filesystem/directoryArtifactReaderOpen.test.ts
-          tests/boundary/filesystem/javascriptPackagePrecedence.test.ts
-          tests/boundary/filesystem/javascriptArtifactContentIdentity.test.ts
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version: 22.19.0
-      - name: Verify native path boundaries on Node 22
-        run: >-
-          npx vitest run --coverage.enabled=false
-          tests/boundary/filesystem/directoryArtifactReaderOpen.test.ts
-          tests/boundary/filesystem/javascriptPackagePrecedence.test.ts
-          tests/boundary/filesystem/javascriptArtifactContentIdentity.test.ts
-          tests/boundary/process/sourceMapUncHosts.test.ts
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        if: always()
-        with:
-          name: windows-capabilities
-          path: windows-capabilities.json
-          retention-days: 30
-
-  docs:
-    name: Docs Generation
-    needs: changes
-    if: needs.changes.outputs.docs == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version-file: .nvmrc
-      - name: Cache npm package downloads
-        id: npm-cache
-        uses: ./.github/actions/npm-cache
-      - run: npm ci
-      - run: npm run docs:check
-      - name: Generation leaves authored files unchanged
-        run: git diff --exit-code
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: generated-docs
-          path: |
-            docs/public/product-catalog.json
-            docs/verification/managed-conformance-*.json
-            skills/reverse-engineer-anything
-          if-no-files-found: error
-
-  browser:
-    needs: [changes, static, build]
-    if: needs.changes.outputs.browser == 'true'
-    uses: ./.github/workflows/real-browser.yml
-    with:
-      build_cache_artifact: rea-build-cache
-
-  binary_layout:
-    needs: [changes, static, build]
-    if: needs.changes.outputs.binary_layout == 'true'
-    uses: ./.github/workflows/real-binary-layout.yml
-    with:
-      build_cache_artifact: rea-build-cache
-
-  evm:
-    needs: [changes, static, build]
-    if: needs.changes.outputs.evm == 'true'
-    uses: ./.github/workflows/real-evm-interface.yml
-    with:
-      build_cache_artifact: rea-build-cache
-
-  javascript_recovery:
-    needs: [changes, static, build]
-    if: needs.changes.outputs.javascript_recovery == 'true'
-    uses: ./.github/workflows/real-javascript-recovery.yml
-    with:
-      build_cache_artifact: rea-build-cache
-
-  recorded_crash:
-    needs: [changes, static, build]
-    if: needs.changes.outputs.recorded_crash == 'true'
-    uses: ./.github/workflows/real-recorded-crash.yml
-    with:
-      build_cache_artifact: rea-build-cache
-
-  web_network:
-    needs: [changes, static, build]
-    if: needs.changes.outputs.web_network == 'true'
-    uses: ./.github/workflows/real-web-network-captures.yml
-    with:
-      build_cache_artifact: rea-build-cache
-
-  web_runtime:
-    needs: [changes, static, build]
-    if: needs.changes.outputs.web_runtime == 'true'
-    uses: ./.github/workflows/real-web-runtime.yml
-    with:
-      build_cache_artifact: rea-build-cache
-
-  web_source_map:
-    needs: [changes, static, build]
-    if: needs.changes.outputs.web_source_map == 'true'
-    uses: ./.github/workflows/real-web-source-map.yml
-    with:
-      build_cache_artifact: rea-build-cache
-
-  nativeaot:
-    needs: [changes, static]
-    if: needs.changes.outputs.nativeaot == 'true'
-    uses: ./.github/workflows/nativeaot-fixtures.yml
-
-  website:
-    needs: [changes, static]
-    if: needs.changes.outputs.website == 'true'
-    uses: ./.github/workflows/website-check.yml
-
-  required:
-    name: CI required
-    # Report failed dependencies, but release superseded PR concurrency slots.
