Retry transient Windows atomic file replacements

.github/workflows/tests.yml

@@ -31,7 +31,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
       - name: Compile Python sources
-        run: python -m py_compile bimri-engine.py tests/test_bimri_engine.py tests/test_v503_release.py tests/test_v510_lifecycle.py tests/test_v511_performance.py tests/test_v512_defects.py tests/crash_worker.py
+        run: python -m py_compile bimri-engine.py tests/test_bimri_engine.py tests/test_v503_release.py tests/test_v510_lifecycle.py tests/test_v511_performance.py tests/test_v512_defects.py tests/test_windows_atomic_replace.py tests/crash_worker.py
       - name: Run unit tests
         run: python -m unittest discover -s tests -v
       - name: Benchmark smoke with canonical gates

CHANGELOG.md

@@ -3,6 +3,15 @@
 This file records the public BIMRI architecture history. Historical instruction
 files are preserved under [`legacy/`](legacy/) and are not current installers.
 
+## Unreleased
+
+- Atomic text and byte writes now retry brief Windows access-denied or sharing
+  failures while replacing a file. They retry the same flushed temporary file
+  at most six times, with 0.63 seconds of total requested sleep per replacement.
+  Existing preflight, locking, integrity checks and caller warning behavior are
+  unchanged. Persistent failures still propagate to the caller; other errors
+  and non-Windows writes do not gain retries.
+
 ## 5.1.2
 
 - Kept this release engine-only and defects-only. The authority and

bimri-engine.py

@@ -622,6 +622,27 @@ def ensure_directory_durable(directory):
         fsync_directory(created.parent)
 
 
+def _replace_with_windows_retry(source, destination):
+    """Keep atomic replacement when a Windows reader briefly holds the target."""
+    delays = (0.01, 0.02, 0.04, 0.08, 0.16, 0.32)
+    attempt = 0
+    while True:
+        try:
+            os.replace(source, destination)
+            return
+        except OSError as exc:
+            if (
+                os.name != "nt"
+                or getattr(exc, "winerror", None) not in (5, 32)
+                or attempt >= len(delays)
+            ):
+                raise
+            # Retry only this primitive with the same fully flushed temp file.
+            # Persistent permission failures still reach the caller unchanged.
+            time.sleep(delays[attempt])
+            attempt += 1
+
+
 def atomic_write_text(path, content):
     path = Path(path)
     guard_active_code_update(path, "atomic-write")
@@ -634,7 +655,7 @@ def atomic_write_text(path, content):
             handle.write(content)
             handle.flush()
             os.fsync(handle.fileno())
-        os.replace(temp_name, path)
+        _replace_with_windows_retry(temp_name, path)
         fsync_directory(path.parent)
     except Exception:
         with contextlib.suppress(OSError):
@@ -654,7 +675,7 @@ def atomic_write_bytes(path, content):
             handle.write(content)
             handle.flush()
             os.fsync(handle.fileno())
-        os.replace(temp_name, path)
+        _replace_with_windows_retry(temp_name, path)
         fsync_directory(path.parent)
     except Exception:
         with contextlib.suppress(OSError):