@rehearsal-labs/retest 0.2.0 → 0.3.0

package/dist/cli/install/install-archive.js

@@ -1,11 +1,12 @@
 import { constants } from 'node:fs';
-import { access, lstat, mkdir, readdir, rename, rm, writeFile } from 'node:fs/promises';
+import { access, lstat, mkdir, readdir, writeFile } from 'node:fs/promises';
 import { basename, dirname, join } from 'node:path';
 import { buildFolder, describePin, describePlatform, describeTreeProblems, fileSha256, inspectBuild, pinRefusal, readBundledLicence, readFileSha256, readLicences, recordFile, scanTree, treeFolder } from "../../browser/builds.js";
 import { folderChecksum } from "../../native/executors.js";
 import { processExists } from "../../native/processes.js";
 import { isMissingFile } from "../../shared/error-code.js";
 import { downloadFile, mirroredUrl, shownAddress } from "./download.js";
+import { removePath, renamePath } from "./file-changes.js";
 import { takeInstallLock } from "./lock.js";
 import { licenceLines, mirrorProblem } from "./report.js";
 import { unpackArchive } from "./unpack.js";
@@ -25,7 +26,9 @@ const unpackTimeoutMs = 10 * 60_000;
  * bit and links that stay inside it, and where the executable, the pinned files and every licence notice the pin names
  * must be present with their checksums. Only then is the record written and the staging folder renamed into place, so
  * a build folder always holds a finished, checked build, and the archive is deleted. A verified archive whose
- * unpacking failed is kept for the next attempt.
+ * unpacking failed is kept for the next attempt. A rename or removal that does not happen is never thrown: before the
+ * build is in place it ends the install with its reason, and once the build is in place the install stands and what
+ * was left behind is reported. On Windows each is tried again while a program holds a file open (`file-changes.ts`).
  *
  * @example await installArchive({ pin, folders, signal, tools: systemUnpackTools, platform: process.platform, version: retestVersion, report: console.log })
  */
@@ -63,36 +66,65 @@ async function installLocked(options, pinnedSha256) {
     const { pin, folders } = options;
     const folder = buildFolder(folders, pin);
     const archive = archivePath(folders, pin);
+    const changes = changeOptions(options);
     const before = await inspectBuild(pin, folders);
     if (before.state === 'installed') {
         // An archive a killed install left after renaming its build into place is of no further use.
-        await rm(archive, { force: true });
+        reportLeftover(options, archive, await removePath(archive, changes));
         return { ok: true, action: 'already_installed', inspection: before };
     }
     if (before.state !== 'missing')
         return refused(`${describePin(pin)} is in ${folder}, but not as recorded: ${before.problems.join(' ')} Remove ${folder} and run the install again.`);
-    await sweepStaging(folder);
-    await sweepPartials(dirname(archive));
+    await sweepStaging(folder, options);
+    await sweepPartials(dirname(archive), options);
     const obtained = await obtainArchive({ ...options, archive, sha256: pinnedSha256 });
     if (!obtained.ok)
         return obtained;
     const staging = `${folder}${stagingMark}${process.pid}`;
-    await rm(staging, { recursive: true, force: true });
+    const cleared = await removePath(staging, changes);
+    if (!cleared.ok)
+        return notChanged(`Retest could not clear its staging folder ${staging}: ${cleared.reason}. Nothing was installed.`, cleared);
+    let placed;
+    let cleanup;
     try {
-        const placed = await unpackAndRecord({ options, archive, staging, obtained });
-        if (!placed.ok)
-            return placed;
-        await rename(staging, folder);
+        placed = await placeBuild({ options, archive, staging, obtained }, folder);
     }
     finally {
-        await rm(staging, { recursive: true, force: true });
+        // A staging folder left behind is said, and never hides how the install itself ended.
+        cleanup = await removePath(staging, changes);
     }
-    await rm(archive, { force: true });
+    if (!placed.ok)
+        return cleanup.ok ? placed : { ...placed, message: `${placed.message} ${leftover(staging, cleanup)}` };
+    // The build is in place from here on: what is left to tidy is said, and the install stands.
+    reportLeftover(options, staging, cleanup);
+    reportLeftover(options, archive, await removePath(archive, changes));
     const after = await inspectBuild(pin, folders);
     if (after.state !== 'installed')
         return refused(`${describePin(pin)} was unpacked into ${folder}, then did not read as installed: ${after.problems.join(' ')}`);
     return { ok: true, action: 'installed', inspection: after };
 }
+// The unpacked, checked and recorded build, renamed from its staging folder to its own.
+async function placeBuild(placement, folder) {
+    const unpacked = await unpackAndRecord(placement);
+    if (!unpacked.ok)
+        return unpacked;
+    const moved = await renamePath(placement.staging, folder, changeOptions(placement.options));
+    return moved.ok ? moved : notChanged(`Retest could not move the unpacked build into ${folder}: ${moved.reason}. Nothing was installed.`, moved);
+}
+function changeOptions(options) {
+    return { platform: options.platform, signal: options.signal };
+}
+// A change that did not happen ends the install, as stopped when the install's signal ended it.
