Fix Windows backup preview and copy edge cases

CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 3.4.12 - 2026-11-09
+
+- Fix Windows backup preview and copying when a project contains a reserved device
+  name such as `NUL`. Skipped entries are logged during preview and listed in
+  the completed backup report.
+- Exclude the root-level Codex `app-server-control` runtime directory before
+  checking its metadata. Keep the destination's live directory during restore.
+- Add regression coverage for reserved NTFS entries and Windows error 1920.
+- Retry brief Windows file locks when replacing the restored session index.
+
 ## 3.4.11 - 2026-11-03
 
 - Exclude only root-level `.codex-provisioning-<16-hex>.guard` files from backup,

README.md

@@ -3,17 +3,15 @@
 **One-click Codex backup, restore, and Windows PC migration.**
 
 [![Windows](https://img.shields.io/badge/Windows-10%20%7C%2011-0078D4?logo=windows)](https://github.com/dkwolf1/Codex-Lifeboat)
-[![Stable: 3.4.11](https://img.shields.io/badge/stable-v3.4.11-16a34a)](https://github.com/dkwolf1/Codex-Lifeboat/releases/tag/v3.4.11)
+[![Stable release](https://img.shields.io/github/v/release/dkwolf1/Codex-Lifeboat?label=stable)](https://github.com/dkwolf1/Codex-Lifeboat/releases/latest)
 [![CI](https://github.com/dkwolf1/Codex-Lifeboat/actions/workflows/ci.yml/badge.svg)](https://github.com/dkwolf1/Codex-Lifeboat/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
 [Wiki](https://github.com/dkwolf1/Codex-Lifeboat/wiki) · [Nederlands](docs/nl/README.md) · [Security](SECURITY.md) · [Documentation](docs/IMPLEMENTATION-ROADMAP.md)
 
-> **Stable release:** version 3.4.11 safely ignores only Codex's root-level,
-> delete-on-close Windows provisioning guards while keeping every ordinary or
-> near-matching file mandatory. It retains the reviewed dependency preflight and
-> large-restore protections from 3.4.10, and passes all 97 source checks and 12
-> automated compatibility scenarios.
+> **Version 3.4.12** fixes Windows backup preview and copying for reserved
+> device names such as `NUL` and skips Codex's root-level `app-server-control`
+> runtime directory. Reserved entries are listed in the backup report.
 > The migration workflow also has prior
 > physical Windows 11 PC A → PC B → PC A evidence. Keep an independent copy of
 > irreplaceable data and read the [testing guide](docs/TESTING-GUIDE.md).
@@ -22,7 +20,7 @@ https://mechscript.nl/en/codex-lifeboat-backup-restore-migrate-en/
 
 ## Download for Windows
 
-### [Download Codex Lifeboat 3.4.11 for Windows](https://github.com/dkwolf1/Codex-Lifeboat/releases/tag/v3.4.11)
+### [Download the latest Codex Lifeboat release for Windows](https://github.com/dkwolf1/Codex-Lifeboat/releases/latest)
 
 On the release page, download only:
 

build.ps1

@@ -1,6 +1,6 @@
 [CmdletBinding()]
 param(
-    [string]$Version = '3.4.11',
+    [string]$Version = '3.4.12',
     [string]$PythonPath,
     [switch]$SkipTests
 )

docs/KNOWN-LIMITATIONS.md

@@ -1,4 +1,4 @@
-# Known limitations of release 3.4.11
+# Known limitations
 
 1. There is no published stable import contract for the local Codex database.
    The assistant therefore inspects schemas and must be retested after major future
@@ -48,3 +48,5 @@
     Version 3.4.11 conservatively accounts for logical bytes, estimated allocation
     overhead and a safety reserve, and rechecks free space during large writes;
     another process can still consume space unexpectedly.
+15. The backup omits entries with reserved Windows device names. Review the
+    warnings in the backup report for the omitted paths.

docs/RELEASE-CHECKLIST.md

@@ -2,44 +2,48 @@
 
 [Nederlands](nl/RELEASE-CHECKLIST.md)
 
-This checklist publishes Codex Lifeboat 3.4.11 as a **stable release**. The tag
+This checklist publishes Codex Lifeboat 3.4.12 as a **stable release**. The tag
 workflow builds and validates fresh release assets, creates
 their checksums and provenance attestations, and publishes the GitHub release.
 
