@rehearsal-labs/retest 0.2.0 → 0.3.0

package/dist/store/run-store.js

@@ -7,6 +7,7 @@ import { diagnosticsFolder, eventsFile, logsFolder, resultFile, statesFolder } f
 import { parse } from "../protocol/schema.js";
 import { storageStateSchema } from "../protocol/storage-state.js";
 import { errorCode } from "../shared/error-code.js";
+import { keepFolderToUser, PrivateFolderError } from "../shared/private-file.js";
 /** Thrown when the run folder cannot be created or already holds another run. */
 export class RunFolderError extends Error {
     name = 'RunFolderError';
@@ -27,6 +28,7 @@ export class RunStore {
     #resultWritten = false;
     #closed = false;
     #removeStatesOnExit;
+    #statesReady;
     // Where the run's clock stands at zero on the host's monotonic clock, as the events written so far place it.
     #clockZero;
     #clock;
@@ -140,16 +142,44 @@ export class RunStore {
     }
     /**
      * Saves a sign-in state where only this user can read it, never over another. States hold session cookies, so
-     * they are removed when the run ends, and when the process exits before it could.
+     * they are removed when the run ends, and when the process exits before it could. Their folder is made, by this
+     * process alone, and kept to this user before any state is in it (on Windows, whose files take their folder's access
+     * list, that is when its list is replaced); each state is then made exclusively and written through the descriptor
+     * that made it, so nothing written ever follows a link or lands in a file someone else made.
      */
-    writeState(path, state) {
+    async writeState(path, state) {
         const target = this.#path(path);
-        mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+        await this.#statesFolder(dirname(target));
         if (this.#removeStatesOnExit === undefined) {
             this.#removeStatesOnExit = () => this.removeStates();
             process.once('exit', this.#removeStatesOnExit);
         }
-        writeFileSync(target, JSON.stringify(state), { flag: 'wx', mode: 0o600 });
+        const descriptor = openSync(target, 'wx', 0o600);
+        try {
+            writeAll(descriptor, JSON.stringify(state));
+        }
+        catch (error) {
+            closeSync(descriptor);
+            throw withLeftover(error, target, () => rmSync(target, { force: true }));
+        }
+        closeSync(descriptor);
+    }
+    // The states folder, made once per run by this process: a folder already there is refused, so no one else's folder
+    // ever holds a state. It is kept to this user before anything is made in it; a folder that cannot be is removed.
+    #statesFolder(folder) {
+        this.#statesReady ??= (async () => {
+            mkdirSync(folder, { mode: 0o700 });
+            try {
+                await keepFolderToUser(folder);
+            }
+            catch (error) {
+                throw withLeftover(error, folder, () => rmSync(folder, { recursive: true, force: true }));
+            }
+        })().catch((error) => {
+            this.#statesReady = undefined;
+            throw error;
+        });
+        return this.#statesReady;
     }
     /** Reads a state `writeState` saved, checked against its schema. */
     readState(path) {
@@ -163,6 +193,7 @@ export class RunStore {
         if (this.#removeStatesOnExit !== undefined)
             process.removeListener('exit', this.#removeStatesOnExit);
         this.#removeStatesOnExit = undefined;
+        this.#statesReady = undefined;
         rmSync(this.#path(statesFolder), { recursive: true, force: true });
     }
     /** The absolute path of a file inside the run folder. */
@@ -201,6 +232,19 @@ function claim(directory) {
         throw new RunFolderError(`Retest could not write to the run folder ${directory}: ${errorMessage(error)}`, { cause: error });
     }
 }
+// The failure as it was, with what its cleanup could not remove added to it, so a cleanup that fails never replaces it.
+function withLeftover(error, path, remove) {
+    try {
+        remove();
+        return error;
+    }
+    catch (removal) {
+        const leftover = `${path} is still there: ${errorMessage(removal)}`;
+        if (error instanceof PrivateFolderError)
+            return new PrivateFolderError(error.message, `${error.detail}; ${leftover}`);
+        return new Error(`${errorMessage(error)} ${leftover}`, { cause: error });
+    }
+}
 function writeAll(descriptor, text) {
     const bytes = Buffer.from(text, 'utf8');
     let offset = 0;

package/media/Cargo.lock

@@ -184,6 +184,7 @@ dependencies = [
  "libc",
  "serde",
  "serde_json",
+ "windows-sys",
 ]
 
