[NelsonLongxiang]

Windows-native Store (owner direction 2026-10-25)

Brings the Store base to native Windows: SQLite (bundled), the cross-process
writer lane (a named kernel mutex, Global\layerfs-writer-lane-<sha256-64bit-of-verbatim-canonical-dir>), the kernel guard (local NTFS only, long-path
correct), owner-only DACLs on homes/records/Stores/sidecars, real
volume-serial + file-index acquisition identity — all inside audited FFI
modules. The SDK's in-process Store face (fs, branch, project, operator) runs
natively; no WSL2, no daemon. Workspace/FUSE/Exec/daemon calls still
refuse Unsupported. Contract:
DIRECT_STORE.md §Windows-native route.

Head 2dd58881f (38 commits over main; main has not moved under it).

Verification state (seven rounds, independent assessors)

1. Code review — Windows (17 findings) + Linux r1 (5 must-fix) + r2/r3.
2. Production readiness + adversarial round — six fixes live; TOCTOU
   6,431 attempts, soak, 8,440-file load all passed.
3. Fix-verification / concurrency / cross-platform bytes (one Store file
   Win↔Linux 14/14+14/14 byte-exact) / perf / delivery — lane adjudicated
   live (name-agnostic enumeration; the pre-fix anomaly stays unexplained
   instrument-side, corrected on the record); fixes in a7f5cda78.
4. Global-lane adversarial (holder-side causality) / sidecar semantics /
   soak / evidence-trail meta-audit / overhead (≈0.2 ms/open) — fixes in
   c2ca6caa6 with the round-3 narrative correction.
5. Cold-eyes final read found the branch's last P1 — the volume guard's
   dead regrowth branch admitted deep shares as NTFS — fixed in d9687cfa4
   with new boundary tests; the collapsed-name harm fenced by a
   display/decision join split (ADR'd); §6 recovery runbook rewritten from an
   end-to-end verification; 34-min soak and CJK-host-path diversity passed.
6. Fix adversarial verification — all three round-6 fixes attacked and
   upheld; the fence proven end-to-end at Store+merge level (planned merges
   never touch it; full walks refuse InvalidRecord deterministically,
   Windows and Linux); merge rehearsal v2 (merge tree byte-identical to the
   branch tree, all chains + the frozen verify spec green on the merge
   commit); fence overhead ≤ noise (±11%, multi-byte arm never slower);
   SDK test-surface map: zero branch regressions, net improvement (trace
   ×9 fixed vs main, three new store chains pass); one process slip — the
   round-6 test file had not been staged — corrected in 2dd58881f with a
   join_exact unit test added. Full reports: the seven round comments.

Chains on 2dd58881f: content 484/0 + compare_join_exact 2/2 +
volume-guard 2/2 + windows trio 6/2·2/2·1/1, clippy clean, SDK 39/39,
container green, fork CI green (one cold-start transient on the previous
head, rerun green). Frozen verify family: three specs (fresh /
crash-recovered / CJK-host-path), all PASS 5/0 on family re-runs.
Production LOC 104239 → 104281 over the round-3..6 fixes, per-commit
comparisons in every message.

Recorded limitations (details in DIRECT_STORE §6)

Windows Init synthesizes mode from the read-only attribute; no hard-link
membership. Names travel as owner-ratified WTF-8 (2026-10-31); listings
render a non-UTF-8 name empty, a JS write by such a name lands as an U+FFFD
sibling, and a merge/compare whose walk must build a String path over such a
name refuses InvalidRecord (display vs decision join split). Long paths:
verbatim everywhere; plain-spelled host operations depend on the host's
long-path policy. Lane squatting and pre-planted-foreign-DACL objects are
local-adversary availability trade-offs; lane names are enumerable. No
64 MiB headroom pre-admission (typed Capacity). %TEMP% overlay
directories of killed openers accumulate. Upstream-family records: the
Linux FUSE invalidation keys the display spelling; the 256-component path
limit is not enforced on the SDK routes; deep single-chain costs grow
near-quadratically. CI adds one report-only windows job.

Merge

Owner ratified 2026-10-31 ("可以合并"). Create a merge commit (no-ff) —
merge key stays with the owner in the GUI. The rehearsal (twice, latest on
d9687cfa4) shows the merge tree byte-identical to the branch tree while
main stands at 35d36575c, every chain green, and the post-merge script is
rehearsed end to end.

[NelsonLongxiang]

Slice 3b added (ee6c34fba): the existing Store test suites now run natively on Windows — 173 tests across layerfs-persistence, -project, -store-service, -overlay, -node, 0 failed, clean across repeated runs; the Linux 1.85.1 container checks the same crates including tests and examples.

Two product defects the Windows runs exposed, fixed for every platform:

1. Concurrent Store opens met Busy under the no-retry rule. The profile pragmas and the writable setup block (binding hints, lineage, merge scratch, file digests, merge-record sweep) ran outside the writer lane; the first database-touching statements create/recover a WAL -shm, so two simultaneous opens of one Store could fail where the lane should have serialized them. Each block is now one short lane hold (macOS keeps exact Busy by design). The lane verifier's re-exec'd child intermittently failed the child opens the Store: Busy before this; eight consecutive runs pass after.
2. Windows mode synthesis stored writable files as 0o644 (the read-only base), so the read-only attribute was lost; now 0o444/0o555 +0o200 as documented. outside_source on Windows also becomes a real resolved-containment check instead of a no-op, and project/overlay declare the Win32_Security windows-sys feature they actually need (they previously compiled only through another crate's feature unification).

Tests: the one test whose premise this route inverts (Windows refused the Store) is deleted and listed in the commit message; unix-only proofs stay unix-only with refusing non-unix stubs (no fabricated metrics); the SDK gains sdk/js/test/store_lifecycle.mjs, the promoted lifecycle proof on the real binding, no Docker/daemon/WSL2, running on both Linux and Windows.

Production LOC: core 97,232 → 97,258 (+26), sdk unchanged; per-commit numbers in the commit message.

[NelsonLongxiang]

Slice 4 added (843d22f3a): the Store face's full public method matrix is now a permanent test — sdk/js/test/store_matrix.mjs, real binding, direct route, no Docker/daemon/WSL2, dual-platform.

