throughline 0.6.2 → 0.6.3

package/CHANGELOG.md

@@ -10,7 +10,21 @@ shipped to npm but were not individually tagged on GitHub.
 
 ## [Unreleased]
 
-## [0.6.2] — release candidate (pending)
+### Fixed
+
+- `throughline factory-diagnostics --json` now reports the Codex hook summary
+  as `ready` when all three canonical managed hooks are ready. The Codex-only
+  overall aggregate no longer treats the separately exposed, uninspected
+  Claude connector as a blocking `unverified` state. The Claude connector
+  remains explicitly `unverified`; diagnostic output remains read-only and
+  privacy-safe.
+- Windows runtime-error mutations no longer repeat identical PowerShell ACL
+  verification inside one bounded observation. Existing lock/store files are
+  still verified before use, new temporary files receive an exact
+  current-SID-only ACL before atomic replacement, and the five-second hook
+  observer deadline is unchanged.
+
+## [0.6.2] — 2026-07-13
 
 ### Added
 
@@ -22,9 +36,9 @@ shipped to npm but were not individually tagged on GitHub.
   owner-private atomic store with count, first/last seen, resolve/reopen,
   monotonic cursor/ack, retention that preserves unacknowledged records, and
   bounded `throughline runtime-errors ... --json` snapshot/diagnostics APIs.
-- Release candidate only: collection remains disabled by default and the local
-  store sends no network traffic. Publication, tag, CI, and registry-install
-  verification are pending.
+- Collection remains disabled by default and the local store sends no network
+  traffic. Public commit `e6ce6e3`, CI `29238704750`, npm `latest`, tag / GitHub
+  Release, and a registry-derived isolated install were verified.
 - Raised the Node.js floor to 22.13, where `node:sqlite` is available without
   an experimental command-line flag; CI now exercises that exact minimum.
 

package/README.md

@@ -716,10 +716,13 @@ entry to the `tasks` array yourself:
 
 ## Commands
 
-**v0.6.2 は release candidate（公開待ち）です。** factory diagnostics と local
-runtime error aggregate は collection が既定OFFで、canonical dotagents config の
+**v0.6.3 はリリース準備中です。** factory diagnostics は Codex の managed
+`UserPromptSubmit` / `PostToolUse` / `Stop` hooks がすべて canonical `ready` の場合に
+Codex readiness を `ready` と返す。Claude connector は未検査のまま明示的に
+`unverified` とし、Codex-only overall を妨げない。local runtime error
+aggregate は collection が既定OFFで、canonical dotagents config の
 `collection.enabled: true` を明示した場合だけ収集します。いずれも network I/O は
-行いません。npm公開、tag、CI、registry由来installの確認は未完了です。
+行いません。v0.6.3 の npm publish、tag、GitHub Release は未実施です。
 
 | Command                                        | What it does                                                 |
 | ---------------------------------------------- | ------------------------------------------------------------ |

