@openclaw/signal 2026.11.3 → 2026.11.5-beta.2

package/node_modules/@openclaw/fs-safe/docs/config.md

@@ -55,6 +55,8 @@ function getFsSafeNativeConfig(): FsSafeNativeConfig;
 ```
 
 Return the effective configuration: programmatic overrides win, then env vars, then the package default (`auto`).
+If only a removed Python-mode variable is configured, configuration reads and
+native operations throw an actionable migration error instead of using the default.
 
 ## `getFsSafeNativeStatus(options?)`
 
@@ -185,7 +187,11 @@ FS_SAFE_NATIVE_MODE=auto      # auto | off | require | true | false | on | 1 | 0
 ### Removed Python-helper configuration
 
 The deprecated Python configuration bridge and its environment variables have
-been removed. Use `configureFsSafeNative()` or `FS_SAFE_NATIVE_MODE`. See the
+been removed. Replace `FS_SAFE_PYTHON_MODE` with `FS_SAFE_NATIVE_MODE` and
+`OPENCLAW_FS_SAFE_PYTHON_MODE` with `OPENCLAW_FS_SAFE_NATIVE_MODE`, preserving the
+value. Without a valid native override, either legacy mode variable raises a
+migration error. Explicit native settings still win over leftover legacy settings.
+Use `configureFsSafeNative()` for a programmatic override. See the
 [0.5 migration checklist](migrating-to-0.5.md#2-replace-python-helper-configuration)
 for the migration path.
 

package/node_modules/@openclaw/fs-safe/docs/contributing.md

@@ -135,6 +135,18 @@ Vitest. Tests live in `test/` and follow `*.test.ts`. Run a single file with:
 pnpm test test/archive.test.ts
 ```
 
+`pnpm pack:check` also checks every literal relative runtime import, re-export,
+module-relative worker URL, and `import.meta.url` asset reference in the packed JavaScript
+against the tarball contents. Release package collection repeats this check;
+files present only in the build directory do not satisfy it.
+Relative URL-constructor paths are checked with or without a `./` prefix.
+Directory URL assets must identify directories present in the archive; ESM
+imports still require files.
+URL references use decoded filenames without queries or fragments; `require()`
+paths retain their literal characters and use Node's file-extension, package
+`main`, and directory-index fallbacks. String arguments to `new Worker()` are
+relative to the consumer's working directory and are outside this package-relative check.
+
 Guest filesystem tests and package smoke also need `python3` on Linux and
 macOS. They execute the exported source on synthetic files; Windows checks
 the import surface and leaves POSIX execution to the Linux/macOS lanes.
@@ -318,13 +330,13 @@ Bun 1.4.2 (as do macOS and Windows).
 | Lane | Runner | Architecture / libc | Runtime |
 | --- | --- | --- | --- |
 | JavaScript check | `ubuntu-latest` | x64 / glibc | Node 22, 24, 26 |
-| JavaScript check | `macos-15` | arm64 | Node 22, 24, 26 |
+| JavaScript check | `xcode-27` | arm64 | Node 22, 24, 26 |
 | JavaScript check | `fs-safe-windows-16core` (`windows-latest`) | x64 | Node 22, 24, 26 |
 | Native check | `ubuntu-latest` | x64 / glibc | Node 24, Bun 1.4.2 |
 | Native check (forced no-openat2) | `ubuntu-latest` | x64 / glibc | Node 24 |
 | Native check | `ubuntu-24.04-arm` | arm64 / glibc | Node 24, Bun 1.4.2 |
-| Native check | `macos-15` | arm64 | Node 24, Bun 1.4.2 |
-| Native check | `macos-15-intel` | x64 | Node 24, Bun 1.4.2 |
+| Native check | `xcode-27` | arm64 | Node 24, Bun 1.4.2 |
+| Native check | `xcode-27` under Rosetta (`x64`) | x64 | Node 24, Bun 1.4.2 |
 | Native check | `fs-safe-windows-16core` (`windows-latest`) | x64 | Node 24, Bun 1.4.2 |
 | Native check | `windows-2022` (standard hosted) | x64 | Node 24, Bun 1.4.2 |
 | Windows ARM64 host | `windows-11-arm` | arm64 native and x64 emulated | Node 24 |
@@ -332,8 +344,16 @@ Bun 1.4.2 (as do macOS and Windows).
 | Native check (Alpine 3.24) | `ubuntu-24.04-arm` | arm64 / musl | Node 24 |
 | GNU glibc 2.28 build + Rocky Linux 8 load | `ubuntu-latest` | x64 / glibc | Node 24 |
 | GNU glibc 2.28 build + Rocky Linux 8 load | `ubuntu-24.04-arm` | arm64 / glibc | Node 24 |
-| Bundled package smoke | `ubuntu-latest`, `macos-15`, `fs-safe-windows-16core` | host | Node 22, 24 |
-| Coverage | `ubuntu-latest`, `macos-15`, `fs-safe-windows-16core` | host | Node 22 |
+| Bundled package smoke | `ubuntu-latest`, `xcode-27`, `fs-safe-windows-16core` | host | Node 22, 24 |
+| Coverage | `ubuntu-latest`, `xcode-27`, `fs-safe-windows-16core` | host | Node 22 |
+
+All macOS jobs use the arm64 `xcode-27` image. Required status-check names
+retain their historical `macos-15` identifiers to preserve branch protection;
+those names do not select the runner. The x64 native and watch lanes
+assert Rosetta availability and run their shells, Node, and Bun under Rosetta;
+they do not require Intel hardware. Native builds preserve the published macOS
+minimums: 11.0 for arm64 and 10.12 for x64. Native CI and release prebuilds
+verify the Mach-O deployment command and load each binding with matching Node.
 