 ## Before pushing
 
-- Confirm that `git status --short` contains only intended 3.4.11 changes.
+- Confirm that `git status --short` contains only intended 3.4.12 changes.
 - Confirm that no real backup, database, token, `.env`, EXE, ZIP, or build
   directory is staged.
 - Keep the generated `dist` directory locally; `.gitignore` deliberately prevents
   it from entering the repository.
-- Do not create the `v3.4.11` tag until the `main` CI run is green.
+- Do not create the `v3.4.12` tag until the `main` CI run is green.
 
 ## Publish with PowerShell
 
 Run these commands from the repository directory:
 
 ```powershell
-git add -A
-git status --short
+git switch -c dkw1/fix-issue-13
+git add -u
+git add -- docs/releases/v3.4.12.md docs/nl/releases/v3.4.12.md
 git diff --cached --check
-git commit -m "Add reviewed dependency preflight exclusions"
-git push origin main
+git commit -m "Fix Windows backup preview and copy edge cases"
+git push -u origin dkw1/fix-issue-13
+gh pr create --base main --head dkw1/fix-issue-13 --title "Fix Windows backup preview and copy edge cases" --body "Addresses issue #13."
 ```
 
-Wait until the `main` CI run is green at
+Merge the PR after its checks pass, then wait until the `main` CI run is green at
 <https://github.com/dkwolf1/Codex-Lifeboat/actions/workflows/ci.yml>. Then run:
 
 ```powershell
-git tag -a v3.4.11 -m "Codex Lifeboat 3.4.11 stable release"
-git push origin v3.4.11
+git switch main
+git pull --ff-only origin main
+git tag -a v3.4.12 -m "Codex Lifeboat 3.4.12 stable release"
+git push origin v3.4.12
 ```
 
 The tag triggers `.github/workflows/release.yml`. Do **not** also create a manual
 release with the same tag: the workflow creates it as the stable latest release.
 Follow it at
 <https://github.com/dkwolf1/Codex-Lifeboat/actions/workflows/release.yml>, then
-open <https://github.com/dkwolf1/Codex-Lifeboat/releases/tag/v3.4.11>.
+open <https://github.com/dkwolf1/Codex-Lifeboat/releases/tag/v3.4.12>.
 
 ## Verify the published release
 
@@ -64,8 +68,8 @@ gh attestation verify .\Codex-Lifeboat-Windows-x64-Portable.zip --repo dkwolf1/C
 
 ## Stable-release evidence
 
-The 97-check source/EXE/ZIP gate, 12/12 automated Windows scenarios, and a physical
-Windows 11 PC A → PC B → PC A workflow all passed. The physical workflow included
+The release workflow runs the 99-check source/EXE/ZIP gate, including 12 automated
+Windows scenarios. A prior physical Windows 11 PC A → PC B → PC A workflow included
 both verify operations and opening and continuing work in Codex after restore.
 Windows 10 and USB-interruption coverage remain documented as pending. Public
 testers must never upload real backups or unsanitized logs.

docs/nl/KNOWN-LIMITATIONS.md

@@ -1,4 +1,4 @@
-# Bekende grenzen van release 3.4.11
+# Bekende grenzen
 
 1. OpenAI publiceert geen stabiel importcontract voor de lokale Codex-database.
    De app gebruikt daarom schema-inspectie en moet na toekomstige grote
@@ -51,3 +51,5 @@
     Versie 3.4.11 telt logische bytes, geschatte bestandssysteemallocatie en een
     veiligheidsreserve conservatief mee en controleert vrije ruimte opnieuw tijdens
     grote schrijfacties; een ander proces kan ruimte nog steeds onverwacht vullen.
+15. De back-up slaat paden met gereserveerde Windows-apparaatnamen over.
+    De waarschuwingen in het back-uprapport vermelden de overgeslagen paden.

docs/nl/README.md

@@ -4,18 +4,17 @@
 
 [Wiki](https://github.com/dkwolf1/Codex-Lifeboat/wiki) · [English](../../README.md) · [Beveiliging](../../SECURITY.md) · [Documentatie](IMPLEMENTATION-ROADMAP.md)
 
