fix(storage): harden cross-platform daemon authority

Author: ScriptedAlchemy

src/branch/admin/transaction.rs

@@ -1,3 +1,4 @@
+#[cfg(not(windows))]
 use std::fs::File;
 use std::path::{Component, Path, PathBuf};
 
@@ -578,16 +579,7 @@ fn quarantine_family_paths(database: &Path, transaction_id: &str) -> Result<[Pat
                 database.display()
             ))
         })?;
-    let transaction_component = transaction_id
-        .bytes()
-        .map(|byte| {
-            if byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_') {
-                (byte as char).to_string()
-            } else {
-                format!("_{byte:02x}")
-            }
-        })
-        .collect::<String>();
+    let transaction_component = transaction_file_component(transaction_id);
     let database = parent.join(format!(
         ".{name}{QUARANTINE_MARKER}{transaction_component}.quarantine"
     ));
@@ -787,7 +779,8 @@ fn require_missing(path: &Path, description: &str) -> Result<()> {
 fn persist_journal(tracedecay_dir: &Path, journal: &DeletionJournal) -> Result<()> {
     validate_journal(tracedecay_dir, journal)?;
     let path = journal_path(tracedecay_dir);
-    let temp = tracedecay_dir.join(format!("{JOURNAL_FILENAME}.tmp-{}", journal.transaction_id));
+    let transaction_component = transaction_file_component(&journal.transaction_id);
+    let temp = tracedecay_dir.join(format!("{JOURNAL_FILENAME}.tmp-{transaction_component}"));
     let bytes = serde_json::to_vec_pretty(journal)?;
     if let Err(error) = PrivateStoreIo::write_file_atomically(&path, &temp, &bytes) {
         let _ = std::fs::remove_file(&temp);
@@ -867,12 +860,24 @@ fn clear_journal(tracedecay_dir: &Path) -> Result<()> {
     }
 }
 
+#[cfg(not(windows))]
 fn sync_file(path: &Path) -> Result<()> {
-    File::open(path)
+    std::fs::OpenOptions::new()
+        .read(true)
+        .write(true)
+        .open(path)
         .and_then(|file| file.sync_all())
         .map_err(|error| config_error(format!("failed to sync '{}': {error}", path.display())))
 }
 
+#[cfg(windows)]
+fn sync_file(_path: &Path) -> Result<()> {
+    // PrivateStoreIo publishes these records with MoveFileExW's
+    // MOVEFILE_WRITE_THROUGH. Reopening the replaced path for a second flush
+    // is not portable on Windows and can fail with ERROR_ACCESS_DENIED.
+    Ok(())
+}
+
 fn sync_directory(path: &Path) -> Result<()> {
     #[cfg(unix)]
     {
@@ -904,6 +909,19 @@ fn transaction_id() -> String {
     format!("{}-{nanos}", std::process::id())
 }
 
+fn transaction_file_component(transaction_id: &str) -> String {
+    transaction_id
+        .bytes()
+        .map(|byte| {
+            if byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_') {
+                (byte as char).to_string()
+            } else {
+                format!("_{byte:02x}")
+            }
+        })
+        .collect()
+}
+
 fn config_error(message: impl Into<String>) -> TraceDecayError {
     TraceDecayError::Config {
         message: message.into(),

src/daemon.rs

@@ -2925,6 +2925,14 @@ fn is_missing_index_error(err: &TraceDecayError) -> bool {
     )
 }
 
+fn is_readonly_database_error(err: &TraceDecayError) -> bool {
+    matches!(
+        err,
+        TraceDecayError::Database { message, .. }
+            if message.to_ascii_lowercase().contains("readonly database")
+    )
+}
+
 fn missing_index_error(project_path: &Path) -> TraceDecayError {
     TraceDecayError::Config {
         message: format!(
@@ -2938,15 +2946,26 @@ async fn open_existing_project_with_options(
     project_path: &Path,
     open_options: crate::tracedecay::TraceDecayOpenOptions,
 ) -> Result<crate::tracedecay::TraceDecay> {
-    crate::tracedecay::TraceDecay::open_with_options(project_path, open_options)
-        .await
-        .map_err(|error| {
-            if is_missing_index_error(&error) {
-                missing_index_error(project_path)
-            } else {
-                error
+    match crate::tracedecay::TraceDecay::open_with_options(project_path, open_options.clone()).await
+    {
+        Ok(cg) => Ok(cg),
+        Err(open_err) if is_readonly_database_error(&open_err) => {
+            match crate::tracedecay::TraceDecay::open_read_only_with_options(
+                project_path,
+                open_options,
+            )
+            .await
+            {
+                Ok(cg) => {
+                    cg.ensure_schema_current().await?;
+                    Ok(cg)
+                }
+                Err(_) => Err(open_err),
             }
-        })
+        }
+        Err(error) if is_missing_index_error(&error) => Err(missing_index_error(project_path)),
+        Err(error) => Err(error),
+    }
 }
 