 Both musl lanes also run root-only package smoke with the real host binding.
 The eight-target source build matrix still runs on release tags. The smoke writes manager versions,

package/node_modules/@openclaw/fs-safe/docs/copy.md

@@ -271,6 +271,16 @@ creates the guarded destination name from the admitted source descriptor. Linux
 uses FICLONE and copy_file_range. Windows and native-disabled operation copy
 bytes; they cannot satisfy `"always"`.
 
+On Btrfs, explicit `"auto"` and `"always"` file copies match the source's NOCOW
+flag on the newly created empty destination before cloning. This can override
+NOCOW inherited from the destination directory, in either direction. Other
+destination flags, including compression policy, are preserved; incompatible
+policy can still prevent cloning. A successful NOCOW clone has no data checksums
+or compression, and shared extents use copy-on-write until they become unshared.
+The source and destination remain independent files. If `"auto"` falls back,
+the clone target is removed and a fresh copy inherits the destination directory's
+ordinary policy. The default `"never"` mode does not change NOCOW flags.
+
 The source descriptor remains open through before/after source identity checks.
 Symlink components are rejected; source hardlinks are rejected unless
 `sourceHardlinks: "allow"` is selected. The byte limit is an EOF bound, not a

package/node_modules/@openclaw/fs-safe/docs/durability.md

@@ -217,16 +217,22 @@ try {
 
 `rename-noreplace` normally uses atomic native rename. On Linux in native `auto`
 mode, a definitively unsupported `RENAME_NOREPLACE` result (`EINVAL`, `ENOSYS`,
-or unsupported-operation errno) permits the existing native file-move fallback.
+or unsupported-operation errno) permits the descriptor-relative file-publication fallback.
 It requires a regular source with one link, retains both parents, creates the
 target with `linkat` without following symlinks, verifies both names against the
-staged identity with exactly two links, then unlinks the source and verifies the
-target has one link. Fallback collisions report `already-exists` without clobbering;
+staged identity with exactly two links, pins the destination, and closes the
+source descriptor before identity-bound unlink. It then verifies the target has
+one link. Fallback collisions report `already-exists` without clobbering;
 the atomic rename path retains its existing `EEXIST` error.
 Success still returns `method: "rename-noreplace"`, with the additive
 `fallback: "link-unlink"` field identifying this weaker mechanism. Atomic rename
 and the other strategies omit `fallback`.
 
