fix(contract): block native, mixed and escaped Windows private paths in the boundary scan

[JasonBuildAI]

Goal And Delivered Outcome

A Windows contributor can no longer push a local machine path through the public/private boundary gate that loopx check and loopx canary premerge --from-git-diff run before publishing: the scan now reports the private roots it already names however the host, the caller or a serializer spells them.

• Outcome basis / optional anchor: Closes [Bug]: the boundary scan blocks POSIX private paths but not the native Windows spelling #6160

• Goal/source and gap: loopx check --scan-path is the public/private boundary scan CONTRIBUTING.md, docs/development/testing-and-quality.md and the contributor workflow tell everyone to run before publishing docs, fixtures, examples or PR evidence, and it is the scan loopx canary premerge --from-git-diff runs over changed files. Its local_private_path rule only matched the POSIX spelling of the private roots it already names, so the same root written the Windows-native way (C:\Users\<name>\Documents\...), with separators mixed at a junction, or escaped by a JSON/source string literal cleaned the scan and the gate reported no hit.

• Observable before vs after, with the validation row that proves it: loopx check --scan-path <dir> over seven synthetic files reports errors=2 at base 5c62c5c03 and errors=6 at head; the seventh file holds a path outside the named roots and stays clean at both revisions (see the real_entrypoint row).

• Issue/task and intended base: Closes [Bug]: the boundary scan blocks POSIX private paths but not the native Windows spelling #6160; base main.

Author Declaration

• Written by: an AI coding agent (Codex, OpenAI), at the human operator's direction and under their review. AI disclosure: this change was drafted with AI assistance at my request, under my direction and review.

Implemented against

• Specification and revision: no accepted RFC; the basis is the reproduced defect in [Bug]: the boundary scan blocks POSIX private paths but not the native Windows spelling #6160 plus the rule intent already stated in loopx/contract.py and the Windows-aware local-path owner already shipped at loopx/public_safe_text.py (find_public_safe_local_path, Refs [Architecture]: two modules both claim to own "private-looking text" #5136 direction 3), at base 5c62c5c03.
• Criteria:

Criterion (spec clause)	Disposition	Symbol / path	Test or command
The scan reports a private path under the roots the rule already names for every accepted separator spelling and separator run	implemented	loopx/contract.py LEAK_RULES["local_private_path"]	tests/test_contract_public_boundary_prefilter.py::test_native_windows_private_paths_are_blocked (5 cases)
The folded-literal prefilter stays a necessary condition, so the regex is reached for every spelling it accepts	implemented	same rule, required_literals	...::test_every_authoritative_leak_pattern_has_a_matching_prefilter[local_private_path-...] (3 new rows) and ...::test_prefilter_is_a_necessary_condition_for_every_separator_spelling
Existing POSIX and forward-slash detection is unchanged	implemented	same rule	...::test_prefilter_preserves_all_boundary_hit_categories plus the pre-existing local_private_path rows
Windows paths outside the named private roots stay public (the roots are not widened)	implemented	same rule	...::test_windows_paths_outside_the_private_roots_stay_public

• Self-check before submission: ran changed-file ruff, the focused boundary-scan file at base and head, the seven boundary-related suites at base and head, the shipped-CLI repro, the public-boundary scan over the two changed files and over the whole worktree, and the diff-scoped semantic-inventory advisory (no supported new vocabulary carriers). Left out: the mirrored control-plane text owner and the preview capability scanner, both named under Scope.

Scope And Continuation

• Completed scope and remaining work: complete within this scope for the repo-publication boundary scan. local_private_path now accepts either separator, or a run of separators, at each junction of the roots it already names (Users/<name>/Documents, Users/<name>/code-reading, ext_data), so the native Windows spelling, a mixed spelling and a serialized/escaped spelling are all reported. required_literals moved to the two necessary forms of each root (users/, users + backslash, ext_data/, ext_data + backslash); together with the separator run they keep the regex reachable for every accepted spelling while the prefilter stays a cheap necessary condition and the regex stays the sole authority. No new rule id, category or policy is introduced, and the named roots are unchanged.
• Slice boundary / successor: the same POSIX-only spelling still exists in two adjacent owners, deliberately left out so this PR stays one reviewable change and does not silently move a mirrored contract:
  • loopx/public_safe_text.py _CATEGORIZED_PRIVATE_TEXT_PATTERNS (the /Users/ arm behind classify_private_text / find_private_text_match). Changing it has to move the TypeScript mirror in loopx/control_plane/goals/vision_checkpoint.ts and tests/fixtures/public_safe_text_corpus.json together, so it is a parity change of its own.
  • loopx/capabilities/public_safe_outbound/scanner.py private_abs_path (preview capability, not the loopx check path).
    Neither gates the scan this PR repairs.

