fix(auth): pin native auth storage operations

2026-08-17 14:52:21 +02:00
parent 6d438f4c7e
commit cb0e873ed7
23 changed files with 3016 additions and 1385 deletions
@@ -0,0 +1,67 @@
+package safeio
+
+import (
+	"strings"
+	"sync"
+)
+
+// PrivateDirectoryHandle pins one private directory for the duration of a storage operation.
+// Implementations use descriptor-relative operations on POSIX and retained no-delete handles on
+// Windows. Callers must close every returned child before releasing its parent.
+type PrivateDirectoryHandle interface {
+	Close() error
+	Validate() error
+	OpenChild(name string, ensure bool) (PrivateDirectoryHandle, bool, error)
+	CreateRegular(name string, contents []byte) (bool, error)
+	ReadRegular(name string, maximum int64) ([]byte, bool, error)
+	ReplaceRegular(name string, contents []byte) error
+	RemoveRegular(name string) (bool, error)
+	ListPage(maximumEntries int, afterName string, validName func(string) bool, validLinks func(string, uint64) bool) (PrivateDirectoryPage, error)
+	ClaimRegular(source, claim string) (bool, error)
+	ReadClaim(source, claim string, maximum int64) ([]byte, bool, error)
+	RemoveClaim(source, claim string) (bool, error)
+}
+
+// OpenPrivateDirectory validates or creates the final private directory while retaining the
+// opened canonical directory handle. With ensure=false, found=false means the final component is
+// absent but its already-opened parent proves the same operation could safely create it.
+func OpenPrivateDirectory(path string, ensure bool) (PrivateDirectoryHandle, bool, error) {
+	if err := ValidateCanonicalPath(path); err != nil {
+		return nil, false, ErrUnsafeFile
+	}
+	return openPrivateDirectory(path, ensure)
+}
+
+func validPrivateLeafName(name string) bool {
+	return name != "" && name != "." && name != ".." && !strings.ContainsAny(name, "\\/:\x00")
+}
+
+var privateDirectoryTestHook struct {
+	sync.RWMutex
+	hook func(string)
+}
+
+// SetPrivateDirectoryTestHookForTest installs a deterministic race hook for internal package
+// tests. It has no production effect unless a test explicitly installs one.
+func SetPrivateDirectoryTestHookForTest(hook func(string)) func() {
+	privateDirectoryTestHook.Lock()
+	previous := privateDirectoryTestHook.hook
+	privateDirectoryTestHook.hook = hook
+	privateDirectoryTestHook.Unlock()
+	return func() {
+		privateDirectoryTestHook.Lock()
+		privateDirectoryTestHook.hook = previous
+		privateDirectoryTestHook.Unlock()
+	}
+}
+
+// NotifyPrivateDirectoryTestHookForTest marks an internal retained-root boundary. It is called
+// only by storage code and lets tests install deterministic directory replacement races.
+func NotifyPrivateDirectoryTestHookForTest(stage string) {
+	privateDirectoryTestHook.RLock()
+	hook := privateDirectoryTestHook.hook
+	privateDirectoryTestHook.RUnlock()
+	if hook != nil {
+		hook(stage)
+	}
+}
@@ -0,0 +1,420 @@
+//go:build !windows
+
+package safeio
+
+import (
+	"errors"
+	"io"
+	"os"
+	"sort"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+type unixPrivateDirectory struct {
+	descriptor int
+}
+
+func openPrivateDirectory(path string, ensure bool) (PrivateDirectoryHandle, bool, error) {
+	parents, err := openCanonicalUnixParent(path)
+	if err != nil {
+		return nil, false, ErrUnsafeFile
+	}
+	defer parents.Close()
+	return openPrivateUnixDirectoryAt(parents.parent, parents.target, ensure)
+}
+
+func openPrivateUnixDirectoryAt(parent int, name string, ensure bool) (PrivateDirectoryHandle, bool, error) {
+	if parent < 0 || !validPrivateLeafName(name) {
+		return nil, false, ErrUnsafeFile
+	}
+	for attempt := 0; attempt < 2; attempt++ {
+		descriptor, err := unix.Openat(parent, name, unix.O_RDONLY|unix.O_CLOEXEC|unix.O_DIRECTORY|unix.O_NOFOLLOW, 0)
+		if err == nil {
+			value := &unixPrivateDirectory{descriptor: descriptor}
+			if value.Validate() != nil {
+				_ = value.Close()
+				return nil, false, ErrUnsafeFile
+			}
+			return value, true, nil
+		}
+		if !errors.Is(err, unix.ENOENT) {
+			return nil, false, ErrUnsafeFile
+		}
+		if !ensure {
+			if unix.Faccessat(parent, ".", unix.W_OK|unix.X_OK, unix.AT_EACCESS) != nil {
+				return nil, false, ErrUnsafeFile
+			}
+			return nil, false, nil
+		}
+		if err := unix.Mkdirat(parent, name, 0o700); err != nil && !errors.Is(err, unix.EEXIST) {
+			return nil, false, ErrUnsafeFile
+		}
+	}
+	return nil, false, ErrUnsafeFile
+}
+
+func (directory *unixPrivateDirectory) Close() error {
+	if directory == nil || directory.descriptor < 0 {
+		return nil
+	}
+	err := unix.Close(directory.descriptor)
+	directory.descriptor = -1
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	return nil
+}
+
+func (directory *unixPrivateDirectory) Validate() error {
+	if directory == nil || directory.descriptor < 0 {
+		return ErrUnsafeFile
+	}
+	var stat unix.Stat_t
+	if err := unix.Fstat(directory.descriptor, &stat); err != nil || !privateUnixDirectoryStat(&stat) {
+		return ErrUnsafeFile
+	}
+	return nil
+}
+
+func (directory *unixPrivateDirectory) OpenChild(name string, ensure bool) (PrivateDirectoryHandle, bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(name) {
+		return nil, false, ErrUnsafeFile
+	}
+	child, found, err := openPrivateUnixDirectoryAt(directory.descriptor, name, ensure)
+	if err != nil || directory.Validate() != nil {
+		if child != nil {
+			_ = child.Close()
+		}
+		return nil, false, ErrUnsafeFile
+	}
+	return child, found, nil
+}
+
+func privateUnixRootRegular(stat *unix.Stat_t, links uint64) bool {
+	return stat != nil && stat.Mode&unix.S_IFMT == unix.S_IFREG && uint64(stat.Nlink) == links &&
+		stat.Uid == uint32(os.Geteuid()) && stat.Mode&0o7777 == 0o600
+}
+
+func sameUnixRootRegular(left, right unix.Stat_t) bool {
+	return left.Dev == right.Dev && left.Ino == right.Ino && left.Size == right.Size &&
+		left.Mtim == right.Mtim && left.Ctim == right.Ctim && left.Mode == right.Mode && left.Nlink == right.Nlink
+}
+
+func requirePrivateUnixRootRegularAt(directory int, name string, links uint64) (unix.Stat_t, error) {
+	var stat unix.Stat_t
+	if err := unix.Fstatat(directory, name, &stat, unix.AT_SYMLINK_NOFOLLOW); err != nil || !privateUnixRootRegular(&stat, links) {
+		return unix.Stat_t{}, ErrUnsafeFile
+	}
+	return stat, nil
+}
+
+func privateUnixRootRegularAtAllowedLinks(directory int, name string, allowed ...uint64) error {