+The handoff precedes unlink so NFS need not create or finish deleting a hidden
+name for an open source. Success still requires the exact destination identity,
+one remaining link, and source absence. Missing native link or identity-bound
+unlink support fails closed. Unverified or substituted destinations are preserved.
+
 **Link/unlink is not crash-atomic.** A crash between those syscalls can leave both
 names on the same complete inode. Callers must recognize that interrupted pair
 as incomplete evidence or recover it under their own identity/ownership rules

package/node_modules/@openclaw/fs-safe/docs/errors.md

@@ -244,6 +244,19 @@ inspection has its own failure surface. Older fs-safe versions could report
 `EACCES` for the same root/open condition, so consumers spanning versions
 should accept both codes.
 
+Read-only filesystem failures retain `EROFS` on native I/O errors. Native
+`openBeneath` and `openCreateBeneath` failures include `path` (relative to the
+supplied directory descriptor), `operation`, and the caller's numeric `flags`.
+Their messages escape control characters in the relative path. These fields
+describe the attempted open; they do not identify the absolute parent or claim
+which syscall the selected backend used. JavaScript owners of native file
+creation attach their known absolute `path` and `syscall: "open"`, including
+sidecar locks, writable opens, staged writes, and synchronous/asynchronous copies.
+Existing Root write wrappers still use
+`invalid-path`, and native copy wrappers still use `helper-failed`; both retain
+these diagnostics in `cause`.
+No read-only failure selects a less restrictive fallback or authorizes a retry.
+
 ## Specialty errors
 
 A handful of helpers throw their own typed errors instead of `FsSafeError`:

package/node_modules/@openclaw/fs-safe/docs/migrating-to-0.5.md

@@ -43,10 +43,12 @@ Replace `FS_SAFE_PYTHON_MODE` with `FS_SAFE_NATIVE_MODE`, or
 `OPENCLAW_FS_SAFE_PYTHON_MODE` with `OPENCLAW_FS_SAFE_NATIVE_MODE`. Remove
 `pythonPath`, `FS_SAFE_PYTHON`, `OPENCLAW_FS_SAFE_PYTHON`,
 `OPENCLAW_PINNED_PYTHON`, and `OPENCLAW_PINNED_WRITE_PYTHON`; prebuilt native
-binaries need no interpreter. Python environment settings are now ignored
-silently: a deployment that set `FS_SAFE_PYTHON_MODE=require` or `off` runs in
-`auto` after upgrading unless it sets `FS_SAFE_NATIVE_MODE` (or calls
-`configureFsSafeNative`) first. Programmatic native configuration wins, followed by
+binaries need no interpreter. Preserve the mode value: `require` stays `require`,
+`off` stays `off`, and `auto` stays `auto`. Since 0.23.0 the bridge is removed;
+current builds reject leftover Python-mode variables with a migration error
+unless a valid native policy explicitly overrides them. Versions 0.23.0–0.26.6
+silently ignored them, so migrate before upgrading to those versions too.
+Programmatic native configuration wins, followed by
 `FS_SAFE_NATIVE_MODE`, `OPENCLAW_FS_SAFE_NATIVE_MODE`, and the default `auto`.
 
 Choose the production mode deliberately:

package/node_modules/@openclaw/fs-safe/docs/native-helper.md

@@ -180,10 +180,12 @@ is authoritative for operation and platform guarantees.
 
 ## Migration from the Python helper
 
-The Python configuration bridge has been removed. Old Python environment
-settings are ignored without a warning, so an old `require` or `off` setting
-does not select the corresponding native policy. Configure
-`FS_SAFE_NATIVE_MODE` or `configureFsSafeNative()` explicitly. Follow the
+The Python configuration bridge was intentionally removed in 0.23.0. A remaining
+`FS_SAFE_PYTHON_MODE` or `OPENCLAW_FS_SAFE_PYTHON_MODE` now raises a migration
+error when no explicit native policy is selected; it never silently selects `auto`.
+Replace either variable with its corresponding `NATIVE_MODE` name and preserve
+the value (`require` → `require`, `off` → `off`, `auto` → `auto`), or call
+`configureFsSafeNative()` explicitly before using fs-safe. Follow the
 [0.5 migration checklist](migrating-to-0.5.md#2-replace-python-helper-configuration)
 for the removed settings and current precedence.
 