package/docs/04_public_release_plan.md

@@ -138,7 +138,7 @@ schema v4 で PostToolUse (`capture-tool`) は廃止、L2/L3 は Stop 内で一
 | **npm 公開 (v0.4.1): typed `/clear` も baton を書く + 2 経路の優先順位入れ替え** | 2026-05-09 `/clear` を UserPromptSubmit hook で検出した時点で当該セッションの `session_id` を `handoff_batons` に書き込み、次 SessionStart が確定的にそのセッションを引き継ぐ。これで multi-window で「最新更新セッション ≠ /clear したセッション」になるシナリオで `findLatestClaudePredecessor` heuristic が誤った前任を選ぶ問題を解消。2 経路の優先順位を **baton path = primary、auto path = fallback** に変更 (auto path は VSCode 拡張メニュー由来など UserPromptSubmit に届かない経路のフォールバック)。`THROUGHLINE_DISABLE_AUTO_HANDOFF=1` は fallback path のみに作用するようになった (typed `/clear` / `/tl` は env と無関係に発火する)。あわせて `.vscode/tasks.json` を git 追跡から外し (gitignore)、`ensureMonitorTaskFile` が hook 発火ごとに絶対パスを書き換える挙動による別環境での dirty diff を解消。`src/prompt-submit.test.mjs` を新設し、`isClearCommand` / `isBatonCommand` 判定 14 件と subprocess+DB 実体テスト 3 件を追加。詳細は [CHANGELOG.md](../CHANGELOG.md) |
 | **npm 公開 (v0.4.7): Codex monitor direct discovery + 80% auto-refresh** | 2026-05-09 Codex Stop hook auto-refresh の verified usage threshold を 90% から 80% に変更し、Codex native auto-compact より先に Throughline DB memory refresh を試行する。estimate usage / estimated context window では mutation しない。`throughline monitor` は `~/.throughline/state` に加えて `~/.codex/sessions/**/rollout-*.jsonl` を直接 discovery し、Throughline state が未生成の現在 Codex thread も表示する。既存 state がある場合は state の usage snapshot を保持しつつ discovered rollout path / mtime を合流する。Codex 表示 ID は `codex:01` ではなく raw thread id 先頭 8 桁 (`019e085c`) にした。Codex open turn の transient `output_tokens` は token count に overlay するが、モデル欄の `live+<tokens>` marker は表示しない |
 | **npm 公開 (v0.6.1): Spotter auditor context projection** | `throughline auditor-context`を追加。exact session/projectと最新完了L2 pairのorigin/turn/hash freshnessを検査し、fresh時だけbounded user/assistant本文をversioned JSONで返す。DBはread-onlyで開き、作成・migration・WAL書き込みをしない。Spotter側はproject opt-inでのみ利用する。580 tests、CI 6/6、pack scan、registry global install / doctorを通過し、npm / tag / GitHub Releaseを2026-07-13に公開した |
-| **v0.6.2 release candidate（公開待ち）: factory diagnostics + local runtime error store** | `throughline factory-diagnostics --json` と `throughline runtime-errors ... --json` を公開候補へ同期する。collection は canonical dotagents config の `collection.enabled: true` が明示された時だけ有効で既定OFF、store は network I/O を行わない。npm公開、tag、CI、registry由来installの確認はこの時点で未実施であり、公開済みとは扱わない |
+| **npm 公開 (v0.6.2): factory diagnostics + local runtime error store** | `throughline factory-diagnostics --json` と `throughline runtime-errors ... --json` を追加。collection は canonical dotagents config の `collection.enabled: true` が明示された時だけ有効で既定OFF、store は network I/O を行わない。公開commit `e6ce6e3`、CI `29238704750`、npm `latest`、tag / GitHub Release、registry由来隔離installと診断snapshotを2026-07-13に確認した |
 | **未リリース: Codex current-session 75% trigger** | Codex 自動発火を token-monitor に依存させず、global install が Codex `UserPromptSubmit` / `PostToolUse` hooks も登録する。hook は当該 Codex session の rollout `token_count` を直接読み、verified 75% 以上なら同じ user turn または tool loop 継続前に `$throughline` workflow 実行指示を `additionalContext` で注入する。Stop hook の guarded auto-refresh は残す。`~/.codex/config.toml` は旧 `codex_hooks = true` に加えて現行 `hooks = true` も有効化する |
 | **グローバル E2E 検証** | 2026-04-17 別ディレクトリから `throughline doctor` 全緑を確認 |
 

package/docs/13_native_factory_diagnostics_plan.md

@@ -23,8 +23,10 @@ session の本文、秘密、絶対パス、例外詳細を出力しない。
   検証する。handoff memoryは一致確認済みproject/threadだけを数える。
 - restore capabilityとlive smoke evidenceを分離する。未実行smokeは`unverified`だが、
   capability readinessを恒常的に失敗扱いにはしない。
-- Codex hookはcanonical shapeを検査するが、trust実火は機械検証不能なので`unverified`に
-  留める。Claude connectorはこの単位では未検査として明示`unverified`にする。
+- Codex hook は canonical shape を検査し、3 managed event がすべて `ready` なら hook
+  summary も `ready` とする。trust 実火はこの read-only projection の判定対象外であり、
+  Claude connector はこの単位では未検査として明示 `unverified` にする。ただし後者は
+  Codex-only overall を阻害しない。
 
 ## 実施 TODO
 

package/docs/BUGHUB_RUNTIME_ERROR_STORE_PLAN.md

@@ -1,6 +1,6 @@
 # BugHub runtime error store plan
 
-Status: implementation complete; v0.6.2 release pending
+Status: v0.6.2 complete; v0.6.3 Windows bounded-observer hardening in progress
 
 This plan is the implementation TODO for Throughline's product-owned, local
 runtime error projection. It implements the cross-repository contract in
@@ -43,10 +43,31 @@ existing transcript, handoff, or SQLite memory contracts.
 - [x] Run the complete test suite and update product documentation.
 - [x] Commit and push this repository independently.
 
