[code-yeongyu]

Working...
Part of sisyphuslabs/omo-desktop-app#4199 (senpi PR S5, native half: the Windows primitive of design 4.3 and 4.5). Stacked on #4302; review only the top commit until #4302 merges, then this PR is retargeted to main.

Summary

crates/senpi-socket-secret gains publish_no_replace (N-API publishNoReplace(stagingPath, finalPath, bytes)): first publication of a public socket secret on Windows without ever writing, copying onto or truncating the final name. No TypeScript caller yet; the TypeScript creation path that uses this primitive (and link() on POSIX) is the next PR.

Behaviour (design 4.3 steps 3-7, 4.5 Windows row)

• Staging: CreateFileW(CREATE_NEW) in the caller's same directory, with a SECURITY_ATTRIBUTES whose descriptor is D:P(A;;FA;;;<user SID>)(A;;FA;;;SY)(A;;FA;;;BA): a protected DACL (no inherited ACE) set before any byte is written; handle not inheritable.
• WriteFile until every byte is written (a zero-byte write is an error), FlushFileBuffers, close the writing handle.
• Reopen for DELETE | SYNCHRONIZE and SetFileInformationByHandle(FileRenameInfo) with ReplaceIfExists = FALSE and a full destination path.
• ERROR_ALREADY_EXISTS/ERROR_FILE_EXISTS is a collision: returns collision, the caller reads and validates the winner. Any other failure returns the failed step and its Windows error; never a fallback.
• On collision or error the staging file is deleted through its own handle (FileDispositionInfo), never by path; after a successful rename nothing is unlinked.

Tests

Native receipts in tests/native_publish.rs (Windows only; ci.yml socket-secret-native-windows already runs cargo test -p senpi-socket-secret, and each prints a RECEIPT_PUBLISH line):

• first publication to an absent name; only the final file remains (design test 1);
• collision with an existing winner keeps the winner's bytes and deletes only this attempt's staging;
• collision while a reader holds the winner open is still a collision, not an access error;
• 16 threads released by one barrier: exactly one published, 15 collision, the final bytes equal the winner's candidate, no staging left (design test 2);
• a pre-existing staging name fails without creating or touching the final name;
• the published file's ACL has no inherited ACE and no Everyone, Users or Authenticated Users entry (icacls).

RED: the primitive is new; its "can fail" proofs are the collision and race assertions, which a final-path CREATE_ALWAYS write or a ReplaceIfExists=TRUE rename would fail.

Gates

cargo fmt -p senpi-socket-secret -- --check rc=0; cargo test -p senpi-socket-secret --locked rc=0 on macOS (the Windows receipts compile out); cargo clippy -p senpi-socket-secret --locked --tests -- -D warnings rc=0 for both x86_64-pc-windows-msvc and aarch64-pc-windows-msvc. The Windows run of the receipts is this PR's CI job.

Not covered

Power-loss durability of the rename (design 4.5 separates it from atomic visibility) and UNC/SMB targets; this primitive is only used on local stores, which the locality classifier of #4302 decides.

Gates (exact head b75492c)

Gated push at this head: bun run check rc=0; cargo fmt -p senpi-socket-secret -- --check rc=0; cargo test -p senpi-socket-secret --locked rc=0; cargo clippy -p senpi-socket-secret --locked --tests --target x86_64-pc-windows-msvc -- -D warnings rc=0; node scripts/check-pr-changelog.mjs --base origin/feat/4199-windows-locality-adapter --labels no-changelog rc=0. Also run locally before the push: the same clippy on aarch64-pc-windows-msvc rc=0.

Review fold r1 (review-4310-r1, FIX_FIRST -> head 91397f5)

• M1, M2, L6, one handle: the staging file is created once with CREATE_NEW, the owner-only DACL, GENERIC_WRITE | DELETE and share mode FILE_SHARE_READ. That handle writes the file, flushes it and renames it with FileRenameInfo and ReplaceIfExists = FALSE. On any outcome except Published (write, flush or rename error, or a collision), the same handle deletes the file through FileDispositionInfo. Nothing is reopened or deleted by path (remove_staging and the reopen are gone). So nothing can swap the file before the rename, and no flushed candidate is left behind on an error.
  • Design check for L6: Revision 8 section 4.3 step 4 says to write, flush and close the writing handle, and never to write the final path. Section 4.5 says the source is "a fully written and flushed same-directory staging file". Neither section requires a reopen or gives a reason to close before the rename. Renaming through the writer keeps both properties (flush completes before the rename, and the final path is never written). It also removes the gap the review found. FILE_SHARE_READ lets readers of the final name in between the rename and this handle's close.
• L3: a failed delete disposition is now reported on stderr with its Windows error code only, never bytes. The result is unchanged, so a collision is still Collision.
• L4: the DACL receipt reads the published file's descriptor with GetNamedSecurityInfoW and converts it to SDDL. It asserts the protected flag and exactly three ACEs: A;;FA;;;<user SID from whoami /user>, A;;FA;;;SY and A;;FA;;;BA. No localized names are involved, and whoami must succeed.
• L5: a staging name that already exists must fail as Os { step: "create_staging", code: 80 }.
• Nit: the WriteFile length now uses u32::try_from(...).unwrap_or(u32::MAX) and the loop continues.
• Local checks (macOS, at this head): cargo fmt --check passed, cargo test -p senpi-socket-secret --locked passed 10, and cargo clippy --tests -D warnings passed for x86_64- and aarch64-pc-windows-msvc. That compiles the Windows tests, but there is no Windows host or VM, so the real-Windows receipts run only in socket-secret-native-windows CI. Actions on this account was reported stalled at fold time.
• The "Gates (exact head b75492c)" section above refers to the pre-fold head.

Review r1 LOW 3 fold (lead ruling, head 0afbce4)

A staging file left behind by a failed FileDispositionInfo delete used to be one stderr line. It is now part of the result.

• publish_no_replace returns Publication { result, staging_left_behind: Option<u32> }; the u32 is the GetLastError of the failed disposition. The stderr line is gone.
• N-API publishNoReplace resolves { outcome: "published" | "collision" | "failed", failure?: { step, code }, stagingLeftBehind?: { path, windowsError } }. An OS failure now resolves as failed instead of throwing, so the leftover survives it too; only an unsupported platform throws. The bytes are never in the result.
• RED: the four new lib.rs unit tests did not compile on 02e44f8 (Publication and publish_result do not exist). A Windows-only unit test in publish.rs injects a failing disposition (|_| Err(5)) and asserts Collision with staging_left_behind == Some(5), the staging file still present and the winner unchanged; it runs in socket-secret-native-windows. The existing receipts now also assert that no staging file was reported left behind.
• Gates (gated-push, rc=0 each): cargo fmt --check, cargo test -p senpi-socket-secret --locked (15 passed on Linux), cargo clippy --tests -D warnings for x86_64- and aarch64-pc-windows-msvc, check-pr-changelog. The real-Windows run of the receipts is this head's CI job.
• The TypeScript side (publishSocketSecretNoReplace, typed stagingLeftBehind with an action naming the path) is on build(native): ship the Windows socket-secret bridge with a loader that has no fallback #4312, where the loader lives.