Covered: every fs write (write, edit, mkdir, cp, mv, rm), every fs read (read with a line range, list, stat, grep, glob, blame), all three comparisons (diff_files, diff_commits, diff_branches), and branch combination (merge with merged-branch readback, publish with main's readback). Three consecutive rounds of the four real-binding SDK tests pass on Windows.

Two contracts the matrix pins, both confirmed as designed (cross-platform, not Windows-specific):

• main is the project's main line, not a Branch: branch.list_commits("main") is NoSuchBranch by the Branch name index; main moves only through branch.publish.
• On Windows the daemon-only workspace surface refuses Unsupported at the native layer once the client's own deploy validation is satisfied.

No product change was needed: the matrix passed against the current implementation once the contracts above were honored. Test-only commit; production LOC unchanged (core 97,258, sdk 3,455).

[NelsonLongxiang]

Evidence round added (ada6f39f7 + verify chains): responding to "the row-count chain proves too little", two harder pillars.

1. Deep machine chain on a divergence/merge/publish scenario (spec_321a94534c75, material v3): the frozen snapshot comes from init(3 files) → fork work → write → fork feat → write → merge → publish. Seven exact-equality clauses, all asserted against frozen facts read out of the snapshot first (never invented): branch = 4; branches with head_commit_id is not null = 3 (publish leaves main on the layer line — a real behavioral pin); commit_lineage = 4; layer = 2; file_digest with length > 0 = 2; object_location = 22; store_totals with stored > 0 = 1. Run run_bb6e43bde4b6a7b1: PASS 7/7 with witnesses, archived arc_955936358dc2 (archive verified, contract 1.2). The reserved-word commit table stays out of the clauses by design (runner limitation, documented in the material).

Controls, not just the pass: a determinism control — the scenario independently re-produced from scratch, same spec, PASS 7/7 again with identical witnesses (run_a6b14902309b33b1), so the exact counts are properties of the operation sequence; and a hollow negative control (tables present, rows absent) → FAIL 7/7.

2. Cross-process concurrent writers (sdk/js/test/store_concurrent.mjs, ada6f39f7): four re-exec'd child processes, each its own client, writing distinct files to one branch of one Store simultaneously — the named-mutex writer lane serializes publishes and the discovery record guard serializes the shared home; all four must land and be readable, commit count exactly base+4, each child bounded at 30 s with its output carried into any failure. Four consecutive runs pass on Windows.

Predicate DSL notes for the verify engine (fed back earlier via kb): where ops are the closed set =/!=/>/>=/</<=/in/between/is null/is not null; exists needs explicit expect: true.

[NelsonLongxiang]

Confidence round + a real bug it caught (5a41b5f11, eb0203bc6/3d90143b1): the three cheap evidence steps from the confidence review, and what the third one found.

1. Divergent merge readback (store_matrix.mjs): both sources advance past their common base → fastForward: false, the merged head carries secondParent, and both sides' files read back on the merged Branch and on main after publish — the merge's content correctness, which the earlier fast-forward case could not show.

2. Deterministic dead-lane test (windows_lane_abandoned.rs, own binary): a thread ends while owning the product's own named mutex (name derived exactly as windows_lane derives it) → the kernel abandons it → the Store still opens and writes through the WAIT_ABANDONED acquisition. No timing, no kill race.

3. Linux suite runs — this caught a real bug I had shipped in 3b. concurrent_first_installs finished in 0.4s at the parent commit and >115s hung at 3b: my setup/sweep wraps self-deadlocked the opening thread on Linux — the raw Writer::acquire held the directory flock on one open file description while Session::run's admission inside acquired it on another (flock is per description). Windows passed only because its named mutex is thread-recursive. Diagnosed with /proc/locks, per-acquire backtraces and a parent-commit rerun; a bisect over the three wrap sites isolated it.

Corrected shape (3d90143b1), verified on both platforms: Session::connect holds the lane for the whole connect-time statement block (profile pragmas + format/profile reads — where a cleaned -shm is rebuilt under an exclusive recovery hold); the writable setup block rides one held publication lane (its statements enter as nested turns, taking no second lock); the sweep stays plain (admission lanes it). Linux: heavy test 0.37s; persistence 99/0, project 22/0, store-service 3/0, overlay 74/0. Windows: lane binary 50/50 isolated clean runs; SDK suite passes on a rebuilt addon.

One residual, stated openly: under cargo test, the lane test's re-exec'd child still meets Busy roughly once per 25 suite runs (never in 50 isolated binary runs; its report is piped into the failure). The busy source inside a mutex-held open remains undiagnosed — recorded as an open item on this PR, not papered over.

Test-infra hardening en route: the abandoned test moved to its own binary (it ran beside the lane test's re-exec'd children); the children's spawn filters --exact; the persistence test support's temp names gain nanoseconds (Windows pid-reuse ghost collisions).

[NelsonLongxiang]

Residual closed (d960a38a6): the ~1/25 cargo-suite child Busy is diagnosed and fixed.

Diagnosis (instrumented): the child met SQLITE_BUSY(5) on its first statement — PRAGMA synchronous=0, where a cleaned -shm is attached and possibly rebuilt — while holding the named writer mutex. The contender was the sibling process's connection teardown: SQLite's close-time WAL checkpoint, which is SQLite work no lane had ever covered, on any platform. The same window exists in the SDK's direct-route close.

Fix: coordinate the close, not the drop. layerfs-persistence exports StoreLane (best-effort lane hold, released on drop) and Handles::shutdown (drops the session under the lane); the SDK's storeClose holds the lane while the service's sessions close; the lane tests' children close through shutdown. A plain drop keeps bare semantics — error-path teardown never waits behind the lane. An intermediate design (acquiring in State::drop) is documented as reverted: it deadlocked multi-session teardown in-process, caught by the SDK lifecycle before it shipped.

Receipts: Windows persistence suite 25 consecutive cargo rounds clean (the flake reproduced every 2–9 rounds at the prior design); SDK store_matrix/store_concurrent/store_lifecycle and a minimal init-fork-write-close all pass on the rebuilt addon; Linux container persistence 99/0, project 22/0, store-service 3/0, overlay 74/0.