+function notChanged(message, settled) {
+    return { ok: false, message, stopped: settled.stopped };
+}
+function leftover(path, settled) {
+    return `Retest could not remove ${path}: ${settled.reason}. Remove it by hand.`;
+}
+function reportLeftover(options, path, settled) {
+    if (!settled.ok)
+        options.report(leftover(path, settled));
+}
 /**
  * The lock that keeps two installs of one build apart on this machine: a folder of its own beside the cache's builds,
  * which holds the lock's newest generations and stays there once made.
@@ -124,11 +156,17 @@ async function obtainArchive(options) {
         const size = (await lstat(archive)).size;
         return { ok: true, size, sha256, fetchedFrom: 'an earlier attempt' };
     }
-    if (kept.kind !== 'missing')
-        await rm(archive, { recursive: true, force: true });
+    const changes = changeOptions(options);
+    if (kept.kind !== 'missing') {
+        const removed = await removePath(archive, changes);
+        if (!removed.ok)
+            return notChanged(`Retest could not remove ${archive}, which is not the pinned archive: ${removed.reason}. Nothing was installed.`, removed);
+    }
     await mkdir(dirname(archive), { recursive: true });
     const partial = `${archive}${partialMark}${process.pid}`;
-    await rm(partial, { force: true });
+    const cleared = await removePath(partial, changes);
+    if (!cleared.ok)
+        return notChanged(`Retest could not clear ${partial} for the download: ${cleared.reason}. Nothing was installed.`, cleared);
     const size = pin.archive.size === undefined ? '' : ` (${formatBytes(pin.archive.size)})`;
     options.report(`Downloading ${describePin(pin)} for ${describePlatform(pin.platform)} from ${shownAddress(url)}${size}`);
     const downloaded = await downloadFile({
@@ -145,18 +183,24 @@ async function obtainArchive(options) {
     if (!downloaded.ok)
         return { ok: false, message: `${downloaded.message} Nothing was installed.`, stopped: downloaded.stopped };
     if (downloaded.sha256 !== sha256) {
-        await rm(partial, { force: true });
-        return refused(`The archive from ${shownAddress(url)} has SHA-256 ${downloaded.sha256}, not the pinned ${sha256}. It was deleted unread and nothing was installed.`);
+        const removed = await removePath(partial, changes);
+        const deleted = removed.ok ? 'It was deleted unread and nothing was installed.' : `Nothing was installed. ${leftover(partial, removed)}`;
+        return refused(`The archive from ${shownAddress(url)} has SHA-256 ${downloaded.sha256}, not the pinned ${sha256}. ${deleted}`);
+    }
+    const named = await renamePath(partial, archive, changes);
+    if (!named.ok) {
+        const removed = await removePath(partial, changes);
+        return notChanged(`Retest could not name the verified download ${archive}: ${named.reason}. Nothing was installed.${removed.ok ? '' : ` ${leftover(partial, removed)}`}`, named);
     }
-    await rename(partial, archive);
     options.report(`Verified: ${downloaded.size} bytes, SHA-256 ${sha256}`);
     // A redirect's query can be a signature, such as the one on a release asset's address, and is never recorded.
     return { ok: true, size: downloaded.size, sha256, fetchedFrom: shownAddress(downloaded.answeredBy) };
 }
 const partialMark = '.partial-';
 // Partial downloads left by installs whose process is gone are deleted; one whose process still runs is left to it,
-// and so is one of this process's, which may belong to another install it is running.
-async function sweepPartials(downloads) {
+// and so is one of this process's, which may belong to another install it is running. One that cannot be deleted is
+// said and left, since this install downloads to a name of its own.
+async function sweepPartials(downloads, options) {
     const names = await readdir(downloads).catch((error) => (isMissingFile(error) ? [] : Promise.reject(error)));
     for (const name of names) {
         const at = name.lastIndexOf(partialMark);
@@ -165,7 +209,7 @@ async function sweepPartials(downloads) {
         const pid = Number(name.slice(at + partialMark.length));
         if (!Number.isSafeInteger(pid) || pid <= 0 || pid === process.pid || mayStillRun(pid))
             continue;
-        await rm(join(downloads, name), { force: true });
+        reportLeftover(options, join(downloads, name), await removePath(join(downloads, name), changeOptions(options)));
     }
 }
 // Above any pid a system hands out; `process.kill` refuses even to ask about one.
