test(windows): stabilize ACL probe budget

[mohanagy]

Closes #352.

Root cause

The Windows-only integration helper gave a fresh Windows PowerShell process only 5 seconds to initialize .NET ACL types and create a private directory. On the hosted Windows Node 24 runner it missed that deadline twice at different startup stages, while Windows Node 20/22 and all non-Windows jobs passed.

Change

• give only the test helper a 15-second bounded probe budget
• give only the nine enclosing contracts that call it a 30-second Vitest budget
• leave production ACL implementation, production timeouts, fail-closed behavior, and security rules unchanged
• leave the dedicated hanging ACL probe at its existing 5-second deadline

Validation

• npm test: 1,828 passed, 33 skipped
• focused Windows test file parses successfully on macOS; 14 Windows-only cases skipped
• npm run lint
• npm run typecheck

The Windows 20/22/24 CI matrix is the authoritative platform validation.

Summary by CodeRabbit

• Tests
  • Improved validation of private-directory access controls during configuration migration.
  • Updated automated checks with more appropriate time limits, helping reduce unreliable test results and improve confidence in migration behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0bfac4d4-d800-4bd5-bab7-0228897ec070

📥 Commits

Reviewing files that changed from the base of the PR and between 6255210 and ab7570d.

📒 Files selected for processing (1)

• tests/windows-config-migration-acl.test.ts

---

📝 Walkthrough

Walkthrough

The Windows ACL test file now defines separate timeouts for private-directory probes and contract tests. The probe uses 15 seconds. Contract tests use 30 seconds instead of inline timeout values.

Changes

Windows ACL test timing

Layer / File(s)	Summary
Define and apply ACL test timeouts tests/windows-config-migration-acl.test.ts	The test file adds separate timeout constants. The private-directory probe uses 15 seconds. Private-directory contract, inherited-descriptor, and ACL-copy tests use 30 seconds.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• mohanagy/miftah#229: Introduced or exercised the Windows ACL migration flow covered by these timeout updates.
• mohanagy/miftah#272: Added related Windows ACL test coverage that these timeout updates modify.
• mohanagy/miftah#324: Adjusted Windows ACL-focused test execution and timing.

Poem

A rabbit hops through ACL gates,
While timers guard the test-run states.
Fifteen for probes, thirty more,
Keeps Windows knocking at the door.
The checks now wait with measured grace. 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Windows ACL probe stabilization as the primary change.
Description check	✅ Passed	The description explains the cause, scope, security boundaries, and validation, but omits explicit template headings and several checklist items.
Linked Issues check	✅ Passed	The changes satisfy issue #352 by separating 15-second probe and 30-second contract budgets while preserving production behavior and the hanging-probe deadline.
Out of Scope Changes check	✅ Passed	The changes are limited to Windows ACL integration-test timeout constants and do not alter production ACL behavior or unrelated files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/issue-352-windows-acl-probe-budget

---

_{Comment @coderabbitai help to get the list of available commands.}