fix(conformance): classify bounded Windows quota retry failures

[BunsDev]

Closes the diagnostic gap on #219: repeat=persistent could not identify a cause.

Stacked on #313 — the first three commits are its, and this shows only its own two once #313 lands.

The defect

Both repeat paths in scripts/windows-job-supervisor.cs classified with a bare catch that mapped every non-missing exception to persistent:

catch (FileNotFoundException)      { repeat = "missing"; }
catch (DirectoryNotFoundException) { repeat = "missing"; }
catch                              { repeat = "persistent"; }

That collapsed three distinct outcomes into one label: a genuine repeated access denial, entry-budget exhaustion at the snapshot.Count >= maximumEntries bound, and concurrent filesystem mutation surfacing as other IOException variants on the retry. The protected Windows failure could not be attributed because the label was the same either way.

Two commits, as the protocol requires

• 2cb98c0 — the supervisor fix, its workflow and doc updates, and the governed digests for the files it changes.
• 4b7a9c9 — repin only: harness revision, authority revision and tree, and the prose and test copies of them.

Verification

Check	Result
All 25 governed digests vs authority 2cb98c0	all match
Recorded tree vs 2cb98c0^{tree}	identical
vitest --config vitest.heavy.config.ts src/phase1-conformance-lock.test.ts	95 passed, 1 skipped
vitest run src/client-v1-conformance-workflow.test.ts	81 passed, 19 skipped
pnpm typecheck, pnpm lint	clean

Digests were checked against the authority commit rather than regenerated, so the pin is verified rather than assumed.

Merge requirement

The repin points harnessAuthority.revision at 2cb98c0, a commit on this branch. Per docs/phase1-conformance.md it must land as a real merge commit, never a squash or rebase, or the pinned revision stops being an ancestor of main and the authority checkout resolves only while this branch survives. An SDK rebind follows.

Note this PR's own Windows job is the one capped at 20 minutes in #324; #325 raises it.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

It repins the Phase 1 conformance authority and updates multiple governed artifacts (workflow integrity pins, lock, docs, tests, and the Windows supervisor), so a final human verification of the protocol and merge strategy is warranted.

Pull request overview

This PR closes a diagnostics gap in the Phase 1 conformance harness by refining Windows bounded-quota retry classification so protected Windows failures can be attributed (e.g., distinguishing repeated access denial vs a changed I/O failure on the retry), while also separating an unrelated native-preflight diagnostic cause that previously collapsed into secure_store_unavailable. It also repins the conformance authority to the new reviewed revision and updates the governed digests/tests/docs that must mirror that authority.

Changes:

• Update scripts/windows-job-supervisor.cs to classify bounded retry failures as persistent-<category> (e.g. persistent-access-denied, persistent-io, persistent-entry-bound) instead of a single persistent bucket, while keeping normalization/sanitization strict.
• Add a distinct conformance-only native diagnostic for custody implementations that do not override installation_id (installation_custody_unsupported) and propagate it through schema-v2 producer classification + tests.
• Repin phase1-conformance.lock.json to the new authority revision/tree and update the corresponding literal copies in tests and docs, plus Windows quota fixture expectations.

File summaries

File	Description
scripts/windows-job-supervisor.cs	Replaces the catch-all “persistent” retry label with a bounded, normalized persistent-<category> classifier for repeat failures.
scripts/windows-quota-diagnostics.test.ps1	Extends the PowerShell regression matrix to assert the refined retry categories and sanitization behavior.
scripts/windows-quota-isolated-reader.test.ps1	Updates fixture expectations to require the refined repeat label (persistent-access-denied).
scripts/windows-quota-delete-pending.test.ps1	Broadens allowed repeat labels to the new normalized set and tightens validation by field rather than full-string enumerations.
scripts/windows-owner-directory-quota.test.ps1	Updates persistent-denial fixture expectation to the new repeat label.
src/client-v1-conformance-workflow.test.ts	Adds a scenario asserting diagnostics now report repeat=persistent-io when the retry fails with an I/O category.
src-tauri/src/keyring.rs	Introduces CustodyInstallationUnsupported (conformance-only) and maps it to installation_custody_unsupported, plus a unit test proving it’s distinct from Unavailable.
scripts/phase1-schema-v2-producer.mjs	Classifies installation_custody_unsupported into the bounded public category custody-unsupported and includes the corresponding native-preflight stage allowlist entry.
src/native-preflight-diagnostics.test.ts	Extends the stage/response classification tests to cover the new custody-unsupported path.
phase1-conformance.lock.json	Repins harness/harnessAuthority revision/tree and updates governed blobs/digests for changed authority files.
src/phase1-conformance-lock.test.ts	Updates the hardcoded expected authority revision/tree and updated governed file digests.
docs/phase1-conformance.md	Documents the bounded quota retry categories and updates authority/digest references for the new reviewed revision.
docs/roadmap.md	Updates the checkpoint narrative to reflect the current protected-validation state and the new diagnostic focus.
.github/workflows/client-v1-conformance.yml	Updates the workflow’s integrity pin(s) for the revised Windows supervisor source bytes/digest to match the new authority.

Review details

• Files reviewed: 13/14 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[BunsDev]

Updated for #325, which has merged.

Merged main in rather than rebasing, because the authority pin has to stay reachable: rebasing would rewrite 2cb98c0 and break it.

Two commits added, keeping the documented shape:

• 0a35e57 — the merge, carrying every governed digest refreshed against the merged tree: ci.yml from main, plus the Cargo.toml, Cargo.lock and keyring.rs production deltas.
• 9914ed9 — repin only, advancing the authority to 0a35e57.

The authority now describes a tree that contains both this branch's supervisor fix and main's raised timeout, so the pin matches what ships rather than lagging behind it.

src-tauri/src/keyring.rs auto-merged, since this branch touched it in aa4d330 and main touched it in #322. The merged file keeps main's session contract work: delete_session_if_matches, session_fields_are_complete, and the parse-before-migrate ordering are all present, and 190 Rust tests pass.

Added ci:full so the Windows supervisor job actually runs. It is the job that exercises the change in windows-job-supervisor.cs, and without the label it skips. It now inherits the 30-minute cap from #325; on the previous cap it measured 18m54s, which is 66 seconds inside the old limit.

Re-verified: authority tree matches 0a35e57^{tree}, all 25 governed files and all 10 production deltas match, heavy suite 909 passed, typecheck and lint clean.