[NelsonLongxiang]

Coordinated close, daemon-symmetric + a third machine chain (head 27f6cf89a):

1. StoreService::close now coordinates its Store teardown (StoreService::at records the Store file; overlays stop first because their final Commits take the lane themselves, then the service drops under the lane). The SDK's storeClose uses the service's hold instead of its own — a second hold on another descriptor would self-deadlock the closing thread on Linux. Services built with new() keep bare close semantics. Receipts: Windows store-service 3/0 + the three SDK tests on the rebuilt addon; Linux store-service 3/0 (persistence 99/0, project 22/0, overlay 74/0 at this tree). The daemon suite needs a privileged container (/dev/fuse, fusectl, cgroup): 62 non-mount tests pass; the 99 mount failures are the same at the parent commit — environmental, recorded as such.

2. Verify chain v4 — the cross-process concurrent scenario (spec_9a8d135fb270): four child processes, each its own SDK client, writing concurrently to one branch through the writer lane. Seven clauses, facts frozen from the snapshot: branch = 2; heads-set = 1; commit_lineage = 4 (every writer's Commit, none lost or duplicated); file_digest(length>0) = 4; object_location ≥ 30 (35); layer = 1; store_totals(stored>0) = 1. Run run_f48df5e7deac31d9: PASS 7/7, archive verified (arc_95e57e734c78). Controls: an independently re-produced concurrent interleaving passes again (run_744930f568abb520), and the hollow control fails 7/7 (run_0eb4d3c594dcc753).

[NelsonLongxiang]

K3 review findings landed (636a641bf): the 「猿光智启专家团2.0——layerfs底座」 review (K3 seat, APPROVE-WITH-NITS, all four dimensions PASS) returned two non-blocking findings; both are now addressed.

• F1 (fixed pre-merge, as recommended): the lane and discovery mutex names hashed the directory with DefaultHasher, whose algorithm may change between Rust releases — old/new binaries over one directory would silently split into two lanes. Both names now derive from SHA-256 of the resolved directory's encoded bytes, truncated to 64 bits (sha2 was already in the locked graph; the new direct edges add no package). The dead-lane test replicates the new derivation and still passes through WAIT_ABANDONED.
• F2 (documented): the mutexes live in Local\, which does not cross sessions — the product opens its Store within one login session today, so this is recorded as a §6 limitation in DIRECT_STORE.md, with the Global\ privilege evaluation named should cross-session coordination ever be needed. The docs seam the review flagged is the same sentence, so the note completes it.

Receipts: Windows persistence 87/0 (both lane binaries), project 10/0, store-service 3/0, overlay 74/0; SDK matrix/concurrent/lifecycle on the rebuilt addon; Linux container cargo check --offline --locked Finished.

[NelsonLongxiang]

Windows overlay last-owner deletion landed (2a4cf6645, head): the recorded limitation "last-owner overlay deletion keeps its Linux identity check" is now lifted — Backing::delete gains a Windows arm with the same discipline through the audited identity (path entry AND retained handle must both still be the acquisition's file — volume serial + file index, sole link — before remove_file; std's FILE_SHARE_DELETE share mode completes the removal when Drop closes the last handle, the Linux order). A swapped-in impostor file is refused and stays.

Tests: new overlay_backing_windows.rs (dangling-Weak pool, so Drop skips the callback — the deletion mechanics are the unit): matching file deleted at last-owner release; swapped-in file refused. Windows store-service 5/0 (was 3), full suites green, SDK tests pass on the rebuilt addon, Linux container cargo check --locked Finished.

With this, the DIRECT_STORE §6 limitation list shrinks to the inherent items (non-UTF-8 names, synthesized mode, subst-drive aliasing, logical overlay allocation).

[NelsonLongxiang]

Review r2 (2026-10-30) answered — head now a8fbe8d8b:

• Windows 实测/CI 确认（评审的两个合入前置）：fork dispatch run 41066129042 全四作业绿，含 windows store suites——真实 Windows runner 上跑通 Must-fix perf(fs): optimize bytesToHex encoding #3（windows_lane_abandoned，Drop/abandoned-mutex）与 Keep mini-benchmark JSON artifacts Prettier-clean #4（dangling-junction Init、junction alias、WTF-8 e2e）。评审所看 tip 96066bd7 之后还有一个它未见的修复 d81cc6cc1（connect 时 lane 等待补记 wait.writer——由同一次 CI 实跑抓出的遥测缺口，Linux 容器三元定位后修复，fast lane 恢复绿）。
• 文档漂移已修（a8fbe8d8b）：§6 机制清单的 GetVolumeInformationW 句改为终路径 + GetVolumeInformationByHandleW 描述。
• PathName/surrogate 策略与 Local\ 会话域：维持待属主拍板——前者是内容语法的长期产品决策（当前实现=规范 WTF-8、拒绝拆对拼写、跨平台同名字节一致），后者已记录为 §6 已知限制。

[NelsonLongxiang]

Synced with main (head a6a489db0): merged upstream's nine new commits (#490 workspace Branch naming, #491 dirty-check streaming, #493 plugin pins, #496/#500 stalled-unmount custody) — the only touchpoint with this branch's crates is operator/inspect.rs, unmodified here; merge-tree was clean before merging. First-parent production LOC 104120 -> 104188 (delta +68, upstream's additions). The fork's dispatched CI run on the merged tree is all four jobs green (fmt and guards / clippy / test / windows store suites, run 41071592317).

[NelsonLongxiang]

Review r3 (2026-10-31) received — verdict unchanged (建议合入, no new findings); its one factual observation (fork main stalled at 582bc786) is resolved: the fork's main is fast-forwarded to 35d36575c, so the branch now reads ~28 ahead / 0 behind against a current fork main. The three r3 post-merge decisions (PathName/surrogate grammar, Local\ acceptance, merge route) remain with the owner; the post-merge verification script for ruling #3 condition ② has been rehearsed end-to-end on this tip (addon build + three SDK chains green in a fresh worktree).

