test(windows): widen functional ACL probe budget

[mohanagy]

Summary

• give the test-only functional Windows ACL descriptor probe a 15-second execution watchdog, matching the existing private-directory integration probe
• preserve the separate 60-second PowerShell bootstrap watchdog
• preserve the synthetic hanging-probe contract at 5 seconds
• leave production ACL code and fail-closed behavior unchanged

Failure evidence

Exact development commit 8eb06f626d1598f27e0b142ed307760bbd68de37 reproduced the failure in Windows Node 22:

• run: https://github.com/mohanagy/miftah/actions/runs/31445639421
• job: https://github.com/mohanagy/miftah/actions/runs/31445639421/job/93639146135
• the synthetic hang terminated in about 5.035 seconds
• the next two functional descriptor probes emitted the bootstrap marker, then exceeded the 5-second execution phase at about 5.4 and 5.3 seconds
• later descriptor probes recovered and passed in about 1.5-2.2 seconds

This trace distinguishes a functional execution-budget false boundary from process startup: bootstrap already has 60 seconds, and the marker switched these probes onto the 5-second execution watchdog.

Security impact

This changes only a Windows integration-test helper. It does not change runtime ACL enforcement, production deadlines, descriptor rules, trusted executable resolution, or fail-closed behavior. The deliberate hanging process is still killed after 5 seconds.

Local validation

• npx vitest run tests/windows-config-migration-acl.test.ts — 3 passed, 14 platform-skipped
• npm run lint
• npm run typecheck
• npm test -- --no-file-parallelism — 146 files passed; 1,842 tests passed; 34 skipped
• npm run build

Windows Node 20/22/24 and the full exact-head protected matrix remain required before merge.

Closes #352

Summary by CodeRabbit

• Bug Fixes
  • Increased the Windows PowerShell ACL probe timeout to improve reliability on slower systems.
  • Added clarification around timeout behavior for different probe types.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 36ed6567-7cac-40ed-857a-2e7e6df19ba1

📥 Commits

Reviewing files that changed from the base of the PR and between 8eb06f6 and 7ac02b1.

📒 Files selected for processing (1)

• tests/windows-config-migration-acl.test.ts

---

📝 Walkthrough

Walkthrough

The Windows functional PowerShell ACL probe timeout increases from 5 seconds to 15 seconds. The private-directory probe remains at 15 seconds, and synthetic hanging probes retain their 5-second timeout.

Changes

Windows ACL probe timing

Layer / File(s)	Summary
Functional probe timeout tests/windows-config-migration-acl.test.ts	The functional PowerShell probe now has a 15-second execution timeout. An explanatory comment documents the shared allowance with private-directory probing. Synthetic hanging probes remain unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• mohanagy/miftah#353 — Continues Windows PowerShell ACL probe stabilization in the same test file.
• mohanagy/miftah#358 — Adjusts the PowerShell ACL probe timeout for startup-budget issues.
• mohanagy/miftah#370 — Modifies timeout handling in the same Windows ACL test file.

Poem

A rabbit saw the probe run late,
So fifteen seconds now await.
The hanging test still keeps its five,
While ACL checks stay bounded, alive.
Hop, hop—the Windows tests arrive!

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Linked Issues check	❌ Error	The PR preserves production behavior and the hanging-probe deadline, but it widens the functional probe instead of the private-directory probe named in issue #352.	Clarify or update the issue scope, and provide evidence that the required private-directory timing fix and Windows Node 20, 22, and 24 acceptance criteria are satisfied.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Windows test change: widening the functional ACL probe timeout.
Description check	✅ Passed	The description covers the change, security impact, failure evidence, validation results, and remaining CI requirements.
Out of Scope Changes check	✅ Passed	The changes are limited to a Windows integration-test timeout and an explanatory comment, with no unrelated production or security changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/issue-352-acl-probe-recovery

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

CodeRabbit scope check addressed: issue #352 now records the full recurring ACL harness problem, including the latest functional descriptor execution-phase recurrence and its distinct acceptance criteria. On PR head 7ac02b1, the serialized Windows core-contract step has passed on Node 20, 22, and 24; the synthetic hang remains separately bounded at five seconds. Full-job and Linux-quality completion are still pending, so the issue remains open.

[mohanagy]

CI triage: the ACL-focused Windows core step passed on Node 20, 22, and 24. The only prerequisite failure occurred later in the unrelated package contract on Windows Node 22: npm pack --dry-run --json exceeded that test existing 5-second Vitest limit at tests/package-contract.test.ts:950. The same package contract passed on Windows Node 20 and 24 and locally on this head. No package-contract or ACL-source coupling exists in this one-file diff, so I am using the CI-fix policy single failed-job rerun rather than adding a speculative unrelated patch.