[GH-ISSUE #2950] [Bug] Windows WABT verifier assigns child TEMP beneath its retained private-directory lease #1038

New issue

Closed

opened 2026-10-15 18:30:33 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:30:33 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2950

The real WABT verifier cannot exercise Windows analysis because it sets child TEMP/TMP/TMPDIR to a PrivateRuntimeRoot whose DELETE-access directory lease remains held by the verifier. Fresh native admission intentionally refuses allocating a runtime beneath that leased ancestor.

Pinnedmain d4f0c5e664; relevant verifier/runtime/native sources unchanged at currentmain ebaaa79ca. Actual Windows11 x64/Node24.18.0, official Windows-x64 WABT1.0.42 with published archive digest verified. Both direct and explicit installed-entrypoint verifier attempts reach tool/fixture preflight, then CLI inspect_wasm_artifact returns retryable capability_unavailable: native self-test Open Windows path component failed ... (Win32 32). Actual REA artifact inspection does not proceed. Installed npm bootstrap itself was incomplete, so that attempt carries an additional qualification.

A fresh native parent/child A/B independently confirms the boundary without WABT:

Retain one PrivateRuntimeRoot; a fresh loader child with TEMP beneath that root returns available=false/retryable=true/Win3232.
Another fresh child with TEMP set to a separate ordinary sibling directory returns available=true.
Both parents contain no allocated probes afterward; retained parent's independent NTFS device/inode identity is unchanged; owned cleanup completes, native Job remaining processes0.

The source mechanism is explicit: verify-wasm-artifact.mjs:53–58,96–100 configures the conflicting child environment. Native runtime admission opens the parent with FILE_SHARE_READ, which conflicts with the verifier's retained DELETE access. verify-windows-native.mjs:152–172 deliberately covers this exact case as retryable/not-started. This is an intentional ownership rule, not the historical Win325 deletion issue #1701/#2196 and not #2722 output throughput.

Use separate fixture-staging and ordinary child-temporary owners. Keep private input staging/DACL and selected CLI/MCP paths; give child/provider private runtimes an ordinary sibling parent outside the staging lease. A subdirectory inside staging still has the conflicting ancestor. WABT reads selected inputs via the stable Node file reader, so moving TEMP is sufficient for this specific input path; do not generalize that claim to arbitrary native snapshot consumers.

Inspect delegated packaged WABT coverage and the final cleanup boundary: a residue assertion must not skip root.close() or lose ownership of a failed cleanup. Attempt independent owners' cleanup and preserve the original failure. Do not weaken native sharing, add retries, or skip Windows. Then rerun complete real CLI/MCP WABT artifact checks, malformed inputs, stable identity/provenance, output schema and resource cleanup with bounded compact reporting.

Resource evidence: actual direct failed lane33.74s814.9MiBJob; installed-entrypoint29.80s871.8MiB; parent/sibling diagnostic4.19s81.9MiBJob/2.64s sampledCPU. Each Job0. Diagnostic was serial after other analysis work; nativeJobcommit excludes guardian, sampled family memory/CPU has the separately documented observer limits. Raw evidence is retained locally under /tmp/rea-windows-e2e-20261013/results; no binary or ambient environment published.

Originally created by @N0zoM1z0 on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2950 The real WABT verifier cannot exercise Windows analysis because it sets child TEMP/TMP/TMPDIR to a `PrivateRuntimeRoot` whose DELETE-access directory lease remains held by the verifier. Fresh native admission intentionally refuses allocating a runtime beneath that leased ancestor. Pinnedmain d4f0c5e664e26fe7ed1566dcc4b85ea9b57d52da; relevant verifier/runtime/native sources unchanged at currentmain ebaaa79ca. Actual Windows11 x64/Node24.18.0, official Windows-x64 WABT1.0.42 with published archive digest verified. Both direct and explicit installed-entrypoint verifier attempts reach tool/fixture preflight, then CLI `inspect_wasm_artifact` returns retryable capability_unavailable: native self-test `Open Windows path component failed ... (Win32 32)`. Actual REA artifact inspection does not proceed. Installed npm bootstrap itself was incomplete, so that attempt carries an additional qualification. A fresh native parent/child A/B independently confirms the boundary without WABT: - Retain one `PrivateRuntimeRoot`; a fresh loader child with TEMP beneath that root returns available=false/retryable=true/Win3232. - Another fresh child with TEMP set to a separate ordinary sibling directory returns available=true. - Both parents contain no allocated probes afterward; retained parent's independent NTFS device/inode identity is unchanged; owned cleanup completes, native Job remaining processes0. The source mechanism is explicit: `verify-wasm-artifact.mjs:53–58,96–100` configures the conflicting child environment. Native runtime admission opens the parent with FILE_SHARE_READ, which conflicts with the verifier's retained DELETE access. `verify-windows-native.mjs:152–172` deliberately covers this exact case as retryable/not-started. This is an intentional ownership rule, not the historical Win325 deletion issue #1701/#2196 and not #2722 output throughput. Use separate fixture-staging and ordinary child-temporary owners. Keep private input staging/DACL and selected CLI/MCP paths; give child/provider private runtimes an ordinary sibling parent outside the staging lease. A subdirectory inside staging still has the conflicting ancestor. WABT reads selected inputs via the stable Node file reader, so moving TEMP is sufficient for this specific input path; do not generalize that claim to arbitrary native snapshot consumers. Inspect delegated packaged WABT coverage and the final cleanup boundary: a residue assertion must not skip `root.close()` or lose ownership of a failed cleanup. Attempt independent owners' cleanup and preserve the original failure. Do not weaken native sharing, add retries, or skip Windows. Then rerun complete real CLI/MCP WABT artifact checks, malformed inputs, stable identity/provenance, output schema and resource cleanup with bounded compact reporting. Resource evidence: actual direct failed lane33.74s814.9MiBJob; installed-entrypoint29.80s871.8MiB; parent/sibling diagnostic4.19s81.9MiBJob/2.64s sampledCPU. Each Job0. Diagnostic was serial after other analysis work; nativeJobcommit excludes guardian, sampled family memory/CPU has the separately documented observer limits. Raw evidence is retained locally under `/tmp/rea-windows-e2e-20261013/results`; no binary or ambient environment published.

bsakaguchi

2026-10-15 18:30:33 +00:00

closed this issue
added the
area: runtime

bug
labels

bsakaguchi commented

2026-10-15 18:30:34 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Resolved on main by eca18e08a. scripts/verify-wasm-artifact.mjs now creates the child TEMP/TMP/TMPDIR outside the retained PrivateRuntimeRoot lease and removes that separate temporary root during finalization. The producing configuration and cleanup paths were checked on current main b8510ee00; this closure does not claim a fresh Windows/WABT runtime run.

@morluto commented on GitHub (Oct 14, 2026): Resolved on main by eca18e08a. scripts/verify-wasm-artifact.mjs now creates the child TEMP/TMP/TMPDIR outside the retained PrivateRuntimeRoot lease and removes that separate temporary root during finalization. The producing configuration and cleanup paths were checked on current main b8510ee00; this closure does not claim a fresh Windows/WABT runtime run.

bsakaguchi referenced this issue

2026-10-17 21:08:06 +00:00

[PR #1045] [MERGED] fix(javascript): recognize digits in artifact URI schemes #2604

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1038

No description provided.

Rows
Columns