@@ -186,21 +230,18 @@ async function unpackAndRecord({ options, archive, staging, obtained }) {
     const { pin } = options;
     const root = join(staging, treeFolder);
     await mkdir(root, { recursive: true });
-    const problem = await unpackArchive({ archive, format: pin.archive, into: root, platform: options.platform, tools: options.tools, signal: options.signal, timeoutMs: unpackTimeoutMs });
+    const problem = await unpackArchive({ archive, format: pin.archive, into: root, platform: options.platform, tools: options.tools, signal: options.signal, timeoutMs: unpackTimeoutMs, report: options.report });
     if (options.signal.aborted)
         return { ok: false, message: `The install was stopped while the archive was unpacked. The verified archive is kept at ${archive} for the next attempt.`, stopped: true };
     if (problem !== undefined)
         return refused(`${problem} The verified archive is kept at ${archive} for the next attempt.`);
     const noticesProblem = await copyBundledLicences(pin, root);
-    if (noticesProblem !== undefined) {
-        await rm(archive, { force: true });
-        return refused(`${noticesProblem} The archive was deleted and nothing was installed.`);
-    }
+    if (noticesProblem !== undefined)
+        return refused(`${noticesProblem} ${await deleteRefusedArchive(options, archive)}`);
     const checked = await checkUnpacked(pin, root);
     if (!checked.ok) {
-        await rm(archive, { force: true });
         const notices = checked.missing === undefined ? {} : { notices: { lead: `${describePin(pin)} lacks these licence notices, so Retest deleted its archive and installed nothing:`, files: checked.missing } };
-        return { ...refused(`${checked.message} The archive was deleted and nothing was installed.`), ...notices };
+        return { ...refused(`${checked.message} ${await deleteRefusedArchive(options, archive)}`), ...notices };
     }
     const record = {
         schemaVersion: 1,
@@ -220,8 +261,13 @@ async function unpackAndRecord({ options, archive, staging, obtained }) {
     };
     const temporary = join(staging, `${recordFile}.${process.pid}.tmp`);
     await writeFile(temporary, `${JSON.stringify(record, null, 2)}\n`);
-    await rename(temporary, join(staging, recordFile));
-    return { ok: true };
+    const recorded = await renamePath(temporary, join(staging, recordFile), changeOptions(options));
+    return recorded.ok ? recorded : notChanged(`Retest could not write the record of the unpacked build: ${recorded.reason}. Nothing was installed.`, recorded);
+}
+// An archive whose build was refused is deleted, and the sentence says whether it was.
+async function deleteRefusedArchive(options, archive) {
+    const removed = await removePath(archive, changeOptions(options));
+    return removed.ok ? 'The archive was deleted and nothing was installed.' : `Nothing was installed. ${leftover(archive, removed)}`;
 }
 /** Place only checked notice bytes into the private staging tree, before its licence and tree checks. */
 export async function copyBundledLicences(pin, root) {
@@ -303,8 +349,9 @@ function describeAbsence(reading) {
         return `SHA-256 ${reading.sha256 ?? ''}, not the pinned ${reading.file.sha256 ?? ''}`;
     return reading.state === 'missing' ? 'missing' : (reading.problem ?? 'not a file');
 }
-// Staging folders of installs whose process is gone are removed; one whose process still runs is left to it.
-async function sweepStaging(folder) {
+// Staging folders of installs whose process is gone are removed; one whose process still runs is left to it. One that
+// cannot be removed is said and left, since this install stages in a folder of its own.
+async function sweepStaging(folder, options) {
     const parent = dirname(folder);
     const prefix = `${basename(folder)}${stagingMark}`;
     const names = await readdir(parent).catch((error) => (isMissingFile(error) ? [] : Promise.reject(error)));
@@ -314,7 +361,7 @@ async function sweepStaging(folder) {
         const pid = Number(name.slice(prefix.length));
         if (Number.isSafeInteger(pid) && pid > 0 && pid !== process.pid && mayStillRun(pid))
             continue;
-        await rm(join(parent, name), { recursive: true, force: true });
+        reportLeftover(options, join(parent, name), await removePath(join(parent, name), changeOptions(options)));
     }
 }
 function refused(message) {

package/dist/cli/install/lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../../src/cli/install/lock.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAE5D,OAAO,KAAK,EAAW,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AA4B1F,+GAA+G;AAC/G,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAA;CAAE,CAAA;AAE9G,2FAA2F;AAC3F,KAAK,QAAQ,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,CAAA;AAE7E,yIAAyI;AACzI,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAA;CACjC,CAAA;AAED,wHAAwH;AACxH,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB,CAAA;AAyBD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,WAAW,CAAC,CA0B1G;AA8DD,mDAAmD;AACnD,MAAM,MAAM,OAAO,GACf;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvF;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7D;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,SAAS,CAAA;CAAE,GAAG,OAAO,GAAG,MAAM,CAclP"}
