feat: add native Windows hierarchy test harness

internal/client/spool/lock_windows.go

@@ -37,7 +37,10 @@ func syncDirectory(path string) error {
 	if err != nil {
 		return err
 	}
-	handle, err := windows.CreateFile(value, windows.GENERIC_READ, windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE, nil, windows.OPEN_EXISTING, windows.FILE_FLAG_BACKUP_SEMANTICS, 0)
+	// FlushFileBuffers requires GENERIC_WRITE even when the handle refers to a
+	// directory.  Opening it read-only succeeds, then deterministically fails
+	// the durability barrier with ERROR_ACCESS_DENIED on Windows.
+	handle, err := windows.CreateFile(value, windows.GENERIC_READ|windows.GENERIC_WRITE, windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE, nil, windows.OPEN_EXISTING, windows.FILE_FLAG_BACKUP_SEMANTICS, 0)
 	if err != nil {
 		return err
 	}

internal/client/spool/private_windows.go

@@ -18,11 +18,9 @@ const privateStateSDDL = "D:P(A;;FA;;;SY)(A;;FA;;;BA)"
 func ensurePrivateFile(path string) error {
 	file, err := os.OpenFile(path, os.O_CREATE|os.O_EXCL|os.O_RDWR, 0o600)
 	if err == nil {
-		err = file.Close()
-	} else if !errors.Is(err, os.ErrExist) {
-		return err
+		return file.Close()
 	}
-	if err != nil {
+	if !errors.Is(err, os.ErrExist) {
 		return err
 	}
 	info, err := os.Lstat(path)

internal/client/spool/private_windows_test.go

@@ -0,0 +1,18 @@
+//go:build windows
+
+package spool
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+func TestEnsurePrivateFileAcceptsExistingPrivateFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "spool.lock")
+	if err := ensurePrivateFile(path); err != nil {
+		t.Fatalf("create private file: %v", err)
+	}
+	if err := ensurePrivateFile(path); err != nil {
+		t.Fatalf("recheck existing private file: %v", err)
+	}
+}

internal/client/spool/spool.go

@@ -11,6 +11,7 @@ import (
 	"net/url"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"sync"
 	"time"
 
@@ -116,8 +117,7 @@ func Open(ctx context.Context, options Options) (*Store, error) {
 	query.Add("_pragma", "foreign_keys(ON)")
 	query.Add("_pragma", "synchronous(FULL)")
 	query.Add("_pragma", "busy_timeout("+strconv.FormatInt(options.BusyTimeout.Milliseconds(), 10)+")")
-	databaseURL := &url.URL{Scheme: "file", Path: filepath.ToSlash(databasePath), RawQuery: query.Encode()}
-	db, err := sql.Open("sqlite", databaseURL.String())
+	db, err := sql.Open("sqlite", sqliteFileURI(databasePath, query))
 	if err != nil {
 		_ = unlock()
 		return nil, err
@@ -136,6 +136,17 @@ func Open(ctx context.Context, options Options) (*Store, error) {
 	return store, nil
 }
 
+// sqliteFileURI creates a file: URI with no authority. SQLite requires a
+// Windows drive path to be /C:/... in the URI path; without the leading slash
+// net/url renders C: as an authority (file://C:/...), which SQLite rejects.
+func sqliteFileURI(path string, query url.Values) string {
+	path = strings.ReplaceAll(path, `\`, "/")
+	if len(path) >= 2 && path[1] == ':' {
+		path = "/" + path
+	}
+	return (&url.URL{Scheme: "file", Path: path, RawQuery: query.Encode()}).String()
+}
+
 func (store *Store) ClientInstanceID() domain.UUID { return store.identity }
 
 func (store *Store) Close() error {

internal/client/spool/spool_test.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"crypto/sha256"
 	"errors"
+	"net/url"
 	"os"
 	"path/filepath"
 	"testing"
@@ -16,6 +17,13 @@ import (
 	"google.golang.org/protobuf/proto"
 )
 
+func TestSQLiteFileURIWindowsDrivePath(t *testing.T) {
+	query := url.Values{"_pragma": {"journal_mode(WAL)"}}
+	if got, want := sqliteFileURI(`C:\ProgramData\RVBox\test-state\spool.db`, query), "file:///C:/ProgramData/RVBox/test-state/spool.db?_pragma=journal_mode%28WAL%29"; got != want {
+		t.Fatalf("sqliteFileURI() = %q, want %q", got, want)
+	}
+}
+
 func TestExecutionSpecIsDurableAndQuotaCounted_HP_DISPATCH_07(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()