+	var stat unix.Stat_t
+	if err := unix.Fstatat(directory, name, &stat, unix.AT_SYMLINK_NOFOLLOW); err != nil {
+		return ErrUnsafeFile
+	}
+	for _, links := range allowed {
+		if privateUnixRootRegular(&stat, links) {
+			return nil
+		}
+	}
+	return ErrUnsafeFile
+}
+
+func requireSamePrivateUnixRootPairAt(directory int, source, claim string) error {
+	left, err := requirePrivateUnixRootRegularAt(directory, source, 2)
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	right, err := requirePrivateUnixRootRegularAt(directory, claim, 2)
+	if err != nil || !sameUnixPrivateFile(left, right) {
+		return ErrUnsafeFile
+	}
+	return nil
+}
+
+func isPrivateUnixRootClaimAbsentOrOrphanAt(directory int, source, claim string) bool {
+	var sourceStat, claimStat unix.Stat_t
+	sourceErr := unix.Fstatat(directory, source, &sourceStat, unix.AT_SYMLINK_NOFOLLOW)
+	claimErr := unix.Fstatat(directory, claim, &claimStat, unix.AT_SYMLINK_NOFOLLOW)
+	if errors.Is(sourceErr, unix.ENOENT) && errors.Is(claimErr, unix.ENOENT) {
+		return true
+	}
+	return errors.Is(sourceErr, unix.ENOENT) && claimErr == nil && privateUnixRootRegular(&claimStat, 1)
+}
+
+func writeAllPrivateRoot(file *os.File, contents []byte) error {
+	for written := 0; written < len(contents); {
+		count, err := file.Write(contents[written:])
+		written += count
+		if err != nil {
+			return err
+		}
+		if count == 0 {
+			return io.ErrShortWrite
+		}
+	}
+	return file.Sync()
+}
+
+func (directory *unixPrivateDirectory) CreateRegular(name string, contents []byte) (bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(name) || len(contents) == 0 {
+		return false, ErrUnsafeFile
+	}
+	descriptor, err := unix.Openat(directory.descriptor, name,
+		unix.O_WRONLY|unix.O_CREAT|unix.O_EXCL|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0o600)
+	if errors.Is(err, unix.EEXIST) {
+		if _, existingErr := requirePrivateUnixRootRegularAt(directory.descriptor, name, 1); existingErr != nil || directory.Validate() != nil {
+			return false, ErrUnsafeFile
+		}
+		return false, nil
+	}
+	if err != nil {
+		return false, ErrUnsafeFile
+	}
+	file := os.NewFile(uintptr(descriptor), "tht-safeio-private-root-create")
+	if file == nil {
+		_ = unix.Close(descriptor)
+		_ = unix.Unlinkat(directory.descriptor, name, 0)
+		return false, ErrUnsafeFile
+	}
+	failed := true
+	defer func() {
+		if failed {
+			_ = unix.Unlinkat(directory.descriptor, name, 0)
+		}
+	}()
+	if unix.Fchmod(descriptor, 0o600) != nil {
+		_ = file.Close()
+		return false, ErrUnsafeFile
+	}
+	var stat unix.Stat_t
+	if unix.Fstat(descriptor, &stat) != nil || !privateUnixRootRegular(&stat, 1) || writeAllPrivateRoot(file, contents) != nil || file.Close() != nil {
+		return false, ErrUnsafeFile
+	}
+	if directory.Validate() != nil || unix.Fsync(directory.descriptor) != nil {
+		return false, ErrUnsafeFile
+	}
+	failed = false
+	return true, nil
+}
+
+func (directory *unixPrivateDirectory) ReadRegular(name string, maximum int64) ([]byte, bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(name) || maximum < 0 || maximum == int64(^uint64(0)>>1) {
+		return nil, false, ErrUnsafeFile
+	}
+	before, err := requirePrivateUnixRootRegularAt(directory.descriptor, name, 1)
+	if err != nil {
+		var stat unix.Stat_t
+		if statErr := unix.Fstatat(directory.descriptor, name, &stat, unix.AT_SYMLINK_NOFOLLOW); errors.Is(statErr, unix.ENOENT) {
+			return nil, false, nil
+		}
+		return nil, false, ErrUnsafeFile
+	}
+	descriptor, err := unix.Openat(directory.descriptor, name, unix.O_RDONLY|unix.O_CLOEXEC|unix.O_NOFOLLOW|unix.O_NONBLOCK, 0)
+	if err != nil {
+		return nil, false, ErrUnsafeFile
+	}
+	file := os.NewFile(uintptr(descriptor), "tht-safeio-private-root-read")
+	if file == nil {
+		_ = unix.Close(descriptor)
+		return nil, false, ErrUnsafeFile
+	}
+	contents, readErr := io.ReadAll(io.LimitReader(file, maximum+1))
+	var opened unix.Stat_t
+	statErr := unix.Fstat(descriptor, &opened)
+	closeErr := file.Close()
+	var current unix.Stat_t
+	currentErr := unix.Fstatat(directory.descriptor, name, &current, unix.AT_SYMLINK_NOFOLLOW)
+	if readErr != nil || statErr != nil || closeErr != nil || currentErr != nil || int64(len(contents)) > maximum ||
+		!privateUnixRootRegular(&opened, 1) || !privateUnixRootRegular(&current, 1) ||
+		!sameUnixRootRegular(before, opened) || !sameUnixRootRegular(opened, current) || directory.Validate() != nil {
+		return nil, false, ErrUnsafeFile
+	}
+	return contents, true, nil
+}
+
+func (directory *unixPrivateDirectory) ReplaceRegular(name string, contents []byte) error {
+	if directory.Validate() != nil || !validPrivateLeafName(name) || len(contents) == 0 {
+		return ErrUnsafeFile
+	}
+	if _, err := requirePrivateUnixRootRegularAt(directory.descriptor, name, 1); err != nil {
+		return ErrUnsafeFile
+	}
+	temporary, err := writePrivateTemporaryAt(directory.descriptor, contents)
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	defer func() { _ = unix.Unlinkat(directory.descriptor, temporary, 0) }()
+	if _, err := requirePrivateUnixRootRegularAt(directory.descriptor, name, 1); err != nil || directory.Validate() != nil {
+		return ErrUnsafeFile
+	}
+	if err := unix.Renameat(directory.descriptor, temporary, directory.descriptor, name); err != nil || unix.Fsync(directory.descriptor) != nil || directory.Validate() != nil {
+		return ErrUnsafeFile
+	}
+	return nil
+}
+
+func (directory *unixPrivateDirectory) RemoveRegular(name string) (bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(name) {
+		return false, ErrUnsafeFile
+	}
+	if _, err := requirePrivateUnixRootRegularAt(directory.descriptor, name, 1); err != nil {
+		var stat unix.Stat_t
+		if statErr := unix.Fstatat(directory.descriptor, name, &stat, unix.AT_SYMLINK_NOFOLLOW); errors.Is(statErr, unix.ENOENT) {
+			return false, nil
+		}
+		return false, ErrUnsafeFile
+	}
+	if err := unix.Unlinkat(directory.descriptor, name, 0); err != nil || unix.Fsync(directory.descriptor) != nil || directory.Validate() != nil {
+		return false, ErrUnsafeFile
+	}
+	return true, nil
+}
+
+func (directory *unixPrivateDirectory) ListPage(
+	maximumEntries int,
+	afterName string,
+	validName func(string) bool,
+	validLinks func(string, uint64) bool,
+) (PrivateDirectoryPage, error) {