-    if: ${{ !cancelled() }}
-    needs:
-      [
-        changes,
-        static,
-        build,
-        reverse-tools-quality,
-        test-shard,
-        test-source,
-        sqlite-runtime,
-        test,
-        conformance-fixtures,
-        windows-native-build,
-        package-e2e,
-        apple-artifacts,
-        reconstruction-readiness,
-        windows-curated,
-        docs,
-        browser,
-        binary_layout,
-        evm,
-        javascript_recovery,
-        recorded_crash,
-        web_network,
-        web_runtime,
-        web_source_map,
-        nativeaot,
-        website,
-      ]
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version-file: .nvmrc
-      - name: Require every selected lane to pass
-        id: gate
-        env:
-          CI_JOBS: ${{ toJSON(needs) }}
-          CI_QUALIFICATION_DIRECTORY: .cache/ci-qualification
-        run: node scripts/ci/required.mjs
-      - name: Upload full qualification receipt artifact
-        if: needs.changes.outputs.tier == 'full' && success()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: ${{ steps.gate.outputs.receipt_name }}
-          path: ${{ steps.gate.outputs.receipt_path }}
-          if-no-files-found: error
-          overwrite: true
-          retention-days: 7
+          EXPECTED_VARIANT: ${{ matrix.variant }}
+        run: |
+          node --input-type=module <<'JS'
+          import assert from 'node:assert/strict';
+          import {spawnSync} from 'node:child_process';
+          const result=spawnSync(process.execPath,['scripts/verify-windows-native.mjs','.'],{encoding:'utf8',timeout:180000});
+          if(result.error)throw result.error;
+          process.stdout.write(result.stdout);
+          process.stderr.write(result.stderr);
+          if(process.env.EXPECTED_VARIANT==='fixed'){
+            assert.equal(result.status,0);
+            const observed=JSON.parse(result.stdout.trim());
+            assert.equal(observed.ok,true);
+            assert.equal(observed.controls.readonlyFileWithoutArchiveAttributeRemoved,true);
+          }else{
+            assert.notEqual(result.status,0);
+            assert.match(result.stderr,/Delete owned object by handle failed/);
+            assert.match(result.stderr,/Win32 5/);
+          }
+          console.log(JSON.stringify({ok:true,variant:process.env.EXPECTED_VARIANT,permanentVerifierStatus:result.status,baselineMissingNormalDetected:process.env.EXPECTED_VARIANT!=='fixed'}));
+          JS
@@ -384,11 +384,13 @@ void createRuntime(const std::wstring& parentPath, const std::wstring& prefix,
  owner = std::move(result);
  try {
    owner->directory = createRelative(owner->parents.back().get(), name,
-                                      DELETE | FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | READ_CONTROL,
+                                      DELETE | FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES | READ_CONTROL,
                                      true, security, owner->path);
-    verifyPrivate(owner->directory.get(), owner->path, true);
-    // The owned child pins the parent nonempty before write sharing is relaxed.
+    // FILE_CREATE proves ownership and pins the parent nonempty independently
+    // of admission validation. A failed validation must not retain a strict
+    // parent lease that prevents renaming the still-owned child before retry.
    owner->parents.back() = openComponent(parent->path, 0, true, FILE_SHARE_READ | FILE_SHARE_WRITE);
+    verifyPrivate(owner->directory.get(), owner->path, true);
  } catch (Failure& primary) {
    cleanupFailedRuntime(owner, primary);
    throw;
@@ -469,11 +471,11 @@ static void writeBytes(HANDLE file, const void* bytes, DWORD count, const std::w
 static void dispose(HANDLE handle, const std::wstring& path) {
  FILE_BASIC_INFO info{};
  require(GetFileInformationByHandleEx(handle, FileBasicInfo, &info, sizeof(info)), "Read cleanup attributes failed", path);
-  // READONLY prevents file deletion but is not honored on directories. Clearing
-  // it on a directory would need attribute-write rights cleanup does not need.