 [[package]]
@@ -252,6 +253,21 @@ version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
 
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
 [[package]]
 name = "zlib-rs"
 version = "0.6.8"

package/media/Cargo.toml

@@ -14,10 +14,25 @@ path = "src/main.rs"
 
 [dependencies]
 image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
-libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 
+[target.'cfg(unix)'.dependencies]
+libc = "0.2"
+
+# The encoder's job, its members' identities and their ending, the exclusive rename, positional reads of kept frames,
+# the reply handle and Ctrl+C. Win32_Security is only what CreateJobObjectW's signature names.
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.61", features = [
+    "Win32_Foundation",
+    "Win32_Security",
+    "Win32_Storage_FileSystem",
+    "Win32_System_Console",
+    "Win32_System_Diagnostics_ToolHelp",
+    "Win32_System_JobObjects",
+    "Win32_System_Threading",
+] }
+
 [features]
 # Counts heap allocations and prints them at exit, for measuring one route against another. Never in a shipped build.
 allocation-counts = []

package/media/src/encoder.rs

@@ -9,7 +9,10 @@
 use std::collections::VecDeque;
 use std::ffi::OsString;
 use std::io::{self, Read};
+#[cfg(unix)]
 use std::os::unix::process::CommandExt;
+#[cfg(windows)]
+use std::os::windows::process::CommandExt;
 use std::path::Path;
 use std::process::{Child, Command, ExitStatus, Stdio};
 use std::sync::{Arc, Mutex};
@@ -205,8 +208,39 @@ pub fn encode_arguments(
     arguments
 }
 
+/// The variables an encoder inherits: where programs and temporary files are. Windows programs also expect the
+/// system folder's variable, and name their temporary folder differently.
+#[cfg(unix)]
+const ENCODER_VARIABLES: [&str; 2] = ["PATH", "TMPDIR"];
+#[cfg(windows)]
+const ENCODER_VARIABLES: [&str; 4] = ["PATH", "SystemRoot", "TEMP", "TMP"];
+
+/// Starts the encoder and the ownership that will record it. On Unix the encoder leads a process group of its own; on
+/// Windows it is created suspended and runs only once it is in a job of its own, so everything it starts is in that job
+/// from birth. A Windows encoder that cannot be put in a job is ended through its own handle before it ever ran.
+pub fn spawn_owned(
+    ffmpeg: &Path,
+    arguments: &[OsString],
+    stdin: Stdio,
+    stdout: Stdio,
+) -> io::Result<(Child, Ownership)> {
+    let mut child = spawn_in_group(ffmpeg, arguments, stdin, stdout)?;
+    #[cfg(unix)]
+    let held: io::Result<Ownership> = Ok(Ownership::new(child.id()));
+    #[cfg(windows)]
+    let held: io::Result<Ownership> = Ownership::hold(&mut child);
+    match held {
+        Ok(ownership) => Ok((child, ownership)),
+        Err(error) => {
+            let _ = child.kill();
+            let _ = child.wait();
+            Err(error)
+        }
+    }
+}
+
 /// Starts the encoder in its own process group. Ownership is recorded separately before any cleanup signal.
-pub fn spawn_in_group(
+fn spawn_in_group(
     ffmpeg: &Path,
     arguments: &[OsString],
     stdin: Stdio,
@@ -217,16 +251,29 @@ pub fn spawn_in_group(
     if ffmpeg.components().count() > 1 {
         std::fs::metadata(ffmpeg)?;
     }
-    Command::new(ffmpeg)
+    let mut command = Command::new(ffmpeg);
+    command
         .env_clear()
         .envs(
-            ["PATH", "TMPDIR"]
+            ENCODER_VARIABLES
                 .into_iter()
                 .filter_map(|name| std::env::var_os(name).map(|value| (name, value))),
         )
         .env("LC_ALL", "C")
-        .args(arguments)
-        .process_group(0)
+        .args(arguments);
+    #[cfg(unix)]
+    command.process_group(0);
+    // The encoder gets a console of its own without a window: nothing appears on screen, a Ctrl+C typed in another
+    // console never reaches it, so, as on Unix, only the media process ends it, and the programs a wrapper starts
+    // share that console and the wrapper's pipes. Without any console, a wrapper's child would get a new console in
+    // place of those pipes. Windows signals no process group; the encoder starts suspended instead, so `spawn_owned`
+    // can put it in a job before it runs.
+    #[cfg(windows)]
+    command.creation_flags(
+        windows_sys::Win32::System::Threading::CREATE_NO_WINDOW
+            | windows_sys::Win32::System::Threading::CREATE_SUSPENDED,
+    );
+    command
         .stdin(stdin)
         .stdout(stdout)
         .stderr(Stdio::piped())
@@ -328,14 +375,11 @@ struct Listing {
 // what was asked: `asked` names it, such as "its encoders".
 fn listing(ffmpeg: &Path, arguments: &[&str], asked: &str) -> Result<Listing, EncoderFailure> {
     let arguments: Vec<OsString> = arguments.iter().map(OsString::from).collect();
-    let mut child =
-        spawn_in_group(ffmpeg, &arguments, Stdio::null(), Stdio::piped()).map_err(|error| {
-            EncoderFailure {
-                message: format!("{} could not be started: {error}", ffmpeg.display()),
-                exit: None,
-            }
+    let (mut child, mut ownership) = spawn_owned(ffmpeg, &arguments, Stdio::null(), Stdio::piped())
+        .map_err(|error| EncoderFailure {
+            message: format!("{} could not be started: {error}", ffmpeg.display()),
+            exit: None,
         })?;
-    let mut ownership = Ownership::new(child.id());
     let mut problems = ownership.capture();
     let stdout = child.stdout.take().map(read_bounded);
     let stderr = child.stderr.take().map(read_bounded);