-> **Stabiele release:** versie 3.4.11 negeert veilig alleen de root-level,
-> delete-on-close Windows-provisioningguards van Codex; gewone en bijna gelijknamige
-> bestanden blijven verplicht. De gecontroleerde dependency-preflight en
-> restorebeveiliging uit 3.4.10 blijven behouden. Alle 97 broncontroles en 12
-> geautomatiseerde compatibiliteitsscenario's slagen. Voor de
+> **Versie 3.4.12** verhelpt Windows-fouten bij de back-upvoorvertoning en het
+> kopiëren van gereserveerde apparaatnamen zoals `NUL`. De runtime-map
+> `app-server-control` direct onder `.codex` wordt overgeslagen. Het
+> back-uprapport vermeldt overgeslagen apparaatnamen. Voor de
 > migratiewerkwijze bestaat bovendien eerder fysiek bewijs van een Windows 11-
 > route van pc A naar pc B en terug. Bewaar onvervangbare gegevens ook apart en
 > lees de [testhandleiding](TESTHANDLEIDING.md).
 
 ## Downloaden voor Windows
 
-### [Download Codex Lifeboat 3.4.11](https://github.com/dkwolf1/Codex-Lifeboat/releases/tag/v3.4.11)
+### [Download de nieuwste Codex Lifeboat-release](https://github.com/dkwolf1/Codex-Lifeboat/releases/latest)
 
 Download op de releasepagina uitsluitend dit bestand:
 

docs/nl/RELEASE-CHECKLIST.md

@@ -2,42 +2,46 @@
 
 [English](../RELEASE-CHECKLIST.md)
 
-Deze checklist publiceert Codex Lifeboat 3.4.11 als **stabiele release**. De
+Deze checklist publiceert Codex Lifeboat 3.4.12 als **stabiele release**. De
 tag-workflow bouwt en controleert nieuwe releasebestanden, maakt de
 checksums en herkomstverklaringen en publiceert de GitHub-release.
 
 ## Vóór het pushen
 
-- Controleer dat `git status --short` alleen bedoelde 3.4.11-wijzigingen bevat.
+- Controleer dat `git status --short` alleen bedoelde 3.4.12-wijzigingen bevat.
 - Stage geen echte back-up, database, token, `.env`, EXE, ZIP of bouwmap.
 - De lokale map `dist` hoort niet in Git en wordt bewust genegeerd.
-- Maak tag `v3.4.11` pas nadat de CI-run van `main` groen is.
+- Maak tag `v3.4.12` pas nadat de CI-run van `main` groen is.
 
 ## Publiceren met PowerShell
 
 Voer in de repositorymap uit:
 
 ```powershell
-git add -A
-git status --short
+git switch -c dkw1/fix-issue-13
+git add -u
+git add -- docs/releases/v3.4.12.md docs/nl/releases/v3.4.12.md
 git diff --cached --check
-git commit -m "Add reviewed dependency preflight exclusions"
-git push origin main
+git commit -m "Fix Windows backup preview and copy edge cases"
+git push -u origin dkw1/fix-issue-13
+gh pr create --base main --head dkw1/fix-issue-13 --title "Fix Windows backup preview and copy edge cases" --body "Addresses issue #13."
 ```
 
-Wacht tot de `main`-CI groen is op
+Merge de pull request nadat de controles slagen. Wacht daarna tot de `main`-CI groen is op
 <https://github.com/dkwolf1/Codex-Lifeboat/actions/workflows/ci.yml>. Voer dan uit:
 
 ```powershell
-git tag -a v3.4.11 -m "Codex Lifeboat 3.4.11 stable release"
-git push origin v3.4.11
+git switch main
+git pull --ff-only origin main
+git tag -a v3.4.12 -m "Codex Lifeboat 3.4.12 stable release"
+git push origin v3.4.12
 ```
 
 De tag start `.github/workflows/release.yml`. Maak niet daarnaast handmatig een
 release met dezelfde tag: de workflow maakt deze als stabiele nieuwste release.
 Volg de uitvoering op
 <https://github.com/dkwolf1/Codex-Lifeboat/actions/workflows/release.yml> en open
-daarna <https://github.com/dkwolf1/Codex-Lifeboat/releases/tag/v3.4.11>.
+daarna <https://github.com/dkwolf1/Codex-Lifeboat/releases/tag/v3.4.12>.
 
