[ranxianglei]

What / why

#5155 supplies reproducible A/B evidence (4/4) for the whole win32 EPERM-on-own-data family (#5096 crash loop, #4614 READONLY degrade, #5103 power-loss report): the real switch is not Defender/ACL/read-only-dir but the NTFS mandatory integrity label on the node executable itself — a Low-labeled node.exe cannot write Medium-labeled files even with correct ACLs (MIC no-write-up → EPERM -4048 on every write), and relabeling Low→Medium fixed everything with zero AV/ACL change. This PR implements #5155's suggestions 2/3/4. Suggestion 1 (CA-bundle write degradation) is already implemented on the #5103 thread's branch 2026-10-29_issue5103-startup-recovery-visibility and is deliberately NOT duplicated here.

Changes

1. Hint order flipped on all three EPERM surfaces — "check the node runtime's integrity label" is now the FIRST suggestion for OS-level write refusals on win32, with copy-pasteable commands embedding the REAL runtime path (icacls "<process.execPath>" + /setintegritylevel Medium); AV exclusion drops to second. The canonical diagnosis text lives in ONE place (src/integrity-label.ts) so the surfaces cannot drift:
   • sqliteOpenFailureHint (src/storage/shadow.ts): index.db open refusal (CANTOPEN) and first-write refusal (attempt to write a readonly database, the SQLite unified storage degraded to legacy-only (bili v0.1.205, node v24.22.1, win32-x64) #4614/promptCache.routing is ignored by relay-affinity stamping; no way to persist per-endpoint prompt_cache_key abatement (0.1.209) #5103 field shape);
   • the persist-EPERM alert (src/persist-eperm.ts);
   • the bili.log open-failure notice (src/logger.ts warnReopenFailed, win32 + EPERM/EACCES only).
2. Startup self-check (suggestion 3): new src/integrity-selfcheck.ts, fired from cli.ts at bili start. Non-blocking spawn of icacls <realpath(process.execPath)> (win32 only, 3s timeout, 8KB cap); parses the mandatory ACE; Low/Very Low → one prominent [integrity] … warn naming the cause and the exact fix commands (incl. the non-recursive parent-dir convergence for inherited labels). Fail-open by construction: missing icacls / timeout / unparseable output = silent. Node has no built-in LABEL_SECURITY_INFORMATION API, so the probe reads the same security database via icacls output.
3. Docs (suggestion 4): CONFIGURATION.md gains "Windows: node runtime demoted to low integrity (The incremental lane re-renders the entire conversation history and synchronously flushes it to disk each turn; large co | 增量车道每轮把整段会话历史重新渲染并同步落盘,大对话每轮多花约100毫秒 #5155)" — symptom, check, fix (incl. why one NON-recursive relabel of the parent dir converges the tree), the new self-check warn line, and an explicit note that recursively lowering the data dirs to Low (the SQLite unified storage degraded to legacy-only (bili v0.1.205, node v24.22.1, win32-x64) #4614 interim advice) is superseded as the recommended direction. The [bug] 0.1.63 起 Windows persist EPERM 风暴：会话持久化静默丢数据（4.9k 次/117 会话）+ compress no-valid-ranges 拒绝 #362 section's sentence claiming the AV exclusion was "the first suspect" is corrected to match.

Behavior changes (old → new)

Log/hint wording only, plus one new conditional warn line:

• OLD: EPERM-class hints were AV-first ("exclude from antivirus real-time scanning first"); low-integrity appeared as an unranked parenthetical or not at all, never with commands; the bili.log EPERM notice carried no remedy.
• NEW: integrity label ranked first with copy-pasteable icacls commands (real runtime path embedded); AV second; bili.log notice gains the same pointer on win32+EPERM/EACCES; a new [integrity] startup warn appears ONLY on win32 with a Low/Very Low runtime label.
• sqliteOpenFailureHint now also matches attempt to write a readonly database (was CANTOPEN-only) — superset of the pending extension in the promptCache.routing is ignored by relay-affinity stamping; no way to persist per-endpoint prompt_cache_key abatement (0.1.209) #5103 branch / PR [PR] fix: name the win32 READONLY index.db open failure; drop the delete advice under OS-level refusals (#4614) #4625; see coordination below.
• No protocol/wire/persistence/config changes. Config surface: none added — no env var, config key or CLI flag introduced.