package/media/src/frame.rs

@@ -781,10 +781,16 @@ mod tests {
         let candidates: Vec<std::path::PathBuf> = if path.components().count() > 1 {
             vec![path.to_owned()]
         } else {
+            // Windows finds a program on PATH by its name with `.exe`.
+            let name = if cfg!(windows) && path.extension().is_none() {
+                path.with_extension("exe")
+            } else {
+                path.to_owned()
+            };
             std::env::split_paths(
                 &std::env::var_os("PATH").expect("PATH for the ffmpeg prerequisite"),
             )
-            .map(|folder| folder.join(path))
+            .map(|folder| folder.join(&name))
             .collect()
         };
         let ffmpeg = candidates

package/media/src/main.rs

@@ -5,8 +5,10 @@
 //! recording's kept frames for an interval, and sends a live view of a recording's newest frame. The protocol is in
 //! `protocol.rs`.
 
-#[cfg(not(unix))]
-compile_error!("retest-media runs on Unix: it verifies each encoder process before stopping it");
+#[cfg(not(any(unix, windows)))]
+compile_error!(
+    "retest-media runs on Unix and Windows: it verifies each encoder process before stopping it"
+);
 
 #[cfg(feature = "allocation-counts")]
 mod allocations;
@@ -16,7 +18,10 @@ mod jobs;
 mod ledger;
 mod live;
 mod place;
+#[cfg(unix)]
 mod process_ownership;
+#[cfg(windows)]
+mod process_ownership_windows;
 mod protocol;
 mod queue;
 mod recording;
@@ -25,6 +30,11 @@ mod server;
 mod store;
 mod timeline;
 