Validation

• Tested revision: a70f79302, compared against base 5c62c5c03
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
unit	passed	pytest tests/test_contract_public_boundary_prefilter.py -q at head: 4 failed, 45 passed; at base 5c62c5c03: 4 failed, 32 passed. All 13 added cases pass; the 4 failures are the same pre-existing Windows-host artifacts at both revisions (see regression_parity).
regression_parity	passed	Seven boundary-related suites at base 21 failed, 100 passed, 1 skipped vs head 21 failed, 113 passed, 1 skipped, with an identical failure-name set (symlink creation is privileged on this Windows host, and Path.write_text newline translation turns the \r\n separator case into \r\r\n).
real_entrypoint	passed	shipped .venv/Scripts/loopx.exe check --scan-path <dir> over seven synthetic files: base exits errors=2 (POSIX and forward-slash Windows spellings), head exits errors=6, adding the native Windows, mixed-separator, escaped and ext_data spellings; the out-of-root file stays clean.
unit	passed	rule-level table over 18 synthetic lines (POSIX, forward-slash, native, mixed, escaped, ext_data, plus negative shapes): every expectation matched, and D:\checkout\loopx\docs\x.md, C:\Users\<name>\AppData\..., docs/users/roles.md stay public.
static	passed	ruff check loopx/contract.py tests/test_contract_public_boundary_prefilter.py: All checks passed
static	passed	loopx check --scan-path loopx/contract.py --scan-path tests/test_contract_public_boundary_prefilter.py: ok=True, public boundary scan clean: 2 files — the widened rule does not match the source or tests that declare it.
static	passed	loopx check over the whole worktree: ok=True, 0 errors, public boundary scan clean: 4716 files — the separator-run widening adds no false positive on the existing public tree.
static	passed	python scripts/generate_semantic_inventory.py --changed-from HEAD: no supported new vocabulary carriers detected (data-only change to one regex and its literal list; no new rule id, enum or contract).
static	not_applicable	loopx/contract.py is not in [tool.mypy].files, so the repository type check does not cover it.

• Coverage and gaps: the production change is data-only in the rule table plus new test rows. Coverage exercises the pattern table directly, the prefilter-necessity invariant over separator spellings and runs, the full scan_public_boundary payload for each accepted spelling, a precision case that pins the roots, and the shipped CLI exit.
• Behavior change disclosed: the rule is a strict superset of its previous form and the named roots are unchanged, so detection only grows. One widening is worth naming: C:\Users\Public\Documents\... is now reachable in the native spelling because the middle segment is matched as a username. It was already reported in its forward-slash spelling, the whole-tree scan (4716 files) stays clean, and the AppData negative case pins that unrelated profile subdirectories stay public.
• Known remaining gaps, both pre-existing and symmetric with the POSIX arm, so neither is a regression of this change: the pattern is case-sensitive while Windows paths are not (C:\users\alice\documents\... is still not reported, exactly as /users/alice/documents was not), and percent/URL-encoded spellings are not decoded. Closing either changes detection semantics beyond the separator defect in [Bug]: the boundary scan blocks POSIX private paths but not the native Windows spelling #6160, so it is left as a disclosed gap rather than folded in here.

Frontend / Visual Evidence

• UI impact: none

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference, when applicable: N/A; ordinary self-contained defect repair with its own issue ([Bug]: the boundary scan blocks POSIX private paths but not the native Windows spelling #6160).

Shared-authority RFC fixture impact

• Production-scale fixture schema: N/A
• Semantic dimensions changed, or reviewed no-impact rationale: N/A
• Provider conformance arms run: N/A
• Read-only legacy/file/PostgreSQL three-arm rehearsal (required for promotion, runtime-routing, or compatibility-projection changes): N/A

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md).
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh

[P2] 同步注册表 I/O 清单后再合并（loopx/contract.py:124 附近新增行导致既有调用下移）。AppData negative remains accepted. Full semantic census: Bexit0; Hexit1 with project registry I/O site metadata changed: loopx/contract.py::.check_contract::codec_read:load_registry#1. Independent manifest reconstruction changes only1099->1107.