+### v0.6.3 Windows bounded-observer hardening
+
+- [x] Reproduce the public-CI failure where a cold Windows Node 24 observer
+      exceeded the five-second product deadline while starting several
+      PowerShell ACL apply/verify processes.
+- [x] Characterize the current-SID-only directory, SQLite lock, existing
+      store, unique temporary file, atomic replacement, and five-second
+      no-fallback contract before changing the implementation.
+- [x] Bound one mutation to the minimum distinct ACL transitions: apply plus
+      read-back for a private directory and each newly created file, and one
+      read-before-use verification for an existing lock/store. Carry a private
+      in-process directory capability so unchanged paths are not rechecked by
+      another PowerShell process in the same mutation.
+- [x] Keep malformed/symlink/ACL-drift state fail-loud, leave no late child or
+      partial final store after failure, and do not extend the product deadline.
+- [x] Keep the production 3-second ACL and 5-second observer bounds unchanged,
+      but serialize Windows CI test files so parallel PowerShell fixture load
+      cannot consume those bounds before the contract under test runs.
+- [ ] Run focused Windows matrix tests, the complete suite, pack inspection,
+      registry-derived smoke, and the public Node 22/24 CI matrix before publish.
+
 ## Release wave
 
 - [x] Bump the package and release-facing documentation to `0.6.2` without moving an existing tag.
 - [x] Run the full test suite, pack inspection, secret/path scan, and temporary-prefix install smoke.
-- [ ] Push the release commit and require the public CI gate to pass.
-- [ ] After the owner H gate, publish `throughline@0.6.2`, create tag/release, and verify npm `latest` plus a registry-derived global install.
-- [ ] Confirm `throughline factory-diagnostics --json` and the runtime-error snapshot/ack commands from the published package, then record the public SHA and results in the changelog and canonical docs.
+- [x] Push the release commit and require the public CI gate to pass (`e6ce6e3`, CI `29238704750`).
+- [x] After the owner H gate, publish `throughline@0.6.2`, create tag/release, and verify npm `latest` plus a registry-derived isolated install. Global installation is deferred to the dotagents Mac rollout wave.
+- [x] Confirm `throughline factory-diagnostics --json` and the runtime-error snapshot from the published package, then record the public SHA and results in the changelog and canonical docs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "throughline",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "type": "module",
   "description": "Claude Code hooks plugin for structured context compression (/clear-safe persistent memory)",
   "keywords": [

package/src/cli/factory-diagnostics.mjs

@@ -163,9 +163,11 @@ export function inspectFactoryHooks({ codexHome = defaultCodexHome(), readHooks
     return {
       status: values.includes('not_ready')
         ? 'not_ready'
-        : values.includes('ready')
+        : values.includes('unverified')
           ? 'unverified'
-          : 'not_applicable',
+          : values.includes('ready')
+            ? 'ready'
+            : 'not_applicable',
       reason: 'hooks_inspected',
       events,
     };

package/src/cli/factory-diagnostics.test.mjs

@@ -168,6 +168,31 @@ test('factory-diagnostics hook inspection rejects corrupt and false-ready shapes
   assert.equal(malformed.status, 'not_ready');
 });
 
+test('factory-diagnostics hook inspection summarizes every canonical ready event as ready', () => {
+  const result = inspectFactoryHooks({
+    readHooks: () => ({
+      configExists: true,
+      configReadable: true,
+      hooksExists: true,
+      hooksReadable: true,
+      featureEnabled: true,
+      expectedPromptCommand: 'prompt',
+      expectedPostToolUseCommand: 'post',
+      expectedStopCommand: 'stop',
+      managedPromptHooks: [{ type: 'command', command: 'prompt', timeoutSec: 30, async: false }],
+      legacyManagedPromptHooks: [],
+      managedPostToolUseHooks: [{ type: 'command', command: 'post', timeoutSec: 30, async: false }],
+      legacyManagedPostToolUseHooks: [],
+      managedStopHooks: [{ type: 'command', command: 'stop', timeoutSec: 300, async: false }],
+      legacyManagedStopHooks: [],
+    }),
+  });
+
+  assert.deepEqual(result.events, { userPromptSubmit: 'ready', postToolUse: 'ready', stop: 'ready' });
+  assert.equal(result.status, 'ready');
+  assert.equal(result.reason, 'hooks_inspected');
+});
+
 function createFactorySchema(db) {
   db.exec(`
     PRAGMA user_version = 8;