+	if directory.Validate() != nil || maximumEntries < 1 || maximumEntries > 4096 || validName == nil || validLinks == nil || (afterName != "" && !validName(afterName)) {
+		return PrivateDirectoryPage{}, ErrUnsafeFile
+	}
+	var before unix.Stat_t
+	if unix.Fstat(directory.descriptor, &before) != nil || !privateUnixDirectoryStat(&before) {
+		return PrivateDirectoryPage{}, ErrUnsafeFile
+	}
+	duplicate, err := unix.Dup(directory.descriptor)
+	if err != nil {
+		return PrivateDirectoryPage{}, ErrUnsafeFile
+	}
+	file := os.NewFile(uintptr(duplicate), "tht-safeio-private-root-list")
+	if file == nil {
+		_ = unix.Close(duplicate)
+		return PrivateDirectoryPage{}, ErrUnsafeFile
+	}
+	defer file.Close()
+	seen := make(map[string]struct{}, maximumEntries+1)
+	selected := make([]PrivateDirectoryEntry, 0, maximumEntries+1)
+	scanned := 0
+	for {
+		entries, readErr := file.ReadDir(1)
+		if readErr != nil && !errors.Is(readErr, io.EOF) {
+			return PrivateDirectoryPage{}, ErrUnsafeFile
+		}
+		if len(entries) == 0 {
+			break
+		}
+		if len(entries) != 1 {
+			return PrivateDirectoryPage{}, ErrUnsafeFile
+		}
+		scanned++
+		if scanned > maximumPrivateDirectoryPageScanEntries {
+			return PrivateDirectoryPage{}, ErrUnsafeFile
+		}
+		name := entries[0].Name()
+		if !validPrivateLeafName(name) || !validName(name) {
+			return PrivateDirectoryPage{}, ErrUnsafeFile
+		}
+		if _, duplicate := seen[name]; duplicate {
+			return PrivateDirectoryPage{}, ErrUnsafeFile
+		}
+		seen[name] = struct{}{}
+		var stat unix.Stat_t
+		if unix.Fstatat(directory.descriptor, name, &stat, unix.AT_SYMLINK_NOFOLLOW) != nil ||
+			!privateUnixRootRegular(&stat, uint64(stat.Nlink)) || !validLinks(name, uint64(stat.Nlink)) {
+			return PrivateDirectoryPage{}, ErrUnsafeFile
+		}
+		if name > afterName {
+			selected = appendBoundedPrivateDirectoryEntry(selected, PrivateDirectoryEntry{
+				Name: name, ModifiedUnixMs: time.Unix(stat.Mtim.Sec, stat.Mtim.Nsec).UnixMilli(),
+			}, maximumEntries+1)
+		}
+		if errors.Is(readErr, io.EOF) {
+			break
+		}
+	}
+	var after unix.Stat_t
+	if unix.Fstat(directory.descriptor, &after) != nil || !privateUnixDirectoryStat(&after) ||
+		before.Dev != after.Dev || before.Ino != after.Ino || before.Mode != after.Mode || before.Mtim != after.Mtim || before.Ctim != after.Ctim || directory.Validate() != nil {
+		return PrivateDirectoryPage{}, ErrUnsafeFile
+	}
+	sort.Slice(selected, func(left, right int) bool { return selected[left].Name < selected[right].Name })
+	more := len(selected) > maximumEntries
+	if more {
+		selected = selected[:maximumEntries]
+	}
+	return PrivateDirectoryPage{Entries: selected, More: more}, nil
+}
+
+func (directory *unixPrivateDirectory) ClaimRegular(source, claim string) (bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(source) || !validPrivateLeafName(claim) {
+		return false, ErrUnsafeFile
+	}
+	if err := privateUnixRootRegularAtAllowedLinks(directory.descriptor, source, 1); err != nil {
+		if requireSamePrivateUnixRootPairAt(directory.descriptor, source, claim) == nil || isPrivateUnixRootClaimAbsentOrOrphanAt(directory.descriptor, source, claim) {
+			return false, nil
+		}
+		return false, ErrUnsafeFile
+	}
+	if err := unix.Linkat(directory.descriptor, source, directory.descriptor, claim, 0); err != nil {
+		if errors.Is(err, unix.EEXIST) && privateUnixRootRegularAtAllowedLinks(directory.descriptor, claim, 1, 2) == nil {
+			return false, nil
+		}
+		return false, ErrUnsafeFile
+	}
+	if err := requireSamePrivateUnixRootPairAt(directory.descriptor, source, claim); err != nil || unix.Fsync(directory.descriptor) != nil || directory.Validate() != nil {
+		return false, ErrUnsafeFile
+	}
+	return true, nil
+}
+
+func (directory *unixPrivateDirectory) ReadClaim(source, claim string, maximum int64) ([]byte, bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(source) || !validPrivateLeafName(claim) || maximum < 0 || maximum == int64(^uint64(0)>>1) {
+		return nil, false, ErrUnsafeFile
+	}
+	if err := requireSamePrivateUnixRootPairAt(directory.descriptor, source, claim); err != nil {
+		if isPrivateUnixRootClaimAbsentOrOrphanAt(directory.descriptor, source, claim) {
+			return nil, false, nil
+		}
+		return nil, false, ErrUnsafeFile
+	}
+	descriptor, err := unix.Openat(directory.descriptor, source, unix.O_RDONLY|unix.O_CLOEXEC|unix.O_NOFOLLOW|unix.O_NONBLOCK, 0)
+	if err != nil {
+		return nil, false, ErrUnsafeFile
+	}
+	file := os.NewFile(uintptr(descriptor), "tht-safeio-private-root-claim")
+	if file == nil {
+		_ = unix.Close(descriptor)
+		return nil, false, ErrUnsafeFile
+	}
+	contents, readErr := io.ReadAll(io.LimitReader(file, maximum+1))
+	var after unix.Stat_t
+	statErr := unix.Fstat(descriptor, &after)
+	closeErr := file.Close()
+	if readErr != nil || statErr != nil || closeErr != nil || int64(len(contents)) > maximum || !privateUnixRootRegular(&after, 2) ||
+		requireSamePrivateUnixRootPairAt(directory.descriptor, source, claim) != nil || directory.Validate() != nil {
+		return nil, false, ErrUnsafeFile
+	}
+	return contents, true, nil
+}
+
+func (directory *unixPrivateDirectory) RemoveClaim(source, claim string) (bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(source) || !validPrivateLeafName(claim) {
+		return false, ErrUnsafeFile
+	}
+	if err := requireSamePrivateUnixRootPairAt(directory.descriptor, source, claim); err != nil {
+		if isPrivateUnixRootClaimAbsentOrOrphanAt(directory.descriptor, source, claim) {
+			return false, nil
+		}
+		return false, ErrUnsafeFile
+	}
+	if err := unix.Unlinkat(directory.descriptor, source, 0); err != nil || privateUnixRootRegularAtAllowedLinks(directory.descriptor, claim, 1) != nil ||
+		unix.Unlinkat(directory.descriptor, claim, 0) != nil || unix.Fsync(directory.descriptor) != nil || directory.Validate() != nil {
+		return false, ErrUnsafeFile
+	}
+	return true, nil
+}
@@ -0,0 +1,921 @@
+//go:build windows
+
+package safeio
+
+import (
+	"errors"
+	"io"
+	"os"
+	"runtime"
+	"sort"
+	"time"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+// windowsPrivateDirectory keeps the root's canonical component handles alive, then uses NT
+// RootDirectory-relative opens for every descendant. Unlike a lexical child path, an NT relative
+// object name is resolved by the already-open directory handle and cannot be redirected by a
+// rename, replacement, or reparse point at the original root path.