最小修复：Regenerate and review loopx/semantics/project_registry_io_manifest_v1.json; only the check_contract load_registry codec site moves from1099 to1107. Keep classification/coverage unchanged, then rerun the manifest check and full semantic smoke.

Exact head: a70f7930268d9316c932e7a44dbfb3e3c8729531. Immutable comparison base: 5c62c5c03f13cc84176338100f2bded12801530e.

动机

在 Windows 上准备公开文档、示例或评审材料，并运行既有公开边界检查的贡献者。

同一份材料：基线只报告 POSIX 文件，候选同时报告原生、混合与转义路径；移除这些路径后重跑既有命令即可恢复通过。

真实 loopx check 和扫描 owner 已验证路径修复；完整语义检查仍因 I/O 清单行号过期失败，所以该 head 尚不能交付。

本次只修复既有私有根的分隔符拼写；不承诺覆盖所有本机目录、大小写、用户名中的空格或 URL 百分号编码。

规范：spec_ref https://github.com/loopx-project/loopx/issues/6160；spec_revision 2026-10-10T18:25:39Z；criterion_id “Expected behavior” 已通过。既有 CONTRIBUTING.md Public And Private Boundaries 仍禁止发布本机路径。

改动思路

复用原有 LeakRule 和扫描入口，将正则与必要条件预筛选一起扩展；这避免只有正则改变却仍被预筛选漏掉。公开文本清洗器的目标是脱敏而不是拒绝，不能直接替换这个 owner。

Python 正则和文件扫描是既有专门 I/O 边界；它没有新增控制面决策源。最小有效修复已经归到同一 rule，生成清单必须随源码位置一起更新。

交付既有扫描规则的 Windows 拼写修复、负例与必要条件测试，并同步该文件的注册表 I/O 清单位置；不扩展通用路径清洗或新增能力。

未来相关重构审查：继续使用现有 scanner/provider owner；本次没有需要新增的抽象、并行状态或语言迁移。最近的有效伴随修改是上述最小修复；不把后续猜测当作当前阻塞，也不根据六行或测试数量推断风险。已送达的恢复 RFC 经验不定义这里的验收；只采用普通任务、失败与结果读回的检查方法，不继承历史结论。

具体改动

[\\/]+ 接受一个或多个正反斜杠，用户名段排除两类分隔符，私有根仍是 Documents、code-reading 和 ext_data。四个 literal 是候选必要条件，不能单独认定泄漏。新增测试同时覆盖原生、混合、序列化转义和 AppData 负例。扫描先按现有 Git/private-state 规则排除私有本地状态，再读取正文；每行先折叠检查候选，再执行原始正则，输出路径位置和规则名，不输出私有正文。

关键代码讲解

• loopx/contract.py:70 — LeakRule.is_candidate：Necessary literal prefilter admits possible matches without deciding private/public.

• loopx/contract.py:124 — LEAK_RULES[local_private_path]：Same private roots now accept slash/backslash runs; regex remains authoritative.

• loopx/contract.py:906 — scan_public_boundary：Private-state filtering precedes reads; sorted line-level hits after prefilter/regex.

• loopx/contract.py:1107 — check_contract.load_registry：Existing codec read moves1099->1107 while its tracked census remains1099; full semantic check rejects drift.

独立验证：B: one POSIX hit; H: five hits for POSIX/native/mixed/escaped/ext_data; AppData remains clean. Independently varied four junctions: H256/256 regex matches, B8/256; every matching path survives prefilter. Reverse inputs preserve diagnostics. A later native-path file is covered; correction gives CLI exit0 at both revisions. Missing-root and private/tracked policy cases pass focused suites.

负例与完整检查：AppData negative remains accepted. Full semantic census: Bexit0; Hexit1 with project registry I/O site metadata changed: loopx/contract.py::.check_contract::codec_read:load_registry#1. Independent manifest reconstruction changes only1099->1107.

