fix(ci): restore the native Windows coverage denominator to green

The windows-native job has been red since #1990 put the sandbox-windows-acl sources into the Windows 100%-per-file denominator without tests carrying them, and #1543 dropped the authoring.ts V8 ignore for the POSIX-only owner-execute branch. Non-blocking at merge time, the red state has propagated to every later pull request. Cover every in-process ACL-sandbox failure branch with stub-based failure-path suites (ffi/acl/token/spawn/index), following the package's existing failure-paths pattern; the package now measures 100% per file under the Windows denominator. Exclude only the runner entry from the win32 denominator: it executes exclusively as a spawned child outside the instrumented run, and its behavior is pinned end-to-end by the runner suite. Restore the authoring.ts narrow V8 ignore and add one for the dispose token guard whose absent-token arm is lifecycle-unreachable. Update the dual-lane Agent Note with the denominator composition.
2026-08-10 19:07:35 +08:00
parent d2321d210a
commit 59a2e4d825
12 changed files with 1806 additions and 5 deletions
@@ -360,6 +360,8 @@ export class AclSandbox {
      }
    }
    const token = this.token
+    /* v8 ignore next -- init assigns this.api only after this.token, so an initialized instance always
+       has its token; the guard mirrors the write-SID guard's defensive shape. */
    if (token !== undefined) {
      try {
        if (api.closeHandle(token) === 0) throwLastError(api, 'CloseHandle', 'restricted token')