libutil: delete recursively through handles on Windows

`std::filesystem::remove_all` re-resolves the path at every step, so each
component can be swapped between the check and the removal. Mirror the Unix
walk instead: hold a handle to the parent, and do every operation relative to
it, so a name is resolved exactly once.

That also fixes a case `remove_all` cannot do at all. A tree containing a
directory symlink fails to delete, reporting `ENOENT` and leaving the tree in
place, because libstdc++'s `std::filesystem` on MinGW does not recognise reparse
points -- `symlink_status` calls a directory symlink a plain directory with no
error set. Opening with `FILE_OPEN_REPARSE_POINT` removes the link as a link and
leaves its target alone.

Win32 has no `openat`; `NtCreateFile` does, via `OBJECT_ATTRIBUTES::RootDirectory`,
which the previous commit exposed as `ntOpenAt`. Listing is
`GetFileInformationByHandleEx(FileFullDirectoryInfo)` on the directory's own
handle. Deletion is `SetFileInformationByHandle` with `FileDispositionInfo`. The
`FileDispositionInfoEx` form with POSIX semantics would unlink the name
immediately rather than on last-handle-close, but it needs a newer API level
than the `_WIN32_WINNT=0x0602` this project sets, and the difference does not
matter here: each handle is closed before its parent is deleted, so a child's
name is already gone by then.

One handle per entry carries classification, listing, the attribute change and
the deletion. Opening twice would resolve the name twice, which is the race being
removed.

Names are collected before anything is deleted, since deleting entries while an
enumeration of the same directory is in flight is not defined to visit each entry
exactly once.

The read-only attribute is cleared through that handle. A file carrying it cannot
be deleted, and the store is full of them, because canonicalisation chmods store
contents to 0444 and `chmod()` on Windows is `::_wchmod`, which turns a missing
write bit into that attribute. This is the counterpart of the Unix walk relaxing
permissions with `fchmodatTryNoFollow` before recursing, and doing it through the
handle means the object whose attribute changes is necessarily the one about to
be deleted.

`bytesFreed` is now reported rather than left at zero. Policy copied from the
Unix implementation instead of invented: count a non-directory's size at one or
two links and nothing at three or more, two being assumed to mean an optimised
store entry. Garbage collection previously reported freeing nothing on Windows
however much it deleted, and `gc.cc` says "Rely on deletePath() accounting".

Per-entry failures are collected and rethrown at the end, so one undeletable
entry does not abandon the rest of the tree. Also Unix's behaviour.

Assisted-by: Claude Code (claude-opus-5)

Author: awsmadi

src/libutil/windows/file-system.cc

@@ -1,6 +1,9 @@
 #include "nix/util/file-system.hh"
 #include "nix/util/logging.hh"
 #include "nix/util/signals.hh"
+#include "nix/util/canon-path.hh"
+#include "nix/util/util.hh"
+#include "file-system-at-private.hh"
 
 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
@@ -74,14 +77,193 @@ std::filesystem::path defaultTempDir()
     return std::filesystem::path(buf);
 }
 
