fix(windows): restore native build and runtime validation

.bazelrc

@@ -47,6 +47,9 @@ build:windows --action_env=PATH
 # Windows runfiles default to a manifest; suites read fixtures and spawn
 # binaries through the runfiles tree.
 build:windows --enable_runfiles
+# Git for Windows exports its installation root to Git Bash. Preserve gix's
+# native discovery fast path in tests instead of launching Git per hook.
+test:windows --test_env=EXEPATH
 
 test --test_output=errors
 # Suites spawn child services as well as the bounded Rust test harness.

crates/tracedecay-agent-hosts/BUILD.bazel

@@ -141,7 +141,7 @@ genrule(
     srcs = [":rustfmt_sources_2024", "//:rustfmt.toml"],
     outs = ["rustfmt_check_2024.ok"],
     cmd = "\"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $(locations :rustfmt_sources_2024) && touch \"$@\"",
-    cmd_ps = "foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
+    cmd_ps = "$$env:PATHEXT += ';.EXE'; foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
     tools = ["//:rustfmt_toolchain"],
     toolchains = ["//:rustfmt_toolchain"],
     tags = ["manual"],

crates/tracedecay-agent-hosts/src/agents/context_scout/decision_engine.rs

@@ -634,6 +634,7 @@ pub mod test_server {
 #[cfg(test)]
 #[allow(clippy::unwrap_used)]
 mod tests {
+    use std::io::Read as _;
     use std::time::{Duration, Instant};
 
     use super::test_server::{
@@ -1059,12 +1060,16 @@ mod tests {
     }
 
     #[test]
-    fn an_unreachable_engine_is_unreachable() {
-        let port = std::net::TcpListener::bind("127.0.0.1:0")
-            .unwrap()
-            .local_addr()
-            .unwrap()
-            .port();
+    fn a_disconnected_engine_is_unreachable() {
+        let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+        let port = listener.local_addr().unwrap().port();
+        // A closed port can spend the entire request deadline in Windows'
+        // connect retries. Close an established request to observe transport
+        // loss independently of that platform's refusal timing.
+        let peer = std::thread::spawn(move || {
+            let (mut stream, _) = listener.accept().unwrap();
+            stream.read_exact(&mut [0_u8; 1]).unwrap();
+        });
         let mut configured = config(&format!("http://127.0.0.1:{port}"));
         configured.timeout = Duration::from_millis(500);
         assert_eq!(
@@ -1073,6 +1078,7 @@ mod tests {
                 .ask_blocking(&request("s", vec![noul("q")])),
             DecisionEngineOutcomeV1::Unreachable
         );
+        peer.join().unwrap();
     }
 
     #[test]

crates/tracedecay-agent-hosts/src/agents/host_bundle/tests.rs

@@ -12,6 +12,45 @@ use super::doctor::doctor_artifact_state;
 use super::planner::plan_artifact_action;
 use super::*;
 
+#[cfg(windows)]
+#[test]
+fn publication_survives_a_transient_windows_reader() {
+    let temp = tempfile::tempdir().unwrap();
+    let destination = temp.path().join("artifact");
+    drop(tracedecay_private_fs::create_private_file(&destination).unwrap());
+    fs::write(&destination, b"before").unwrap();
+    let reader =
+        tracedecay_private_fs::windows::open_or_create_private_lock_file(&destination).unwrap();
+    let probe = temp.path().join("probe");
+    fs::write(&probe, b"probe").unwrap();
+    let error = fs::rename(&probe, &destination).unwrap_err();
+    assert!(matches!(error.raw_os_error(), Some(5 | 32)));
+    fs::remove_file(probe).unwrap();
+    let parent =
+        cap_std::fs::Dir::open_ambient_dir(temp.path(), cap_std::ambient_authority()).unwrap();
+    std::thread::scope(|scope| {
+        scope.spawn(move || {
+            std::thread::sleep(std::time::Duration::from_millis(40));
+            drop(reader);
+        });
+        super::writer::atomic_write_nofollow(&parent, "artifact", b"after", true).unwrap();
+    });
+    assert_eq!(fs::read(destination).unwrap(), b"after");
+    assert_eq!(fs::read_dir(temp.path()).unwrap().count(), 1);
+
+    let destination = temp.path().join("artifact");
+    tracedecay_private_fs::make_private_file(&destination).unwrap();
+    let reader =
+        tracedecay_private_fs::windows::open_or_create_private_lock_file(&destination).unwrap();
+    assert!(matches!(
+        super::writer::atomic_write_nofollow(&parent, "artifact", b"denied", true),
+        Err(HostBundleError::StorageFailure(_))
+    ));
+    assert_eq!(fs::read(destination).unwrap(), b"after");
+    assert_eq!(fs::read_dir(temp.path()).unwrap().count(), 1);
+    drop(reader);
+}
+
 #[derive(Clone)]
 struct FirstPartyVerifier([u8; 32]);
 