[NelsonLongxiang]

五角度终审完成（对我的实现裁定的独立复审，2026-10-31）：A2 并发安全=支持（Local/无限等待符合属主书面模型；Windows seal() lane 缺口与既有 panic-retention 为 P2 跟进）；A4 证据链=核心链路逐位核实成立，三处需补收据（Windows clippy、Windows 侧 sdk_timing、彩排表述更正——最终版脚本确实未端到端执行过，机制是手动验证的）；A5 合并风险=需附带条件（与上游零交集、schema 未动；两条非代码条件 + is_wtf8 回滚尾部）。裁定性分歧在 A1+A3：WTF-8 语法放宽方向正确（严格超集、字节一致、排序保持），但 (i) 下游未完成——merge 引擎 String 路径层与 SDK fs.list 对 WTF-8 名坍缩为空串（P1×2，Linux 亦可达）；(ii) 超出属主授权——属主 2026-10-25 记录的是 lossy 限制，实现提交改写了属主记录句而追认机制只覆盖属主签发的变更（A3 裁定：需显式追认或回退）；(iii) core/AGENTS.md 有 ~154 行与 engine/AGENTS.md 重复（上游 10-27 重构的合并残留）。待属主单一决策：追认语法（随后补齐下游）或回退为严格 UTF-8+边界拒绝（本 PR 保持原授权范围尽快合）；两者之外的全部内容均通过五角度审查。

[NelsonLongxiang]

生产可用性评估（六角度实跑，2026-10-31，真实 Windows 宿主）——总判定：引擎内部使用有条件可用；外部生产交付未就绪。

角度	判定	关键实测
P1 功能	有条件可用	全方法面端到端字节精确（CJK/NFD/emoji 无损、merge+publish、三进程跨开、subst 别名识破、UNC 拒绝）
P2 性能	有条件可用	init 线性（10k 文件 2.4s）、提交中位 ~10ms、内存/Store 有界、4 写者并发过（诊断级单样）
P3 可靠性	有条件可用	写中强杀→重开全有或全无恢复；损坏 Store 13–21ms 类型化拒绝；只读卷类型化；断电如实声明不在 Disposable 承诺内
P4 安全	有条件可用	owner-only DACL 实测无继承泄漏；秘密清扫零命中；但 Store 文件重开无 ACL 复查（文档-实现落差）、符号链接被跟随、同会话抢占实测无限等待
P5 环境	有条件可用	中文路径/第二 NTFS 卷/≤248 长路径过；>260 长路径确定性失败（FFI 平文路径+node 无清单）；Dev Drive=ReFS 按设计拒绝
P6 交付	未就绪	addon 无受支持获取途径（build 脚本拒 win32、散文指令不精确、CI 不构建）；主 SDK 文档仍写 Linux-only+WSL2；Windows 拒绝码不在 SDK CODES 表

外部生产阻塞清单（P6 三项 + P5 一项）：① Windows addon 构建/分发途径；② api/docs 与 runtime 的路由文档一致性；③ 错误码面（Unauthorized/Unsupported/NoStore 等入 CODES + DACL 锁死恢复文档 takeown/icacls）；④ 审计 FFI 的 verbatim ?\ 长路径化。
共享主机阻塞级（P4）：open_direct 对 Store 文件补 require_owner_only 复查 + symlink_metadata 拒链接（两处小改）。
应做：headroom 预准入 Windows 对等、WTF-8 名 rm/cp 的类型化、InvalidRecord 等文档码与实现对齐、慢盘/10 万级树探针、被杀进程 overlay 临时目录清理。
评估者分歧如实记录：P4 建议写者 lane 有界等待；早前 A2 按属主锁模型裁定无限等待即设计（与 Linux flock 同构）——保留模型、把『同会话抢占=无限停摆』量级补记 §6，是否改有界留属主。

探针产物：tmp/win-native/prod-readiness/（六套脚本+收据）。结论：合并本身不受阻（引擎四维有条件可用、格式零改动）；上述清单是合并后的 fast-follow 工作面。

[Mola-maker]

建议自己实机跑一遍

[Mola-maker]

thanks for pull requests！
but目前正在重新优化内核和编写各个sdk，包括win点的，所以这个pr在2.0版本之前不能合并

[NelsonLongxiang]

thanks for pull requests！ but目前正在重新优化内核和编写各个sdk，包括win点的，所以这个pr在2.0版本之前不能合并

OK，我这边会进行生产验证，有实际成果再另行通知，同时也一直期待2.0能够带来更加极致的性能，Thanks！

[NelsonLongxiang]

Production-readiness blockers resolved (heads f50172e48+f5622cd04, CI run 41171956548 all four jobs green) — all six findings from the six-angle round are fixed and live-verified on this Windows host:

1. Store-open hardening (P4 2a/3a): a link at the Store's spelling refuses "is a link, not the Store file"; a widened DACL on the file refuses with the owner-only message — both verified live (was: silently opened). The file is the privacy boundary; pre-created directories stay caller-shaped.
2. Verbatim paths (P5 blocker): the audited Win32 calls spell \\?\ paths (forward slashes normalized — a verbatim path is not, and node hands either); the 287-char source tree that cleanly failed Init now runs a full cycle with the Chinese filename round-tripping. §6 keeps the host-process longPathAware caveat.
3. A supported Windows build arm (P6-1): build-native.mjs builds win32 (cargo +1.85.1 --release --locked → layerfs_node.dll → the addon path), run end to end here; docs name it.
4. Error surface (P6-3 + P1-1): the SDK's frozen CODES grows Unauthorized/Unsupported/Failed/NoStore/UnknownMethod; fs.rm/fs.cp over a non-UTF-8 name refuse naming that entry.
5. User docs state the route (P6-2): agent.md (where-calls-run, LAYERFS_STORE_PATH, install) and runtime.md describe the native route, its NTFS requirement, default-when-no-worker, and WSL2 coexistence; §6 adds the DACL lockout recovery (takeown + icacls), the headroom parity gap, the squat magnitude, the overlay-temp note and the fence's SDK code alignment.

Receipts: >260 probe PASS (was FAIL); both tamper refusals live; Windows suites 484/87/17/80/10; SDK matrix/lifecycle/concurrent on the rebuilt addon; Windows clippy clean; Linux container check Finished; fork CI four-green on f5622cd04. LOC 104187→104226 (+39, worktree-measured). Remaining should-level items (slow-disk/p95 campaign, headroom Windows arm, addon version handshake, persistent diagnostics) stay listed in the assessment thread for follow-up.