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../../src/cli/install/lock.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAG5D,OAAO,KAAK,EAAW,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAoC1F,+GAA+G;AAC/G,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAA;CAAE,CAAA;AAE9G,2FAA2F;AAC3F,KAAK,QAAQ,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,CAAA;AAE7E,yIAAyI;AACzI,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAA;CACjC,CAAA;AAED,wHAAwH;AACxH,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB,CAAA;AAyBD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,WAAW,CAAC,CA2B1G;AAoHD,mDAAmD;AACnD,MAAM,MAAM,OAAO,GACf;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvF;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7D;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,SAAS,CAAA;CAAE,GAAG,OAAO,GAAG,MAAM,CAclP"}

package/dist/cli/install/lock.js

@@ -1,5 +1,7 @@
 import { createHash, randomBytes } from 'node:crypto';
+import { constants } from 'node:fs';
 import { link, lstat, mkdir, open, readdir, rm } from 'node:fs/promises';
+import { setTimeout as sleep } from 'node:timers/promises';
 import { join } from 'node:path';
 import { processExists, systemTools } from "../../native/processes.js";
 import { errorMessage } from "../../protocol/failures.js";
@@ -7,6 +9,7 @@ import { parse, s } from "../../protocol/schema.js";
 import { errorCode } from "../../shared/error-code.js";
 import { entryKind, readRecordText } from "../../shared/regular-file.js";
 import { readProcessTableAsync } from "../../shared/process-ownership.js";
+import { launchesHeldByJob, readHeldProcess } from "../../shared/process-system.js";
 import { compareStarts, readMachine, startReader } from "./process-start.js";
 const generationSchema = s.object({
     version: s.literal(2),
@@ -14,7 +17,7 @@ const generationSchema = s.object({
     machine: s.string(),
     host: s.string(),
     pid: s.number({ integer: true, min: 1 }),
-    start: s.object({ clock: s.enum(['boot-ticks', 'utc-seconds']), value: s.number({ integer: true, min: 0 }) }),
+    start: s.object({ clock: s.enum(['boot-ticks', 'utc-seconds', 'held-file']), value: s.number({ integer: true, min: 0 }) }),
     since: s.string(),
     command: s.string(),
 });
@@ -40,6 +43,7 @@ export async function takeInstallLock(path, options = {}) {
     if (stoppedBy(signal))
         return stopped();
     const platform = options.platform ?? process.platform;
+    const held = platform === 'win32';
     const readStart = options.readStart ?? startReader({ platform, tools: options.tools ?? systemTools, signal });
     const folder = await lockFolder(path);
     if (folder !== undefined)
@@ -49,12 +53,12 @@ export async function takeInstallLock(path, options = {}) {
         return stopped();
     if (!machine.ok)
         return { ok: false, message: `${machine.problem} The install lock ${path} records which machine holds it, so Retest installs nothing without it.` };
-    const own = await readStart(process.pid);
+    const own = held ? { state: 'present', start: heldFileStart } : await readStart(process.pid);
     if (stoppedBy(signal))
         return stopped();
     if (own.state !== 'present')
         return { ok: false, message: `Retest could not read when this process started (${own.state === 'unreadable' ? own.problem : 'it is not listed'}). The install lock ${path} names its holder by its start, so Retest installs nothing without it.` };
-    const context = { path, machine: machine.machine, tag: machineTag(machine.machine), ownStart: own.start, readStart };
+    const context = { path, machine: machine.machine, tag: machineTag(machine.machine), ownStart: own.start, readStart, held };
     for (let attempt = 1; attempt <= attempts; attempt += 1) {
         if (stoppedBy(signal))
             return stopped();
@@ -75,6 +79,8 @@ export async function takeInstallLock(path, options = {}) {
 function stoppedBy(signal) {
     return signal?.aborted === true;
 }
+// What a holder on Windows records as its start: none, since its held file is what tells it alive.
+const heldFileStart = { clock: 'held-file', value: 0 };
 // One reading of the folder and, when the newest generation is free, one try at the next.
 async function tryOnce(context) {
     const { path } = context;
@@ -94,13 +100,21 @@ async function tryOnce(context) {
             if (legacy.machine !== undefined && legacy.machine !== context.machine.id)
                 return { kind: 'refused', message: `The install generation ${file} belongs to another machine or boot namespace, whose process table this machine cannot confirm. Remove ${file} once no install of this build is running there.` };
             try {
-                if ((await readProcessTableAsync()).some(entry => entry.pid === legacy.pid))
+                // Windows has no `ps`; there the pid is read through retest-supervisor, as every process is.