package/node_modules/@openclaw/fs-safe/docs/output.md

@@ -99,8 +99,10 @@ boundary and same-filesystem atomic replacement is required. After the callback
 returns, fs-safe pins and validates the staged regular file, rejects hardlinks
 and size-limit violations, applies `mode`, fsyncs it, and atomically renames it
 over the target. Existing files and symlink entries are replaced without
-following their contents or referents. The parent identity is guarded across
-the operation and the parent directory is synchronized best-effort after
+following their contents or referents. The canonical root identity and the
+parent's containment are checked before invoking the producer and throughout
+publication, including redirects before the parent guard is captured. The
+parent identity is guarded across the operation and the parent directory is synchronized best-effort after
 rename. If an error leaves the sibling temp in place and immediate cleanup
 fails, its verified identity remains registered for a best-effort process-exit
 cleanup retry.

package/node_modules/@openclaw/fs-safe/docs/path.md

@@ -86,8 +86,11 @@ if (real === null) return notFound();
 ```
 
 All `realpath` failures collapse to `null` — there is no distinction between `ENOENT`, `EACCES`, and other I/O errors. Use `fs.realpathSync` directly if you need to branch on the error code.
-This convenience wrapper preserves ordinary Node `realpath` semantics; it is
-not a caller-path admission boundary on its own.
+It keeps Node's ordinary `realpath` handling of dot segments and symlinks. On
+POSIX it then returns the on-disk spelling, so a path typed with different
+letter case on a case-insensitive volume resolves to the same string that root
+admission uses. This convenience wrapper is not a caller-path admission boundary
+on its own.
 
 ### `safeStatSync(targetPath)`
 

package/node_modules/@openclaw/fs-safe/docs/permissions.md

@@ -220,6 +220,21 @@ retains the raw byte and decoded
 lowercase Windows SID notation. `daclPresent: false` represents a null DACL,
 which grants unrestricted access; it must not be mistaken for an empty DACL.
 
+The optional `isVolumeRoot` fact is true only when Windows resolves the inspected
+handle to an exact normalized local volume GUID root and a second no-follow
+handle proves the named directory is the same object without a reparse point.
+This distinguishes the volume-root object from a replaceable mounted-folder or
+junction entry pointing at it. Those reparse entries remain false; inspect a
+canonical non-reparse volume-root path to obtain a positive result. The entry
+lookup normalizes trailing separators and current-directory components separately
+from ACL inspection; parent traversal cannot assert a volume root. Ordinary
+directories, drive aliases pointing at a subdirectory, failed identity or
+normalization queries, and remote/UNC paths are also false. Older native helpers
+omit the fact, so consumers must require `isVolumeRoot === true` before using it.
+This metadata does not relax reparse-point or ACL admission policy: consumers
+still decide which rights are acceptable, and all ACE masks are returned
+unchanged.
+
 Object-specific and other ACE layouts are not guessed: they are omitted,
 `complete` becomes false, and their numeric types appear in
 `unsupportedAceTypes`, allowing a security-sensitive caller to fail closed.

package/node_modules/@openclaw/fs-safe/docs/security-model.md

@@ -17,6 +17,15 @@ path components.
 case since `5ddca80`. Exposure is limited to consumers that call
 `resolveRootPath()` or `resolveRootPathSync()` directly.
 
+Releases through 0.26.5 also mishandle symlink targets containing another
+symlink followed by `..`. Synchronous resolvers can admit an existing outside
+target as an unrelated in-root path; both synchronous and asynchronous resolvers
+can misresolve a missing target. The pending fix uses kernel canonicalization
+for symlink hops and existing ancestors before interpreting a missing suffix.
+Parent steps after unresolved components fail closed.
+Acyclic chains of dangling symlinks still resolve to a missing-path result.
+`resolveLocalPathFromRootsSync()` shares the synchronous fix.
+
