Windows: config.toml read failure floods Sentry (root cause hidden, per-poll re-report) #3962

Source

Sentry: TAURI-RUST-DME (self-hosted, id 15206) — 36,722 events / 1 user · first 2026-06-14 · last 2026-06-22 · release openhuman@0.57.39 · Windows 10.0.26100.

Symptom

Failed to read config file: C:\Users\<user>\.openhuman\users\local-wb\config.toml
Tags: domain=rpc, operation=invoke_method, method=openhuman.inference_downloads_progress. The progress RPC is polled continuously; each poll re-reads config and re-reports → 36k events from a single session.

Root cause

1. Root cause invisible. src/openhuman/config/ops/loader.rs:45 returns Err(e.to_string()), collapsing the anyhow chain to the top context only — the underlying io error kind (os error N: ACL-denied / file-locked / OneDrive placeholder) is dropped before it reaches Sentry. Cannot distinguish a user-environment denial from an app-side race.
2. Per-poll flood. config.toml exists (src/openhuman/config/schema/load/impl_load.rs:141 exists() gate passes) but read_to_string fails persistently (5×20ms retry exhausted, impl_load.rs:187). The expected-error classifier (src/core/observability.rs) has no config-read arm, so every poll pages.

Classification

Genuinely-unpreventable user-state — file present, OS refuses the read on one user's disk; fleet unaffected; zero local lever to unlock a foreign-held file. The app-side defects are (1) the hidden root cause and (2) the unbounded per-poll Sentry flood.

Fix direction

• Surface the io source chain at the loader ({e:#}) so future events carry os error N.
• Add a narrow is_config_read_io_failure_message classifier arm that demotes only the OS-denial kinds (access-denied / sharing-lock / os error 5 / 32). NotFound / corruption / unseen kinds keep paging (fail-open to visibility, never mask a real defect).

Reproduces on

upstream/main @ f435d3af7 (by inspection — all paths present). The Windows OS-level denial is not physically reproducible locally (single user's box).