+namespace {
+
+/**
+ * Clear `FILE_ATTRIBUTE_READONLY` through an already-open handle.
+ *
+ * A file carrying it cannot be deleted, and the store is full of them:
+ * canonicalisation chmods store contents to 0444, and `chmod()` on Windows is
+ * `::_wchmod`, which turns a missing write bit into exactly this attribute.
+ *
+ * This is the counterpart of the Unix walk relaxing permissions with
+ * `fchmodatTryNoFollow` before it recurses. Doing it through the handle rather
+ * than by path means the object whose attribute is cleared is necessarily the
+ * one about to be deleted.
+ *
+ * The attribute is not honoured on directories, so in practice this only
+ * matters for files, but it is harmless to apply uniformly.
+ */
+void clearReadOnly(Descriptor fd)
+{
+    FILE_BASIC_INFO basic;
+    if (!GetFileInformationByHandleEx(fd, FileBasicInfo, &basic, sizeof(basic)))
+        return; /* Leave it; the deletion below will report the real problem. */
+
+    if (!(basic.FileAttributes & FILE_ATTRIBUTE_READONLY))
+        return;
+
+    basic.FileAttributes &= ~FILE_ATTRIBUTE_READONLY;
+    /* Clearing the last attribute leaves zero, which is not a valid value to
+       set; `FILE_ATTRIBUTE_NORMAL` is how you say "no attributes". */
+    if (basic.FileAttributes == 0)
+        basic.FileAttributes = FILE_ATTRIBUTE_NORMAL;
+
+    SetFileInformationByHandle(fd, FileBasicInfo, &basic, sizeof(basic));
+}
+
+/**
+ * Delete through an already-open handle, so the name is never resolved twice.
+ *
+ * This marks the object for deletion on last-handle-close rather than unlinking
+ * the name immediately. `FileDispositionInfoEx` with
+ * `FILE_DISPOSITION_FLAG_POSIX_SEMANTICS` would do the latter, but it needs a
+ * newer API level than the `_WIN32_WINNT=0x0602` this project sets, and the
+ * distinction does not matter here: the caller closes the handle before moving
+ * on, so a child's name is gone before its parent is deleted.
+ *
+ * @return whether the object was marked for deletion.
+ */
+bool deleteByHandle(Descriptor fd)
+{
+    FILE_DISPOSITION_INFO disposition{};
+    disposition.DeleteFile = TRUE;
+    return SetFileInformationByHandle(fd, FileDispositionInfo, &disposition, sizeof(disposition));
+}
+
+/**
+ * List a directory through its own handle.
+ *
+ * The names are collected rather than acted on as they arrive, because deleting
+ * entries while an enumeration of the same directory is in flight is not
+ * defined to visit each entry exactly once.
+ */
+std::vector<std::wstring> listByHandle(Descriptor fd, const std::filesystem::path & path)
+{
+    std::vector<std::wstring> names;
+
+    /* Big enough that a typical directory needs one round trip, but the loop
+       below does not depend on that. */
+    std::vector<char> buf(64 * 1024);
+
+    while (true) {
+        checkInterrupt();
+
+        if (!GetFileInformationByHandleEx(fd, FileFullDirectoryInfo, buf.data(), buf.size())) {
+            auto lastError = GetLastError();
+            if (lastError == ERROR_NO_MORE_FILES)
+                break;
+            throw windows::WinError(lastError, "reading directory %1%", PathFmt(path));
+        }
+
+        auto * info = reinterpret_cast<FILE_FULL_DIR_INFO *>(buf.data());
+        while (true) {
+            std::wstring name(info->FileName, info->FileNameLength / sizeof(wchar_t));
+            if (name != L"." && name != L"..")
+                names.push_back(std::move(name));
+            if (info->NextEntryOffset == 0)
+                break;
+            info = reinterpret_cast<FILE_FULL_DIR_INFO *>(reinterpret_cast<char *>(info) + info->NextEntryOffset);
+        }
+    }
+
+    return names;
+}
+
+/**
+ * Recursively delete `name` within the directory `parentFd` refers to.
+ *
+ * Mirrors the Unix `_deletePath`: every step is relative to a directory handle,
+ * so no path is resolved a second time and there is no window in which a
+ * component could be replaced. Reparse points are opened rather than followed,
+ * so a symlink is removed as a link and its target is left alone.
+ *
+ * Errors deleting individual entries are collected in `ex` rather than thrown
+ * immediately, so that one undeletable entry does not abandon the rest of the
+ * tree. This too matches Unix.
+ */
+void deletePathAt(
+    Descriptor parentFd, const std::filesystem::path & path, uint64_t & bytesFreed, std::exception_ptr & ex)
+{
+    checkInterrupt();
+
+    auto name = path.filename().native();
+
+    /* One handle, carrying everything the rest of this function needs:
+       classification, listing, clearing the attribute, and the deletion. Two
+       opens would mean resolving `name` twice, which is the race this is
+       written to avoid. */
+    auto fd = windows::tryNtOpenAt(
+        parentFd,
+        name,
+        DELETE | FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES | SYNCHRONIZE,
+        FILE_OPEN_REPARSE_POINT);
+    if (!fd)
+        return; /* Already gone. */
+
+    FILE_BASIC_INFO basic;
+    if (!GetFileInformationByHandleEx(fd->get(), FileBasicInfo, &basic, sizeof(basic)))
+        throw windows::WinError("getting attributes of %1%", PathFmt(path));
+
+    bool isDir = (basic.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0;
+    bool isReparsePoint = (basic.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0;
+
+    if (!isDir) {
+        /* Will deleting this actually free space? Same policy as Unix: count it
+           at one or two links, nothing at three or more, on the assumption that
+           two means an optimised store entry. */
+        FILE_STANDARD_INFO standard;
+        if (GetFileInformationByHandleEx(fd->get(), FileStandardInfo, &standard, sizeof(standard))
+            && standard.NumberOfLinks <= 2)
+            bytesFreed += static_cast<uint64_t>(standard.EndOfFile.QuadPart);
+    }
+
+    /* Descend into real directories only. A directory symlink or junction is
+       deleted as itself. */
+    if (isDir && !isReparsePoint)
+        for (auto & child : listByHandle(fd->get(), path))
+            deletePathAt(fd->get(), path / child, bytesFreed, ex);
+
+    clearReadOnly(fd->get());
+
+    if (!deleteByHandle(fd->get())) {
+        auto lastError = GetLastError();
+        if (lastError == ERROR_FILE_NOT_FOUND || lastError == ERROR_PATH_NOT_FOUND)
+            return;
+        try {
+            throw windows::WinError(lastError, "cannot delete %1%", PathFmt(path));
+        } catch (...) {
+            if (!ex)
+                ex = std::current_exception();
+            else
+                ignoreExceptionExceptInterrupt();
+        }
+    }
+}
+
+} // namespace
+
 void deletePath(const std::filesystem::path & path, uint64_t & bytesFreed)
 {
     bytesFreed = 0;
 
-    std::error_code ec;
-    std::filesystem::remove_all(path, ec); // NOLINT(bugprone-unsafe-functions)
-    if (ec && ec != std::errc::no_such_file_or_directory)
-        throw SysError(ec.default_error_condition().value(), "recursively deleting %1%", PathFmt(path));
+    assert(path.is_absolute());
+    auto parentPath = path.parent_path();
+    assert(parentPath != path);
+
+    auto parentFd = openDirectory(parentPath);
+    if (!parentFd) {
+        if (GetLastError() == ERROR_FILE_NOT_FOUND || GetLastError() == ERROR_PATH_NOT_FOUND)
+            return;
+        throw windows::WinError("opening directory %1%", PathFmt(parentPath));
+    }
+
+    std::exception_ptr ex;
+
+    deletePathAt(parentFd.get(), path, bytesFreed, ex);
+
+    if (ex)
+        std::rethrow_exception(ex);
 }
 
 std::filesystem::path descriptorToPath(Descriptor handle)