+// Windows has no `ps` and no signals: an encoder is witnessed by a job of its own, and each process in it by its own
+// handle.
+#[cfg(windows)]
+use process_ownership_windows as process_ownership;
+
 use std::ffi::OsString;
 use std::io::{self, BufReader};
 use std::path::PathBuf;
@@ -54,6 +64,14 @@ fn main() -> ExitCode {
             return ExitCode::from(2);
         }
     };
+    // A media process started in its runner's console would end at the first Ctrl+C typed there, before the runner
+    // could finish its recordings. As on Unix, where it is not in the terminal's process group, the runner ends it.
+    // Its encoders and finalizers have consoles of their own and hear no Ctrl+C either.
+    #[cfg(windows)]
+    // SAFETY: a null handler with TRUE only sets this process's own flag to ignore Ctrl+C.
+    unsafe {
+        windows_sys::Win32::System::Console::SetConsoleCtrlHandler(None, 1);
+    }
     let replies = match replies::stdout_pipe().and_then(|output| Replies::new(Box::new(output))) {
         Ok(replies) => replies,
         Err(error) => {

package/media/src/place.rs

@@ -4,10 +4,16 @@
 //! as FAT or exFAT, refuses the link; then the file is copied to `<path>.copying` beside it, synced, and renamed to
 //! the path with a rename that refuses to replace a file, so nothing is ever at the path but a whole file. A process
 //! killed during the copy leaves the `.copying` file, which `leftovers` lists and removes.
+//!
+//! Windows refuses to rename or remove a file while another program holds it open without allowing that, as a virus
+//! scanner reading a new file briefly does. There each move and removal waits a bounded time for the file to be let go,
+//! and a failure names the file as open in another program.
 
 use std::fs::{self, File, OpenOptions};
 use std::io::{self, Read, Write};
 use std::path::{Path, PathBuf};
+#[cfg(windows)]
+use std::time::{Duration, Instant};
 
 use serde::{Deserialize, Serialize};
 
@@ -51,7 +57,7 @@ pub fn place(partial: &Path, path: &Path) -> io::Result<Placed> {
 /// Publishes a complete file without removing its original partial.
 pub fn retain_source(partial: &Path, path: &Path) -> io::Result<Placed> {
     delayed_if_a_test_asks();
-    match link(partial, path) {
+    match while_in_use(partial, || link(partial, path)) {
         Ok(()) => Ok(Placed::Link),
         Err(error) if links_unavailable(&error) => {
             copy_exclusively(partial, path)?;
@@ -85,7 +91,7 @@ pub fn finalize_file(partial: &Path, path: &Path) -> Finalization {
         }
     }
     match retain_source(partial, path) {
-        Ok(placed) => match fs::remove_file(partial) {
+        Ok(placed) => match while_in_use(partial, || fs::remove_file(partial)) {
             Ok(()) => Finalization::Placed(placed),
             Err(error) => Finalization::Failed(format!(
                 "the video was placed at {}, but its source at {} could not be removed: {error}",
@@ -118,7 +124,7 @@ fn delayed_if_a_test_asks() {}
 #[cfg(debug_assertions)]
 fn link(partial: &Path, path: &Path) -> io::Result<()> {
     if std::env::var_os("RETEST_MEDIA_TEST_NO_HARD_LINKS").is_some() {
-        return Err(io::Error::from_raw_os_error(libc::ENOTSUP));
+        return Err(io::Error::from_raw_os_error(NOT_SUPPORTED));
     }
     fs::hard_link(partial, path)
 }
@@ -135,10 +141,86 @@ fn links_unavailable(error: &io::Error) -> bool {
     }
     matches!(
         error.raw_os_error(),
-        Some(code) if [libc::EPERM, libc::ENOTSUP, libc::EOPNOTSUPP, libc::EXDEV, libc::EMLINK, libc::ENOSYS].contains(&code)
+        Some(code) if LINKS_UNAVAILABLE.contains(&code)
     )
 }
 