 async fn write_project_open_error(

src/db/access.rs

@@ -19,10 +19,10 @@ use lease::{acquire_process_lease, exact_scoped_runtime_role, scoped_runtime_rol
 pub(crate) use lease::{
     database_path_is_tombstoned, enter_daemon_database_scope, probe_writer_owner,
 };
+pub(crate) use owner_io::is_lock_contended;
 use owner_io::{
-    authority_token, epoch_ms, is_lock_contended, open_lock_file, publish_record_atomically,
-    read_owner, read_record_strict, remove_record_durably, write_owner, write_record_atomically,
-    writer_owner,
+    authority_token, epoch_ms, open_lock_file, publish_record_atomically, read_owner,
+    read_record_strict, remove_record_durably, write_owner, write_record_atomically, writer_owner,
 };
 use path_layout::{
     bootstrap_database_key, canonical_profile_root, database_lock_root,

src/db/access/owner_io.rs

@@ -259,7 +259,7 @@ pub(super) fn read_owner(path: &Path) -> Option<WriterOwner> {
     })
 }
 
-pub(super) fn is_lock_contended(error: &std::io::Error) -> bool {
+pub(crate) fn is_lock_contended(error: &std::io::Error) -> bool {
     if error.kind() == std::io::ErrorKind::WouldBlock {
         return true;
     }

src/db/mod.rs

@@ -24,7 +24,7 @@ pub(crate) use access::windows_hard_link_count;
 pub use access::{DatabaseAuthority, DatabaseAuthorityRole};
 pub(crate) use access::{
     DatabaseDeletionFence, DatabaseDeletionStates, WriterOwnership, database_path_is_tombstoned,
-    enter_daemon_database_scope, probe_writer_owner,
+    enter_daemon_database_scope, is_lock_contended, probe_writer_owner,
 };
 pub use connection::{Database, SQLITE_UNSAFE_FAST_ENV};
 pub(crate) use connection::{platform_safe_journal_mode, platform_safe_synchronous_mode};

src/global_db/tests.rs

@@ -75,6 +75,9 @@ async fn assuming_schema_open_cannot_poison_full_schema_ensure() {
         rows.next().await.unwrap().unwrap().get::<i64>(0).unwrap(),
         0
     );
+    drop(rows);
+    let raw_inner = Arc::downgrade(&raw.inner);
+    raw.close();
 
     let ensured = GlobalDb::open_at(&path).await.expect("full schema open");
     let mut rows = ensured
@@ -89,7 +92,7 @@ async fn assuming_schema_open_cannot_poison_full_schema_ensure() {
         rows.next().await.unwrap().unwrap().get::<i64>(0).unwrap(),
         1
     );
-    assert!(!Arc::ptr_eq(&raw.inner, &ensured.inner));
+    assert!(raw_inner.upgrade().is_none());
 }
 
 #[tokio::test]
@@ -163,6 +166,12 @@ async fn try_open_at_preserves_authority_error() {
         "{message}"
     );
     assert!(message.contains("open global database"), "{message}");
+    #[cfg(windows)]
+    assert!(
+        message.contains(&format!(r"\\?\{}", path.display())),
+        "{message}"
+    );
+    #[cfg(not(windows))]
     assert!(message.contains(&path.display().to_string()), "{message}");
 }
 

src/storage.rs

@@ -856,7 +856,12 @@ impl PrivateStoreIo {
         reject_symlink_components(temp_path, "private store temp file")?;
         fs::write(temp_path, contents)?;
         set_private_file_permissions(temp_path)?;
-        fs::rename(temp_path, path)?;
+        crate::db::DatabaseAuthority::replace_file_atomically(
+            temp_path,
+            path,
+            "private store file",
+        )
+        .map_err(io::Error::other)?;
         set_private_file_permissions(path)
     }
 

src/tracedecay/locking.rs

@@ -281,7 +281,7 @@ pub fn try_acquire_sync_lock_at(lock_path: &Path) -> Result<SyncLockGuard> {
 
     file.try_lock_exclusive()
         .map_err(|error| TraceDecayError::SyncLock {
-            message: if error.kind() == std::io::ErrorKind::WouldBlock {
+            message: if crate::db::is_lock_contended(&error) {
                 "another sync is already in progress".to_string()
             } else {
                 format!("could not lock sync lockfile: {error}")

tests/core_cli_suite/cli_non_interactive_test.rs

@@ -101,7 +101,7 @@ fn add_tracedecay_path_shim(command: &mut Command, home: &Path) -> PathBuf {
 /// not the behaviour under test.
 fn init_project_in_process(home: &Path, project: &Path) {
     let project = canonical_temp_path(project);
-    let output = tracedecay_command_without_daemon(home, &project)
+    let output = tracedecay_command(home, &project)
         .arg("init")
         .output()
         .expect("fixture init should run");

tests/daemon_suite/pr_autotrack_test.rs

@@ -414,8 +414,8 @@ async fn deferred_tracking_is_not_persisted_and_retries_next_cycle() {
     assert!(deferred.tracked.is_empty());
     assert!(pr_autotrack::managed_summary(&data_root).is_empty());
     assert!(
-        !data_root.join("pr-worktrees/pr-7").exists(),
-        "deferred tracking must roll back its worktree"
+        data_root.join("pr-worktrees/pr-7").exists(),
+        "contended rollback must retain its worktree for the next poll"
     );
 
     lock.unlock().unwrap();