-  if ((info.FileAttributes & FILE_ATTRIBUTE_READONLY) != 0 &&
-      (info.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) == 0) {
+  if ((info.FileAttributes & FILE_ATTRIBUTE_READONLY) != 0) {
    info.FileAttributes &= ~FILE_ATTRIBUTE_READONLY;
+    // Zero means "leave attributes unchanged" to FileBasicInfo. A file whose
+    // sole attribute was READONLY needs NORMAL to actually clear that marker.
+    if (info.FileAttributes == 0) info.FileAttributes = FILE_ATTRIBUTE_NORMAL;
    require(SetFileInformationByHandle(handle, FileBasicInfo, &info, sizeof(info)), "Clear owned readonly attribute failed", path);
  }
  FILE_DISPOSITION_INFO deletion{TRUE};
@@ -0,0 +1,111 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import {
+  access,
+  mkdir,
+  mkdtemp,
+  readFile,
+  readdir,
+  rename,
+  rm,
+  stat,
+  writeFile,
+} from "node:fs/promises";
+import { createRequire } from "node:module";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+if (process.platform !== "win32")
+  throw new Error("Requires actual Windows NTFS");
+const [rootArgument, artifactArgument, expected] = process.argv.slice(2);
+assert.ok(rootArgument && artifactArgument);
+assert.ok(expected === "expect-leak" || expected === "retain-owner");
+const root = resolve(rootArgument);
+const artifact = resolve(artifactArgument);
+const manifest = JSON.parse(
+  await readFile(join(artifact, "manifest.json"), "utf8"),
+);
+const image = await readFile(join(artifact, manifest.artifact));
+assert.equal(
+  createHash("sha256").update(image).digest("hex"),
+  manifest.artifactSha256,
+);
+assert.equal(manifest.abiVersion, 1);
+assert.equal(manifest.nodeApiVersion, 8);
+const native = createRequire(join(root, "package.json"))(
+  join(artifact, manifest.artifact),
+);
+const workspace = await mkdtemp(join(tmpdir(), "rea-failed-creation-probe-"));
+process.env.REA_NATIVE_CREATION_FAILURE = "1";
+let retry;
+const failures = [];
+try {
+  let failure;
+  try {
+    native.call("runtime_create", [workspace, "owned-"]);
+  } catch (cause) {
+    failure = cause;
+  }
+  assert.equal(failure?.constraint, "Read private DACL by handle failed");
+  assert.equal(failure?.win32Code, 5);
+  assert.notEqual(failure.runtimeAllocation, "not-started");
+  if (expected === "retain-owner") {
+    assert.equal(
+      failure.cleanupConstraint,
+      "Delete owned object by handle failed",
+    );
+    assert.equal(failure.cleanupWin32Code, 5);
+  } else assert.equal(failure.cleanupConstraint, undefined);
+  const [name, ...extra] = await readdir(workspace);
+  assert.ok(name && name.startsWith("owned-"));
+  assert.equal(extra.length, 0);
+  const allocated = join(workspace, name);
+  const identity = await stat(allocated, { bigint: true });
+  assert.equal(failure.requestedPath, allocated);
+  const moved = allocated + "-moved";
+  await writeFile(join(allocated, "owned-child.txt"), "owned child");
+  await rename(allocated, moved);
+  await mkdir(allocated);
+  const replacement = await stat(allocated, { bigint: true });
+  assert.notEqual(replacement.ino, identity.ino);
+  const sentinel = join(allocated, "unrelated.txt");
+  await writeFile(sentinel, "preserve replacement");
+
+  retry = native.call("runtime_create", [workspace, "retry-"]);
+  native.call("runtime_close", [retry.handle]);
+  retry = undefined;
+  if (expected === "expect-leak") {
+    assert.equal((await stat(moved, { bigint: true })).ino, identity.ino);
+    assert.equal(
+      await readFile(join(moved, "owned-child.txt"), "utf8"),