[NelsonLongxiang]

Second verification round complete (five adversarial/production assessors on f5622cd04; their findings fixed in 34ea1b95c, CI all four green — the one red attempt was a runner-side python3 cold-start transient, green on rerun):

Assessor	Verdict
R1 adversarial security	修复成立 — six attacks (TOCTOU race 6,431 attempts, hardlink, junction, verbatim edge matrix, widened sidecars, long-path ACL) produced no end-to-end bypass; two P2 defects found inside the fix surface, both fixed below
R2 regression + long-path	无回归 — every round-1 behavior reproduces; tamper refusals 10/10 no false positives; long-path envelope mapped (sources any depth, home/store cliffs are SQLite-side, all refusals typed)
R3 soak	生产耐久通过 — 18 segments/9.1 min, 6 mid-batch kills all recovered next-open, 0 refusals, WAL bounded, memory flat, 6/6 in-flight commits present and byte-exact
R4 realistic load	真实负载可用 — 8,440-file/78.8MB repo-like tree: init 2.6s, 300/300 multi-process writes exact, merges byte-exact; only legitimate HeadMoved under continuous-write merges
R5 delivery re-audit	内部交付就绪 — all three round-1 blockers verified fixed live (build arm end-to-end, docs walk, error codes with live triggers); recovery recipe dry-run restores a refused home

Fixed in 34ea1b95c: R1-P2-① the UNC verbatim conversion dropped the \ after UNC (\\server mis-named to server "UNCserver"; also //server now takes the UNC branch — the new unit test caught that); R1-P2-② SQLite's own open now receives the verbatim spelling, so a >MAX_PATH Store is not just installable but openable (verified live end-to-end, was "Uncertain"); R1-P3 relative storePath refused InvalidInput (was silently CWD-resolved); R5's doc gaps (README's wrong build paragraph, §6 lockout recipe needs an elevated console and the Store-file step, LAYERFS_HOME parent-must-exist documented).

P3-level observations recorded, not blocking: the ACL check matches broad SIDs rather than owner identity (planted narrow-DACL files pass the privacy check but fail pack binding); the check→open TOCTOU window is real but narrow (EBUSY pins the file while open; 0/6,431 race hits); -wal/-shm sidecars carry the token-default DACL. New unit tests: verbatim_wide_windows.rs (4 forms). Receipts: persistence 91/0, SDK chains green on the rebuilt addon, Windows clippy clean, Linux container Finished, CI four-green on 34ea1b95c.

[NelsonLongxiang]

Third verification round complete (five fresh angles on 34ea1b95c; their findings fixed/recorded in a7f5cda78, all chains green):

Angle	Verdict
A1 fix-verification + residual path surface	修复成立，新增 2×P2 已修 — the three r2 fixes re-verified independently (unit + black-box); a 23-call-site path-spelling map with a 6/6 deep-path e2e matrix; split-brain lane unconstructible (all spellings canonicalize to one digest; 3-spelling concurrent writers 60/60 exact)
A2 concurrency & writer lane	行为全过，P1 疑点经裁决消解 — 6×33 multi-process writes 198/198 exact, kill-holder recovery 132/132 published bytes exact, 2,825 commits no starvation, lifecycle/#436 clean
A3 cross-platform byte fidelity	通过（两方向 14/14 逐字节一致） — one Store file written on Windows read on Linux, and written on Linux read on Windows: CJK / emoji pairs / combining / lone-surrogate 3-byte forms all byte-exact; read-only open leaves the file's sha256 unchanged
A4 production perf envelope	无异常回归 — init 874 ms/4k files (throughput above the r2 reference), small-write p50 8.0 ms, 5 MiB ≈80 MB/s, random-read p50 0.68 ms, 3×20 multi-process exact, merge 6.8 ms, WAL deleted on close
A5 delivery clean-room	有缺口（无功能阻断） — docs/scripts/error-surface walk ✓ against HEAD; one P2 committed-residue and several P3 doc gaps

A2's P1 "the writer lane was never observed held" dissolved under adjudication. A canary-calibrated, name-agnostic enumeration of the session's named-object directory caught the lane mutex live during writes — Mutant:layerfs-writer-lane-1c515513f79bf042, exactly the verbatim-form (\\?\-canonicalized) digest — openHits 89/465 passes with heldHits 78 while 449 concurrent writes ran. The round's probe had derived the name without the \\?\ form and watched a nonexistent object. The lane holds per write transaction exactly as designed; A2's behavioral results (zero Busy, zero loss) stand with the mechanism now attributed.

Fixed in a7f5cda78 (probe evidence in tmp/win-native/round3/, receipts in each angle's report):

• A2-F4 (P2) — the writer lane moves Local\ → Global\: a session-0 scheduled task and the user session now share one lane (probe after the switch: Global openHits 592/1455, heldHits 580; the Local spelling 0). windows_lane_abandoned test derives the new name.
• A1-F1 (P2) — open_direct tightens SQLite's -wal/-shm sidecars to owner-only whenever an open sees them. Since connect creates them under the first open, they are restricted from creation; a crash's leftovers are re-tightened by the next open. Probe: crashed -wal already OWNER RIGHTS:(F) (pre-fix: Authenticated Users:(M) inherited), reopen recovers the write byte-exact, clean close deletes the sidecars.
• A1-F2 (P2) — project.init refuses a relative storePath up front (InvalidInput), matching the r2 direct.rs fence; no directory or project entry is left (probed).
• A5-F1 (P2) — removed committed probe residue api/agentharden-run/ (208 KB store.sqlite included) and unreferenced api/agent/harden-child.mjs; .gitignore guards the run directory.
• P3s — doc pointers to the audited-FFI list corrected to engine/AGENTS.md; inprocess.js header no longer "Linux only"; README states the Node ≥ 20 floor; verbatim_wide doc now matches byte-for-byte passthrough (A1-F3) and softens the longPathAware claim (A1-F6); §6 records the Global\ lane, sidecar tightening, the %TEMP% overlay-directory accumulation trade-off (A2-F2) and the SDK's lone-surrogate write behaviour (A3-F2: a JS write by such a name lands as an U+FFFD sibling; byte-carrying path stays the recorded follow-up).
• A1-F5 recorded, not changed — layerfs-overlay's two Win32 path probes keep raw wide spellings: importing the shared helper failed the product-source boundary guard (overlay is a first-party-dep-free leaf crate) and was reverted; inputs are TEMP-local and fail cleanly beyond MAX_PATH; documented as the exception.

