fix(win): record the fsync attempt and degrade coordination-path ACL stalls

Real Windows exposed two seams the win32 test override never reached:
the directory-fsync recorder ran only after a directory handle opened,
which Windows refuses, so the ordering seam now records the best-effort
attempt before the platform layer decides; and a genuine icacls stall on
the config-mutation coordination directory crashed server startup
through the new fail-closed path, so coordination directories now warn
once and degrade while secret-bearing files keep failing closed.

Author: lidge-jun

src/config.ts

@@ -18,6 +18,7 @@ import {
   hardenSecretDir,
   hardenSecretPath,
   hardenSecretPathAsync,
+  windowsSecretAclApplies,
 } from "./lib/windows-secret-acl";
 import { recordOwnedConfigPath } from "./lib/config-ownership";
 import { assertNotRealHomeUnderTest } from "./lib/test-home-guard";
@@ -1506,6 +1507,7 @@ export function readConfigDiagnostics(): ConfigDiagnostics {
 
 const CONFIG_MUTATION_DB_FILENAME = "config-mutation.sqlite";
 const CONFIG_MUTATION_DB_SIDECARS = ["-journal", "-wal", "-shm"] as const;
+let warnedConfigMutationDirectoryAcl = false;
 
 export class ConfigMutationLockError extends Error {
   readonly code = "CONFIG_MUTATION_LOCK_UNAVAILABLE";
@@ -1526,8 +1528,18 @@ function configMutationDatabasePath(): string {
   } else {
     try { chmodSync(dir, 0o700); } catch { /* best-effort on existing dir */ }
   }
-  if (process.platform === "win32") {
-    hardenSecretDir(dir, { required: true });
+  if (windowsSecretAclApplies()) {
+    try {
+      hardenSecretDir(dir, { required: true });
+    } catch (error) {
+      if (!warnedConfigMutationDirectoryAcl) {
+        warnedConfigMutationDirectoryAcl = true;
+        const diagnostics = error instanceof Error ? error.message : "ACL hardening failed";
+        console.warn(
+          `[opencodex] Config mutation coordination directory ACL hardening did not complete; continuing without it. ${diagnostics}`,
+        );
+      }
+    }
   }
   const path = join(dir, CONFIG_MUTATION_DB_FILENAME);
   recordOwnedConfigPath(dir, path);

src/lib/windows-secret-acl.ts

@@ -182,6 +182,11 @@ function effectivePlatform(): string {
   return platformOverride ?? platform;
 }
 
+/** Test-aware platform predicate for callers that must avoid even a no-op ACL call. */
+export function windowsSecretAclApplies(): boolean {
+  return (platformOverride ?? process.platform) === "win32";
+}
+
 /** Error carrying an honest code: ETIMEDOUT only for real timeouts, EICACLS otherwise. */
 function icaclsError(step: string, result: IcaclsResult): NodeJS.ErrnoException {
   const err = new Error(

src/responses/spill-store.ts

@@ -82,11 +82,13 @@ function record(event: "write" | "fsync" | "close" | "harden" | "publish" | "dir
 
 function fsyncDirectoryBestEffort(dir: string): void {
   let fd: number | null = null;
+  // Record the durability attempt before opening the directory: Windows cannot
+  // open/fsync directory handles this way, but callers still cross this seam.
+  record("dir-fsync");
   try {
     fd = openSync(dir, "r");
     if (spillIoForTest?.fsync) spillIoForTest.fsync(fd);
     else fsyncSync(fd);
-    record("dir-fsync");
   } catch {
     // Windows and some filesystems do not support fsync on directory handles.
   } finally {

tests/config.test.ts

@@ -1619,15 +1619,16 @@ describe("config.ts – Windows ACL hardening integration", () => {
     }
   });
 
-  test("saveConfig throws when hardenSecretDir fails in required mode on win32", () => {
+  test("saveConfig degrades when config-mutation directory hardening fails on win32", () => {
     const origPlatform = process.platform;
     Object.defineProperty(process, "platform", { value: "win32", configurable: true });
     try {
       const spy = spyOn(windowsAcl, "hardenSecretDir").mockImplementation((_path, opts) => {
         if (opts?.required) throw new Error("ACL hardening failed: access denied");
         return { ok: true };
       });
-      expect(() => saveConfig(getDefaultConfig())).toThrow(/ACL/i);
+      expect(() => saveConfig(getDefaultConfig())).not.toThrow();
+      expect(existsSync(getConfigPath())).toBe(true);
       spy.mockRestore();
     } finally {
       Object.defineProperty(process, "platform", { value: origPlatform, configurable: true });