+                const present = launchesHeldByJob ? readHeldProcess(legacy.pid) !== undefined : (await readProcessTableAsync()).some(entry => entry.pid === legacy.pid);
+                if (present)
                     return { kind: 'refused', message: `Retest cannot confirm the recorded start time zone in the install generation ${file}; pid ${legacy.pid} is present. Remove ${file} once no install of this build is running.` };
             }
             catch (error) {
                 return { kind: 'refused', message: `Retest cannot confirm absence for install generation ${file}: ${errorMessage(error)}. Remove ${file} once no install of this build is running.` };
             }
         }
+        else if (context.held) {
+            const generation = reading.generation;
+            const decision = (await isReleased(path, newest, generation.token)) ? 'free' : await decideHeld(path, newest, generation, context);
+            if (decision !== 'free')
+                return { kind: 'refused', message: describeBlocker(path, newest, decision) };
+        }
         else {
             const generation = reading.generation;
             const released = await isReleased(path, newest, generation.token);
@@ -136,11 +150,59 @@ async function tryOnce(context) {
     // that is still the newest holds the lock.
     const after = await listGenerations(context);
     if (!after.ok || after.newest !== newest + 1) {
-        await release(path, newest + 1, made.token);
+        await release(path, newest + 1, made.token, made.hold);
         return after.ok ? { kind: 'again' } : { kind: 'refused', message: after.message };
     }
     await removeOldGenerations(path, newest + 1);
-    return { kind: 'held', lock: heldLock(path, newest + 1, made.token) };
+    return { kind: 'held', lock: heldLock(path, newest + 1, made.token, made.hold) };
+}
+// Held files this process holds open, by path, so its own generation reads as its own rather than as another holder's.
+const holding = new Set();
+// libuv's UV_FS_O_EXLOCK (uv/win.h): the file is opened sharing nothing, so every other open of it fails while this one
+// lasts. Node hands numeric flags to libuv as they are; only Windows reads this one.
+const openedAlone = 0x10000000;
+function holdName(number, token) {
+    return `${number}.${token}.held`;
+}
+/**
+ * Whether a generation on Windows leaves the lock free: its holder's held file opens, so nothing holds it any more. One
+ * that does not open is held, by this process or another; one that is missing, or cannot be read, proves nothing.
+ */
+async function decideHeld(path, number, generation, context) {
+    if (generation.machine !== context.machine.id)
+        return { kind: 'foreign', generation };
+    const file = join(path, holdName(number, generation.token));
+    if (holding.has(file))
+        return { kind: 'self', generation };
+    const probe = await probeHeldFile(file);
+    if (probe === 'free')
+        return 'free';
+    if (probe === 'held')
+        return { kind: 'running', generation };
+    return { kind: 'unknown', generation, problem: probe === 'missing' ? `its held file ${file} is missing` : probe.problem };
+}
+// A held file that opens alone is held by no one. A virus scanner may hold it for a moment, so one that will not open is
+// asked again a few times before it counts as held.
+async function probeHeldFile(file) {
+    for (let attempt = 1;; attempt += 1) {
+        let handle;
+        try {
+            handle = await open(file, constants.O_RDONLY | openedAlone);
+        }
+        catch (error) {
+            const code = errorCode(error);
+            if (code === 'ENOENT')
+                return 'missing';
+            if (code !== 'EBUSY')
+                return { problem: `${file} cannot be opened: ${errorMessage(error)}` };
+            if (attempt >= 3)
+                return 'held';
+            await sleep(20);
+            continue;
+        }
+        await handle.close();
+        return 'free';
+    }
 }
 /**
  * Whether a generation leaves the lock free, as a taker on `machine` reads it: let go; or held by this machine's
@@ -258,13 +320,19 @@ async function makeGeneration(context, number) {
     const token = randomBytes(16).toString('hex');
     const generation = { version: 2, token, machine: context.machine.id, host: context.machine.host, pid: process.pid, start: context.ownStart, since: new Date().toISOString(), command: holderCommand() };
     const temporary = join(path, `.${context.tag}-${process.pid}-${randomBytes(8).toString('hex')}.tmp`);
+    let hold;
     try {
+        // The held file is open before the generation that names it exists, so no taker ever reads it as let go.
+        if (context.held)
+            hold = await holdFile(join(path, holdName(number, token)));
         await writeDurably(temporary, `${JSON.stringify(generation)}\n`);
         await link(temporary, join(path, `${number}.json`));
         await syncFolder(path);
-        return { kind: 'made', token };
+        return { kind: 'made', token, hold };
     }
     catch (error) {
+        if (hold !== undefined)
+            await letGo(hold, { remove: true });
         if (errorCode(error) === 'EEXIST')
             return { kind: 'taken' };
         return { kind: 'failed', message: `Retest could not take the install lock ${path}: ${errorMessage(error)}.` };
@@ -273,25 +341,44 @@ async function makeGeneration(context, number) {
         await rm(temporary, { force: true }).catch(() => undefined);
     }
 }
-function heldLock(path, number, token) {
+async function holdFile(file) {
+    const handle = await open(file, constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | openedAlone);
+    holding.add(file);
+    return { file, handle };
+}
+// Closing the file is what tells other processes this holder let go; removing it is only tidying.