+type windowsPrivateDirectory struct {
+	anchors *windowsParentHandles
+	parent  windows.Handle
+	handle  windows.Handle
+	info    windows.ByHandleFileInformation
+}
+
+type windowsPrivateRegularAt struct {
+	handle windows.Handle
+	info   windows.ByHandleFileInformation
+}
+
+func openPrivateDirectory(path string, ensure bool) (PrivateDirectoryHandle, bool, error) {
+	anchors, target, err := openCanonicalWindowsParent(path)
+	if err != nil || anchors == nil || len(anchors.handles) == 0 {
+		if anchors != nil {
+			anchors.Close()
+		}
+		return nil, false, ErrUnsafeFile
+	}
+	parent := anchors.handles[len(anchors.handles)-1]
+	handle, found, err := openWindowsPrivateDirectoryAt(parent, target, false)
+	if err != nil {
+		anchors.Close()
+		return nil, false, ErrUnsafeFile
+	}
+	if !found {
+		// The final root is absent. The retained canonical parent must prove that the same
+		// ensure operation could create it; validation itself must remain side-effect free.
+		// FILE_APPEND_DATA is the Win32 spelling of directory FILE_ADD_SUBDIRECTORY.
+		probe, probeErr := openWindowsComponentWithAccess(anchors.directory, true, windows.FILE_APPEND_DATA)
+		if probeErr != nil {
+			anchors.Close()
+			return nil, false, ErrUnsafeFile
+		}
+		_ = windows.CloseHandle(probe)
+		if !ensure {
+			anchors.Close()
+			return nil, false, nil
+		}
+		// The canonical parent chain remains pinned by anchors; this extra handle supplies
+		// FILE_ADD_SUBDIRECTORY for the one initial root creation without reopening a child
+		// beneath the private root lexically.
+		writableParent, writableErr := openWindowsComponentWithAccess(anchors.directory, true, windows.FILE_APPEND_DATA)
+		if writableErr != nil {
+			anchors.Close()
+			return nil, false, ErrUnsafeFile
+		}
+		handle, found, err = openWindowsPrivateDirectoryAt(writableParent, target, true)
+		_ = windows.CloseHandle(writableParent)
+		if err != nil || !found {
+			anchors.Close()
+			return nil, false, ErrUnsafeFile
+		}
+	}
+	value := &windowsPrivateDirectory{anchors: anchors, handle: handle}
+	if value.captureAndValidate() != nil {
+		_ = value.Close()
+		return nil, false, ErrUnsafeFile
+	}
+	return value, true, nil
+}
+
+func openWindowsPrivateDirectoryAt(parent windows.Handle, name string, ensure bool) (windows.Handle, bool, error) {
+	if parent == 0 || !validPrivateLeafName(name) {
+		return 0, false, ErrUnsafeFile
+	}
+	for attempt := 0; attempt < 2; attempt++ {
+		handle, err := openWindowsRelativeDirectory(parent, name)
+		if err == nil {
+			return handle, true, nil
+		}
+		if !isWindowsRelativeNotFound(err) {
+			return 0, false, ErrUnsafeFile
+		}
+		if !ensure {
+			return 0, false, nil
+		}
+		handle, err = createWindowsRelativePrivateDirectory(parent, name)
+		if err == nil {
+			return handle, true, nil
+		}
+	}
+	return 0, false, ErrUnsafeFile
+}
+
+func openWindowsRelativeDirectory(parent windows.Handle, name string) (windows.Handle, error) {
+	handle, err := openWindowsRelativeObject(
+		parent,
+		name,
+		// The retained directory handle is also the RootDirectory for create, rename,
+		// hard-link, and delete operations below, so it needs the owner's full private
+		// directory capability rather than a read-only probe handle.
+		windows.FILE_GENERIC_READ|windows.FILE_GENERIC_WRITE|windows.DELETE,
+		windows.FILE_OPEN,
+		windows.FILE_DIRECTORY_FILE|windows.FILE_SYNCHRONOUS_IO_NONALERT|windows.FILE_OPEN_REPARSE_POINT,
+		nil,
+	)
+	if err != nil {
+		return 0, err
+	}
+	if _, err := privateWindowsDirectoryInfo(handle); err != nil {
+		_ = windows.CloseHandle(handle)
+		return 0, ErrUnsafeFile
+	}
+	return handle, nil
+}
+
+func createWindowsRelativePrivateDirectory(parent windows.Handle, name string) (windows.Handle, error) {
+	security, err := newOwnerOnlySecurityDescriptor()
+	if err != nil {
+		return 0, ErrUnsafeFile
+	}
+	defer security.Close()
+	handle, err := openWindowsRelativeObject(
+		parent,
+		name,
+		windows.FILE_GENERIC_READ|windows.FILE_GENERIC_WRITE|windows.DELETE,
+		windows.FILE_CREATE,
+		windows.FILE_DIRECTORY_FILE|windows.FILE_SYNCHRONOUS_IO_NONALERT|windows.FILE_OPEN_REPARSE_POINT,
+		security,
+	)
+	if err != nil {
+		return 0, err
+	}
+	if _, err := privateWindowsDirectoryInfo(handle); err != nil {
+		_ = markWindowsHandleForDelete(handle)
+		_ = windows.CloseHandle(handle)
+		return 0, ErrUnsafeFile
+	}
+	return handle, nil
+}
+
+func openWindowsRelativeObject(
+	parent windows.Handle,
+	name string,
+	access uint32,
+	disposition uint32,
+	options uint32,
+	security *ownerOnlySecurityDescriptor,
+) (windows.Handle, error) {
+	if parent == 0 || !validPrivateLeafName(name) {
+		return 0, ErrUnsafeFile
+	}
+	objectName, err := windows.NewNTUnicodeString(name)
+	if err != nil {
+		return 0, ErrUnsafeFile
+	}
+	attributes := &windows.OBJECT_ATTRIBUTES{
+		Length:             uint32(unsafe.Sizeof(windows.OBJECT_ATTRIBUTES{})),
+		RootDirectory:      parent,
+		ObjectName:         objectName,
+		Attributes:         windows.OBJ_CASE_INSENSITIVE,
+		SecurityDescriptor: nil,
+	}
+	if security != nil {
+		attributes.SecurityDescriptor = security.descriptor
+	}
+	var (
+		handle         windows.Handle
+		status         windows.IO_STATUS_BLOCK
+		allocationSize int64
+	)
+	err = windows.NtCreateFile(
+		&handle,
+		access,
+		attributes,
+		&status,
+		&allocationSize,
+		windows.FILE_ATTRIBUTE_NORMAL,
+		windowsRetainedHandleShareMode,
+		disposition,
+		options,
+		0,
+		0,