 ## Threat model
 
 You hand a `root()` boundary to a piece of code that takes caller-controlled relative paths. The library defends against a caller that:

package/node_modules/@openclaw/fs-safe/docs/staged-file.md

@@ -77,6 +77,8 @@ Modes retaining owner read/write skip the extra mode-only file sync, so a crash
 may leave the tighter staged `0600` instead of the wider requested mode. Modes
 removing owner read or write, and corrections of an observed wider staged mode,
 retain the post-chmod file sync. No parent is created or chmodded.
+File and directory synchronization runs asynchronously on the retained descriptors;
+cleanup waits for any pending publication synchronization before closing them.
 Creation uses an exclusive, no-follow, close-on-exec open of a generated direct
 child name. Writes use that descriptor. Inspection uses non-following metadata
 operations, never a potentially blocking reopen of the leaf.

package/node_modules/@openclaw/fs-safe/docs/testing.md

@@ -106,7 +106,7 @@ must retain that limitation rather than call it proved kernel overflow.
 ### Nightly workload
 
 The nightly workflow runs on `ubuntu-latest` (x64), `ubuntu-24.04-arm`,
-`macos-15` (arm64), `macos-15-intel`, and the Windows latest 16-core runner,
+`xcode-27` (arm64), `xcode-27` under Rosetta (`x64`), and the Windows latest 16-core runner,
 using Node 24 and freshly built native bindings. Each job has a 25-minute
 budget, uploads one JSON result per scenario (including failures), and fails
 if any scenario fails. Remaining scenarios still run after a failure. Only

package/node_modules/@openclaw/fs-safe/docs/watch.md

@@ -108,12 +108,24 @@ Linux discards queued events for watches retired by fs-safe, including their
 `IN_IGNORED` echoes, without invalidating unrelated subscriptions. A genuinely
 unknown descriptor or kernel queue overflow still invalidates every subscription.
 
+Windows may briefly report `EPERM` from `realpath` while an unrelated directory
+is being deleted. Hint admission retries that observation at most twice before
+reporting uncertainty; it never ignores persistent failures or relaxes the
+identity checks on selected paths.
+
 `mode` is required. `poll` never starts or loads the watch hub; guarded scans
 may still use the existing addon. Existing `FS_SAFE_NATIVE_MODE=off` and
 `require` policies apply: `require` plus an unavailable event backend rejects
 `auto` too. Health reports the selected `events` or `poll` mode and failures
 from selection have `operation: "watch"`.
 
+If macOS cannot create or start an FSEvents stream during initial admission,
+`auto` falls back to guarded polling. This includes the system-wide stream
+ceiling: FSEvents does not expose a distinct capacity error. Explicit `events`
+and native `require` mode reject with `helper-unavailable` instead. Exclusion
+configuration failures remain fatal, and a stream failure after readiness
+does not silently change the subscription's mode.
+
 Linux installs each watch **before** enumerating children. It opens directories
 beneath the Root using the shared guarded native open (openat2, or its checked
 openat fallback), checks exact identities, verifies the procfs namespace, and
@@ -190,13 +202,50 @@ handles and delivery queues, and closing one does not retire another's observati
 | `persistent` | `true`; `false` lets Node exit with the subscription still open |
 | `intervalMs` | 30000 with events; 1000 with poll; minimum 20 ms |
 | `pollIntervalMs` | Optional polling override; minimum 20 ms, maximum 2147483647 ms (same as `intervalMs`) |
+| `fullReconcileIntervalMs` | 300000 ms (5 minutes); minimum 20 ms, maximum 2147483647 ms |
 | `maxDirectories` | 4096 observed directories, including scope ancestors |
 | `maxEntries` | 100000 examined entries per pass, including excluded entries |
 | `maxPendingPaths` | 256; maximum 4096 |
 | Reconciliation | One active pass and one coalesced pending pass; no convergence/pass budget |
 
-Periodic guarded reconciliation runs without needing an event. It catches
-missed events and works on filesystems where native hints are incomplete.
+On Node, bulk watcher filesystem observations run in a shared `worker_thread`,