+async function letGo(hold, { remove }) {
+    holding.delete(hold.file);
+    await hold.handle.close().catch(() => undefined);
+    if (remove)
+        await rm(hold.file, { force: true }).catch(() => undefined);
+}
+function heldLock(path, number, token, hold) {
     let releasing;
-    return { ok: true, release: () => (releasing ??= release(path, number, token)) };
+    return { ok: true, release: () => (releasing ??= release(path, number, token, hold)) };
 }
 // Lets go of generation `number` only while it is still this holder's, by its token: a folder removed and made again
-// meanwhile holds another process's generation under that number, which this release must not free.
-async function release(path, number, token) {
-    const reading = await readGeneration(path, number);
-    if (reading.kind !== 'found' || reading.generation.token !== token)
-        return `The install lock ${path} no longer holds this process's generation ${number}, so nothing there was let go.`;
+// meanwhile holds another process's generation under that number, which this release must not free. A held file is
+// closed after the released mark is written, and whatever the release met, since a holder that let go holds nothing.
+async function release(path, number, token, hold) {
     try {
-        await writeDurably(join(path, releasedName(number, token)), `${token}\n`);
-        await syncFolder(path);
-        return undefined;
-    }
-    catch (error) {
-        if (errorCode(error) === 'EEXIST')
+        const reading = await readGeneration(path, number);
+        if (reading.kind !== 'found' || reading.generation.token !== token)
+            return `The install lock ${path} no longer holds this process's generation ${number}, so nothing there was let go.`;
+        try {
+            await writeDurably(join(path, releasedName(number, token)), `${token}\n`);
+            await syncFolder(path);
             return undefined;
-        return `The install lock ${path} was not let go: ${errorMessage(error)}. The next install passes it over once this process has ended.`;
+        }
+        catch (error) {
+            if (errorCode(error) === 'EEXIST')
+                return undefined;
+            return `The install lock ${path} was not let go: ${errorMessage(error)}. The next install passes it over once this process has ended.`;
+        }
+    }
+    finally {
+        if (hold !== undefined)
+            await letGo(hold, { remove: false });
     }
 }
 // Keeps the newest generation and the one before it, which a taker may still be reading, and removes the rest. A file

package/dist/cli/install/media-doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media-doctor.d.ts","sourceRoot":"","sources":["../../../src/cli/install/media-doctor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAKxD,sGAAsG;AACtG,wBAAsB,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAGnH;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAkClG;AAED,qGAAqG;AACrG,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMrD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMxF"}
+{"version":3,"file":"media-doctor.d.ts","sourceRoot":"","sources":["../../../src/cli/install/media-doctor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAMxD,sGAAsG;AACtG,wBAAsB,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAGnH;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAkClG;AAED,qGAAqG;AACrG,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMrD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMxF"}

package/dist/cli/install/media-doctor.js

@@ -1,3 +1,4 @@
+import { notAnEncoder } from "../../media/host.js";
 import { locateFfmpeg, ffmpegFix, locateMedia } from "../../media/locate.js";
 import { mediaTarget, minimumRust } from "./media-pins.js";
 import { findMediaTool, probeMediaBinary, rustAtLeast, runMediaTool, rustFix } from "./media-tools.js";
@@ -11,7 +12,7 @@ export async function mediaDoctorRows(env, signal) {
     const checks = [];
     if (signal.aborted)
         return [{ group: 'media', subject: 'retest-media', ok: false, text: 'The media check was stopped.', fix: rustFix }];
-    const found = await locateMedia({ env, ffmpeg: '/usr/bin/false', signal });
+    const found = await locateMedia({ env, ffmpeg: notAnEncoder, signal });
     checks.push(found.ok
         ? { group: 'media', subject: 'retest-media', ok: true, text: `retest-media ${found.hello.version}, protocol ${found.hello.protocol}, from ${found.source}; source builds need Rust 1.88 or later, edition 2024 needs Rust 1.85 or later${found.inspection?.record === undefined ? '; no cache record for this explicit binary' : `; SHA-256 ${found.inspection.record.binarySha256} matches its record`}`, detail: found.executable, fix: rustFix }