+	)
+	runtime.KeepAlive(objectName)
+	runtime.KeepAlive(security)
+	if err != nil {
+		return 0, err
+	}
+	return handle, nil
+}
+
+func privateWindowsDirectoryInfo(handle windows.Handle) (windows.ByHandleFileInformation, error) {
+	var info windows.ByHandleFileInformation
+	if handle == 0 || windows.GetFileInformationByHandle(handle, &info) != nil ||
+		info.FileAttributes&windows.FILE_ATTRIBUTE_REPARSE_POINT != 0 ||
+		info.FileAttributes&windows.FILE_ATTRIBUTE_DIRECTORY == 0 ||
+		validateOwnerOnlyDACL(handle) != nil {
+		return windows.ByHandleFileInformation{}, ErrUnsafeFile
+	}
+	return info, nil
+}
+
+func privateWindowsRegularInfo(handle windows.Handle, allowedLinks ...uint32) (windows.ByHandleFileInformation, error) {
+	var info windows.ByHandleFileInformation
+	if handle == 0 || windows.GetFileInformationByHandle(handle, &info) != nil ||
+		info.FileAttributes&windows.FILE_ATTRIBUTE_REPARSE_POINT != 0 ||
+		info.FileAttributes&windows.FILE_ATTRIBUTE_DIRECTORY != 0 ||
+		validateOwnerOnlyDACL(handle) != nil {
+		return windows.ByHandleFileInformation{}, ErrUnsafeFile
+	}
+	for _, links := range allowedLinks {
+		if info.NumberOfLinks == links {
+			return info, nil
+		}
+	}
+	return windows.ByHandleFileInformation{}, ErrUnsafeFile
+}
+
+func isWindowsRelativeNotFound(err error) bool {
+	return errors.Is(err, windows.ERROR_FILE_NOT_FOUND) ||
+		errors.Is(err, windows.ERROR_PATH_NOT_FOUND) ||
+		errors.Is(err, windows.STATUS_NO_SUCH_FILE) ||
+		errors.Is(err, windows.STATUS_OBJECT_NAME_NOT_FOUND) ||
+		errors.Is(err, windows.STATUS_OBJECT_PATH_NOT_FOUND)
+}
+
+func isWindowsRelativeCollision(err error) bool {
+	return errors.Is(err, windows.ERROR_FILE_EXISTS) ||
+		errors.Is(err, windows.ERROR_ALREADY_EXISTS) ||
+		errors.Is(err, windows.STATUS_OBJECT_NAME_COLLISION)
+}
+
+func (directory *windowsPrivateDirectory) captureAndValidate() error {
+	if directory == nil || directory.handle == 0 {
+		return ErrUnsafeFile
+	}
+	info, err := privateWindowsDirectoryInfo(directory.handle)
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	directory.info = info
+	return nil
+}
+
+func (directory *windowsPrivateDirectory) Close() error {
+	if directory == nil {
+		return nil
+	}
+	var result error
+	if directory.handle != 0 {
+		if err := windows.CloseHandle(directory.handle); err != nil {
+			result = ErrUnsafeFile
+		}
+		directory.handle = 0
+	}
+	if directory.parent != 0 {
+		if err := windows.CloseHandle(directory.parent); err != nil {
+			result = ErrUnsafeFile
+		}
+		directory.parent = 0
+	}
+	if directory.anchors != nil {
+		directory.anchors.Close()
+		directory.anchors = nil
+	}
+	return result
+}
+
+func sameWindowsPrivateDirectoryIdentity(left, right windows.ByHandleFileInformation) bool {
+	return left.VolumeSerialNumber == right.VolumeSerialNumber && left.FileIndexHigh == right.FileIndexHigh &&
+		left.FileIndexLow == right.FileIndexLow && left.FileAttributes == right.FileAttributes
+}
+
+func sameWindowsPrivateDirectorySnapshot(left, right windows.ByHandleFileInformation) bool {
+	return sameWindowsPrivateDirectoryIdentity(left, right) && left.LastWriteTime == right.LastWriteTime
+}
+
+func (directory *windowsPrivateDirectory) Validate() error {
+	if directory == nil || directory.handle == 0 || (directory.anchors == nil && directory.parent == 0) {
+		return ErrUnsafeFile
+	}
+	if directory.anchors != nil && len(directory.anchors.handles) == 0 {
+		return ErrUnsafeFile
+	}
+	if directory.parent != 0 {
+		if _, err := privateWindowsDirectoryInfo(directory.parent); err != nil {
+			return ErrUnsafeFile
+		}
+	}
+	current, err := privateWindowsDirectoryInfo(directory.handle)
+	if err != nil || !sameWindowsPrivateDirectoryIdentity(directory.info, current) {
+		return ErrUnsafeFile
+	}
+	return nil
+}
+
+func duplicateWindowsRetainedHandle(handle windows.Handle) (windows.Handle, error) {
+	if handle == 0 {
+		return 0, ErrUnsafeFile
+	}
+	var duplicate windows.Handle
+	process := windows.CurrentProcess()
+	if err := windows.DuplicateHandle(process, handle, process, &duplicate, 0, false, windows.DUPLICATE_SAME_ACCESS); err != nil {
+		return 0, ErrUnsafeFile
+	}
+	return duplicate, nil
+}
+
+func (directory *windowsPrivateDirectory) OpenChild(name string, ensure bool) (PrivateDirectoryHandle, bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(name) {
+		return nil, false, ErrUnsafeFile
+	}
+	parent, err := duplicateWindowsRetainedHandle(directory.handle)
+	if err != nil {
+		return nil, false, ErrUnsafeFile
+	}
+	handle, found, err := openWindowsPrivateDirectoryAt(parent, name, ensure)
+	if err != nil || !found {
+		_ = windows.CloseHandle(parent)
+		if err != nil {
+			return nil, false, ErrUnsafeFile
+		}
+		return nil, false, nil
+	}
+	child := &windowsPrivateDirectory{parent: parent, handle: handle}
+	if child.captureAndValidate() != nil || directory.Validate() != nil {
+		_ = child.Close()
+		return nil, false, ErrUnsafeFile
+	}
+	return child, true, nil
+}
+
+func openWindowsPrivateRegularAt(
+	parent windows.Handle,
+	name string,
+	access uint32,
+	allowedLinks ...uint32,
+) (*windowsPrivateRegularAt, error) {
+	handle, err := openWindowsRelativeObject(
+		parent,
+		name,
+		access,
+		windows.FILE_OPEN,
+		windows.FILE_NON_DIRECTORY_FILE|windows.FILE_SYNCHRONOUS_IO_NONALERT|windows.FILE_OPEN_REPARSE_POINT,
+		nil,
+	)
+	if err != nil {
+		return nil, err
+	}
+	info, err := privateWindowsRegularInfo(handle, allowedLinks...)