+      "owned child",
+    );
+  } else await assert.rejects(access(moved), { code: "ENOENT" });
+  assert.equal((await stat(allocated, { bigint: true })).ino, replacement.ino);
+  assert.equal(await readFile(sentinel, "utf8"), "preserve replacement");
+  console.log(
+    JSON.stringify({
+      ok: true,
+      expected,
+      postAllocationValidationDenied: true,
+      rollbackDispositionDenied: true,
+      baselineLostOwner: expected === "expect-leak",
+      renamedOwnerRemovedOnRetry: expected === "retain-owner",
+      unrelatedReplacementPreserved: true,
+      fixtureArtifactSha256: manifest.artifactSha256,
+      originalHostDeleteDenialReproduced: false,
+    }),
+  );
+} catch (failure) {
+  failures.push(failure);
+  console.error(failure);
+}
+try {
+  if (retry) native.call("runtime_close", [retry.handle]);
+  native.call("inspect", []);
+  await rm(workspace, { recursive: true, force: true });
+} catch (cleanupFailure) {
+  failures.push(cleanupFailure);
+}
+if (failures.length !== 0)
+  throw new AggregateError(failures, "Creation ownership probe failed");
@@ -316,6 +316,7 @@ process.stdout.write(JSON.stringify({executable:basename(process.execPath),abiVe
  ]);
  const sentinel = join(sourceDirectory, "sentinel");
  await writeFile(sentinel, "preserve");
+  const runtimeVerificationErrors = [];
  try {
    const acl = JSON.parse(
      execFileSync(
@@ -587,7 +588,7 @@ process.stdout.write(JSON.stringify({executable:basename(process.execPath),abiVe
          "-NoProfile",
          "-NonInteractive",
          "-Command",
-          "$ErrorActionPreference='Stop'; $items=@($env:REA_TEST_READONLY_CHILDREN | ConvertFrom-Json); @($items | ForEach-Object { [IO.File]::SetAttributes($_,[IO.FileAttributes]([int][IO.File]::GetAttributes($_) -bor 1)); $a=[int][IO.File]::GetAttributes($_); @{readonly=(($a -band 1) -ne 0); directory=(($a -band 16) -ne 0)} }) | ConvertTo-Json -Compress",
+          "$ErrorActionPreference='Stop'; $items=ConvertFrom-Json -InputObject $env:REA_TEST_READONLY_CHILDREN; @($items | ForEach-Object { $current=[int][IO.File]::GetAttributes($_); $next=if(($current -band 16) -ne 0){$current -bor 1}else{1}; [IO.File]::SetAttributes($_,[IO.FileAttributes]$next); $a=[int][IO.File]::GetAttributes($_); @{readonly=(($a -band 1) -ne 0); directory=(($a -band 16) -ne 0); onlyReadonly=($a -eq 1)} }) | ConvertTo-Json -Compress",
        ],
        {
          encoding: "utf8",
@@ -603,16 +604,29 @@ process.stdout.write(JSON.stringify({executable:basename(process.execPath),abiVe
      ),
    );
    assert.deepEqual(readonlyChildren, [
-      { readonly: true, directory: true },
-      { readonly: true, directory: false },
+      { readonly: true, directory: true, onlyReadonly: false },
+      { readonly: true, directory: false, onlyReadonly: true },
    ]);
-  } finally {
-    native.call("runtime_close", [runtime.handle]);
+  } catch (failure) {
+    runtimeVerificationErrors.push(failure);
  }
+  try {
+    native.call("runtime_close", [runtime.handle]);
+  } catch (cleanupFailure) {
+    runtimeVerificationErrors.push(cleanupFailure);
+  }
+  if (runtimeVerificationErrors.length === 1)
+    throw runtimeVerificationErrors[0];
+  if (runtimeVerificationErrors.length > 1)
+    throw new AggregateError(
+      runtimeVerificationErrors,
+      "Native runtime verification and cleanup failed",
+    );
  assert.equal(await exists(runtime.path), false);
  assert.equal(await readFile(sentinel, "utf8"), "preserve");