+including exact metadata probes, path resolution, synchronous directory reads and
+all pre/post observation guards. The worker retains open listing handles until
+joined disposal. Policy callbacks and native event delivery remain with the
+subscription, and host snapshot bookkeeping yields every 32 entries. The worker
+is shared across subscriptions with the same native policy and stops when its
+last subscription closes; `persistent: false` still permits process exit.
+Ordinary single Root operations retain their synchronous observation fences.
+Source-loader, test-hook, Bun and Deno execution uses the same guarded helpers
+with explicit event-loop yields between entries, probes and directory checks.
+A slow filesystem call or user callback cannot be preempted in that fallback;
+callbacks must remain cheap. Worker startup/observation failures fail closed.
+
+Periodic metadata checks run without needing an event. Each check compares exact
+bigint identities, mode, link count, size, mtime and ctime with the last guarded
+observations. Observations less than one second old are re-listed until the
+clock update window passes, because timestamp storage precision alone does not
+prove update frequency. A later guarded listing must confirm each such directory
+before its cached names become reusable, even if the next tick arrives after
+that window. Entirely unchanged ticks retain their previous snapshot after the
+final identity fence. Each probe also verifies the Root's canonical path, so
+moving an ancestor above the Root cannot preserve admission using only an
+unchanged inode. Unchanged directories reuse their guarded listings; changed
+directories and newly discovered children are listed and verified through the
+ordinary Root guards. File metadata is checked separately because in-place writes
+need not change the parent directory's timestamps. Probe metadata never admits a
+new name or authorizes a read. Reused directory identities and observations are
+checked again after the pass to detect ancestor swaps during file probes.
+
+Full guarded reconciliation still runs every five minutes by default, controlled
+by `fullReconcileIntervalMs`. It also runs on a probe error, identity mismatch,
+timestamp regression, or devices whose guarded timestamps show only coarse
+(millisecond or worse) resolution. A single aligned timestamp on an otherwise
+precise device does not disable incremental checks. This safety net catches missed events and provides conservative
+behavior on filesystems that cannot support incremental checks. Listing work
+scales with changed directories; stat-only probes still scale with watched
+entries. `exclude` callbacks must remain cheap; they are evaluated on cached
+entries during incremental checks so changing an exclusion still takes effect.
 Hint validation, scope relevance, and spelling-alias admission share the internal
 hint module. Bounded change merging preserves structural precedence and insertion
 order; nameless children require remaining tree depth, while folded subtrees also
@@ -209,8 +258,12 @@ hints, vanished or hard-linked leaves, changed topology, uncertain identities,
 backend loss, and batches without filenames still receive a full guarded pass.
 `reconcile()`, initial admission, and scope replacement always reconcile every scope.
 The periodic timer is independent of event traffic, so frequent hints cannot defer
-the full missed-event check. Repeated passes reuse bounded pathname strings, never
-cached metadata or filesystem authority.
+the full safety-net check. Repeated passes reuse bounded pathname strings and
+unchanged guarded observations; neither raw hints nor probes grant filesystem authority.
+On Windows with the native helper, each listing fence obtains exact directory
+identity and physical path from one short-lived handle. Native-off and POSIX
+scans retain the JavaScript checks. Both paths recheck the Root and reject
+substituted directories or redirected ancestors at the same fences.
 When polling is selected, the interval is `pollIntervalMs`, then `intervalMs`,
 then 1000 ms, in that order. This applies to explicit `mode: "poll"`, `auto`
 selecting polling, and `auto` falling back after an unsupported event backend.