Evidence correction for the r2 round (A3-F1): the "lone surrogate" names constructed in r2 via Node/PowerShell were silently U+FFFD (legal UTF-8); only CreateFileW-level construction makes the real 3-byte form. r2's capability claim stands — re-proven this round with true lone surrogates (both directions byte-exact, utf8:false on exactly those rows). LOC correction (A5-F2): f5622cd04's tree recomputes to 104218 (rustfmt −8), not the message's delta 0; the correction is recorded in a7f5cda78's message.

Receipts on a7f5cda78: verbatim 4/4, lane-abandoned 1/1 (Global name), windows_store_native 1/1, acl 2/2, kernel_guard 1/1; pinned clippy clean on the touched crates (examples' warnings pre-exist); boundary guard PASS (964 files); SDK fast chain 39/39 on the rebuilt addon; Linux container --offline --locked Finished; Production LOC 104239 → 104255 (+16, project.rs +10 / store_service.rs +6). Remaining recorded, not blocking: perf envelope is diagnostic single-sample; CI adds one report-only windows job (A5-F8); merge/compare byte-carrying path, headroom pre-admission parity, addon version handshake and the formal p95 baseline stay on the should-level list.

[NelsonLongxiang]

Fourth verification round complete (five fresh angles on a7f5cda78; docs delta in 2ff821486; includes a correction to round 3's narrative):

Angle	Verdict
B1 Global-lane adversarial	通过 — holder-side causality proven: holding the derived Global\ name blocked a write for exactly the 800 ms hold window (+13 ms after release); a squatter's write lands nothing and the kill of the holder releases the lane; abandoned handoff accepted under Global\; case-variant names are different objects (prefix is an exact match marker)
B2 sidecar semantics	通过 — 4-process concurrent first-open 4/4 serialized through the lane, 32/32 bytes exact, all DACL samples owner-only; re-tightening a sidecar another writer holds open: 4,130 writes zero errors; pre-planted wide-open sidecar tightened at open; WAL-header/frame and SHM tamper all salvage-or-refuse, never corrupt-accept
B3 soak + fault injection	本体达标，一项 P1 裁决见下 — 12 segments/10.9 min, 3 writers + merger, 1,508 writes 0 mismatch; 5 kills (4 confirmed mid-transaction) + 3 double-kills all recovered with every published commit byte-exact; 0 Busy; WAL ≤4 MiB bounded, RSS flat; recovery-sidecar DACL owner-only every time
B4 evidence-trail meta-audit	有断点（已更正） — 27 audited items reproduced exactly (tests, LOC both snapshots, CI, both fix probes re-run on HEAD); but round 3's adjudication narrative was refuted by retained evidence (below)
B5 overhead regression	无可感回归 — the new per-open cost is ≈0.2 ms (2× SetNamedSecurityInfo ≈104 µs steady-state; Global\ vs Local\ mutex differ <1 µs), <1% of every end-to-end face; init median 915 ms vs 874 (within noise of concurrent-agent load, first-samples retained not cherry-picked)

Correction to round 3 (B4-F1, integrity): round 3's comment said the lane probe "had derived the name without the \\?\ form". The meta-audit refuted that: A2's scripts did derive the verbatim form, and recomputing the digest confirms the watched name was correct. A2's pre-fix zero-observation anomaly therefore remains unexplained on the instrument side — I withdraw the causal claim, and also acknowledge its pre-fix numbers (89/465·78) were posted without retained receipts (single log files overwritten by the post-fix run; B4-F2). What stands for the product, now with retained receipts on both builds: round-3 post-fix enumeration 592/1455·held 580, round-4 adjunct2 242/1737·held 224 (tmp/win-native/round4/adjunct2/{writer-run2,prober-run2}.log), plus B1's holder-side causality on the same build — three independent positives; and B3's round-4 negative (its own sampler: 50 samples × 20 ms per round, lineage of A2's) contradicts B1's positive hold proof, so it is classified as an instrument false-negative with the mechanism not fully localized. All probe receipts are now retained per-round.

Other outcomes: the fence's "no directory left" wording was imprecise — discovery::home() creates the (empty) home root before the refusal; no project entry, no Store directory (B4-F3). api/agent/test/packaging.mjs fails on Windows for a pre-existing upstream import() path bug (B4-F4, not this branch's regression). Standard-user Global\ creation remains untested (B4-F6). The §6 long-path sentence now names the real condition — the host's long-path policy, not one manifest (A1's 308-char plain-path measurement; 2ff821486). B1's P3: a squatted write keeps the Node process alive until the outer timeout (INFINITE readiness wait, no cancel path — the §6-recorded tradeoff).

[NelsonLongxiang]

Fifth verification round complete (five fresh angles on 2ff821486; fixes and records in c2ca6caa6) — the round's headline is the merge rehearsal: the exact no-ff merge commit the owner will create was built locally and passed every chain:

Angle	Verdict
C1 Linux final-diff read	有条件通过→已收口 — full upstream/main...HEAD adversarial read: no Linux contract weakening, no cfg leakage, no lane-hold self-deadlock (container-proven on ext4); 1×P2 stale doc + 1×P3 unix dir-mode window, both fixed in c2ca6caa6
C2 merge rehearsal	通过 — local no-ff merge of 2ff821486 into 35d36575c (upstream/main): merge tree byte-identical to the branch tree (same tree oid); four chains + addon + SDK 39/39 + the frozen verify spec re-run on a merge-tree Store (run_58e79383230559ca PASS 5/0) + container check all green; one tooling fix (below)
C3 red team	零穿透 — no confidentiality/integrity break, no P0/P1; one new P2 availability primitive fully characterized; NUL-truncation P3 re-adjudicated (below)
C4 input-space edges	通过 — malformed-store battery all typed refusals 1–31 ms (truncated/foreign/user_version drift/directory-as-store); 100 MiB single write 1.37 s + byte-exact paged read-back; 101-level nesting; 2000 writes; 200-commit paginated history exact
C5 share conflicts & noise	通过 — every third-party hold shape fails fast and clean (≤201 ms, no hang/panic/half-writes); 41/41 torn-WAL copies recover with integrity_check ok; 45/45 writes exact under CPU+IO noise