运行来源为各自不可变基线/候选 worktree，CPython 3.14.8，验证导入来自该 checkout。Ruff 与 git diff --check 通过；开发期语义 advisory 先于完整检查运行，零候选只说明该探针范围。测试结果：七个聚焦文件，基线122项通过、候选135项通过；完整语义检查基线通过、候选失败。没有查询、轮询或等待 GitHub CI。独立探针最初的调用脚本错误已纠正，失败记录保留；它们不是产品失败，也没有用于掩盖上面当前候选的失败。

对主干的风险

A patch can correctly reject leaked paths but still fail the repository census because changed source coordinates were not regenerated. 用户的普通路径是继续调用原有命令或已授权读取，没有新增确认或重复配置步骤。Native Windows system calls were not run: this change operates on file contents, verified on macOS with CPython3.14.8. Existing case-sensitive/root-prefix limits remain. Required semantic smoke fails at H; no CI consulted. 上述测试没有扩大权限，合成注册表、临时配置与子进程均不修改活动 Goal 或真实外部服务。正例不能抵消候选的关键失败。既有 schema、quota、scheduler 与授权边界未增加；评审结论也不授予合并权限。恢复必须由原有内容/读取 owner 完成，纠正后重新读回，不能把收到成功字段当作完整性证明。

我的整体评价

REQUEST_CHANGES。The useful separator fix is demonstrated, but a required current repository gate newly fails from the same diff; this is PR-caused, not inherited. Regenerate and review loopx/semantics/project_registry_io_manifest_v1.json; only the check_contract load_registry codec site moves from1099 to1107. Keep classification/coverage unchanged, then rerun the manifest check and full semantic smoke. 修改范围本身合理，原有 owner 可承接；当前阻塞都有基线/候选差异和可重跑证据。修复后应在新精确 head 重做相关失败检查，并保留本次已通过的合法路径与反方向负例，不能仅改评审标签或削弱检查。

English verdict: REQUEST_CHANGES. The Windows spelling fix works at the exact head and the expanded prefilter preserves the authoritative regex. However, the required semantic census passes at the immutable base and fails at this head: check_contract.load_registry moved from line1099 to1107 while its manifest still records1099. Regenerate the existing manifest without weakening its classifications, review the one-row delta, and rerun both manifest and full semantic checks. This is a bounded integration omission, not a request to broaden the path policy.

Validation: B: one POSIX hit; H: five hits for POSIX/native/mixed/escaped/ext_data; AppData remains clean. Independently varied four junctions: H256/256 regex matches, B8/256; every matching path survives prefilter. Reverse inputs preserve diagnostics. A later native-path file is covered; correction gives CLI exit0 at both revisions. Missing-root and private/tracked policy cases pass focused suites. AppData negative remains accepted. Full semantic census: Bexit0; Hexit1 with project registry I/O site metadata changed: loopx/contract.py::.check_contract::codec_read:load_registry#1. Independent manifest reconstruction changes only1099->1107. Native Windows system calls were not run: this change operates on file contents, verified on macOS with CPython3.14.8. Existing case-sensitive/root-prefix limits remain. Required semantic smoke fails at H; no CI consulted.

[JasonBuildAI]

Review blocker fixed at a new head: d14dddb4bc7987e138cd5cc98e700628780a690c, rebased onto upstream/main @ f1a0290bbfe837956694313d0b94a62ed2fb67ed.

Delta since the reviewed head (a70f79302)

• loopx/semantics/project_registry_io_manifest_v1.json regenerated with scripts/generate_project_registry_io_manifest.py. The only delta is the tracked census row loopx/contract.py::<module>.check_contract::codec_read:load_registry#1 moving from line 1099 to 1107 (column 20, kind codec_read, api load_registry; classification and the 291-site coverage unchanged).
• loopx/contract.py and tests/test_contract_public_boundary_prefilter.py are unchanged from the reviewed head.