         : { group: 'media', subject: 'retest-media', ok: false, text: found.message, fix: 'Run npx retest install media. For an explicit release binary set RETEST_MEDIA_BINARY.' });

package/dist/cli/install/media-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media-install.d.ts","sourceRoot":"","sources":["../../../src/cli/install/media-install.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,KAAK,EAAE,eAAe,EAAe,MAAM,mBAAmB,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAgBpE,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/H,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IACtG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,eAAe,CAAA;CAC1I,CAAA;AACD,MAAM,MAAM,kBAAkB,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,mBAAmB,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAA;AAE9N,yHAAyH;AACzH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsC5F"}
+{"version":3,"file":"media-install.d.ts","sourceRoot":"","sources":["../../../src/cli/install/media-install.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,KAAK,EAAE,eAAe,EAAe,MAAM,mBAAmB,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAkBpE,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/H,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IACtG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,eAAe,CAAA;CAC1I,CAAA;AACD,MAAM,MAAM,kBAAkB,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,mBAAmB,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAA;AAE9N,yHAAyH;AACzH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA6C5F"}

package/dist/cli/install/media-install.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { chmod, mkdir, rename, rm, writeFile } from 'node:fs/promises';
+import { chmod, mkdir, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { MEDIA_PROTOCOL_VERSION } from "../../media/protocol.js";
 import { describeCommand } from "../../native/processes.js";
@@ -7,9 +7,11 @@ import { errorMessage } from "../../protocol/failures.js";
 import { Deadline } from "../../protocol/deadline.js";
 import { openRegularFile, readFileSha256, readRecordText } from "../../shared/regular-file.js";
 import { downloadFile, mirroredUrl } from "./download.js";
+import { removePath, renamePath } from "./file-changes.js";
 import { takeInstallLock } from "./lock.js";
+import { mediaBuildFolder, notAnEncoder } from "../../media/host.js";
 import { checkMediaSource, inspectMedia, mediaFolder, mediaLockPath, mediaNoticePins, mediaPackageRoot } from "./media-record.js";
-import { maximumMediaBinaryBytes, mediaPrebuiltPins, mediaSourceDigest, mediaSourceFiles, mediaTarget, mediaVersion } from "./media-pins.js";
+import { maximumMediaBinaryBytes, mediaExecutableName, mediaPrebuiltPins, mediaSourceDigest, mediaSourceFiles, mediaTarget, mediaVersion } from "./media-pins.js";
 import { probeMediaBinary, readRustTools, runMediaTool } from "./media-tools.js";
 import { mirrorProblem } from "./report.js";
 /** Explicit source build or exactly pinned prebuilt. Uses the current install lock and never repairs a damaged cache. */
@@ -17,7 +19,7 @@ export async function installMedia(options) {
     const refuse = (message) => ({ ok: false, message, stopped: options.signal.aborted });
     const target = options.target ?? mediaTarget();
     if (target === undefined)
-        return refuse(`No media build path for ${process.platform} ${process.arch}. macOS arm64 is exercised; Linux x64 is planned and unverified.`);
+        return refuse(`Retest builds retest-media for macOS arm64, Linux x64 and Windows x64, and this machine is ${process.platform} ${process.arch}.`);
     const pins = options.pins ?? mediaPrebuiltPins;
     const prebuilt = options.binary !== undefined || options.mirror !== undefined;
     const pin = prebuilt ? pins.find((candidate) => candidate.target === target && candidate.version === mediaVersion && candidate.protocol === MEDIA_PROTOCOL_VERSION && candidate.sourceDigest === mediaSourceDigest) : undefined;
@@ -43,18 +45,24 @@ export async function installMedia(options) {
     let result;
     let cleanupProblem;
     const staging = `${folder}.staging-${process.pid}-${randomUUID()}`;
+    const build = mediaBuildFolder(staging);
     try {
-        result = await installLocked(options, target, folder, root, staging, pin);
+        result = await installLocked(options, target, folder, root, staging, build, pin);
     }
     catch (error) {
         result = refuse(`Media install failed: ${errorMessage(error)} Nothing was installed.`);
     }
     finally {
         try {
-            await rm(staging, { recursive: true, force: true });
-        }
-        catch (error) {
-            cleanupProblem = `Media staging cleanup failed at ${staging}: ${errorMessage(error)}.`;
+            // A removal settles without throwing, so the staging folder is removed even when the build folder could not be.