Fixed in c2ca6caa6: doc 83's Windows-lane sentence now says Global\ (stale since a7f5cda78, C1-F1); project.init creates the Store's parent owner-only from the first instant on unix (DirBuilder::mode(0o700), no create-then-chmod window, C1-F3); NUL fences on storePath in both direct.rs and project.rs (C3-F4) — with honest scope: the observed truncation happens at the OS env boundary (NUL-terminated env block) before any product code, and the SDK is env-only, so today the fences are unreachable defense-in-depth for future non-env argument paths; the round's probe proves the env layer truncates at set time. §6 records the round's security neighbours (C3-F1: a pre-planted lane object with a foreign DACL fails the next open, typed Malformed today — typing improvement on the should-list; C3-F2: lane names are enumerable by any local user, a digest revealing activity, not the path; C3-F5: foreign-placed sidecars on a caller-pre-created wide directory stay foreign-owned) and C1-F2 (Linux refusal paths now leave the created Store parent behind). The rehearsal also fixed the patrol post-merge-verify.sh (untracked tooling): chain 4 now prebuilds --no-run — a cold compile alone measured 184 s against the script's 110 s per-suite ceiling — and reports explicit FAILED instead of a misleading "0 passed".

Verify freeze, round 5: a second frozen spec for a crash-recovered Store (30 writes, hard exit, reopen+recover, clean close) — spec_5e773f5fa69a → run_c2892720f8786183 PASS 5/5, archived arc_f71cb6a6ab0e; recovery and fresh paths produce the identical account. A recursive verify tree over both leaves was prepared and run: verdict STALE, correctly fail-closed — tree contract v1.2 carries a single target identity, and a two-distinct-snapshot aggregate cannot be blessed as PASS under it; the leaf runs and archives remain the frozen evidence (the tool refusing a shape it cannot honestly verify is the discipline working, not a failure).

Receipts: Windows + container checks on layerfs-node green after the fixes, clippy clean, SDK 39/39 on the rebuilt addon, Production LOC 104255 → 104272 (+17, the two fences), fork CI on c2ca6caa6 green (the windows-store-suites job finished success; one earlier run's in-flight status was superseded). Merge key remains with the owner: Create a merge commit — the rehearsal shows the merge tree identical to the branch tree while main stands at 35d36575c.

[NelsonLongxiang]

Sixth verification round complete (five fresh angles on c2ca6caa6; fixes in d9687cfa4). This round found and closed the branch's first P1 since round 2:

Angle	Verdict
D1 cold-eyes final read (zero prior context)	1×P1 + 1×P2, both fixed below + a 10-item refuted-suspicions ledger; otherwise "high engineering discipline, residual risk concentrated in branch paths of checking code"
D2 runbook literalism	§6 recovery runbook was not followable (P1 doc) — rewritten to the sequence verified end to end; post-merge script defects fixed (untracked tooling); agent.md/README walkthrough 12/12 exact, zero differences
D3 integrator journey	通过（docs-only 走通） — a real consumer app built from docs alone runs green; 13 documentation gaps recorded, one P2 doc fix (sandbox-call routing sentence)
D4 long-horizon soak	PASS — 34.4 min end to end, 4,729 ops, WAL bounded (≤4.1 MiB, zero after close), RSS flat, read path undegraded at 156 merges, 3 kills recovered byte-exact
D5 host-path diversity	PASS, zero behavioral difference — full chain (incl. two crashes, dual-process same-branch writes) under all-CJK, spaces/brackets/&/' and emoji directory names; error-code sets identical to the ASCII baseline

D1-F1 (P1, fixed in d9687cfa4): the volume guard's buffer regrowth was dead code — a Vec can never try_into a fixed [u16; 1024] for a longer requirement, so the retry read into a zeroed buffer on which the \\?\UNC\ refusal silently passed: a network share deeper than 1023 UTF-16 units was admitted as NTFS, breaking the local-volume-only condition. D1 proved it three ways (unit-level, ctypes, end to end through \\localhost\D$ following the product's exact algorithm). The final path now grows for real, the failure is captured before later syscalls, and new tests pin the behavior: a ~1160-unit local tree passes, the same tree through the admin share is refused — the refusal is the fix's behavioral proof.

D1-F2 (P2, fixed): the InvalidRecord fence covered only name_all. join now stays the display spelling (listings render a non-UTF-8 name empty — the documented contract), while a new join_exact fences every decision path (tree walks, bindings, changes, merge names/places) where a collapsed key silently dropped the second change of a directory. Captured as a decision ADR: "display join renders the empty segment, decisions refuse". content --tests 484/0.

Also in d9687cfa4: a missing Store answers Missing on Windows again (was Failed, D1-F4); §6 records the subst-spelling second-lane note (D1-F3, bounded by SQLite's WAL lock); agent.md names the Sandbox-related calls that still refuse Unsupported (D3-F1). Recorded, not changed: D1-F7/D1-F8 (wording and the Linux WTF-8 import face), D2-F2 (partial-recovery refusal drift), D3's documentation gaps.

Verify freeze grows to three leaves: fresh (spec_8d9a826db739), crash-recovered (spec_5e773f5fa69a) and now the CJK-host-path Store (spec_6b1711a0605a → run_380864b8e741da55 PASS 5/5, archived arc_fb4b88b22096) — the account invariants hold regardless of the host path's encoding.

Receipts on d9687cfa4: content 484/0 + windows trio 6/0 + volume-guard 2/0 + acl 2/0 + kernel_guard 1/0; clippy clean; SDK 39/39 on the rebuilt addon; container --offline --locked --all-targets green for content/store-service; Production LOC 104272 → 104281 (+9). Fork CI: the first attempt's windows store suites job was killed by the workflow's own timeout 120 per-crate ceiling — the content suite's first-execution cold cost on a cache-less fork runner (the same physics D2 measured at 184–228 s in the merge rehearsal; the suite itself runs 2.69 s warm, 484/0 locally, and the kill landed exactly at step-start+120 s). --failed rerun: all four jobs green.