package/src/factory-diagnostics.mjs

@@ -77,7 +77,6 @@ export function buildFactoryDiagnostics({ version, database = {}, hooks = {}, th
       status: aggregate([
         stateSchemaStatus,
         hooksStatus,
-        claudeConnectorStatus,
         captureStatus,
         restoreStatus,
         handoffStatus,

package/src/factory-diagnostics.test.mjs

@@ -45,6 +45,24 @@ test('factory diagnostics: restore は実行していない smoke を ready に
   assert.equal(result.overall.status, 'ready');
 });
 
+test('factory diagnostics: Claude connector 未検査は Codex-only ready snapshot を unverified にしない', () => {
+  const result = buildFactoryDiagnostics({
+    version: '0.6.2',
+    database: { status: 'ready', schemaVersion: 8, supportedSchemaVersion: 8, handoffMemory: true },
+    hooks: {
+      status: 'ready',
+      events: { userPromptSubmit: 'ready', postToolUse: 'ready', stop: 'ready' },
+    },
+    thread: { status: 'ready', rolloutAvailable: true },
+  });
+
+  assert.equal(result.hooks.status, 'ready');
+  assert.equal(result.connectors.codex.status, 'ready');
+  assert.equal(result.connectors.claude.status, 'unverified');
+  assert.equal(result.connectors.claude.reason, 'diagnostic_unverified');
+  assert.equal(result.overall.status, 'ready');
+});
+
 test('factory diagnostics: JSON に本文、秘密、絶対 path、生 state を含めない', () => {
   const secret = 'sk-test-very-secret';
   const body = 'ユーザーの prompt 本文';

package/src/runtime-error-store.mjs

@@ -9,7 +9,7 @@ import {
   rmSync,
   writeFileSync,
 } from 'node:fs';
-import { spawnSync } from 'node:child_process';
+import childProcess from 'node:child_process';
 import { arch as hostArch, homedir, platform as hostPlatform } from 'node:os';
 import { dirname, join } from 'node:path';
 import { createRequire } from 'node:module';
@@ -27,6 +27,7 @@ const BEST_EFFORT_TIMEOUT_MS = 750;
 const WINDOWS_BEST_EFFORT_TIMEOUT_MS = 5_000;
 const WINDOWS_ACL_TIMEOUT_MS = 3_000;
 const RESOLUTION_REASONS = new Set(['manual', 'recovered']);
+const PRIVATE_DIRECTORY_CAPABILITY = Symbol('throughline.private-directory');
 
 const DEFINITIONS = Object.freeze({
   HOOK_SESSION_START_FAILED: Object.freeze({
@@ -86,13 +87,13 @@ export function observeRuntimeError(input, options = {}) {
   if (!definition) throw new TypeError('未登録の runtime error code です');
   if (!collectionEnabled(options)) return { status: 'disabled' };
 
