[yifanxuaaa]

Closes #529. Stacked on #528: the base is #528's branch, so this diff shows only #529. Merge #528 first, then retarget this PR to layerfs_v2_0_0.

What changes

A Sandbox now names the platform it runs on. LayerFS.init and where a home keeps its Stores (LAYERFS_PLACEMENT) don't change.

- sandbox.create({ image }?)             -> { sandbox, image }
+ sandbox.create({ image?, platform? }?) -> { sandbox, image, platform }
  project.list_sandboxes(...)            -> [{ ..., platform, ... }]   (every platform's Sandboxes)
  workspace.mount(sandbox, branch)       -> { ..., platform }
+ runtime.status().platforms             -> [{ id, allowed, ready, missing }]
+ layerfs sandbox create --platform <name>

• Platforms: docker, mac, linux, apple-container, microsandbox, lima, firecracker, ssh. There is no windows platform: Windows uses docker through the WSL2 worker.
• What a home allows:
  • macOS Docker and Windows: docker.
  • macOS native: mac.
  • Linux: docker and linux, mixed in one project on one Store file.
  • vm:X: X.
• Refusals happen before anything is made. A known platform the home doesn't allow is Unsupported. Anything else, including windows, native and namespaces, is InvalidInput.
• The record decides. Every later call on a Sandbox follows its record, not the client's LAYERFS_SANDBOX. That setting is now only the home's default. Old records with no platform are read with a default; nothing is rewritten.
• Default image: a linux or VM Sandbox defaults to its archive's image. An image the archive doesn't have is InvalidInput before any effect.
• Native records: with no LAYERFS_LOCAL_DIR, a native record must own its directory, through a mode-0600 owner marker.
• Finding 6, fixed: a record that can't be read is left out of list_sandboxes and cleanup. It is reported as refused in runtime.sandbox.records and kept on disk.

Spec: core/docs/issues/529/README.md. Pass record: core/docs/issues/529/PLATFORM-PASS.md.

Terminal pass

• All 108 cells pass (C01–C12 on 9 platforms), with every Sandbox made by sandbox.create({ platform }).
• Other checks pass:
  • the mixed Linux project: one Store file (dev 64769, inode 797004) shared by the agent, the docker daemon and the linux daemon;
  • the default on ten homes;
  • 107 refusal answers;
  • old records, rerun after finding 6.
• Not run:
  • Windows: there is no Windows host;
  • live Connect: Connect's UI change is in the layerfs-connect repository, uncommitted, and passes in its harness only.

Open findings

• One LAYERFS_IMAGE alone can't serve both Linux platforms. The per-platform default image covers it.
• One test needs cc.
• discovery.rs is 985 lines, close to the 999-line limit.
• Sandbox platform integration and consolidation #527's findings are still open.
• Finding 7: a stopped native Sandbox whose directory is gone is not reclaimed when LAYERFS_LOCAL_DIR isn't set. It has to be removed by hand.

Production LOC

tools/production_loc.py, first-party product code. Reference absent (retired R9c; last counted 65,417 at tree 498dd1917812).

Commit	Production LOC
b3efa9b move to place/	123811 -> 123811 (delta 0)
db4b8e4 a Sandbox names its platform	123811 -> 123966 (delta +155)
6f242b7 cell runner	123966 -> 123966 (delta 0)
33733d0 back to platform/, move only	123966 -> 123966 (delta 0)
91f3161 default image per platform	123966 -> 123993 (delta +27)
4e89998 owner marker for native records	123993 -> 124051 (delta +58)
78b63e8 image the archive lacks	124051 -> 124059 (delta +8)
a3e956d finding 6	124059 -> 124168 (delta +109)
Docs and receipts commits	delta 0
Total	123811 -> 124168 (delta +357)

🤖 Generated with Claude Code