test: make Windows phase fence fixtures portable

Author: CompleteDotTech

.github/workflows/test.yml

@@ -18,3 +18,22 @@ jobs:
       - run: python tools/run_validation.py
       - run: python -m pip install --no-deps .
       - run: trace-gc --version
+  windows-fence:
+    runs-on: windows-latest
+    strategy:
+      matrix:
+        python-version: ['3.12', '3.13']
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: python -m pip install -r requirements.txt
+      - name: Run the nine native Windows admission-fence cases
+        shell: bash
+        run: |
+          set -o pipefail
+          python -m unittest discover -s tests -p "test_paper_pilot_phase_cutover_guarded_v2.py" -v 2>&1 | tee "$RUNNER_TEMP/windows-fence.log"
+          # A bare "OK" means every case executed; skips would print "OK (skipped=N)".
+          grep -Eq '^Ran 9 tests in ' "$RUNNER_TEMP/windows-fence.log"
+          grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/windows-fence.log"

MANIFEST.json

@@ -7,8 +7,8 @@
   "files": [
     {
       "path": ".github/workflows/test.yml",
-      "bytes": 615,
-      "sha256": "ba3c6064c1fb430eda6f7fedf60561637be3daedfff4d1d533a61e5ef851ed2b"
+      "bytes": 1434,
+      "sha256": "a38dd6c889f7d214a3a3590c76fa07ab73586b737d78f4b7e2fad798575de650"
     },
     {
       "path": ".gitignore",
@@ -2632,8 +2632,8 @@
     },
     {
       "path": "tests/test_paper_pilot_phase_cutover_guarded_v2.py",
-      "bytes": 11173,
-      "sha256": "c1fab4e9adbe973c53d01fa2d0340559ffef0dc4d482e2b5b8bb68cfa9f43c33"
+      "bytes": 11981,
+      "sha256": "8ab205a79fd925b3ed645a6ea3bd8e6f872c98d731b0467358f7f5de74ca6513"
     },
     {
       "path": "tests/test_paper_pilot_phase_cutover_guarded_v4.py",

tests/test_paper_pilot_phase_cutover_guarded_v2.py

@@ -1,4 +1,8 @@
-"""Windows-only owned disposable tests for the historical admission barrier."""
+"""Windows-only owned disposable tests for the historical admission barrier.
+
+Every case builds its own fixture inside a unique temporary directory created
+by this test, so it never depends on (or creates) any historical task state.
+"""
 from __future__ import annotations
 
 import hashlib
@@ -17,7 +21,7 @@
 from trace_gc.budget import RunBudget
 
 
-OWNED = Path(r"D:\codex-task-runs\issue90-real-historical-transition-disabled-plan-20260930-01\fence-owned-tests")
+TEMP_PREFIX = "jraphyte-fence-"
 LIMITS = {"retrieval_requests": 1, "model_calls": 1, "retries": 0,
           "solver_expansions": 1, "review_actions": 1, "request_bytes": 1000}
 
@@ -38,11 +42,14 @@ def test_module_load_does_not_require_msvcrt(self):
     def setUp(self):
         if os.name != "nt":
             self.skipTest("Windows ACL contract")
-        OWNED.mkdir(exist_ok=True)
-        self.temp = tempfile.TemporaryDirectory(dir=OWNED)
+        self.sid = _current_sid()
+        self.temp = tempfile.TemporaryDirectory(prefix=TEMP_PREFIX)
         self.addCleanup(self._cleanup)
         self.base = Path(self.temp.name)
-        self.assertEqual(self.base.resolve().parent, OWNED.resolve())
+        # The fixture owns this fresh directory; only paths beneath it are ever
+        # given a barrier ACL or have one removed again.
+        self.assertTrue(self.base.is_dir())
+        self.assertTrue(self.base.name.startswith(TEMP_PREFIX))
         self.root = self.base / "old-app"
         self.root.mkdir()
         self.old = self.root / "state"
@@ -73,14 +80,25 @@ def setUp(self):
             guarded.directory_dacl_sddl(self.old / name).encode()).hexdigest()
             for name in guarded.NAMES}
 
+    def _owned(self, path: Path) -> Path:
+        resolved = Path(path).resolve()
+        if not resolved.is_relative_to(self.base.resolve()):
+            raise AssertionError(f"refusing ACL change outside fixture: {path}")
+        return resolved
+
     def _cleanup(self):
+        # Lift only this test's own deny ACEs so the owned tree can be removed;
+        # no ancestor of the temporary directory has its ACL touched.
         if hasattr(self, "root") and self.root.exists():
-            _call("icacls.exe", str(self.root), "/remove:d", "*" + self.sid)
+            _call("icacls.exe", str(self._owned(self.root)), "/remove:d", "*" + self.sid)
         for root in (getattr(self, "old", None), getattr(self, "archive", None)):
             if root is not None and root.exists():
                 for name in guarded.NAMES:
-                    _call("icacls.exe", str(root / name), "/remove:d", "*" + self.sid)
+                    if (root / name).exists():
+                        _call("icacls.exe", str(self._owned(root / name)),
+                              "/remove:d", "*" + self.sid)
         self.temp.cleanup()
+        self.assertFalse(self.base.exists())
 
     def invoke(self):
         return guarded.fence_closed_old_phase_guarded(