-  return withStoreLock(options, () => {
+  return withStoreLock(options, (privateDirectory) => {
     const now = normalizeTimestamp(input.now);
     const version = normalizeVersion(options.version ?? PACKAGE_VERSION);
     const fingerprint = createHash('sha256')
       .update(['throughline', definition.component, input.code, definition.template].join('\0'))
       .digest('hex');
-    const store = readStore(options);
+    const store = readStore(options, { privateDirectory });
     const existing = store.records.find((record) => record.fingerprint === fingerprint);
     const sequence = nextSequence(store);
     if (existing) {
@@ -115,7 +116,7 @@ export function observeRuntimeError(input, options = {}) {
         status: 'open', resolved_at: null, reason_code: null, sequence,
       });
     }
-    writeStore(store, options);
+    writeStore(store, options, privateDirectory);
     return { status: 'recorded', fingerprint, sequence };
   });
 }
@@ -124,8 +125,8 @@ export function resolveRuntimeError(fingerprint, options = {}) {
   assertExactOptions(options, ['env', 'configPath', 'storePath', 'now', 'reasonCode']);
   assertFingerprint(fingerprint);
   if (!collectionEnabled(options)) return { status: 'disabled' };
-  return withStoreLock(options, () => {
-    const store = readStore(options);
+  return withStoreLock(options, (privateDirectory) => {
+    const store = readStore(options, { privateDirectory });
     const record = store.records.find((candidate) => candidate.fingerprint === fingerprint);
     if (!record) return { status: 'not_found' };
     if (record.status === 'resolved') return { status: 'resolved', sequence: record.sequence };
@@ -135,7 +136,7 @@ export function resolveRuntimeError(fingerprint, options = {}) {
     record.resolved_at = normalizeTimestamp(options.now);
     record.reason_code = reasonCode;
     record.sequence = nextSequence(store);
-    writeStore(store, options);
+    writeStore(store, options, privateDirectory);
     return { status: 'resolved', sequence: record.sequence };
   });
 }
@@ -144,8 +145,8 @@ export function reopenRuntimeError(fingerprint, options = {}) {
   assertExactOptions(options, ['env', 'configPath', 'storePath']);
   assertFingerprint(fingerprint);
   if (!collectionEnabled(options)) return { status: 'disabled' };
-  return withStoreLock(options, () => {
-    const store = readStore(options);
+  return withStoreLock(options, (privateDirectory) => {
+    const store = readStore(options, { privateDirectory });
     const record = store.records.find((candidate) => candidate.fingerprint === fingerprint);
     if (!record) return { status: 'not_found' };
     if (record.status === 'open') return { status: 'open', sequence: record.sequence };
@@ -153,7 +154,7 @@ export function reopenRuntimeError(fingerprint, options = {}) {
     record.resolved_at = null;
     record.reason_code = null;
     record.sequence = nextSequence(store);
-    writeStore(store, options);
+    writeStore(store, options, privateDirectory);
     return { status: 'open', sequence: record.sequence };
   });
 }
@@ -161,12 +162,12 @@ export function reopenRuntimeError(fingerprint, options = {}) {
 export function acknowledgeRuntimeErrors(cursor, options = {}) {
   if (!Number.isSafeInteger(cursor) || cursor < 0) throw new TypeError('cursor は非負の整数が必要です');
   if (!collectionEnabled(options)) return { status: 'disabled', acknowledgedThrough: 0 };
-  return withStoreLock(options, () => {
-    const store = readStore(options);
+  return withStoreLock(options, (privateDirectory) => {
+    const store = readStore(options, { privateDirectory });
     const highWatermark = store.next_sequence - 1;
     if (cursor > highWatermark) throw new RangeError('cursor がstore high watermarkを超えています');
     store.acknowledged_through = Math.max(store.acknowledged_through, cursor);
-    writeStore(store, options);
+    writeStore(store, options, privateDirectory);
     return { status: 'acknowledged', acknowledgedThrough: store.acknowledged_through };
   });
 }
@@ -183,8 +184,8 @@ export function compactRuntimeErrors({
   }
   const options = { env, configPath, storePath };
   if (!collectionEnabled(options)) return { status: 'disabled', removed: 0 };
-  return withStoreLock(options, () => {
-    const store = readStore(options);
+  return withStoreLock(options, (privateDirectory) => {
+    const store = readStore(options, { privateDirectory });
     const cutoff = Date.parse(normalizeTimestamp(now)) - retentionMs;
     const before = store.records.length;
     store.records = store.records.filter((record) => {
@@ -192,7 +193,7 @@ export function compactRuntimeErrors({
       const expired = Date.parse(record.last_seen) <= cutoff;
       return !(acknowledged && record.status === 'resolved' && expired);
     });
-    writeStore(store, options);
+    writeStore(store, options, privateDirectory);
     return { status: 'compacted', removed: before - store.records.length };
   });
 }
@@ -256,7 +257,7 @@ export function getRuntimeErrorDiagnostics(options = {}) {
 export function recordRuntimeErrorBestEffort(code, options = {}) {
   const { stderr = process.stderr, ...storeOptions } = options;
   try {
-    const child = spawnSync(process.execPath, [fileURLToPath(new URL('./runtime-error-observer.mjs', import.meta.url)), code], {
+    const child = childProcess.spawnSync(process.execPath, [fileURLToPath(new URL('./runtime-error-observer.mjs', import.meta.url)), code], {
       env: storeOptions.env ?? process.env,
       encoding: 'utf8',
       stdio: 'ignore',
@@ -288,13 +289,13 @@ function emptyStore() {
   };
 }
 