+            const problems = [];
+            for (const path of [build, staging]) {
+                const removed = await removePath(path, changeOptions(options));
+                if (!removed.ok)
+                    problems.push(`Media staging cleanup failed at ${path}: ${removed.reason}.`);
+            }
+            if (problems.length > 0)
+                cleanupProblem = problems.join(' ');
         }
         finally {
             const problem = await lock.release();
@@ -68,7 +76,7 @@ export async function installMedia(options) {
             : { ...result, message: `${result.message} ${cleanupProblem}` };
     return result;
 }
-async function installLocked(options, target, folder, root, staging, pin) {
+async function installLocked(options, target, folder, root, staging, build, pin) {
     const refuse = (message) => ({ ok: false, message, stopped: options.signal.aborted });
     const before = await inspectMedia(options.env, { target, pins: options.pins ?? mediaPrebuiltPins, verify: true, signal: options.signal });
     if (before?.state === 'installed')
@@ -79,7 +87,7 @@ async function installLocked(options, target, folder, root, staging, pin) {
         return refuse('Media install was stopped before it built or copied anything.');
     let rustcVersion = null;
     await mkdir(staging, { recursive: true });
-    const executable = join(staging, 'retest-media');
+    const executable = join(staging, mediaExecutableName(target));
     if (pin === undefined) {
         const run = options.run ?? runMediaTool;
         const tools = await readRustTools(options.env, options.signal, run);
@@ -101,20 +109,24 @@ async function installLocked(options, target, folder, root, staging, pin) {
         const copiedProblem = await checkMediaSource(source, { signal: options.signal });
         if (copiedProblem !== undefined)
             return refuse(copiedProblem);
-        const targetDir = join(staging, 'target');
-        const args = ['build', '--release', '--locked', ...(options.offline === true ? ['--offline'] : []), '--manifest-path', join(source, 'media', 'Cargo.toml'), '--target', target, '--target-dir', targetDir];
+        const args = ['build', '--release', '--locked', ...(options.offline === true ? ['--offline'] : []), '--manifest-path', join(source, 'media', 'Cargo.toml'), '--target', target, '--target-dir', build];
         options.report(`Building retest-media ${mediaVersion} with ${tools.rustcVersion}; Cargo.lock is pinned. ffmpeg is a separate host prerequisite.`);
-        const built = await run(tools.cargo, args, { env: options.env, signal: options.signal, cwd: source, timeoutMs: 30 * 60_000, environment: { RUSTC: tools.rustc, CARGO_TARGET_DIR: targetDir } });
+        const built = await run(tools.cargo, args, { env: options.env, signal: options.signal, cwd: source, timeoutMs: 30 * 60_000, environment: { RUSTC: tools.rustc, CARGO_TARGET_DIR: build } });
         const afterProblem = await checkMediaSource(source, { signal: options.signal });
         if (afterProblem !== undefined)
             return refuse(`The build changed the pinned source or Cargo.lock. ${afterProblem}`);
+        // Cargo's last line only says the build failed; its first error says why.
+        const cause = built.stderr.split('\n').find((line) => line.startsWith('error')) ?? '';
         if (built.code !== 0 || built.stopped || built.timedOut || built.cleanupProblems.length > 0)
-            return refuse(`${describeCommand('cargo build --release --locked', built)}. Nothing was installed.`);
-        const placed = await copyRegularBinary(join(targetDir, target, 'release', 'retest-media'), executable);
+            return refuse(`${describeCommand('cargo build --release --locked', built)}.${cause === '' ? '' : ` ${cause.slice(0, 300)}`} Nothing was installed.`);
+        const placed = await copyRegularBinary(join(build, target, 'release', mediaExecutableName(target)), executable);
         if (placed !== undefined)
             return refuse(placed);
-        await rm(source, { recursive: true });
-        await rm(targetDir, { recursive: true });
+        for (const path of [source, build]) {
+            const removed = await removePath(path, changeOptions(options));
+            if (!removed.ok)
+                return refuse(`Retest could not remove ${path} after the build: ${removed.reason}. Nothing was installed.`);
+        }
     }
     else {
         if (options.binary !== undefined) {
@@ -136,7 +148,7 @@ async function installLocked(options, target, folder, root, staging, pin) {
     if (options.signal.aborted)
         return refuse('Media install was stopped before the binary probe. Nothing was installed.');
     await chmod(executable, 0o755);
-    const probe = await probeMediaBinary(executable, '/usr/bin/false', target);
+    const probe = await probeMediaBinary(executable, notAnEncoder, target);
     if (!probe.ok)
         return refuse(probe.message);
     if (options.signal.aborted)
@@ -157,10 +169,17 @@ async function installLocked(options, target, folder, root, staging, pin) {
         return refuse(sourceProblem);
     const record = { schemaVersion: 1, version: mediaVersion, protocol: MEDIA_PROTOCOL_VERSION, sourceDigest: mediaSourceDigest, target, method: pin === undefined ? 'source' : 'prebuilt', rustcVersion, binarySha256: hash.sha256, notices: mediaNoticePins(), installedAt: new Date().toISOString(), installedBy: options.version };
     await writeFile(join(staging, 'build.json'), `${JSON.stringify(record, null, 2)}\n`, { flag: 'wx' });
-    await rename(staging, folder);
+    const moved = await renamePath(staging, folder, changeOptions(options));
+    if (!moved.ok)
+        return refuse(`Retest could not move the built media folder into ${folder}: ${moved.reason}. Nothing was installed.`);
     const after = await inspectMedia(options.env, { target, pins: options.pins ?? mediaPrebuiltPins, verify: true, signal: options.signal });
     return after?.state === 'installed' ? { ok: true, action: 'installed', inspection: after } : refuse(`The media folder did not read as installed: ${after?.problems.join(' ') ?? 'no cache'}.`);
 }
+// Windows refuses to rename or remove a file a virus scanner holds open, as it does a freshly built retest-media.exe, so
+// each change the install makes in the cache is tried again there for a while.
+function changeOptions(options) {
+    return { platform: process.platform, signal: options.signal };
+}
 async function copyRegularBinary(from, to, expectedSize) {
     const opened = await openRegularFile(from);
     if (opened.kind !== 'opened')