Protected run 34611963297 Windows job reports, after the primary quota failure (#219):
Ephemeral Windows identity cleanup failed: root-delete:win32-3,root-survived:invalid-operation
win32-3 is ERROR_PATH_NOT_FOUND raised by a Win32Exception in DeleteDirectoryTree/DeleteDirectoryContents (scripts/windows-job-supervisor.cs). Only the raw DeleteFileW/RemoveDirectoryW P/Invoke paths produce a Win32Exception there; the managed Delete/GetFileSystemInfos paths would have classified as not-found/access-denied/io. The bootstrap root then survived, so the isolated identity's temp tree (phase1-conformance-run-* checkouts, pnpm stores, cargo registry) remained on the runner.
Candidate causes, none proven yet:
- Entry vanished between enumeration and deletion (concurrent teardown by a lingering child process) — Win32 reports 3 when a parent component is gone.
- Win32 path normalization on a non-extended (
\\?\-less) path (component ending in ./space, or MAX_PATH if the host process is not long-path aware) while the long-path-aware .NET enumerator still sees the entry.
- Reparse-point branch racing a target directory removal.
Required follow-up (mirrors the #219 cleanup bullet):
- Add bounded, path-free context to the cleanup failure: operation (
delete-file / remove-directory / remove-reparse-*), entry kind, depth bucket, path-length bucket, whether the entry still exists after the failure and whether its parent exists. No paths, names, exception text or environment data.
- Route the P/Invoke deletes through the extended-length (
\\?\) form of the already-normalized full path so Win32 resolves the same entry the managed enumerator returned.
- Treat
ERROR_FILE_NOT_FOUND / ERROR_PATH_NOT_FOUND as satisfied only when a managed re-check confirms the entry is gone; otherwise keep failing closed.
- Native regression covering: >260-char tree, trailing-dot/space component, entry removed mid-walk, and the
root-survived invariant.
- Frozen-source binding via the two-commit procedure, native Windows CI proof, SDK rebinding and a fresh protected attempt.
Do not suppress the primary monitor error or claim cleanup success while the root survives. Sequencing: land after #221 to avoid a second frozen-harness rebase.
Protected run 34611963297 Windows job reports, after the primary quota failure (#219):
Ephemeral Windows identity cleanup failed: root-delete:win32-3,root-survived:invalid-operationwin32-3isERROR_PATH_NOT_FOUNDraised by aWin32ExceptioninDeleteDirectoryTree/DeleteDirectoryContents(scripts/windows-job-supervisor.cs). Only the rawDeleteFileW/RemoveDirectoryWP/Invoke paths produce aWin32Exceptionthere; the managedDelete/GetFileSystemInfospaths would have classified asnot-found/access-denied/io. The bootstrap root then survived, so the isolated identity's temp tree (phase1-conformance-run-*checkouts, pnpm stores, cargo registry) remained on the runner.Candidate causes, none proven yet:
\\?\-less) path (component ending in./space, orMAX_PATHif the host process is not long-path aware) while the long-path-aware .NET enumerator still sees the entry.Required follow-up (mirrors the #219 cleanup bullet):
delete-file/remove-directory/remove-reparse-*), entry kind, depth bucket, path-length bucket, whether the entry still exists after the failure and whether its parent exists. No paths, names, exception text or environment data.\\?\) form of the already-normalized full path so Win32 resolves the same entry the managed enumerator returned.ERROR_FILE_NOT_FOUND/ERROR_PATH_NOT_FOUNDas satisfied only when a managed re-check confirms the entry is gone; otherwise keep failing closed.root-survivedinvariant.Do not suppress the primary monitor error or claim cleanup success while the root survives. Sequencing: land after #221 to avoid a second frozen-harness rebase.