+// The codes a failed link or rename gives when the filesystem cannot do it at all, rather than because of what is at
+// the path, as each host numbers them.
+#[cfg(unix)]
+const LINKS_UNAVAILABLE: [i32; 6] = [
+    libc::EPERM,
+    libc::ENOTSUP,
+    libc::EOPNOTSUPP,
+    libc::EXDEV,
+    libc::EMLINK,
+    libc::ENOSYS,
+];
+#[cfg(unix)]
+const RENAME_UNSUPPORTED: [i32; 4] = [libc::ENOTSUP, libc::EOPNOTSUPP, libc::EINVAL, libc::ENOSYS];
+// What the test hook that hides hard links answers.
+#[cfg(all(unix, any(debug_assertions, test)))]
+const NOT_SUPPORTED: i32 = libc::ENOTSUP;
+
+// FAT and exFAT answer a hard link with ERROR_INVALID_FUNCTION, a share without links with ERROR_NOT_SUPPORTED.
+#[cfg(windows)]
+const LINKS_UNAVAILABLE: [i32; 5] = [
+    windows_sys::Win32::Foundation::ERROR_INVALID_FUNCTION as i32,
+    windows_sys::Win32::Foundation::ERROR_NOT_SUPPORTED as i32,
+    windows_sys::Win32::Foundation::ERROR_NOT_SAME_DEVICE as i32,
+    windows_sys::Win32::Foundation::ERROR_TOO_MANY_LINKS as i32,
+    windows_sys::Win32::Foundation::ERROR_CALL_NOT_IMPLEMENTED as i32,
+];
+#[cfg(windows)]
+const RENAME_UNSUPPORTED: [i32; 3] = [
+    windows_sys::Win32::Foundation::ERROR_INVALID_FUNCTION as i32,
+    windows_sys::Win32::Foundation::ERROR_NOT_SUPPORTED as i32,
+    windows_sys::Win32::Foundation::ERROR_CALL_NOT_IMPLEMENTED as i32,
+];
+#[cfg(all(windows, any(debug_assertions, test)))]
+const NOT_SUPPORTED: i32 = windows_sys::Win32::Foundation::ERROR_NOT_SUPPORTED as i32;
+
+/// How long a move or removal waits for another program to let go of a file on Windows.
+#[cfg(windows)]
+const IN_USE_WAIT: Duration = Duration::from_secs(2);
+
+// Runs a move or removal of `path` again while another program holds the file open against it, up to `IN_USE_WAIT`.
+// A file still held then is named as open in another program.
+#[cfg(windows)]
+fn while_in_use<T>(path: &Path, mut operation: impl FnMut() -> io::Result<T>) -> io::Result<T> {
+    use windows_sys::Win32::Foundation::{ERROR_LOCK_VIOLATION, ERROR_SHARING_VIOLATION};
+    let started = Instant::now();
+    loop {
+        match operation() {
+            Err(error)
+                if matches!(
+                    error.raw_os_error(),
+                    Some(code) if code == ERROR_SHARING_VIOLATION as i32 || code == ERROR_LOCK_VIOLATION as i32
+                ) =>
+            {
+                if started.elapsed() >= IN_USE_WAIT {
+                    return Err(io::Error::new(
+                        error.kind(),
+                        format!(
+                            "{} is open in another program, which kept it from being moved or removed for {} s: {error}",
+                            path.display(),
+                            IN_USE_WAIT.as_secs()
+                        ),
+                    ));
+                }
+                std::thread::sleep(Duration::from_millis(50));
+            }
+            done => return done,
+        }
+    }
+}
+
+// A Unix file that is open can always be renamed and removed.
+#[cfg(unix)]
+fn while_in_use<T>(_: &Path, mut operation: impl FnMut() -> io::Result<T>) -> io::Result<T> {
+    operation()
+}
+
 fn copy_exclusively(partial: &Path, path: &Path) -> io::Result<()> {
     if path.symlink_metadata().is_ok() {
         return Err(io::Error::from(io::ErrorKind::AlreadyExists));
@@ -165,7 +247,12 @@ fn copy_exclusively(partial: &Path, path: &Path) -> io::Result<()> {
 // operation is supported, placement fails with the destination named and keeps the source. Ordinary rename is
 // never used because it can replace a foreign file between a check and publication.
 fn rename_without_replacing(from: &Path, to: &Path) -> io::Result<()> {
-    rename_using(from, to, exclusive_rename, || {})
+    rename_using(
+        from,
+        to,
+        |from, to| while_in_use(from, || exclusive_rename(from, to)),
+        || {},
+    )
 }
 