@@ -242,7 +295,9 @@ observe a selected sentinel edit and drain its trailing events.
 Each later pass compares with the previous snapshot, publishes bounded differences,
 and adopts its result as the next snapshot. Vanishing entries, kind changes, and
 transient descendant scan errors produce structural invalidations, preserving the
-Root identity checks. Events during a pass coalesce into one pending pass and
+Root identity checks. A hinted child absent from both scans invalidates its
+admitted parent, since a consumer may have observed that child between scans.
+The unobserved child spelling is not published. Events during a pass coalesce into one pending pass and
 retain bounded detail regardless of how long the scan takes. The 25 ms hint
 coalescing window does not impose a scan deadline. A full native callback queue
 retains its bounded pending batch for retry. Pending native and JavaScript hint queues degrade to coarse subtree hints when
@@ -268,6 +323,8 @@ await `close()` or `[Symbol.asyncDispose]()` to join owned work.
 `health()` returns `starting`, `ready`, `reconciling`, `unavailable`, or `closed`,
 the actual mode, observed `directories`, and optional `{ operation, code, error }`
 failure. A running reconciliation reports `reconciling`, then returns to `ready`.
+A Root that disappears during identity revalidation reports `path-mismatch`; its underlying filesystem error remains available as the cause.
+
 Observation becomes `unavailable` on loss of Root authority (removed, replaced,
 or inaccessible), fatal native backend/registration failures such as `watch-limit`,
 deterministic size limits (`too-large`, operation `scan`), or callback contract

package/node_modules/@openclaw/fs-safe/docs/writing.md

@@ -225,7 +225,12 @@ await fs.create("config/flushed.json", initial, { atomic: true, durable: "file"
 
 `atomic: true` finishes all bytes in a sibling stage before publication.
 The native backend uses its no-replace rename; the JavaScript fallback hardlinks
-the completed stage and unlinks its temporary name in the same JavaScript turn.
+the completed stage and removes its verified temporary name. On POSIX it pins
+the destination before closing the stage descriptor, preventing NFS deferred
+unlink from retaining an extra link. Identity and link counts are rechecked
+after this handoff.
+Unreadable final modes retain the original descriptor on platforms without a
+read-free file open; strict post-publication checks still apply there.
 When the OS refuses hardlinks, it uses the [placeholder-rename fallback](#publication-without-hardlinks).
 Other processes can briefly observe both linked names, or an empty placeholder
 before the atomic replacement. Entries present at the exclusive claim are preserved, including dangling symlinks;

package/node_modules/@openclaw/fs-safe/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe",
-  "version": "0.26.5",
+  "version": "0.26.13",
   "description": "Capability-style filesystem roots for Node.js apps that handle untrusted relative paths.",
   "keywords": [
     "filesystem",
@@ -157,7 +157,8 @@
     "test:coverage:collect": "pnpm build && pnpm archive:wasm:allocator-tests && vitest run --coverage --coverage.reporter=json --coverage.thresholds.lines=0 --coverage.thresholds.functions=0 --coverage.thresholds.statements=0 --coverage.thresholds.branches=0",
     "test:coverage:merge": "node scripts/merge-coverage.mjs",
     "test:security": "vitest run test/fs-safe.test.ts test/read-boundary-bypass.test.ts test/write-boundary-bypass.test.ts test/additional-boundary-bypass.test.ts test/adversarial-boundary-payloads.test.ts",
-    "check": "pnpm lint:file-size && pnpm lint:fs-boundary && pnpm build && pnpm archive:wasm:allocator-tests && pnpm docs:check && pnpm test && node scripts/check-pack.mjs",
+    "check": "pnpm lint:file-size && pnpm lint:fs-boundary && pnpm check:runtime",
+    "check:runtime": "pnpm build && pnpm archive:wasm:allocator-tests && pnpm docs:check && pnpm test && node scripts/check-pack.mjs",
     "docs:check": "node scripts/check-doc-examples.mjs",
     "docs:site": "node scripts/build-docs-site.mjs",
     "native:build": "pnpm --filter @openclaw/fs-safe-native-build build",