crates/tracedecay-agent-hosts/src/agents/host_bundle/writer.rs

@@ -12,6 +12,10 @@ use cap_std::ambient_authority;
 use cap_std::fs::{Dir, OpenOptions as CapOpenOptions};
 use sha2::{Digest, Sha256};
 use tracedecay_host_integration::host_bundle_storage_failure;
+#[cfg(windows)]
+use tracedecay_private_fs::capability_dir::rename_noreplace;
+use tracedecay_private_fs::capability_dir::replace_file;
+use tracedecay_runtime_core::storage::retry_transient_file_op;
 
 use super::control::{
     HOST_BUNDLE_CONTROL_DIR, HOST_BUNDLE_LOCK_FILE, MAX_CONTROL_FILE_BYTES,
@@ -829,21 +833,29 @@ pub(super) fn atomic_write_nofollow(
             // a final symlink; the preflight and capability parent prevent
             // traversal through any descendant component.
             if replace_existing {
-                parent
-                    .rename(&temporary, parent, name)
+                // Retain the staged bytes across transient failures under
+                // the shared bounded file policy.
+                retry_transient_file_op(|| replace_file(parent, temporary.as_ref(), name.as_ref()))
                     .map_err(|_| host_bundle_storage_failure!())?;
             } else {
-                parent
-                    .hard_link(&temporary, parent, name)
-                    .map_err(|error| {
-                        if error.kind() == io::ErrorKind::AlreadyExists {
-                            HostBundleError::OwnershipConflict(format!(
-                                "{name}: a file appeared at this deploy path mid-write"
-                            ))
-                        } else {
-                            host_bundle_storage_failure!()
-                        }
-                    })?;
+                #[cfg(windows)]
+                // First publication needs the same namespace durability as
+                // replacement, without ever displacing a raced entry.
+                let publication = retry_transient_file_op(|| {
+                    rename_noreplace(parent, temporary.as_ref(), parent, name.as_ref())
+                });
+                #[cfg(not(windows))]
+                let publication = parent.hard_link(&temporary, parent, name);
+                publication.map_err(|error| {
+                    if error.kind() == io::ErrorKind::AlreadyExists {
+                        HostBundleError::OwnershipConflict(format!(
+                            "{name}: a file appeared at this deploy path mid-write"
+                        ))
+                    } else {
+                        host_bundle_storage_failure!()
+                    }
+                })?;
+                #[cfg(not(windows))]
                 parent
                     .remove_file(&temporary)
                     .map_err(|_| host_bundle_storage_failure!())?;

crates/tracedecay-api/BUILD.bazel

@@ -110,7 +110,7 @@ genrule(
     srcs = [":rustfmt_sources_2024", "//:rustfmt.toml"],
     outs = ["rustfmt_check_2024.ok"],
     cmd = "\"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $(locations :rustfmt_sources_2024) && touch \"$@\"",
-    cmd_ps = "foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
+    cmd_ps = "$$env:PATHEXT += ';.EXE'; foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
     tools = ["//:rustfmt_toolchain"],
     toolchains = ["//:rustfmt_toolchain"],
     tags = ["manual"],

