[OPT-Q05] Draft macOS/APFS same-volume quarantine and recovery (#111)

[szmyty]

Advances #111; does not close it. Five bounded, unvalidated checkpoints; the newest adds Optiflow's standalone Mac copy-property declaration contract.

Why

Optiflow's next operator milestone needs macOS/APFS quarantine and recovery with explicit approval, no-replace operations and preserved evidence. Cross-volume work additionally needs independently verified Darwin ACL preservation. Source review found that the current dependencies cannot provide that through the required safe, descriptor-bound API.

What changes

• Adds macOS/APFS same-volume quarantine, resume, restore and verified empty-namespace cleanup, with actual filesystem/device checks.
• Adds bounded Mac property observations and Darwin/SQLite full-sync handling while preserving existing Linux fingerprints, migrations and v1–v4 wire shapes. The later checkpoints do not change the first checkpoint's Mac same-volume fingerprint.
• Keeps all Mac cross-volume plans refused before mutation-capability probes or writable journal access, including a supported same-volume prefix. Adds pure policy coverage and a mixed-plan regression preserving an existing unfinished journal, source bytes and retained evidence.
• Hardens existing recovery: new apply/resume commit events bind the observed quarantine identity; later cross-volume recovery checks it when present. Historical null identity events retain their existing content/property checks without invented evidence.
• Reopens a reverse-copy temporary entry relative to its held parent and checks it against the verified file handle, plus both property fingerprints, before source publication. Authors regressions for equivalent-inode replacement and late temporary/quarantine metadata changes.
• Records the safe metadata adapter prerequisite and finite handoff. Mac cross-volume copying/restoration is not implemented by this checkpoint.

Descriptor ACL dependency proposal

The third checkpoint supplies an inert exacl extension patch and adoption packet, based on upstream v0.13.0 commit fa36df1745a41e50ab0730546c04d86a8503e46b.

• Proposes safe borrowed-descriptor APIs for bounded, lossless kernel-exposed ACL snapshots and replacement followed by independent read-back.
• Preserves raw UUIDs, entry order/duplicates, rights, entry flags and ACL-level flags; distinguishes absent from present-empty ACLs and refuses unsupported/malformed observations.
• Authors 18 internal and eight native cases. All 26 remain unrun.
• Includes exact source pins, MIT notice, patch hash, ABI/bounds review and deferred adoption/qualification commands.
• Documents kernel normalization, write-without-rollback and deferred-inheritance-on-rename limits.

This patch is not adopted, compiled or linked by Optiflow. Application dependencies, lockfile, unsafe-code policy, runtime dispatch and evidence schemas remain unchanged in this checkpoint. No upstream submission or fork was created. Review/native qualification and an accepted upstream release or explicitly reviewed pinned dependency fork are still required before integration. Mac cross-volume mutation remains refused.

Adapter failure-boundary checkpoint

The fourth checkpoint introduces a private transport for the proposed dependency's two native calls while keeping its public borrowed-descriptor API and bounds unchanged.

• Adds eleven deterministic transport cases: exact request layout, buffers and call order; permission/unsupported/I/O/interrupted errors at all three read and all seven replacement boundaries; capability loss; malformed replies; and mismatched independent read-back.
• Asserts invalid input reaches no native call, pre-write failures never reach the setter, and failures never trigger retry or rollback. A simulated setter error can leave recorded write evidence; this is not native filesystem proof.
• Adds three native cases for ownership/mode/mtime/content preservation and exact replacement/removal of destination-inherited ACL entries. Fixtures establish actual inheritance and recheck it after preparation.
• Updates the patch manifest and qualification matrix. Patch SHA-256: 6fa75a507e89826573520c4a74ddfd336f791f51c8e0ac564272115cc8ed9118.

Independent source review found no concrete defect. No executable check or patch-application check ran. Optiflow application code, dependencies, lockfile, schemas and dispatch did not change in this fourth checkpoint. Same-volume restore leaves no retained copy; Mac finalization still depends on cross-volume restore.

Standalone Mac property-contract checkpoint

The fifth checkpoint authors execution::property_evidence, an application-owned, host-neutral declaration model and bounded review API. It is independent of the proposed exacl Rust API.

• Requires explicit absent versus present-empty ACL state; preserves ordered/duplicate ACEs, raw principals, supported rights/header flags, exact ownership/mode/timestamps and bounded canonical xattrs.
• Refuses unsupported schemas/profiles, missing ACL data, nonzero BSD flags, deferred inheritance, unsupported rights, malformed hex and exceeded bounds.
• Caps JSON input before parsing and requires objects at every record boundary. It then decodes the original bytes so duplicate-key refusal survives the shape inspection.
• Produces a schema/profile-bound BLAKE3 fingerprint using explicit recursive object-key ordering; no array reordering or deduplication.
• Adds a closed registered schema, synthetic example, protocol and 20 authored, unrun integration tests, including the parser/schema mismatch found in source review.

This API reviews supplied declarations. It performs no native observation, descriptor calls, source mutation or journal writes, and grants no authority. Existing mutation/recovery modules, dependencies, lockfile, the inert adapter patch, v1–v4 formats and historical fingerprints remain unchanged by this fifth checkpoint. The new fingerprint must not be inserted into the untagged v3 field; native observation and a discriminated persistence envelope remain future integration work.

Property protocol · Resume handoff

Review and qualification

Unvalidated draft. Independent source review only. No tests, compiler, builds, formatting, lint, schema, smoke or CI commands were run, per the implementation-first check budget. No user media or physical volumes were processed.

Published head: ac381942e4202d7221cbd1d8832d65058e146081
Published tree: bc050535f4bea7b58c9ffa54287b011476e68e02
Matching local commit: f1affc5036109d79dc5f394bed1297738a1a5360
Base: c5dbcd1761e810aea228389b8ba017acc97a411e

Tree equality verifies publication integrity, not runtime behavior.

Remaining boundaries

• Mac cross-volume support needs a reviewed safe descriptor ACL observation/copy/verification backend and explicit stronger evidence compatibility. The repository's unsafe-code prohibition and dependencies are unchanged.
• Native Mac compilation, directory F_FULLFSYNC, APFS properties, interruption/power-loss behavior and disposable-volume qualification remain unproven.
• Same-volume Mac ACL content is not independently fingerprinted. Recovery identity checks do not eliminate the verification-to-record or check-to-rename race with hostile concurrent writers.
• A SQLite row can become visible before a later explicit flush fails. Errors stop progression but are not rollback guarantees.
• New Linux cross-volume regression fixtures retain the existing conditional /dev/shm availability; a skipped fixture cannot qualify the behavior.
• Mac retained-copy finalization and [OPT-Q05] Port bounded exact-dedup mutation and recovery to macOS/APFS #111 qualification remain open. [Release] Qualify removable-volume exact deduplication and publish v0.2.0 #93 owns the mutation release and three-target installation/signing. Signed v0.1.1 stays read-only.

No merge or release is part of this checkpoint.