Re-run evidence at the new head

• uv run --extra test python scripts/generate_project_registry_io_manifest.py --check -> project registry I/O manifest is current: 291 sites
• uv run --extra test loopx canary smoke-suite --script semantic-vocabulary-drift-smoke.py -> passed (72.6s), including the census and generated-contract checks
• uv run --extra test loopx canary premerge --from-git-diff --git-diff-base upstream/main -> diff hygiene, changed-file compile and 7/9 catalog canaries pass, including the semantic smoke; the two failing canaries (quota-plan-smoke.py, todo-readmodel-boundary-smoke.py) fail identically on pristine upstream/main in this environment, so they are not diff-caused
• uv run python scripts/generate_semantic_inventory.py --changed-from upstream/main -> no supported new vocabulary carriers (advisory)
• Focused pytest on the changed surface: the PR-added prefilter and native-path tests pass; four pre-existing tests (iter_scan_files symlink enumeration and the CRLF-separator line-number case) fail identically on pristine upstream/main in this Windows checkout

No path-policy, classification, or coverage change; no check was weakened.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=xhigh

Exact head: d14dddb4bc7987e138cd5cc98e700628780a690c. Immutable comparison base: f1a0290bbfe837956694313d0b94a62ed2fb67ed. 未发现阻塞本次有界修复的问题；旧评审的清单漂移已验证解除。另有一项独立基线 canary 失败，下面保留其完整归因与范围。

动机

在 Windows 上准备公开材料并运行既有发布前边界检查的贡献者。

同一份待公开材料，基线只报告两种正斜杠拼写；候选报告六种已声明拼写，正文纠正后原命令重跑通过。

当前 head 的扫描修复与清单同步已通过源码和正常安装包；先前评审的清单漂移阻塞已解除。

本次只修复既有私有根的分隔符拼写，不声称覆盖所有本机路径、大小写或 URL 编码，也不新增发布授权。

这给已有命令带来可用的安全收益：不再因为正文使用原生或序列化分隔符而错误报告干净，发现问题后仍由贡献者修改材料，再运行原命令，没有新增配置、确认或权限步骤。

改动思路

复用当前 scanner 的同一 LeakRule 和必要条件预筛选即可修复拼写遗漏；直接采用更宽的文本清洗器会改变合法输入，另建框架没有实际必要。

同一 PR 交付 Windows 分隔符修复、精度与必要条件反例和生成 I/O 清单同步；保持既有调用、私有文件隔离与诊断格式。

check 与 premerge 都继续调用既有 scanner。Git/private-state 分类先于正文读取；整文件和逐行的 literal 只决定是否值得运行正则，不能单独认定泄漏。Python 保留的是既有专门正则与文件 I/O，不产生第二份通用控制面决策。原 public_safe_text 的更宽文本策略和 preview scanner 不属于这个发布检查的同一契约，直接替换会改变接受范围。

未来相关重构审查：此次在原 rule 内完成修复，保持单一正则权威；不需要再加框架、模块或配置。已送达的恢复 RFC 经验仅用于普通任务、纠正与读回的方法，不把其分期规则或历史结论当作本次验收。

具体改动

全 PR 三文件 +74/-10：contract.py +17/-9 扩展分隔符和四个必要 literal；测试 +56 覆盖原生、混合、转义、根范围精度与预筛选；生成清单仅一行 1099→1107，仍有相同 291 个调用点、分类和读取 owner。相较旧 reviewed head a70f7930268d9316c932e7a44dbfb3e3c8729531，两份行为/测试文件字节未变；这次整合了新基线并补齐生成清单，当前完整 PR 仍独立核验。

规范依据：spec_ref https://github.com/loopx-project/loopx/issues/6160；spec_revision 2026-10-10T18:25:39Z。criterion_id Expected behavior 已 implemented：同一命名私有根的两种拼写都应报告。既有 CONTRIBUTING.md Public And Private Boundaries（revision f1a0290bbfe837956694313d0b94a62ed2fb67ed）仍是发布边界；本次没有发明新的路径根或把未来完整检测能力变成当前义务。

关键代码讲解

• loopx/contract.py:70 — LeakRule.is_candidate：literal 是必要条件。独立改变四处 junction 的 256 种组合，候选 256/256 均匹配且通过预筛选；基线只有 8/256。
• loopx/contract.py:124 — LEAK_RULES[local_private_path]：一个或多个正反斜杠，用户名排除分隔符；保留 Documents、code-reading、ext_data 根。AppData 和普通 checkout 不被这次扩大成私有根。
• loopx/contract.py:906 — scan_public_boundary：新鲜枚举、私有/Git 过滤、读取、行号、正则和排序沿原 owner。实际反向文件参数及重叠私有输入两种顺序保持覆盖，不缓存旧文件结果。
• loopx/contract.py:1046 — check_contract：继续输出同一错误类别/文件/行号与 exit1；材料纠正后另进程为 exit0，重复结果相同。清单在当前 source 的 load_registry 调用处同步到 1107。