crates/tracedecay-application/BUILD.bazel

@@ -150,7 +150,7 @@ genrule(
     srcs = [":rustfmt_sources_2024", "//:rustfmt.toml"],
     outs = ["rustfmt_check_2024.ok"],
     cmd = "\"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $(locations :rustfmt_sources_2024) && touch \"$@\"",
-    cmd_ps = "foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
+    cmd_ps = "$$env:PATHEXT += ';.EXE'; foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
     tools = ["//:rustfmt_toolchain"],
     toolchains = ["//:rustfmt_toolchain"],
     tags = ["manual"],

crates/tracedecay-application/src/lsp_runtime/semantic/tests.rs

@@ -103,11 +103,18 @@ impl PendingAnalyzerRequest {
 
     async fn assert_stopped(mut self) {
         let mut byte = [0_u8];
-        let bytes = tokio::time::timeout(TEST_BOUND, self.stream.read(&mut byte))
+        let stopped = tokio::time::timeout(TEST_BOUND, self.stream.read(&mut byte))
             .await
-            .expect("cancelled analyzer work must release its process")
-            .unwrap();
-        assert_eq!(bytes, 0);
+            .expect("cancelled analyzer work must release its process");
+        match stopped {
+            Ok(0) => {}
+            Err(error)
+                if matches!(
+                    error.kind(),
+                    std::io::ErrorKind::ConnectionReset | std::io::ErrorKind::ConnectionAborted
+                ) => {}
+            other => panic!("cancelled analyzer connection must close: {other:?}"),
+        }
     }
 }
 

crates/tracedecay-application/tests/application_suite/registered_scope_route.rs

@@ -2,12 +2,13 @@ use std::path::Path;
 use std::process::Command;
 
 use tracedecay_domain::ProjectId;
+use tracedecay_runtime_core::path_safety::plain_git_args;
 use tracedecay_session_memory::context::RegisteredScopeResolver;
 
 fn git(root: &Path, args: &[&str]) {
     let status = Command::new("git")
         .current_dir(root)
-        .args(args)
+        .args(plain_git_args(args))
         .status()
         .expect("git command starts");
     assert!(status.success(), "git command failed: {args:?}");

crates/tracedecay-automation-runtime/BUILD.bazel

@@ -113,7 +113,7 @@ genrule(
     srcs = [":rustfmt_sources_2024", "//:rustfmt.toml"],
     outs = ["rustfmt_check_2024.ok"],
     cmd = "\"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $(locations :rustfmt_sources_2024) && touch \"$@\"",
-    cmd_ps = "foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
+    cmd_ps = "$$env:PATHEXT += ';.EXE'; foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
     tools = ["//:rustfmt_toolchain"],
     toolchains = ["//:rustfmt_toolchain"],
     tags = ["manual"],

crates/tracedecay-automation-runtime/src/automation/scheduler.rs

@@ -1020,6 +1020,7 @@ mod tests {
         SESSION_EVIDENCE_BUDGET_EXHAUSTED, SESSION_EVIDENCE_BUDGET_SUPPRESSED,
     };
     use tracedecay_private_fs::framed_log::{DirectorySyncPolicy, with_owned_temp_publish};
+    use tracedecay_private_fs::{create_private_file, open_private_file};
     #[cfg(unix)]
     use tracedecay_runtime_core::storage::with_durable_namespace_sync_fault_for_test;
 