+	if err != nil {
+		_ = windows.CloseHandle(handle)
+		return nil, ErrUnsafeFile
+	}
+	return &windowsPrivateRegularAt{handle: handle, info: info}, nil
+}
+
+func openWindowsPrivateRegularAtAllowedLinks(
+	parent windows.Handle,
+	name string,
+	access uint32,
+	allowedLinks ...uint32,
+) (*windowsPrivateRegularAt, error) {
+	var (
+		lastError   error
+		unsafeFound bool
+	)
+	for _, links := range allowedLinks {
+		value, err := openWindowsPrivateRegularAt(parent, name, access, links)
+		if err == nil {
+			return value, nil
+		}
+		lastError = err
+		if !isWindowsRelativeNotFound(err) {
+			unsafeFound = true
+		}
+	}
+	if unsafeFound {
+		return nil, ErrUnsafeFile
+	}
+	return nil, lastError
+}
+
+func createWindowsPrivateRegularAt(parent windows.Handle, name string) (*windowsPrivateRegularAt, error) {
+	security, err := newOwnerOnlySecurityDescriptor()
+	if err != nil {
+		return nil, ErrUnsafeFile
+	}
+	defer security.Close()
+	handle, err := openWindowsRelativeObject(
+		parent,
+		name,
+		windows.FILE_GENERIC_READ|windows.FILE_GENERIC_WRITE|windows.DELETE,
+		windows.FILE_CREATE,
+		windows.FILE_NON_DIRECTORY_FILE|windows.FILE_SYNCHRONOUS_IO_NONALERT|windows.FILE_OPEN_REPARSE_POINT,
+		security,
+	)
+	if err != nil {
+		return nil, err
+	}
+	info, err := privateWindowsRegularInfo(handle, 1)
+	if err != nil {
+		_ = markWindowsHandleForDelete(handle)
+		_ = windows.CloseHandle(handle)
+		return nil, ErrUnsafeFile
+	}
+	return &windowsPrivateRegularAt{handle: handle, info: info}, nil
+}
+
+func (value *windowsPrivateRegularAt) Close() error {
+	if value == nil || value.handle == 0 {
+		return nil
+	}
+	handle := value.handle
+	value.handle = 0
+	if err := windows.CloseHandle(handle); err != nil {
+		return ErrUnsafeFile
+	}
+	return nil
+}
+
+func writeWindowsPrivateRegular(value *windowsPrivateRegularAt, contents []byte) error {
+	if value == nil || value.handle == 0 || len(contents) == 0 {
+		return ErrUnsafeFile
+	}
+	for remaining := contents; len(remaining) > 0; {
+		var written uint32
+		if err := windows.WriteFile(value.handle, remaining, &written, nil); err != nil || written == 0 || int(written) > len(remaining) {
+			return ErrUnsafeFile
+		}
+		remaining = remaining[written:]
+	}
+	if err := windows.FlushFileBuffers(value.handle); err != nil {
+		return ErrUnsafeFile
+	}
+	info, err := privateWindowsRegularInfo(value.handle, 1)
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	value.info = info
+	return nil
+}
+
+func readWindowsPrivateRegular(value *windowsPrivateRegularAt, maximum int64, links uint32) ([]byte, error) {
+	if value == nil || value.handle == 0 || maximum < 0 || maximum == int64(^uint64(0)>>1) {
+		return nil, ErrUnsafeFile
+	}
+	contents := make([]byte, 0, 4096)
+	buffer := make([]byte, 4096)
+	for {
+		var read uint32
+		err := windows.ReadFile(value.handle, buffer, &read, nil)
+		if read > 0 {
+			if int64(len(contents))+int64(read) > maximum {
+				return nil, ErrUnsafeFile
+			}
+			contents = append(contents, buffer[:read]...)
+		}
+		if err != nil {
+			if errors.Is(err, windows.ERROR_HANDLE_EOF) {
+				break
+			}
+			return nil, ErrUnsafeFile
+		}
+		if read == 0 {
+			break
+		}
+	}
+	after, err := privateWindowsRegularInfo(value.handle, links)
+	if err != nil || !sameWindowsPrivateFile(value.info, after) {
+		return nil, ErrUnsafeFile
+	}
+	value.info = after
+	return contents, nil
+}
+
+func markWindowsHandleForDelete(handle windows.Handle) error {
+	if handle == 0 {
+		return ErrUnsafeFile
+	}
+	buffer := [1]byte{1}
+	var status windows.IO_STATUS_BLOCK
+	if err := windows.NtSetInformationFile(handle, &status, &buffer[0], uint32(len(buffer)), windows.FileDispositionInformation); err != nil {
+		return ErrUnsafeFile
+	}
+	return nil
+}
+
+func closeAndDeleteWindowsPrivateRegular(value *windowsPrivateRegularAt) error {
+	if value == nil || value.handle == 0 || markWindowsHandleForDelete(value.handle) != nil || value.Close() != nil {
+		return ErrUnsafeFile
+	}
+	return nil
+}
+
+func (directory *windowsPrivateDirectory) CreateRegular(name string, contents []byte) (bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(name) || len(contents) == 0 {
+		return false, ErrUnsafeFile
+	}
+	value, err := createWindowsPrivateRegularAt(directory.handle, name)
+	if err != nil {
+		existing, existingErr := openWindowsPrivateRegularAt(directory.handle, name, windows.FILE_GENERIC_READ, 1)
+		if existingErr == nil {
+			_ = existing.Close()
+			return false, nil
+		}
+		return false, ErrUnsafeFile
+	}
+	published := false
+	defer func() {
+		if !published {
+			_ = closeAndDeleteWindowsPrivateRegular(value)
+		}
+	}()
+	if writeWindowsPrivateRegular(value, contents) != nil || directory.Validate() != nil {
+		return false, ErrUnsafeFile
+	}
+	if value.Close() != nil {
+		return false, ErrUnsafeFile
+	}
+	published = true
+	return true, nil
+}
+
+func (directory *windowsPrivateDirectory) ReadRegular(name string, maximum int64) ([]byte, bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(name) || maximum < 0 || maximum == int64(^uint64(0)>>1) {
+		return nil, false, ErrUnsafeFile
+	}
+	value, err := openWindowsPrivateRegularAt(directory.handle, name, windows.FILE_GENERIC_READ, 1)
+	if isWindowsRelativeNotFound(err) {
+		return nil, false, nil
+	}
+	if err != nil {
+		return nil, false, ErrUnsafeFile
+	}
+	defer value.Close()
+	contents, err := readWindowsPrivateRegular(value, maximum, 1)
+	if err != nil || directory.Validate() != nil {
+		return nil, false, ErrUnsafeFile
+	}
+	return contents, true, nil
+}
+
+type windowsRelativeNameInformation struct {
+	Flags          uint32
+	RootDirectory  windows.Handle
+	FileNameLength uint32
+	FileName       [1]uint16
+}
+
+func setWindowsRelativeNameInformation(
+	handle windows.Handle,
+	parent windows.Handle,
+	name string,
+	class uint32,
+	flags uint32,
+) error {
+	if handle == 0 || parent == 0 || !validPrivateLeafName(name) {
+		return ErrUnsafeFile
+	}
+	encoded, err := windows.UTF16FromString(name)
+	if err != nil || len(encoded) < 2 {
+		return ErrUnsafeFile
+	}
