[MaxLikesCode]

What

guest_kqueue can abort on Windows with:

terminate called after throwing an instance of 'std::runtime_error'
  what():  EVFILT_VNODE: the parent watch of "\\?\C:\$Extend\$Deleted\" failed, FindFirstChangeNotification error=5

TakeSnapshot read the file information (FileBasicInfo, FileStandardInfo) and then the path (GetFinalPathNameByHandleW). A delete between the two left a snapshot with the old link count and delete flag but a path already under \$Extend\$Deleted\. IsDeleted was false for it, so the watch thread asked WatchParent for \$Extend\$Deleted\, which FindFirstChangeNotification refuses with ERROR_ACCESS_DENIED. The exception on the detached watch thread ends the process. FileWatch hits this when it removes its file while a watch thread it has just stopped is still in a poll; the watch threads are detached, and Stop only sets their event.

The snapshot now reads the path first. A path under \$Extend\$Deleted\ is only returned after the delete, so the information read after it reports the delete, IsDeleted holds and the parent watch is skipped, as #8623 does at registration. A delete between the two reads now leaves the old path with the deleted state, and the next poll replaces the path.

What Windows reports for a deleted file that is still open, measured on this machine with DeleteFileW on NTFS:

• the only name: NumberOfLinks 0, DeletePending 1, path \\?\C:\$Extend\$Deleted\...;
• one of two hard links, the one the handle was opened by: NumberOfLinks 1, DeletePending 1, path under \$Extend\$Deleted\.

So IsDeleted is true whenever the path is under \$Extend\$Deleted\ and the information is read after it. #7049 also changes IsDeleted, to treat a path under \$Extend\$Deleted\ as deleted for a rename into it; this change is independent of it and touches neither IsDeleted nor SnapshotHints.

Tested

• Windows 11 Pro 26200, WinLibs GCC 15.2.0 r7, full Release build with BUILD_TESTING=ON, on main cecb540.
• A full ctest --parallel 4 on main failed guest_kqueue once with the message above; alone it passed 5 of 5.
• 16 copies of guest_kqueue_tests.exe at once, each in its own working directory, 1024 runs each way: main aborted 2 times, both with the message above; this change 0 times. With all 16 copies in one working directory, the directory changes wake the watch threads more often: main aborted 121 times in 1536 runs with that message, this change 0 times in 1792. (In the shared directory both builds also had a few failures of other checks, 4 and 10, where copies picked the same steady-clock file name; they did not occur with separate directories.)
• python tools/select_tests.py ctest build --output-on-failure --timeout 120 --parallel 4: 1517 of the 1520 selected tests pass. The 3 failures are agc_driver_sample_order, agc_driver_sample_order_grid_reference and agc_driver_sample_order_recipe_depth_locations, which fail the same way on main on this RTX 4090 and which test(agc): read the sample order tests' depth through a sampled copy #9056 fixes. agc_driver_image_array_window_past_layer_limit is not built: it does not compile with MinGW on main (test(agc): align the array window test's texels at run time #8310).
• guest_kqueue passes 20 of 20 under ctest --repeat until-fail:20.
• python tools/check_conventions.py --base origin/main passes. python tools/pr_overlap.py --branch fix/kqueue-snapshot-path-before-state reports no open PR changing the same lines. It could not compare feat(aot): consolidate native ARM64 compiler, runtime and consumers #5021, feat(wasm): run relinked titles in the browser with WebGPU #6879, fix(libkernel): retire an EV_ONESHOT note through its delete callback and follow Windows $Deleted paths #7049, feat(libkernel): support kevent read and write events on regular files #7088 and feat(libkernel): report open, read and close notes on watched files #7121, which conflict with main; none of them changes TakeSnapshot (fix(libkernel): retire an EV_ONESHOT note through its delete callback and follow Windows $Deleted paths #7049 changes IsDeleted and SnapshotHints below it).
• Not tested: a title, Linux or macOS (the change is in the _WIN32 path only).

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Fixes: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes. Written with Claude Code (Claude Opus 5.5).

🤖 Generated with Claude Code

[github-actions]

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request	Shared files not compared
PR 5021	core/libs/prx/libkernel/Equeue/src/FileEvent.cpp
PR 6879	core/libs/prx/libkernel/Equeue/src/FileEvent.cpp
PR 7049	core/libs/prx/libkernel/Equeue/src/FileEvent.cpp
PR 7088	core/libs/prx/libkernel/Equeue/src/FileEvent.cpp
PR 7121	core/libs/prx/libkernel/Equeue/src/FileEvent.cpp
PR 9823	core/libs/prx/libkernel/Equeue/src/FileEvent.cpp