@@ -1899,13 +1900,13 @@ evidence about it",
         for command in std::io::stdin().lock().lines() {
             let answer = match command.unwrap().as_str() {
                 "prepare" if old => {
-                    let file = std::fs::OpenOptions::new()
-                        .read(true)
-                        .write(true)
-                        .create(true)
-                        .truncate(false)
-                        .open(&coordination_path)
-                        .unwrap();
+                    let file = match create_private_file(&coordination_path) {
+                        Ok(file) => file,
+                        Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => {
+                            open_private_file(&coordination_path).unwrap()
+                        }
+                        Err(error) => panic!("create old coordination: {error}"),
+                    };
                     match file.try_lock() {
                         Ok(()) => {
                             coordination = Some(FileLease::held(file, "test.old-task"));
@@ -1921,11 +1922,7 @@ evidence about it",
                     // The production publisher hard-linked a synced staging
                     // file under this lock. Keep that publication ordering.
                     let staging = lock_dir.join("old-owner-staging");
-                    let mut file = std::fs::OpenOptions::new()
-                        .write(true)
-                        .create_new(true)
-                        .open(&staging)
-                        .unwrap();
+                    let mut file = create_private_file(&staging).unwrap();
                     writeln!(file, "pid={}\ncreated_at=0", std::process::id()).unwrap();
                     file.sync_all().unwrap();
                     std::fs::hard_link(&staging, &lock_path).unwrap();
@@ -2244,12 +2241,16 @@ evidence about it",
     fn write_pre_lease_lock(lock_dir: &Path, key: &str, payload: &[u8]) -> PathBuf {
         tracedecay_runtime_core::storage::PrivateStoreIo::create_dir_all_durable(lock_dir).unwrap();
         let lock_path = lock_dir.join(format!("{key}.lock"));
-        std::fs::write(&lock_path, payload).unwrap();
-        std::fs::write(
-            tracedecay_runtime_core::storage::append_lock_path(&lock_path),
-            b"",
-        )
-        .unwrap();
+        create_private_file(&lock_path)
+            .unwrap()
+            .write_all(payload)
+            .unwrap();
+        drop(
+            create_private_file(&tracedecay_runtime_core::storage::append_lock_path(
+                &lock_path,
+            ))
+            .unwrap(),
+        );
         lock_path
     }
 

crates/tracedecay-automation/BUILD.bazel

@@ -66,7 +66,7 @@ genrule(
     srcs = [":rustfmt_sources_2024", "//:rustfmt.toml"],
     outs = ["rustfmt_check_2024.ok"],
     cmd = "\"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $(locations :rustfmt_sources_2024) && touch \"$@\"",
-    cmd_ps = "foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
+    cmd_ps = "$$env:PATHEXT += ';.EXE'; foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
     tools = ["//:rustfmt_toolchain"],
     toolchains = ["//:rustfmt_toolchain"],
     tags = ["manual"],

crates/tracedecay-capture/BUILD.bazel

@@ -95,7 +95,7 @@ genrule(
     srcs = [":rustfmt_sources_2024", "//:rustfmt.toml"],
     outs = ["rustfmt_check_2024.ok"],
     cmd = "\"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $(locations :rustfmt_sources_2024) && touch \"$@\"",
-    cmd_ps = "foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
+    cmd_ps = "$$env:PATHEXT += ';.EXE'; foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
     tools = ["//:rustfmt_toolchain"],
     toolchains = ["//:rustfmt_toolchain"],
     tags = ["manual"],

crates/tracedecay-cli/BUILD.bazel

@@ -230,7 +230,7 @@ genrule(
     srcs = [":rustfmt_sources_2024", "//:rustfmt.toml"],
     outs = ["rustfmt_check_2024.ok"],
     cmd = "\"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $(locations :rustfmt_sources_2024) && touch \"$@\"",
-    cmd_ps = "foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
+    cmd_ps = "$$env:PATHEXT += ';.EXE'; foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
     tools = ["//:rustfmt_toolchain"],
     toolchains = ["//:rustfmt_toolchain"],
     tags = ["manual"],

crates/tracedecay-code-extraction/BUILD.bazel

@@ -169,7 +169,7 @@ genrule(
     srcs = [":rustfmt_sources_2024", "//:rustfmt.toml"],
     outs = ["rustfmt_check_2024.ok"],
     cmd = "\"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $(locations :rustfmt_sources_2024) && touch \"$@\"",
-    cmd_ps = "foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
+    cmd_ps = "$$env:PATHEXT += ';.EXE'; foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
     tools = ["//:rustfmt_toolchain"],
     toolchains = ["//:rustfmt_toolchain"],
     tags = ["manual"],