[Louie0806]

(ai: deepseek/deepseek-v41-flash)

ci-fixes still leaves 4 shards red — and all four fixes already exist on #5178

At 67f8e894, the convergence branch turns some of master's red lanes green, but four remain. Every one of them is a missing delta: the fix exists on PR #5178 and was simply never ported here. This PR ports the missing hunks so the convergence branch actually converges.

shard	failing suite	root cause
test (windows-latest, 24, 3)	tests/issue5103-startup-recovery-visibility.test.ts	win32 separator in the sidecar db path
test (windows-latest, 22, 4)	tests/issue4739-bounded-session-load.test.ts (both full-mode cases)	open sqlite handle blocks unlink
test (windows-latest, 24, 5)	tests/issue4788-resident-minimal.test.ts (d)	same open-handle family
test (ubuntu-latest, 24, 3)	tests/plugin-fork.test.ts #5140 cold-restored raw tail	fixed setTimeout(20) budget missed a debounced flush
test (ubuntu-latest, 22, 3)	tests/issue4788-resident-minimal.test.ts (a)–(d)	unref'd debounce timer never drains afterNextFlush

1. #5103 — a mixed separator, not a missing warning

UnifiedShadow builds its db path as ${dir}/index.db, so on Windows the open-failure warning reads C:\...\sessions/index.db. The assertion needle is path.join(dir, "index.db") — ...\index.db on win32 — so the mixed form never matches, on every Windows shard. path is already imported at src/storage/shadow.ts:30, and the db is opened through that same join, so POSIX output is byte-identical. I proved the mismatch mechanically:

old message = C:\Users\...\bili-5103-shadow-abcd/index.db
test needle = C:\Users\...\bili-5103-shadow-abcd\index.db
OLD passes? false     NEW passes? true

2. #4739 / #4788 teardown — the sidecar is still open

These suites arm a real SessionStorage under BILI_STORAGE_UNIFIED=full, so index.db is open at teardown. cancelAll() (src/persist.ts:3230) clears timers and the build map but never calls this.shadow?.close(); Windows refuses to unlink a directory holding an open file. The shared rmrf retries transient EBUSY/EPERM for ~9.5s, so a failure here means the handle genuinely never closes — the observed duration_ms: 11877 is exactly that budget expiring.

closeQuietly() (src/persist.ts:3193) is cancelAll() + shadow.close(). Only the short-lived-store teardowns need it; the UnifiedStore.open(...) cases already call store.close().

This hunk has a portable negative control — no Windows needed. /proc/self/fd shows the leak directly:

cancelAll:    before=["index.db","index.db-shm","index.db-wal"] after=["index.db","index.db-shm","index.db-wal"] unlink=ok
closeQuietly: before=["index.db","index.db-shm","index.db-wal"] after=[]                                    unlink=ok

Three open handles survive cancelAll(), zero survive closeQuietly(). (Linux unlink succeeds on open files, which is precisely why a Linux-only test cannot fail without this probe.)

3. #5155 — a millisecond budget is a deadline

Both cold-rebuild cases waited for the debounced durable flush with a fixed setTimeout(20). A magic budget is a deadline a loaded runner can miss, and the miss is an honest 409 !== 200 from a one-turn-old table. Await the settle itself — afterNextFlush("conv-ptrs") resolves once the armed save lands, with a landing proof.

4. #4788 — the unref'd timer deadlocks the verdict

afterNextFlush parks a resolver in flushWaiters; the only thing that drains it is the debounce timer — armed with timer.unref?.() at src/persist.ts:2769. Once that timer is the last pending handle, the loop drains, the promise never settles, and node reports Promise resolution is still pending but the event loop has already resolved. Keep the timer referenced exactly while a waiter exists (arm unref'd, ref() on waiter registration). This is the one lane with a deterministic local repro:

issue4788 on 67f8e894:                      pass 0 / fail 4
  + timer-ref hunk:                       pass 4 / fail 0
  revert only the timer-ref hunk:         pass 0 / fail 4

That is a real double-direction control, not an assertion loosened until green.

Verification

npx tsc --noEmit                          exit 0
issue4788-resident-minimal                4/4
inc-canonical-pointers                    3/3
issue4739-bounded-session-load            4/4
issue5103-startup-recovery-visibility     5/5

Honest scope: the two teardown hunks have no local negative control — reverting closeQuietly() keeps Linux green because EBUSY/EPERM only fire where an open handle blocks unlink. For those, the /proc/self/fd probe above is the evidence, and the CI verdict is the Windows shards.

Close this if the sentinel already folded these in; the value is the four deltas plus the line numbers, not the branch.

Coordination: #4599, #5178, #5208.