+	nameBytes := (len(encoded) - 1) * 2
+	var header windowsRelativeNameInformation
+	size := int(unsafe.Offsetof(header.FileName)) + nameBytes
+	buffer := make([]byte, size)
+	value := (*windowsRelativeNameInformation)(unsafe.Pointer(&buffer[0]))
+	value.Flags = flags
+	value.RootDirectory = parent
+	value.FileNameLength = uint32(nameBytes)
+	copy(unsafe.Slice(&value.FileName[0], len(encoded)-1), encoded[:len(encoded)-1])
+	var status windows.IO_STATUS_BLOCK
+	if err := windows.NtSetInformationFile(handle, &status, &buffer[0], uint32(len(buffer)), class); err != nil {
+		return ErrUnsafeFile
+	}
+	runtime.KeepAlive(encoded)
+	runtime.KeepAlive(buffer)
+	return nil
+}
+
+func renameWindowsPrivateRegularAt(handle windows.Handle, parent windows.Handle, name string) error {
+	return setWindowsRelativeNameInformation(handle, parent, name, windows.FileRenameInformation, windows.FILE_RENAME_REPLACE_IF_EXISTS)
+}
+
+func linkWindowsPrivateRegularAt(handle windows.Handle, parent windows.Handle, name string) error {
+	return setWindowsRelativeNameInformation(handle, parent, name, windows.FileLinkInformation, 0)
+}
+
+func createWindowsPrivateTemporaryAt(parent windows.Handle, contents []byte) (*windowsPrivateRegularAt, error) {
+	for attempt := 0; attempt < 16; attempt++ {
+		name, err := randomTemporaryName()
+		if err != nil {
+			return nil, ErrUnsafeFile
+		}
+		value, err := createWindowsPrivateRegularAt(parent, name)
+		if err != nil {
+			if isWindowsRelativeCollision(err) {
+				continue
+			}
+			return nil, ErrUnsafeFile
+		}
+		if writeWindowsPrivateRegular(value, contents) == nil {
+			return value, nil
+		}
+		_ = closeAndDeleteWindowsPrivateRegular(value)
+		return nil, ErrUnsafeFile
+	}
+	return nil, ErrUnsafeFile
+}
+
+func (directory *windowsPrivateDirectory) ReplaceRegular(name string, contents []byte) error {
+	if directory.Validate() != nil || !validPrivateLeafName(name) || len(contents) == 0 {
+		return ErrUnsafeFile
+	}
+	existing, err := openWindowsPrivateRegularAt(directory.handle, name, windows.FILE_GENERIC_READ, 1)
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	if existing.Close() != nil {
+		return ErrUnsafeFile
+	}
+	temporary, err := createWindowsPrivateTemporaryAt(directory.handle, contents)
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	renamed := false
+	defer func() {
+		if !renamed {
+			_ = closeAndDeleteWindowsPrivateRegular(temporary)
+		}
+	}()
+	current, err := openWindowsPrivateRegularAt(directory.handle, name, windows.FILE_GENERIC_READ, 1)
+	if err != nil || current.Close() != nil || directory.Validate() != nil {
+		return ErrUnsafeFile
+	}
+	if renameWindowsPrivateRegularAt(temporary.handle, directory.handle, name) != nil || temporary.Close() != nil {
+		return ErrUnsafeFile
+	}
+	renamed = true
+	replaced, err := openWindowsPrivateRegularAt(directory.handle, name, windows.FILE_GENERIC_READ, 1)
+	if err != nil || replaced.Close() != nil || directory.Validate() != nil {
+		return ErrUnsafeFile
+	}
+	return nil
+}
+
+func (directory *windowsPrivateDirectory) RemoveRegular(name string) (bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(name) {
+		return false, ErrUnsafeFile
+	}
+	value, err := openWindowsPrivateRegularAt(directory.handle, name, windows.FILE_GENERIC_READ|windows.DELETE, 1)
+	if isWindowsRelativeNotFound(err) {
+		return false, nil
+	}
+	if err != nil {
+		return false, ErrUnsafeFile
+	}
+	if closeAndDeleteWindowsPrivateRegular(value) != nil || directory.Validate() != nil {
+		return false, ErrUnsafeFile
+	}
+	return true, nil
+}
+
+func (directory *windowsPrivateDirectory) ListPage(
+	maximumEntries int,
+	afterName string,
+	validName func(string) bool,
+	validLinks func(string, uint64) bool,
+) (PrivateDirectoryPage, error) {
+	if directory.Validate() != nil || maximumEntries < 1 || maximumEntries > 4096 || validName == nil || validLinks == nil ||
+		(afterName != "" && !validName(afterName)) {
+		return PrivateDirectoryPage{}, ErrUnsafeFile
+	}
+	var before windows.ByHandleFileInformation
+	if err := windows.GetFileInformationByHandle(directory.handle, &before); err != nil ||
+		!sameWindowsPrivateDirectoryIdentity(directory.info, before) {
+		return PrivateDirectoryPage{}, ErrUnsafeFile
+	}
+	duplicate, err := duplicateWindowsRetainedHandle(directory.handle)
+	if err != nil {
+		return PrivateDirectoryPage{}, ErrUnsafeFile
+	}
+	file := os.NewFile(uintptr(duplicate), "tht-safeio-private-root-list")
+	if file == nil {
+		_ = windows.CloseHandle(duplicate)
+		return PrivateDirectoryPage{}, ErrUnsafeFile
+	}
+	defer file.Close()
+	seen := make(map[string]struct{}, maximumEntries+1)
+	selected := make([]PrivateDirectoryEntry, 0, maximumEntries+1)
+	scanned := 0
+	for {
+		entries, readErr := file.ReadDir(1)
+		if readErr != nil && !errors.Is(readErr, io.EOF) {
+			return PrivateDirectoryPage{}, ErrUnsafeFile
+		}
+		if len(entries) == 0 {
+			break
+		}
+		if len(entries) != 1 {
+			return PrivateDirectoryPage{}, ErrUnsafeFile
+		}
+		scanned++
+		if scanned > maximumPrivateDirectoryPageScanEntries {
+			return PrivateDirectoryPage{}, ErrUnsafeFile
+		}
+		name := entries[0].Name()
+		if !validPrivateLeafName(name) || !validName(name) {
+			return PrivateDirectoryPage{}, ErrUnsafeFile
+		}
+		if _, duplicate := seen[name]; duplicate {
+			return PrivateDirectoryPage{}, ErrUnsafeFile
+		}
+		seen[name] = struct{}{}
+		value, valueErr := openWindowsPrivateRegularAtAllowedLinks(directory.handle, name, windows.FILE_GENERIC_READ, 1, 2)
+		if valueErr != nil {
+			return PrivateDirectoryPage{}, ErrUnsafeFile
+		}
+		info := value.info
+		if value.Close() != nil {
+			return PrivateDirectoryPage{}, ErrUnsafeFile
+		}
+		if !validLinks(name, uint64(info.NumberOfLinks)) {
+			return PrivateDirectoryPage{}, ErrUnsafeFile
+		}
+		if name > afterName {
+			selected = appendBoundedPrivateDirectoryEntry(selected, PrivateDirectoryEntry{
+				Name: name, ModifiedUnixMs: time.Unix(0, info.LastWriteTime.Nanoseconds()).UnixMilli(),
+			}, maximumEntries+1)
+		}
+		if errors.Is(readErr, io.EOF) {
+			break
+		}
+	}