 ## Gepubliceerde release controleren
 
@@ -60,8 +64,9 @@ Controleer na downloaden eventueel de GitHub-herkomstverklaring:
 gh attestation verify .\Codex-Lifeboat-Windows-x64-Portable.zip --repo dkwolf1/Codex-Lifeboat
 ```
 
-De 97 bron-/EXE-/ZIP-controles, 12/12 geautomatiseerde Windows-scenario's en een
-fysieke Windows 11-route van pc A naar pc B en terug zijn geslaagd. Die route bevatte
+De releaseworkflow voert 99 bron-/EXE-/ZIP-controles uit, waaronder 12
+geautomatiseerde Windows-scenario's. Een eerdere fysieke Windows 11-route van
+pc A naar pc B en terug bevatte
 beide controles en verder werken in Codex na herstel. Windows 10 en USB-onderbreking
 blijven als open aanvullende dekking vermeld. Testers mogen nooit echte back-ups
 of niet-opgeschoonde logs uploaden.

docs/nl/releases/v3.4.12.md

@@ -0,0 +1,21 @@
+# Codex Lifeboat 3.4.12 — fixes voor de Windows-back-upvoorvertoning
+
+[English](../../releases/v3.4.12.md)
+
+Deze update pakt beide Windows-back-upfouten uit [issue #13](https://github.com/dkwolf1/Codex-Lifeboat/issues/13) aan.
+
+- De voorvertoning en de kopie herkennen gereserveerde Windows-apparaatnamen
+  zoals `NUL` en `NUL.txt` vóór het pad wordt benaderd. Overgeslagen paden
+  staan in het activiteitenlogboek en in `reports/backup-report.json`. Als
+  het om een map gaat, wordt ook de inhoud overgeslagen. Hernoem het pad veilig
+  aan de bron vóór het maken van de back-up als je die inhoud nodig hebt.
+- De socket- en lockmap `.codex/app-server-control` wordt vóór de
+  metadatacontrole overgeslagen om Windows-fout 1920 te voorkomen. Bij herstel
+  blijft de eigen runtime-map op de doel-pc behouden. Een gelijknamige
+  submap in een project gaat gewoon mee.
+- De vervanging van de herstelde sessie-index wordt kort opnieuw geprobeerd
+  als Windows tijdelijk toegang weigert.
+
+De regressietests gebruiken echte gereserveerde NTFS-namen en simuleren
+Windows-fout 1920. Pak `Codex-Lifeboat-Windows-x64-Portable.zip` volledig
+uit en start `Codex-Lifeboat.exe`.

docs/releases/v3.4.12.md

@@ -0,0 +1,21 @@
+# Codex Lifeboat 3.4.12 — Windows backup preview fixes
+
+[Nederlands](../nl/releases/v3.4.12.md)
+
+This update addresses both Windows backup failures reported in [issue #13](https://github.com/dkwolf1/Codex-Lifeboat/issues/13).
+
+- Backup preview and copy now identify reserved Windows device names such as
+  `NUL` and `NUL.txt` before accessing the entry. The preview activity log
+  and the finished package's `reports/backup-report.json` list omitted entries.
+  If a reserved name is a directory, its entire subtree is omitted. Rename the
+  entry safely at the source before backing up if you need its contents.
+- The root-level `.codex/app-server-control` socket and lock directory is
+  excluded before metadata access, avoiding Windows error 1920. Restore keeps
+  the destination's own runtime directory. A project subfolder with the same
+  name is still included.
+- The restored session index now uses atomic replacement with bounded retries
+  when Windows temporarily denies access.
+
+The regression tests exercise real reserved NTFS entries and a simulated
+Windows error 1920. Download and fully extract
+`Codex-Lifeboat-Windows-x64-Portable.zip`, then run `Codex-Lifeboat.exe`.

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codex-lifeboat"
-version = "3.4.11"
+version = "3.4.12"
 description = "One-click Codex backup, restore and Windows PC migration utility"
 readme = "README.md"
 license = "MIT"

src/codex_transfer/__init__.py

@@ -1 +1 @@
-__version__ = "3.4.11"
+__version__ = "3.4.12"

src/codex_transfer/atomic_io.py

@@ -46,7 +46,7 @@ def _sync_parent(path: Path) -> None:
         os.close(descriptor)
 
 
-def _replace(source: Path, target: Path) -> None:
+def replace_with_retry(source: Path, target: Path) -> None:
     """Retry brief Windows scanner/indexer locks without hiding real failures."""
 
     for attempt in range(_WINDOWS_REPLACE_ATTEMPTS):
@@ -86,7 +86,7 @@ def write_text(
             raise OSError(f"Temporary metadata verification failed: {path.name}")
         if validate:
             validate(persisted)
-        _replace(temporary, path)
+        replace_with_retry(temporary, path)
         _sync_parent(path)
     finally:
         try: