Three hygiene gaps in the Windows paused-gateway record:
- _atomic_write left `<name>.<pid>.tmp` beside the record when os.replace
was refused (a Windows reader without FILE_SHARE_DELETE) or the write
failed: the temp is now unlinked and the error still propagates.
- _mutex counted re-entry process-wide, so a second thread of the same
process (gateway consumer, watcher) entered while the first held the
kernel lock: the depth is now threading.local and each thread's first
entry takes its own descriptor + flock/msvcrt lock, so threads exclude
each other like processes.
- A `.retired` list that reads but does not parse raised RetiredUnknown
from adopt_orphans -> every Windows update aborted, forever. With no
record or claim of this checkout left the list guards nothing: it is
renamed to `.corrupt` (warning on stderr) and the update goes on.
While a record/claim exists the list may be the only proof it was
completed, so it stays unknown (R9 fail-closed is unchanged); a list
that cannot be read at all (sharing violation) is unknown as before.
Review W3.
183eff2f5d