+	var after windows.ByHandleFileInformation
+	if windows.GetFileInformationByHandle(directory.handle, &after) != nil || directory.Validate() != nil ||
+		!sameWindowsPrivateDirectorySnapshot(before, after) {
+		return PrivateDirectoryPage{}, ErrUnsafeFile
+	}
+	sort.Slice(selected, func(left, right int) bool { return selected[left].Name < selected[right].Name })
+	more := len(selected) > maximumEntries
+	if more {
+		selected = selected[:maximumEntries]
+	}
+	return PrivateDirectoryPage{Entries: selected, More: more}, nil
+}
+
+func sameWindowsRelativeClaim(source, claim *windowsPrivateRegularAt) bool {
+	return source != nil && claim != nil && sameWindowsPrivateFile(source.info, claim.info)
+}
+
+func windowsRelativeClaimPairExists(directory *windowsPrivateDirectory, source, claim string) (bool, error) {
+	left, err := openWindowsPrivateRegularAt(directory.handle, source, windows.FILE_GENERIC_READ, 2)
+	if isWindowsRelativeNotFound(err) {
+		return false, nil
+	}
+	if err != nil {
+		return false, ErrUnsafeFile
+	}
+	defer left.Close()
+	right, err := openWindowsPrivateRegularAt(directory.handle, claim, windows.FILE_GENERIC_READ, 2)
+	if isWindowsRelativeNotFound(err) {
+		return false, nil
+	}
+	if err != nil {
+		return false, ErrUnsafeFile
+	}
+	defer right.Close()
+	return sameWindowsRelativeClaim(left, right), nil
+}
+
+func windowsRelativeClaimAbsentOrOrphan(directory *windowsPrivateDirectory, source, claim string) (bool, error) {
+	current, err := openWindowsPrivateRegularAtAllowedLinks(directory.handle, source, windows.FILE_GENERIC_READ, 1, 2)
+	if err == nil {
+		_ = current.Close()
+		return false, nil
+	}
+	if !isWindowsRelativeNotFound(err) {
+		return false, ErrUnsafeFile
+	}
+	orphan, err := openWindowsPrivateRegularAt(directory.handle, claim, windows.FILE_GENERIC_READ, 1)
+	if err == nil {
+		_ = orphan.Close()
+		return true, nil
+	}
+	if isWindowsRelativeNotFound(err) {
+		return true, nil
+	}
+	return false, ErrUnsafeFile
+}
+
+func (directory *windowsPrivateDirectory) ClaimRegular(source, claim string) (bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(source) || !validPrivateLeafName(claim) {
+		return false, ErrUnsafeFile
+	}
+	value, err := openWindowsPrivateRegularAt(
+		directory.handle,
+		source,
+		windows.FILE_GENERIC_READ|windows.FILE_GENERIC_WRITE|windows.DELETE,
+		1,
+	)
+	if err != nil {
+		pair, pairErr := windowsRelativeClaimPairExists(directory, source, claim)
+		if pairErr == nil && pair {
+			return false, nil
+		}
+		orphan, orphanErr := windowsRelativeClaimAbsentOrOrphan(directory, source, claim)
+		if orphanErr == nil && orphan {
+			return false, nil
+		}
+		return false, ErrUnsafeFile
+	}
+	defer value.Close()
+	if linkWindowsPrivateRegularAt(value.handle, directory.handle, claim) != nil {
+		existing, existingErr := openWindowsPrivateRegularAtAllowedLinks(directory.handle, claim, windows.FILE_GENERIC_READ, 1, 2)
+		if existingErr == nil {
+			_ = existing.Close()
+			return false, nil
+		}
+		return false, ErrUnsafeFile
+	}
+	after, err := privateWindowsRegularInfo(value.handle, 2)
+	if err != nil {
+		return false, ErrUnsafeFile
+	}
+	value.info = after
+	claimed, err := openWindowsPrivateRegularAt(directory.handle, claim, windows.FILE_GENERIC_READ, 2)
+	if err != nil {
+		return false, ErrUnsafeFile
+	}
+	defer claimed.Close()
+	if !sameWindowsRelativeClaim(value, claimed) || directory.Validate() != nil {
+		return false, ErrUnsafeFile
+	}
+	return true, nil
+}
+
+func (directory *windowsPrivateDirectory) ReadClaim(source, claim string, maximum int64) ([]byte, bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(source) || !validPrivateLeafName(claim) ||
+		maximum < 0 || maximum == int64(^uint64(0)>>1) {
+		return nil, false, ErrUnsafeFile
+	}
+	value, err := openWindowsPrivateRegularAt(directory.handle, source, windows.FILE_GENERIC_READ, 2)
+	if err != nil {
+		orphan, orphanErr := windowsRelativeClaimAbsentOrOrphan(directory, source, claim)
+		if orphanErr == nil && orphan {
+			return nil, false, nil
+		}
+		return nil, false, ErrUnsafeFile
+	}
+	defer value.Close()
+	claimed, err := openWindowsPrivateRegularAt(directory.handle, claim, windows.FILE_GENERIC_READ, 2)
+	if isWindowsRelativeNotFound(err) {
+		return nil, false, nil
+	}
+	if err != nil {
+		return nil, false, ErrUnsafeFile
+	}
+	defer claimed.Close()
+	if !sameWindowsRelativeClaim(value, claimed) {
+		return nil, false, ErrUnsafeFile
+	}
+	contents, err := readWindowsPrivateRegular(value, maximum, 2)
+	if err != nil {
+		return nil, false, ErrUnsafeFile
+	}
+	afterClaim, err := privateWindowsRegularInfo(claimed.handle, 2)
+	if err != nil || !sameWindowsPrivateFile(value.info, afterClaim) || directory.Validate() != nil {
+		return nil, false, ErrUnsafeFile
+	}
+	return contents, true, nil
+}
+
+func (directory *windowsPrivateDirectory) RemoveClaim(source, claim string) (bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(source) || !validPrivateLeafName(claim) {
+		return false, ErrUnsafeFile
+	}
+	value, err := openWindowsPrivateRegularAt(directory.handle, source, windows.FILE_GENERIC_READ|windows.DELETE, 2)
+	if err != nil {
+		orphan, orphanErr := windowsRelativeClaimAbsentOrOrphan(directory, source, claim)
+		if orphanErr == nil && orphan {
+			return false, nil
+		}
+		return false, ErrUnsafeFile
+	}
+	claimed, err := openWindowsPrivateRegularAt(directory.handle, claim, windows.FILE_GENERIC_READ, 2)
+	if isWindowsRelativeNotFound(err) {
+		_ = value.Close()
+		return false, nil
+	}
+	if err != nil || !sameWindowsRelativeClaim(value, claimed) {
+		_ = value.Close()
+		if claimed != nil {
+			_ = claimed.Close()
+		}
+		return false, ErrUnsafeFile
+	}
+	if claimed.Close() != nil || closeAndDeleteWindowsPrivateRegular(value) != nil {
+		return false, ErrUnsafeFile
+	}
+	remaining, err := openWindowsPrivateRegularAt(directory.handle, claim, windows.FILE_GENERIC_READ|windows.DELETE, 1)
+	if err != nil || closeAndDeleteWindowsPrivateRegular(remaining) != nil || directory.Validate() != nil {
+		return false, ErrUnsafeFile
+	}
+	return true, nil
+}