-function readStore(options, { missingIsEmpty = true } = {}) {
+function readStore(options, { missingIsEmpty = true, privateDirectory } = {}) {
   const path = options.storePath || defaultRuntimeErrorStorePath(options.env);
   let parsed;
   try {
     const info = lstatSync(path);
     if (!info.isFile() || info.isSymbolicLink()) throw new Error('runtime error store path unsafe');
-    assertPrivateStoreDirectory(dirname(path), options.env);
+    assertPrivateDirectoryCapability(privateDirectory, dirname(path), options.env);
     assertPrivateStoreFile(info, options.env, path);
     parsed = JSON.parse(readFileSync(path, 'utf8'));
   } catch (error) {
@@ -305,19 +306,28 @@ function readStore(options, { missingIsEmpty = true } = {}) {
   return parsed;
 }
 
-function writeStore(store, options) {
+function writeStore(store, options, privateDirectory) {
   validateStore(store);
   const path = options.storePath || defaultRuntimeErrorStorePath(options.env);
   const directory = dirname(path);
-  ensurePrivateStoreDirectory(directory, options.env);
+  assertPrivateDirectoryCapability(privateDirectory, directory, options.env);
   const temporary = join(directory, `.runtime-errors.${process.pid}.${randomBytes(6).toString('hex')}.tmp`);
   try {
     writeFileSync(temporary, `${JSON.stringify(store)}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
-    if (!isWindows(options.env)) chmodSync(temporary, 0o600);
+    if (!isWindows(options.env)) {
+      chmodSync(temporary, 0o600);
+    } else {
+      // The apply script performs an exact read-back verification. Repeating
+      // the same PowerShell verification here only consumes the bounded hook
+      // observer deadline without protecting a new state transition.
+      applyAndVerifyWindowsAcl(temporary, false);
+      assertPrivateStoreFileShape(lstatSync(temporary));
+    }
+    // ACL/mode is complete before replacement, so an ACL failure leaves the
+    // previous final store intact. Rename preserves the prepared file ACL.
     renameSync(temporary, path);
-    if (!isWindows(options.env)) chmodSync(path, 0o600);
-    else applyAndVerifyWindowsAcl(path, false);
-    assertPrivateStoreFile(lstatSync(path), options.env, path);
+    if (!isWindows(options.env)) assertPrivateStoreFile(lstatSync(path), options.env, path);
+    else assertPrivateStoreFileShape(lstatSync(path));
   } finally {
     rmSync(temporary, { force: true });
   }
@@ -339,15 +349,15 @@ function withStoreLock(options, operation) {
     if (isWindows(options.env)) applyAndVerifyWindowsAcl(lockPath, false);
     else chmodSync(lockPath, 0o600);
   }
-  assertPrivateStoreFile(lstatSync(lockPath), options.env, lockPath);
+  if (created && isWindows(options.env)) assertPrivateStoreFileShape(lstatSync(lockPath));
+  else assertPrivateStoreFile(lstatSync(lockPath), options.env, lockPath);
   const database = new DatabaseSync(lockPath);
   let active = false;
   try {
-    assertPrivateStoreFile(lstatSync(lockPath), options.env, lockPath);
     database.exec('PRAGMA busy_timeout=5000; PRAGMA synchronous=FULL');
     database.exec('BEGIN IMMEDIATE');
     active = true;
-    const result = operation();
+    const result = operation(privateDirectoryCapability(directory, options.env));
     database.exec('COMMIT');
     active = false;
     return result;
@@ -363,10 +373,42 @@ function ensurePrivateStoreDirectory(directory, env = process.env) {
   if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('runtime error store directory unsafe');
   if (isWindows(env)) {
     applyAndVerifyWindowsAcl(directory, true);
+    assertPrivateStoreDirectoryShape(lstatSync(directory));
   } else {
     chmodSync(directory, 0o700);
+    assertPrivateStoreDirectory(directory, env);
+  }
+}
+
+function privateDirectoryCapability(directory, env) {
+  return Object.freeze({
+    directory,
+    windows: isWindows(env),
+    [PRIVATE_DIRECTORY_CAPABILITY]: true,
+  });
+}
+
+function assertPrivateDirectoryCapability(capability, directory, env) {
+  if (!capability || capability[PRIVATE_DIRECTORY_CAPABILITY] !== true ||
+    capability.directory !== directory || capability.windows !== isWindows(env)) {
+    // Read-only callers do not hold a mutation capability and still perform
+    // the complete ACL/mode verification immediately before reading.
+    assertPrivateStoreDirectory(directory, env);
+    return;
+  }
+  assertPrivateStoreDirectoryShape(lstatSync(directory));
+}
+
+function assertPrivateStoreDirectoryShape(info) {
+  if (!info.isDirectory() || info.isSymbolicLink()) {
+    throw new Error('runtime error store directory unsafe');
+  }
+}
+
+function assertPrivateStoreFileShape(info) {
+  if (!info.isFile() || info.isSymbolicLink()) {
+    throw new Error('runtime error store path unsafe');
   }
-  assertPrivateStoreDirectory(directory, env);
 }
 