独立源码与正常 wheel 安装的同一八例：初始 B2/H6，后来新增原生文件 H7；纠正/重放均通过；缺失根仍拒绝；私有输入仍跳过，AppData 仍可用。五个未改变情形的完整 B/H JSON 相同，每个 revision 的八例源码/wheel 全包相同；仅替换临时 fixture 绝对根，不去掉字段、诊断或差异。独立 oracle 来自 issue 和既有边界，不从候选输出生成。把正常已安装包复制到隔离目录，故意删掉反斜杠预筛选 literal，真实 CLI 只报告 3 个而非应有 6 个，断言失败；正常候选全部通过。扫描不改正文，纠正由操作者负责。

对主干的风险

本次没有新增阻塞 finding。最强风险是正则扩展却被预筛选再次截掉，或源码行号变化使完整语义检查失败；实际 CLI 突变和当前清单/语义检查分别覆盖这两个方向。新增检测是明确的默认行为修复，不是默认关闭能力；没有新增 actor、grant、quota、scheduler、Todo 状态或自动发布义务。

独立验证：七个聚焦测试文件 B123/H136 pass，0 skip；291-site 清单和完整 semantic smoke B/H 均通过；changed-diff advisory 零支持的新词汇 carrier（不证明动态语义无变化）；Ruff、diff-check、三候选文件公共边界 scan 通过；正常 wheel 构建/安装通过，实际 CLI 从 site-packages 运行。未改的 chat bundle 复用并逐文件验证，不冒充新 UI 构建或交互验证。

语义与 CI 对齐

本地 native premerge 五项 direct 检查通过，九项 selected 中八项通过、一项 todo-readmodel-boundary-smoke.py 失败。独立 B/H 用同一命令均 exit1，完整 offender 签名相同：legacy_mutation.py:16 与 mutation_api.py:38 的反向 status imports；两个 owner 文件和 smoke 的 sha256 在 B/H 完全相同。该 PR 只改变三个扫描相关文件，未进入此失败的因果路径；扫描 invariant 另有完整 source/wheel 正反例与语义通过证据，因此归为 pre_existing_unrelated。保留这项既有质量失败及现有 #6171 owner；不删检查、改阈值或把整次 premerge 标成绿色。未查询、轮询或等待 CI。

保留限制：本轮在 macOS/CPython 3.14.8 执行，验证的是内容正则和真实文件/CLI；没有执行原生 Windows 系统调用或长期吞吐对照。大小写、用户名空白、URL 编码及命名根前缀范围是公开的原有边界；不宣称所有本机路径已识别。Native Public username 分支仍沿原 forward-slash 规则；PR 已明示。初次私有 probe 字段和脚本路径调用错误已纠正并保存，不归因给产品，也没有用它们抵消当前质量失败。

我的整体评价

APPROVE。本次 separator 修复与实际纠正/重跑旅程达到 issue 的有界目标；long_horizon 与 user_experience 在这条重复发布检查路径上 improved，没有增加用户操作或持久状态。效果证据是同一材料不再假干净、合法材料及读取边界保持；整体时延、吞吐和长期净成本未测，不从更少漏报或测试数推断速度提升。

复用当前 scanner 的同一 LeakRule 和必要条件预筛选即可修复拼写遗漏；直接采用更宽的文本清洗器会改变合法输入，另建框架没有实际必要。

同一 PR 交付 Windows 分隔符修复、精度与必要条件反例和生成 I/O 清单同步；保持既有调用、私有文件隔离与诊断格式。

复用既有 LeakRule/类别与专门 I/O owner，没有新增词汇。旧清单 blocker 已解除；独立基线 canary hold 保留，批准不代表全库绿色，也不授予合并、bypass 或发布权限。

English verdict: APPROVE - d14dddb; separator coverage and fresh correction/replay work in source and normally installed wheels; manifest/full semantic B/H pass,123/136 focused tests pass. Native premerge retains one independently identical baseline readmodel failure; no CI consulted, native Windows or long-term performance claim.