  report.controls.cleanupDoesNotTraverseJunctions = true;
  report.controls.readonlyRootAndChildrenRemoved = true;
+  report.controls.readonlyFileWithoutArchiveAttributeRemoved = true;
  const fixture = join(workspace, "tree.mjs");
  await writeFile(
    fixture,
@@ -0,0 +1,175 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import {
+  access,
+  mkdir,
+  mkdtemp,
+  readFile,
+  rename,
+  rm,
+  stat,
+  writeFile,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+if (process.platform !== "win32")
+  throw new Error("Requires actual Windows NTFS");
+const [rootArgument, expected] = process.argv.slice(2);
+assert.ok(rootArgument);
+assert.ok(expected === "deny-clear" || expected === "allow");
+const root = resolve(rootArgument);
+const { requireWindowsNativeAuthority } = await import(
+  pathToFileURL(join(root, "dist/windows/WindowsNativeLoader.js"))
+);
+const native = requireWindowsNativeAuthority();
+const workspace = await mkdtemp(join(tmpdir(), "rea-readonly-root-probe-"));
+const roots = [];
+const attributes = (path, readonly) => {
+  const script = `$ErrorActionPreference='Stop';
+$path=$env:REA_OWNED_ATTRIBUTE_PROBE;
+$current=[int][IO.File]::GetAttributes($path);
+$next=if($env:REA_ATTRIBUTE_PROBE_MODE -eq 'only'){1}elseif($env:REA_ATTRIBUTE_PROBE_MODE -eq 'set'){ $current -bor 1 }else{ $current -band (-bnot 1) };
+[IO.File]::SetAttributes($path,[IO.FileAttributes]$next);
+$observed=[int][IO.File]::GetAttributes($path);
+@{readonly=(($observed -band 1) -ne 0); attributes=$observed} | ConvertTo-Json -Compress`;
+  const result = JSON.parse(
+    execFileSync(
+      "powershell.exe",
+      ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script],
+      {
+        encoding: "utf8",
+        timeout: 10000,
+        windowsHide: true,
+        env: {
+          ...process.env,
+          REA_OWNED_ATTRIBUTE_PROBE: path,
+          REA_ATTRIBUTE_PROBE_MODE: readonly === "only" ? "only" : readonly ? "set" : "clear",
+        },
+      },
+    ),
+  );
+  assert.equal(result.readonly, Boolean(readonly));
+  return result;
+};
+const create = () => {
+  const runtime = native.call("runtime_create", [workspace, "owned-"]);
+  const owned = { runtime, currentPath: runtime.path, closed: false };
+  roots.push(owned);
+  return owned;
+};
+const close = (owned) => {
+  native.call("runtime_close", [owned.runtime.handle]);
+  owned.closed = true;
+};
+try {
+  const normal = create();
+  close(normal);
+  await assert.rejects(access(normal.currentPath), { code: "ENOENT" });
+
+  const owned = create();
+  const original = owned.currentPath;
+  const originalIdentity = await stat(original, { bigint: true });
+  const marked = attributes(original, true);
+  assert.notEqual(marked.attributes & 16, 0, "Probe must be a directory");
+  const moved = original + "-moved";
+  await rename(original, moved);
+  owned.currentPath = moved;
+  await mkdir(original);
+  const replacementIdentity = await stat(original, { bigint: true });
+  assert.notEqual(replacementIdentity.ino, originalIdentity.ino);
+  const sentinel = join(original, "unrelated.txt");
+  await writeFile(sentinel, "replacement must survive");
+  let failure;
+  try {
+    close(owned);
+  } catch (cause) {
+    failure = cause;
+  }
+  if (expected === "deny-clear") {
+    assert.equal(failure?.win32Code, 5);
+    assert.equal(failure?.constraint, "Clear owned readonly attribute failed");
+    assert.equal(
+      (await stat(moved, { bigint: true })).ino,
+      originalIdentity.ino,
+    );
+    attributes(moved, false);