 function isWindows(env = process.env) {
@@ -496,13 +538,13 @@ function isCanonicalTimestamp(value) {
 
 function assertPrivateStoreDirectory(directory, env = process.env) {
   const info = lstatSync(directory);
-  if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('runtime error store directory unsafe');
+  assertPrivateStoreDirectoryShape(info);
   if (isWindows(env)) verifyWindowsAcl(directory, true);
   else assertPosixOwnerMode(info, 0o700);
 }
 
 function assertPrivateStoreFile(info, env = process.env, path) {
-  if (!info.isFile() || info.isSymbolicLink()) throw new Error('runtime error store path unsafe');
+  assertPrivateStoreFileShape(info);
   if (isWindows(env)) verifyWindowsAcl(path, false);
   else assertPosixOwnerMode(info, 0o600);
 }
@@ -521,7 +563,7 @@ function verifyWindowsAcl(path, directory) {
 }
 
 function runWindowsAclScript(path, directory, script) {
-  const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
+  const result = childProcess.spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
     env: { ...process.env, FACTORY_ACL_PATH: path, FACTORY_ACL_DIRECTORY: directory ? '1' : '0' },
     stdio: 'ignore', timeout: WINDOWS_ACL_TIMEOUT_MS, windowsHide: true,
   });

package/src/runtime-error-store.test.mjs

@@ -1,7 +1,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { spawn } from 'node:child_process';
-import { chmodSync, mkdtempSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import childProcess, { spawn } from 'node:child_process';
+import { chmodSync, mkdtempSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 
@@ -16,7 +16,7 @@ import {
   reopenRuntimeError,
   resolveRuntimeError,
 } from './runtime-error-store.mjs';
-import { applyWindowsPrivateAcl } from './windows-acl-test-helper.mjs';
+import { applyWindowsPrivateAcl, verifyWindowsPrivateAcl } from './windows-acl-test-helper.mjs';
 
 const TEST_PLATFORM = process.platform === 'win32' ? 'win32' : 'darwin';
 
@@ -83,6 +83,50 @@ test('runtime error store: Windows native uses the canonical LocalAppData paths'
   );
 });
 
