[Windows] Managed session writes intermittently fail with managed_replace_failed:io_error

[webstrdy00]

Description

On native Windows, GJC intermittently fails while appending messages to managed session storage.

The failure is not tied to a specific project directory. It has occurred in multiple workspaces while the GJC session data was stored under:

C:\Users\<user>\.gjc\agent\

The error appears to happen during the managed-file replacement operation.

Steps to Reproduce

The failure is intermittent, but the observed sequence is:

1. Install and run GJC globally with Bun on native Windows.
2. Start GJC in a project directory.
3. Continue using the session so that messages are appended to the managed session storage.
4. In some cases, the managed-file replacement fails with managed_replace_failed:io_error.
5. GJC records the crash in C:\Users\<user>\.gjc\agent\gjc-crash.log.

The issue has occurred in more than one project, so it does not appear to be project-specific.

Expected Behavior

A temporary Windows file-sharing conflict should not crash the active GJC session.

The managed-file replacement should retry transient, pre-mutation I/O failures for a short bounded period and then either:

• complete successfully, or
• return a more specific diagnostic describing the affected path and Windows error code.

Error Output

[Unhandled Rejection] ManagedReplaceError: managed_replace_failed:io_error
    at replaceManagedFileGeneratedSync (...\managed-session-storage.ts:2806:15)
    at appendSync (...\managed-session-storage.ts:1552:21)
    at <anonymous> (...\session-manager.ts:15637:26)
    at #appendManagedRecordsSync (...\session-manager.ts:15630:8)
    at <anonymous> (...\session-manager.ts:15761:11)
    at _persist (...\session-manager.ts:15753:9)
    at #appendEntryWithinPersistenceFence (...\session-manager.ts:15841:9)
    at #withSessionPersistenceFenceSync (...\session-manager.ts:10471:11)
    at #appendEntry (...\session-manager.ts:15792:8)
    at appendMessage (...\session-manager.ts:16006:8)

{"code":"io_error"}

Platform

Windows (native)

gjc version

0.13.1

Bun version

1.3.14

Area

Session / Compaction

Additional Context

The session directory is on the user's local Windows filesystem, not inside the project directory.

Disk space and directory permissions were checked, and the user has full control of the session directory.

A controlled test was also performed by temporarily opening the destination file without delete sharing for approximately 1.2 seconds. This reproduced the transient replacement conflict.

As a proof of concept, a local patch was tested with bounded retries only when all of the following were true:

• Platform is Windows.
• The returned code is io_error.
• detachedOldPath is undefined.
• retainedNewPath is undefined.
• retainedNewIdentityPath is undefined.

With 30 retries and a 100 ms delay, the controlled replacement completed successfully after approximately 1.34 seconds, and the resulting file contents were correct.

The retry condition was intentionally limited to a bare, pre-mutation io_error so that failures occurring after a namespace mutation would not be retried blindly.

It may also be useful for the native replacement function to preserve the underlying Windows error code, such as a sharing violation, instead of returning only io_error.

[Yeachan-Heo]

Intake: reproducing and owning #4330

Sole-owner worktree: gajae-code-issue-4330-windows-managed-replace, branch fix/issue-4330-windows-managed-replace.

Base dev at intake: cae0c20cb89509941ae859ffe39012c83daf3645 (current dev after #4328; worktree started from e8af95c8332e588eb878b470dc6543c8645be74e and was rebased before implementation).

Reporter reproduction (credited to @webstrdy00):

• Native Windows, Bun 1.3.14, managed session append under C:\Users\<user>\.gjc\agent\ (multi-project, not project-specific).
• Intermittent ManagedReplaceError: managed_replace_failed:io_error from replaceManagedFileGeneratedSync → appendSync → #appendManagedRecordsSync, recorded in gjc-crash.log.
• Deterministic repro: hold the destination open without delete sharing for ~1.2s; bounded PoC retry (30 × 100 ms) succeeds in ~1.34 s only for a bare pre-mutation Windows io_error where detachedOldPath, retainedNewPath, and retainedNewIdentityPath are all undefined.

Fault model (traced): on Windows, exactReplacePath opens the destination with FILE_SHARE_READ | FILE_SHARE_DELETE (NtCreateFile relative to the retained parent) before any namespace mutation. A concurrent holder that denies delete sharing makes that open fail with STATUS_SHARING_VIOLATION (0xC000004B / ERROR_SHARING_VIOLATION 32), which today collapses to a generic io_error with no underlying code surfaced — and the whole append is surfaced to the session as an unhandled rejection.

Planned contract (per the issue's Expected Behavior):

• Windows-only, bounded, transient retry at the narrow syscall boundary, only for pre-mutation io_error with no detached/retained paths (nothing in the namespace was mutated).
• Never retry after any namespace mutation (detachedOldPath/retainedNewPath/retainedNewIdentityPath present).
• Preserve the underlying Windows error category (sharing violation vs. other) without leaking paths.
• No broad retry of permission, disk-full, path-not-found, or identity failures; no duplicate append, corruption, or lost fsync/durability.

Windows verification: this worktree is a Linux host, so Windows-native compile/runtime validation runs on the repository's windows-latest CI (windows-dev-doctor + path-identity-windows.test.ts). Deterministic fault injection is designed to be platform-neutral in the native layer (injected before the real syscall, mirroring the existing EINTR-restart seams) and Windows-gated at runtime.

Will post the implementation PR here with reporter credit once verification is green.

[Yeachan-Heo]

Implemented — PR #4345.\n\nSole-owner worktree gajae-code-issue-4330-windows-managed-replace, branch fix/issue-4330-windows-managed-replace, base dev cae0c20cb8. The fix retries the transient Windows destination-sharing conflict at the narrow pre-mutation native open (bounded 30 × 100 ms, sharing violations only, never after any namespace mutation), reports the specific sharing_violation category plus the path-free hex NTSTATUS on exhaustion, and the TypeScript layer never retries so no append can be duplicated. Deterministic Windows tests cover holder-released success, budget exhaustion without mutation, and the full managed-session append path; cross-platform Rust tests pin the retry policy. Windows-native compile/runtime validation runs on the repository's windows-latest jobs. Reporter reproduction and PoC bounds credited to @webstrdy00.

[Yeachan-Heo]

Progress — implementation merged-ready on PR #4345 (rebased).\n\n- Worktree: gajae-code-issue-4330-windows-managed-replace, branch fix/issue-4330-windows-managed-replace.\n- Base dev at implementation: 94f48b77586e6eb021163a94fa7158f002f26ed8 (rebased past cae0c20cb8 intake base after dev advanced via #4332/#4337/#4339).\n- Implementation: bounded (30 × 100 ms) native retry of the exact-replace destination open only on Windows, sharing violations (STATUS_SHARING_VIOLATION 0xC0000043) only, never after any namespace mutation; exhaustion reports the specific sharing_violation code plus path-free hex NTSTATUS; TS layer never retries. Reporter reproduction and PoC bounds credited to @webstrdy00.\n- Verification: cross-platform Rust policy tests, Windows real-handle TS tests (child-holder release → success; persistent holder → exhaustion without mutation), Windows session-level append tests, plus Linux check:rs/smoke/natives/session suites all green. Windows-native compile + runtime on the repository's windows-latest jobs (windows-dev-doctor, windows-telegram-daemon-safety) are running on the PR now.

[Yeachan-Heo]

Fixed in PR #4345 (squash-merged to dev as bf44122). The native exactReplacePath destination open now retries transient STATUS_SHARING_VIOLATION for a bounded 30 x 100 ms before failing with the specific sharing_violation category and hex NTSTATUS, and never retries after any namespace mutation.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]