 fn rename_using(
@@ -178,7 +265,7 @@ fn rename_using(
         Err(error)
             if matches!(
                 error.raw_os_error(),
-                Some(code) if [libc::ENOTSUP, libc::EOPNOTSUPP, libc::EINVAL, libc::ENOSYS].contains(&code)
+                Some(code) if RENAME_UNSUPPORTED.contains(&code)
             ) =>
         {
             if to.symlink_metadata().is_ok() {
@@ -233,7 +320,34 @@ fn exclusive_rename(from: &Path, to: &Path) -> io::Result<()> {
     }
 }
 
-#[cfg(not(any(target_os = "macos", target_os = "linux")))]
+// MoveFileExW without MOVEFILE_REPLACE_EXISTING fails when anything is at the destination, the same refusal as
+// RENAME_EXCL and RENAME_NOREPLACE.
+#[cfg(windows)]
+fn exclusive_rename(from: &Path, to: &Path) -> io::Result<()> {
+    let (from, to) = (wide_path(from)?, wide_path(to)?);
+    // SAFETY: MoveFileExW takes two NUL-terminated UTF-16 paths that live across the call, and no flags.
+    let moved = unsafe {
+        windows_sys::Win32::Storage::FileSystem::MoveFileExW(from.as_ptr(), to.as_ptr(), 0)
+    };
+    if moved != 0 {
+        Ok(())
+    } else {
+        Err(io::Error::last_os_error())
+    }
+}
+
+#[cfg(windows)]
+fn wide_path(path: &Path) -> io::Result<Vec<u16>> {
+    use std::os::windows::ffi::OsStrExt;
+    let mut wide: Vec<u16> = path.as_os_str().encode_wide().collect();
+    if wide.contains(&0) {
+        return Err(io::Error::from(io::ErrorKind::InvalidInput));
+    }
+    wide.push(0);
+    Ok(wide)
+}
+
+#[cfg(not(any(target_os = "macos", target_os = "linux", windows)))]
 fn exclusive_rename(_: &Path, _: &Path) -> io::Result<()> {
     Err(io::Error::from_raw_os_error(libc::ENOTSUP))
 }
@@ -259,8 +373,9 @@ fn copy_in_chunks(source: &mut File, target: &mut File) -> io::Result<()> {
     }
 }
 
-// A test sets this to prove what a process killed in the middle of a copy leaves behind. Release builds have no hook.
-#[cfg(debug_assertions)]
+// A test sets this to prove what a process killed in the middle of a copy leaves behind. Release builds have no hook,
+// and neither has Windows, where no test asks.
+#[cfg(all(debug_assertions, unix))]
 fn killed_if_a_test_asks() {
     if std::env::var_os("RETEST_MEDIA_TEST_KILL_DURING_COPY").is_some() {
         // SAFETY: kill(2) on this process's own pid; SIGKILL leaves exactly what a kill from outside would.
@@ -270,7 +385,7 @@ fn killed_if_a_test_asks() {
     }
 }
 
-#[cfg(not(debug_assertions))]
+#[cfg(not(all(debug_assertions, unix)))]
 fn killed_if_a_test_asks() {}
 
 #[cfg(test)]
@@ -349,7 +464,7 @@ mod tests {
         let result = rename_using(
             &copying,
             &path,
-            |_, _| Err(io::Error::from_raw_os_error(libc::ENOTSUP)),
+            |_, _| Err(io::Error::from_raw_os_error(NOT_SUPPORTED)),
             || {
                 barrier.wait();
                 barrier.wait();
@@ -391,6 +506,7 @@ mod tests {
         let _ = fs::remove_dir_all(folder);
     }
 