@@ -179,23 +180,24 @@
     "archive:producer-smoke": "node scripts/archive-producer-smoke.mjs"
   },
   "optionalDependencies": {
-    "@openclaw/fs-safe-darwin-arm64": "0.26.5",
-    "@openclaw/fs-safe-darwin-x64": "0.26.5",
-    "@openclaw/fs-safe-freebsd-arm64": "0.26.5",
-    "@openclaw/fs-safe-freebsd-x64": "0.26.5",
-    "@openclaw/fs-safe-linux-arm64-gnu": "0.26.5",
-    "@openclaw/fs-safe-linux-arm64-musl": "0.26.5",
-    "@openclaw/fs-safe-linux-x64-gnu": "0.26.5",
-    "@openclaw/fs-safe-linux-x64-musl": "0.26.5",
-    "@openclaw/fs-safe-win32-arm64-msvc": "0.26.5",
-    "@openclaw/fs-safe-win32-x64-msvc": "0.26.5",
+    "@openclaw/fs-safe-darwin-arm64": "0.26.13",
+    "@openclaw/fs-safe-darwin-x64": "0.26.13",
+    "@openclaw/fs-safe-freebsd-arm64": "0.26.13",
+    "@openclaw/fs-safe-freebsd-x64": "0.26.13",
+    "@openclaw/fs-safe-linux-arm64-gnu": "0.26.13",
+    "@openclaw/fs-safe-linux-arm64-musl": "0.26.13",
+    "@openclaw/fs-safe-linux-x64-gnu": "0.26.13",
+    "@openclaw/fs-safe-linux-x64-musl": "0.26.13",
+    "@openclaw/fs-safe-win32-arm64-msvc": "0.26.13",
+    "@openclaw/fs-safe-win32-x64-msvc": "0.26.13",
     "jszip": "^3.10.2"
   },
   "devDependencies": {
-    "@emnapi/runtime": "2.0.0-alpha.6",
-    "@napi-rs/cli": "3.10.8",
+    "@emnapi/runtime": "2.0.0-beta.2",
+    "@napi-rs/cli": "3.10.9",
     "@types/node": "^26.6.5",
-    "@vitest/coverage-v8": "5.0.3",
+    "@vitest/coverage-v8": "5.0.5",
+    "acorn": "8.19.0",
     "fast-check": "^4.10.2",
     "istanbul-lib-coverage": "3.2.2",
     "istanbul-lib-report": "3.0.1",
@@ -203,7 +205,7 @@
     "sigstore": "5.0.0",
     "tar": "7.5.22",
     "typescript": "^7.0.2",
-    "vite": "8.3.4",
+    "vite": "8.3.5",
     "vitest": "^5.0.3"
   },
   "engines": {

package/node_modules/@openclaw/fs-safe-darwin-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-darwin-arm64",
-  "version": "0.26.5",
+  "version": "0.26.13",
   "description": "macOS arm64 native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-darwin-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-darwin-x64",
-  "version": "0.26.5",
+  "version": "0.26.13",
   "description": "macOS x64 native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-freebsd-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-freebsd-arm64",
-  "version": "0.26.5",
+  "version": "0.26.13",
   "description": "FreeBSD 14.4+ arm64 native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-freebsd-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-freebsd-x64",
-  "version": "0.26.5",
+  "version": "0.26.13",
   "description": "FreeBSD 14.4+ x64 native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-arm64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-arm64-gnu",
-  "version": "0.26.5",
+  "version": "0.26.13",
   "description": "Linux arm64 glibc native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-arm64-musl/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-arm64-musl",
-  "version": "0.26.5",
+  "version": "0.26.13",
   "description": "Linux arm64 musl native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-x64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-x64-gnu",
-  "version": "0.26.5",
+  "version": "0.26.13",
   "description": "Linux x64 glibc native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-x64-musl/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-x64-musl",
-  "version": "0.26.5",
+  "version": "0.26.13",
   "description": "Linux x64 musl native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-win32-arm64-msvc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-win32-arm64-msvc",
-  "version": "0.26.5",
+  "version": "0.26.13",
   "description": "Windows ARM64 MSVC native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-win32-x64-msvc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-win32-x64-msvc",
-  "version": "0.26.5",
+  "version": "0.26.13",
   "description": "Windows x64 MSVC native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/zod/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zod",
-  "version": "4.6.5",
+  "version": "4.6.7",
   "type": "module",
   "license": "MIT",
   "author": "Colin McDonnell <zod@colinhacks.com>",