+test('runtime error store: one Windows mutation spends ACL processes only on distinct state transitions', (t) => {
+  const box = sandbox();
+  box.env.OS = 'Windows_NT';
+  enableCollection(box);
+  const calls = [];
+  t.mock.method(childProcess, 'spawnSync', (command, args, options) => {
+    calls.push({ command, args, options });
+    return { status: 0, signal: null, error: undefined };
+  });
+  const options = { env: box.env, configPath: box.configPath, storePath: box.storePath };
+
+  assert.equal(observeRuntimeError({ code: 'HOOK_CODEX_FAILED' }, options).status, 'recorded');
+  assert.equal(calls.length, 3, 'new directory, lock, and store each require one apply+verify process');
+  assert.ok(calls.every((call) => call.command === 'powershell.exe'));
+  calls.length = 0;
+
+  assert.equal(observeRuntimeError({ code: 'HOOK_CODEX_FAILED' }, options).status, 'recorded');
+  assert.equal(calls.length, 4, 'directory apply, existing lock/store verify, and replacement store apply are distinct');
+  assert.ok(calls.every((call) => call.options.timeout === 3_000));
+});
+
+test('runtime error store: Windows temporary ACL failure leaves the previous atomic store intact', (t) => {
+  const box = sandbox();
+  box.env.OS = 'Windows_NT';
+  enableCollection(box);
+  let calls = 0;
+  let failAt = Number.POSITIVE_INFINITY;
+  t.mock.method(childProcess, 'spawnSync', () => {
+    calls += 1;
+    return { status: calls === failAt ? 1 : 0, signal: null, error: undefined };
+  });
+  const options = { env: box.env, configPath: box.configPath, storePath: box.storePath };
+
+  observeRuntimeError({ code: 'HOOK_CODEX_FAILED', now: '2026-07-13T00:00:00.000Z' }, options);
+  const before = readFileSync(box.storePath, 'utf8');
+  failAt = calls + 4;
+  assert.throws(
+    () => observeRuntimeError({ code: 'HOOK_CODEX_FAILED', now: '2026-07-13T00:01:00.000Z' }, options),
+    /Windows owner-only ACL verification failed/,
+  );
+  assert.equal(readFileSync(box.storePath, 'utf8'), before);
+  assert.deepEqual(readdirSync(dirname(box.storePath)).filter((name) => name.endsWith('.tmp')), []);
+});
+
 test('runtime error store: reporting config and credentials are ignored and no network API is accepted', () => {
   const box = sandbox();
   enableCollection(box, {
@@ -235,6 +279,10 @@ test('runtime error store: atomic private store has owner-only modes and bounded
   if (process.platform !== 'win32') {
     assert.equal(statSync(dirname(box.storePath)).mode & 0o777, 0o700);
     assert.equal(statSync(box.storePath).mode & 0o777, 0o600);
+  } else {
+    verifyWindowsPrivateAcl(dirname(box.storePath), true);
+    verifyWindowsPrivateAcl(`${box.storePath}.lock.sqlite`);
+    verifyWindowsPrivateAcl(box.storePath);
   }
   assert.doesNotThrow(() => JSON.parse(readFileSync(box.storePath, 'utf8')));
 

package/src/windows-acl-test-helper.mjs

@@ -27,3 +27,32 @@ if($isDir){[System.IO.Directory]::SetAccessControl($target,$acl)}else{[System.IO
   });
   if (result.status !== 0) throw new Error(result.stderr || 'Windows ACL fixture setup failed');
 }
+
+export function verifyWindowsPrivateAcl(path, directory = false) {
+  if (process.platform !== 'win32') return;
+  const script = String.raw`
+$ErrorActionPreference='Stop'
+$target=$env:THROUGHLINE_TEST_ACL_PATH; $isDir=$env:THROUGHLINE_TEST_ACL_DIRECTORY -eq '1'
+$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+$acl=if($isDir){[System.IO.Directory]::GetAccessControl($target)}else{[System.IO.File]::GetAccessControl($target)}
+$owner=$acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+if($owner -ne $sid){exit 41}
+$rules=@($acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]))
+if($rules.Count -ne 1){exit 42}
+$rule=$rules[0]
+if($rule.IdentityReference.Value -ne $sid -or $rule.AccessControlType -ne 'Allow' -or $rule.IsInherited -or ($rule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne [System.Security.AccessControl.FileSystemRights]::FullControl){exit 43}
+`;
+  const result = spawnSync('powershell.exe', [
+    '-NoProfile', '-NonInteractive', '-Command', script,
+  ], {
+    encoding: 'utf8',
+    timeout: 3_000,
+    windowsHide: true,
+    env: {
+      ...process.env,
+      THROUGHLINE_TEST_ACL_PATH: path,
+      THROUGHLINE_TEST_ACL_DIRECTORY: directory ? '1' : '0',
+    },
+  });
+  if (result.status !== 0) throw new Error(result.stderr || 'Windows ACL fixture verification failed');
+}