[NelsonLongxiang]

Seventh verification round complete (fix-adversarial verification, merge rehearsal v2, fence-at-scale, SDK test-surface map, fence end-to-end proof; one process correction in 2dd58881f):

Angle	Verdict
E1 fix adversarial verification	三处修复全部经攻击成立 — boundary matrix 1021–1100 units (local accept, admin-share refuse at every length), Missing-order 7-case matrix, join_exact coverage audit: all 6 decision sites fenced, write paths never key on the display spelling
E2 merge rehearsal v2	通过 — merge tree byte-identical to the branch tree (same tree oid); the v3 post-merge script executed end to end in variant form: five crates 682 passed / 0 failed (matching D2's warm total exactly), frozen verify spec PASS on the merge-tree Store, container green
E3 fence at scale	无可感开销，规模正确 — 8,000-file/4-deep tree: 3×1,500 writes zero refusals, two 3,000-change merges 337/203 ms, all read-backs byte-exact; fence A/B arms differ ≤±11% (noise; the multi-byte arm is never slower)
E4 SDK test-surface map	零分支回归，净改善 — 26 scripts cataloged: 17 executable, 12/14 whole-script PASS, failures all upstream-existing or platform-scoped; the branch fixes trace ×9 vs main and adds three passing store chains; real-Store scenarios 27/28 both legs (the one is the documented list_sandboxes Unsupported)
E5 fence end-to-end	通过 — planned merges with two unpaired-surrogate names in one directory succeed with 5/5 entries preserved (they never enter a String-path decision); the full-walk path (diff_branches, >65,536-changed merges) refuses InvalidRecord deterministically, byte-exact preservation, Windows and Linux identical; clean 2×2 attribution

Process correction (2dd58881f): round-6's message claimed "new tests volume_guard_long_paths_windows" — the file was written but never staged (git add -u stages tracked files only), so it was absent from d9687cfa4's tree while present in the local working tree that produced the 2/2 receipts (E1-F3). It enters the tree unchanged, passes 2/2, and this CI run is the first where it ran from the tree. 2dd58881f also adds compare_join_exact — the fence's first in-tree unit test (identical to display for UTF-8, InvalidRecord outside it, and two distinct surrogate names provably collapsing to one display key — the fenced harm). CI four-green on 2dd58881f. Frozen verify family re-run: all three specs PASS 5/0.

Recorded for the owner (not this branch's regressions): E1-F1 (P2, upstream — the Linux FUSE invalidation keys Stale::Entry on the display spelling; commit_merge.rs/invalidate.rs untouched by this branch per diff, so a non-UTF-8 name rebound by a merge would miss its kernel dentry invalidation); E3 (P2 decisions — the 256-component path limit is enforced on the workspace/rename route but not the SDK fs/init routes, live-accepted at 257–301 components; deep single-chain costs grow near-quadratically, d=250 mkdir 1.8 s); E1-F2 (P3 — walk.rs feeds the display join to descent/glob filters, display-scope drift only). Tooling: post-merge-verify.sh v4 — toolchain pinned +1.85.1/--offline, per-crate same-selection prebuild (E2 proved a cross-crate prebuild still recompiles past the ceiling), and a tested TIMEOUT recovery recipe (a kill mid-link corrupts PDBs — LNK1207 — recover with clean -p + re-prebuild).

Merge key remains with the owner: Create a merge commit. The rehearsal now covers d9687cfa4; the tree identity argument holds for 2dd58881f identically (tests-only delta, verified byte-identical merge tree by construction).

[NelsonLongxiang]

Eighth verification round complete (incremental cold read, in-process concurrency, cross-document consistency, flake hunt, merge-day package; fixes in 1443753b4):

Angle	Verdict
F1 incremental cold read (the two fix commits)	修复核心成立，但抓到测试的两个真问题（P2: the discriminating share half silently self-skipped off D:; P3: the regrow retry trusted its second answer — both fixed in 1443753b4）+ a 12-item refuted-suspicions ledger
F2 in-process concurrency	PASS — 6 clients × 40 writes in one process: 480/480 exact, 0 Busy/HeadMoved/Conflict; open/close churn ×50 leak-free; two Stores in one directory share the lane without starvation (170/170 exact each); pool width 4/8/64 equivalent
F3 cross-document matrix (27 facts × 10 carriers)	6×P2 contradictions, all aligned in 1443753b4 — the "fs/branch/project/operator in this process" family vs the sandbox exception (four carriers), §6's directory-check sentence vs the code, README's pre-native opening sentence, NoStore never documented, InvalidRecord vs the SDK's Failed, and the PR body pointing at §6 records that weren't there
F4 flake hunt	23 executions, zero flakes — every suite ×3 green; the r6 CI transient reproduced and quantified locally: cold cost = clean 340 s + cold build 80 s against the 110 s ceiling (a budget separation, not instability)
F5 merge-day package	17/17 artifacts verified — script v4 syntax/pinning/prebuild in place, three frozen specs re-run PASS 5/0 today, all referenced run/archive ids resolve, MERGE-DAY.md assembled; one P2 broken link fixed (the script checked the fork's main, which never moves — now prefers upstream/main)

Fixed in 1443753b4: the volume-guard test now derives the share spelling from the temporary directory's own drive letter — verified 2/2 in the default C:-TEMP environment through \\localhost\C$, the first receipt where the discriminating refusal half provably executed (round-7's "2/2 refused" ran the skip branch); the deep() helper builds its verbatim prefix textually (PathBuf::join drops it for absolute components), so the test no longer depends on the host's long-path relaxation; the regrow retry refuses Unsupported when the requirement outgrew the regrown buffer (the concurrent-rename race that could revive the round-6 P1 harm); and the six documentation contradictions above plus their P3 tails (--offline, Node ≥ 20, the worker-branch comment, the four-threads claim → the actual default of 64).

Recorded: F2's read-during-write latency characteristic (reads stay correct but queue behind long writes on the shared pool — integrators mixing latency-sensitive reads should know); F4's cold-cost quantification (the CI lane's per-crate 120 s wraps build-first policy already; the transient stays possible on cold cache-miss runners); F1-F4 (dangling-link spellings answer Missing/NoStore, still never followed); F5-4 (the WinFsp contract text awaits the owner — the only un-assembled piece of adjudication #3).

Merge key remains with the owner: Create a merge commit. MERGE-DAY.md (in the round-8 receipts) walks the whole sequence: pre-press checks, the press, the post-merge script (now checking upstream/main first), the frozen-spec family re-runs, and the 24 h / 72 h checkpoints.