+    close(owned);
+  } else assert.equal(failure, undefined, failure?.message);
+  await assert.rejects(access(moved), { code: "ENOENT" });
+  assert.equal(
+    (await stat(original, { bigint: true })).ino,
+    replacementIdentity.ino,
+  );
+  assert.equal(await readFile(sentinel, "utf8"), "replacement must survive");
+
+  const stationary = create();
+  attributes(stationary.currentPath, true);
+  if (expected === "deny-clear") {
+    assert.throws(
+      () => close(stationary),
+      (error) =>
+        error.win32Code === 5 &&
+        error.constraint === "Clear owned readonly attribute failed",
+    );
+    attributes(stationary.currentPath, false);
+  }
+  close(stationary);
+  await assert.rejects(access(stationary.currentPath), { code: "ENOENT" });
+
+  const children = create();
+  native.call("runtime_mkdir", [children.runtime.handle, "nested"]);
+  native.call("runtime_write", [
+    children.runtime.handle,
+    "nested/readonly.txt",
+    Buffer.from("owned readonly file"),
+  ]);
+  attributes(children.currentPath, true);
+  attributes(join(children.currentPath, "nested"), true);
+  attributes(join(children.currentPath, "nested", "readonly.txt"), true);
+  if (expected === "deny-clear") {
+    assert.throws(
+      () => close(children),
+      (error) =>
+        error.win32Code === 5 &&
+        error.constraint === "Clear owned readonly attribute failed",
+    );
+    attributes(children.currentPath, false);
+  }
+  close(children);
+  await assert.rejects(access(children.currentPath), { code: "ENOENT" });
+  const onlyReadonly = create();
+  native.call("runtime_write", [onlyReadonly.runtime.handle, "only-readonly.txt", Buffer.from("owned file")]);
+  const onlyReadonlyPath = join(onlyReadonly.currentPath, "only-readonly.txt");
+  assert.equal(attributes(onlyReadonlyPath, "only").attributes, 1);
+  if (expected === "deny-clear") {
+    assert.throws(() => close(onlyReadonly), error => error.win32Code === 5 && error.constraint === "Delete owned object by handle failed");
+    attributes(onlyReadonlyPath, false);
+  }
+  close(onlyReadonly);
+  await assert.rejects(access(onlyReadonly.currentPath), { code: "ENOENT" });
+  console.log(
+    JSON.stringify({
+      ok: true,
+      expected,
+      rootReadonlyConfirmed: true,
+      stationaryRootRemoved: true,
+      populatedReadonlyRootRemoved: true,
+      renamedOwnedRootRemoved: true,
+      unrelatedReplacementPreserved: true,
+      readonlyChildFileAndDirectoryRemoved: true,
+      readonlyFileWithoutOtherAttributesRemoved: true,
+      baselineConstraint: failure?.constraint ?? null,
+      baselineWin32: failure?.win32Code ?? null,
+      originalIssueDeleteDenialReproduced: false,
+    }),
+  );
+} finally {
+  for (const owned of roots) {
+    if (owned.closed) continue;
+    attributes(owned.currentPath, false);
+    close(owned);
+  }
+  await rm(workspace, { recursive: true, force: true });
+}
Author	SHA1	Message	Date
morluto	6d874f8a70	test(windows): prove permanent readonly fixture rejects missing fallback	2026-10-15 09:06:49 +08:00
morluto	0b46b37d37	test(windows): probe readonly files with no other attributes	2026-10-15 08:48:44 +08:00
morluto	84b35d8e7f	test(windows): release parent write guard before admission validation	2026-10-15 08:34:44 +08:00
morluto	3afb5412fb	test(windows): broaden cleanup probes and preserve primary failures	2026-10-15 08:29:01 +08:00
morluto	554898f859	test(windows): compare failed creation ownership with baseline	2026-10-15 08:21:01 +08:00