Summary

• Pre-fix, ensure_runtime_dir() was broken on Windows from the second invocation onward: NTFS synthesizes POSIX mode bits as 0o666/0o777, so stat.S_IMODE(st.st_mode) & 0o077 was always non-zero and the validator raised PermissionError("unsafe permissions") against a directory it had just created.
• Make the Windows path explicit: runtime_dir() skips the XDG_RUNTIME_DIR branch on Windows (it's a Linux/systemd convention, and honoring it without the POSIX mode-bit gate is half-baked); ensure_runtime_dir() keeps the symlink + non-directory rejections on every platform but skips the mode-bit + owner-uid gates on Windows (%LOCALAPPDATA%\Temp\ is already per-user, and proper NTFS owner-SID checks via GetSecurityInfo are out of scope).
• Module docstring documents the asymmetric trust posture so a future contributor doesn't re-enable a check that has no NTFS semantics.
• Replace the three skipif(not hasattr(os, "geteuid")) guards on the POSIX-only test classes with skipif(os.name == "nt") — same effect today but parallel to the production guard.
• Add TestWindowsRuntimeDir covering the NTFS-equivalent contract: tempdir-only resolution with uid=0 suffix, XDG ignored when set, idempotent ensure_runtime_dir (regression guard for the mode-bit failure), and the symlink + non-directory rejections that survive the NTFS relaxation. Symlink test uses the existing requires_symlinks marker so it auto-skips when the Windows runner doesn't have Developer Mode/admin.

What changed

POSIX behaviour is untouched. _is_safe_dir is now POSIX-only by contract — its docstring says so.

Why these gates can be relaxed on Windows

• tempfile.gettempdir() on Windows resolves to %LOCALAPPDATA%\Temp\ — already a per-user directory. The cross-user threat that motivates 0o700 on shared /tmp does not apply.
• POSIX mode bits on NTFS are synthesized (0o666/0o777) and do not reflect the real ACL — checking & 0o077 is theatre and false-positives against any directory we ourselves just created.
• Symlinks on Windows exist (require Developer Mode/admin to create) and are exploitable identically to POSIX symlinks once present, so the symlink rejection survives. Non-directory rejection survives for the same reason.
• Proper NTFS owner-SID validation would need pywin32 / ctypes calls into GetSecurityInfo. Heavyweight optional dependency for marginal value when the temp base is already per-user — explicitly out of scope.

Test plan

• uv run pytest packages/memtomem/tests/test_runtime_paths.py -v — 18 passed, 7 skipped on macOS
• uv run pytest packages/memtomem/tests/test_uninstall_cmd.py packages/memtomem/tests/test_runtime_paths.py — 46 passed, 7 skipped (downstream runtime_dir() consumer)
• uv run pytest packages/memtomem/tests/test_web_routes_context.py packages/memtomem/tests/test_context_skills.py — 86 passed (other consumers)
• uv run ruff check + ruff format --check — clean
• uv run mypy packages/memtomem/src/memtomem/_runtime_paths.py — no issues
• Windows CI matrix run will exercise the new TestWindowsRuntimeDir class — currently informational, should pass in this PR's run

References

• Closes Windows: replace POSIX file-mode XDG_RUNTIME_DIR tests with NTFS-aware equivalents #637
• Builds on ci: add Windows runner to CI matrix #634 (CI matrix expansion) and ci: matrix infrastructure + macOS gating; Windows informational (#634) #638 (matrix infra)
• Sibling Windows fixes: test(windows): set_home helper + sweep ~133 HOME monkeypatch sites (refs #644) #714 (HOME → USERPROFILE sweep, refs Windows: HOME monkeypatch doesn't reach Path.home() on Windows (uses USERPROFILE) #644), fix(config): support Windows backslash paths in categorize_memory_dir (#316) #716 (Windows: wizard fails to auto-detect Claude/Codex memory dirs (backslash path regex) #316 backslash regex), test: skipif POSIX-only assertions on Windows (mode bits, fcntl, signal) — Windows CI PR 2/N #713 (POSIX skipifs), test: normalize path separators in 7 cross-platform assertions (#643) #711 (path separator normalization)

🤖 Generated with Claude Code