+    #[cfg(unix)]
     #[test]
     fn only_link_refusals_choose_the_copy() {
         for code in [libc::EPERM, libc::ENOTSUP, libc::EXDEV, libc::EMLINK] {
@@ -406,4 +522,107 @@ mod tests {
             );
         }
     }
+
+    #[cfg(windows)]
+    #[test]
+    fn only_link_refusals_choose_the_copy_on_windows() {
+        use windows_sys::Win32::Foundation::{
+            ERROR_ACCESS_DENIED, ERROR_ALREADY_EXISTS, ERROR_DISK_FULL, ERROR_FILE_NOT_FOUND,
+            ERROR_INVALID_FUNCTION, ERROR_NOT_SAME_DEVICE, ERROR_NOT_SUPPORTED,
+            ERROR_TOO_MANY_LINKS,
+        };
+        for code in [
+            ERROR_INVALID_FUNCTION,
+            ERROR_NOT_SUPPORTED,
+            ERROR_NOT_SAME_DEVICE,
+            ERROR_TOO_MANY_LINKS,
+        ] {
+            assert!(
+                links_unavailable(&io::Error::from_raw_os_error(code as i32)),
+                "{code}"
+            );
+        }
+        for code in [
+            ERROR_ALREADY_EXISTS,
+            ERROR_FILE_NOT_FOUND,
+            ERROR_ACCESS_DENIED,
+            ERROR_DISK_FULL,
+        ] {
+            assert!(
+                !links_unavailable(&io::Error::from_raw_os_error(code as i32)),
+                "{code}"
+            );
+        }
+    }
+
+    // Opens `path` as a program that lets others read it but neither rename nor remove it, and lets go after `hold`.
+    #[cfg(windows)]
+    fn held_open(path: &Path, hold: std::time::Duration) -> std::thread::JoinHandle<()> {
+        use std::os::windows::fs::OpenOptionsExt;
+        let file = OpenOptions::new()
+            .read(true)
+            .share_mode(windows_sys::Win32::Storage::FileSystem::FILE_SHARE_READ)
+            .open(path)
+            .expect("the other program opens the file");
+        std::thread::spawn(move || {
+            std::thread::sleep(hold);
+            drop(file);
+        })
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn a_partial_another_program_holds_open_is_placed_once_it_is_let_go() {
+        let folder = folder("held-briefly");
+        let path = folder.join("video.mp4");
+        let partial = partial_path_of(&path);
+        fs::write(&partial, b"video").expect("written");
+        let other = held_open(&partial, std::time::Duration::from_millis(400));
+        let placed = finalize_file(&partial, &path);
+        other.join().expect("the other program lets go");
+        assert!(
+            matches!(placed, Finalization::Placed(Placed::Link)),
+            "{placed:?}"
+        );
+        assert_eq!(fs::read(&path).expect("there"), b"video");
+        assert!(!partial.exists());
+        let _ = fs::remove_dir_all(folder);
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn a_partial_held_open_past_the_wait_is_named_as_open_in_another_program() {
+        let folder = folder("held-long");
+        let path = folder.join("video.mp4");
+        let partial = partial_path_of(&path);
+        fs::write(&partial, b"video").expect("written");
+        let other = held_open(&partial, IN_USE_WAIT + std::time::Duration::from_secs(1));
+        let placed = finalize_file(&partial, &path);
+        other.join().expect("the other program lets go");
+        let Finalization::Failed(message) = placed else {
+            panic!("a source still held open is not removed: {placed:?}");
+        };
+        assert!(message.contains("is open in another program"), "{message}");
+        assert!(
+            message.contains(&partial.display().to_string()),
+            "{message}"
+        );
+        assert_eq!(fs::read(&path).expect("the video is in place"), b"video");
+        let _ = fs::remove_dir_all(folder);
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn a_copy_another_program_holds_open_is_renamed_once_it_is_let_go() {
+        let folder = folder("copy-held");
+        let path = folder.join("video.mp4");
+        let copying = copying_path_of(&path);
+        fs::write(&copying, b"whole").expect("written");
+        let other = held_open(&copying, std::time::Duration::from_millis(400));
+        rename_without_replacing(&copying, &path).expect("renamed once let go");
+        other.join().expect("the other program lets go");
+        assert_eq!(fs::read(&path).expect("there"), b"whole");
+        assert!(!copying.exists());
+        let _ = fs::remove_dir_all(folder);
+    }
 }