Coverage

Verifies that an existing private root supports the optional artifact operations.

Pure filesystem/platform classification seam used by the supported-lane tests.

Dispatches fstatfs to the symbol matching the native filesystem-stat structure ABI.

Reads filesystem metadata through narrow platform observations while keeping the retained directory handle and all path validation under the normal capability probe.

Finds the filesystem type of the longest Linux mountpoint containing a path.

Combines caller policy metadata with repository HEAD and working-tree state fingerprints.

Reads provenance and returns a safe outcome for the Git-state probe.

Validates the supplied writer pair before it enters the core.

Runs collection, then evaluates and writes the supplied gate only after a successful collection.

Creates a cause-specific optional-storage failure without disclosing exception text.

Writes one bounded trusted diagnostic to stderr; writer failures remain secondary.

Renders an observed path for local diagnostics, with no credential-bearing URI support.

Escapes controls and bounds an informational value; it never creates executable shell text.

Checks cancellation and the work deadline before the next bounded chunk.

Annotates an ordinary invalid-data error, preserving the existing exception contract.

Annotates a native permission refusal while preserving its IOException contract.

Classifies a nonempty unmarked root without changing the existing IOException refusal contract.

Attaches only a trusted bounded classification while retaining the original exception type.

Gets a trusted classification, or null for unclassified errors; messages and payloads are never inspected.

Distinguishes an observed volume change only when both complete legacy tuples parse.

Parses nonempty unsigned tuple fields in the complete schema-v1 record format; malformed fields fail closed without slicing outside their bounds.

Gets actionable trusted text for a known refusal, without raw paths, metadata or native IDs.

Gets the conservative schema-v1 recovery path; no operation rebinds uncertain registrations.

Counts regular files below repository TestResults and coverage-output roots.

Reads a supplied effective settings file safely; this reports configured risk, not execution.

Opens a candidate without following links and validates native regular-file facts.

Registers a path that this invocation creates or overwrites; absent failed writes are not invented.

Registers a newly created invocation-unique subtree, never a reused project or output directory.

Captures the pre-write state of a fixed-name artifact so a retained stale file is not adopted.

Records a newly created producer file; ambiguous retained destinations make the inventory incomplete.

Hashes the writer-owned regular files after producers stop, preserving exact original bytes.

Creates bounded informational provenance from an invocation's declared policy.

Acquires strongest modes in deterministic physical-object order, reusing an explicit nested session.

Extends compatible current inventory with gate report bytes after publication.

Releases all acquired leases in reverse deterministic order.

Inspects at preflight or terminal publication with the remaining cumulative observation budget.

Reports configured collector risk or unknown settings, under the same persistent cooldown.

Emits one trusted condition unless an equivalent persisted observation is still in cooldown.

Gets the physical identity of an already-opened regular file or directory.

Reads native identity, length, last-write time and change time from an open regular file.

Opens a retained directory without coverage-output ownership semantics.

Rechecks the entire pathname against the directory objects originally acquired.

Opens the Windows cooperative-lock file without following links or allowing replacement.

Validates an existing zero-length private coordination file without creating or changing it.

Verifies the named Windows operation lock still identifies the retained lock object.

Creates a private immediate child and retains its complete no-follow path.

Opens an immediate regular, singly-linked file through the retained directory.

Enumerates at most a caller-supplied number of immediate entries without following links.

Atomically renames an immediate child, optionally replacing one regular metadata file.

Deletes only a previously authorized immediate entry through the retained directory.

Validates one cross-platform path component before any filesystem call.

Retains and validates each Windows path component, reopening a competing creator without repairing its access.

Accepts only an already-existing-name race during an idempotent Windows component walk.

Atomically creates one new directory with the current-user owner and protected private ACL.

Publishes a fresh Windows directory with its already-built private security descriptor in the native create call.

Rejects Windows ownership or allow rules granting access beyond the current user and system administrators.

Validates ownership, link count and private permissions from one retained Unix object.

Collects bounded immediate Windows names from the retained directory.

Enumerates a bounded Unix directory with explicit descriptor/stream ownership.

Atomically duplicates a Unix descriptor with close-on-exec set.

Encodes a Windows handle-relative rename and rejects unsuccessful native publication.

Reads and validates a version 1 coverage artifact policy from a bounded UTF-8 JSON stream. Integer fields must use JSON integer syntax and satisfy their documented ranges; fractions, exponents, negative values where prohibited, unknown fields, duplicate fields, and documents deeper than 16 levels are rejected. The parser reads no more than 65,537 bytes to distinguish an allowed 65,536-byte document from an oversized one.

Reads at most the metadata limit plus one byte, even if an opened file grows.

Writes and atomically replaces one bounded state file without accumulating unique remnants.

Acquires output mutation authority, then attempts a prior-run snapshot at the normal clean boundary.

Verifies the required output identity before a participating mutation or read.

Publishes current-run registration without replacing the primary command outcome.

Records reports written under this session and republishes the same run metadata.

Updates an existing registered run's sidecar and registry after an independent gate writes reports.

Releases compatible output authority after every participating caller has finished.

Publishes the current sidecar and removes only this call's staging file when publication fails.

Finds a physically bound managed input root without adopting copied metadata.

Reads one bounded current sidecar, requiring compatible explicit producer inventory.

Classifies expected optional store, filesystem, and metadata failures without catching programming errors broadly.

Previews or explicitly creates a separate, empty private domain without accessing the configured old domain.

Opens or creates the current user's private artifact domain.

Opens an existing private domain for status reads without creating or repairing any filesystem entry.

Registers one producer-owned current output and inventory.

Creates a complete, verified archive of the supplied registered current run.

Returns the registered current run for the same physical output directory, if present.

Checks whether a registered current output already has a complete, integrity-verified archive.

Reads a bounded status snapshot without changing current outputs or archives.

Acquires candidate authority outside a deletable Windows directory, using the private domain's fixed lock file.

Applies or previews eligible archive expiry under the shared retention policy.

Changes pin state for a verified archived run.

Restores a verified archive into a fresh private output directory.

Releases store resources.

Reads bounded schema-v1 ownership metadata; missing is distinguished from malformed bytes.

Requires the complete native identity; schema-v1 contains no independent remount continuity proof.

Counts bounded domain metadata, including the non-authoritative warning and inspection observations.

Creates and verifies a complete archive in an existing private staging directory.

Writes one complete version 1 manifest to a caller-owned stream under the JSON size limit.

Reads and validates one bounded version 1 manifest without disposing the input stream.

Restores all verified payloads into an existing, empty, private staging directory.

Verifies every stored and original payload fact without publishing extracted files.

Reads the cursor for one scope without creating or modifying any store entry.

Writes a bounded cursor for one scope into the existing store's private staging tree.

Acquires one nonblocking strongest-mode lease without performing output cleanup.

Rejects a changed physical output binding before a participating operation publishes.

Releases native authority once; lock files remain persistent and are never removed to force admission.

Maps a physical candidate identity to one nonzero Windows byte-range offset without growing the lock file.