Coordination (hot-file overlap)

• Branch 2026-10-29_issue5103-startup-recovery-visibility (promptCache.routing is ignored by relay-affinity stamping; no way to persist per-endpoint prompt_cache_key abatement (0.1.209) #5103 thread; pushed, no PR opened yet) also extends sqliteOpenFailureHint to the READONLY form and adds its own startupFailureHints (src/index.ts) + CA-degrade warn (src/ca.ts), both currently AV-first. Its shadow.ts hunk is semantically subsumed by this PR's version (same regex extension, reordered text) — resolve any merge conflict by taking this PR's text. Commented in that thread asking it to flip its two hint texts to integrity-first (reusing src/integrity-label.ts) before opening its PR.
• PR [PR] fix: name the win32 READONLY index.db open failure; drop the delete advice under OS-level refusals (#4614) #4625 (READONLY hint + recursive-Low relabel command): this PR supersedes its hint WORDING (evidence order) while keeping its do-NOT-delete stance ("Deleting the file will not clear an OS-level refusal"). The recursive-Low relabel command should not ship as the recommended direction per The incremental lane re-renders the entire conversation history and synchronously flushes it to disk each turn; large co | 增量车道每轮把整段会话历史重新渲染并同步落盘,大对话每轮多花约100毫秒 #5155's evidence — flagged in that thread.

Verification

Targeted local runs green: 67/67 across tests/integrity-selfcheck.test.ts (new: all five levels parse, fail-open negatives, warn positive/negative gate per #3617), tests/storage-cantopen-hint.test.ts (ordering pinned both directions, READONLY shape fires, non-matching errors stay silent, platform gate both directions), tests/persist-eperm.test.ts (ordering pinned) plus all logger suites and proxy-persist (unchanged pins still hold). typecheck clean; full build green. Full regression = CI on this head.

Closes #5155

[github-actions]

📦 Built Package Artifact

Branch: 2026-10-29_integrity-label-hints-selfcheck (619ed00)

Latest build — install this exact version

npm install -g billion-context@0.0.7467-pr.5160.ac6c135

This exact version is immutable and reproducible. The rolling pr tag tracks the newest test build across all PRs.

Recent builds (commit → version)

commit	version	build
619ed00	billion-context@0.0.7467-pr.5160.ac6c135	build
d04ebe7	billion-context@0.0.7409-pr.5160.d5d260d	build
c6532f1	billion-context@0.0.7300-pr.5160.9f1a9a6	build
cb22754	billion-context@0.0.7069-pr.5160.37ec9f1	build
d07517f	billion-context@0.0.6831-pr.5160.d16cf98	build

Download artifact

1. Download the artifact from the Actions run
2. Extract the tarball and install:

tar xzf billion-context-pr5160.tgz
npm install -g package

---

Install instructions are refreshed on each push.

[ranxianglei]

🤖 Powered by ework · qwen3.8-27b

[bot] 🏷
(ai: vllm-qwen/qwen3.8-27b)

Synced: master was moving fast during this window (two merge cycles needed — #5294/#5292/#5253 batch, then #5163, then #5236 message-timestamps + kernel 0.0.173). Both merges were clean with zero conflicts; this PR's diff stays small and touches no files those merges rewrote semantically. Verified on the new head d04ebe7: typecheck clean + 32/32 targeted tests green (storage-cantopen-hint / persist-eperm / issue5154-selfcheck). State after push: mergeable: true, compare vs master = ahead_by 8 / behind_by 0, mergeable_state: blocked = checks running only. Fully caught up now.

[ranxianglei]

🤖 Powered by ework · qwen3.8-27b

(ai: vllm-qwen/qwen3.8-27b)

rebase 完成(簇攻坚 #5302 攻击序第 3 项):分支已重建为当前 master 顶上的单个线性提交 619ed00(force-with-lease 更新 PR 头)。

• 为什么重写:旧头 d04ebe7 累积了 4+ 个 merge-guard 循环产生的 "Merge branch 'master'" 垃圾提交(Merge guard 对 PR #5207 反复误报 "PR behind"：分支已完整包含 master #5282 家族症状),且 base 停在 e193861。本次用原 diff(merge-base..head,逐字节相同)+ 3-way apply 重建,零冲突(master 侧仅 CONFIGURATION.md 有无关改动)。旧历史仍可在 GitHub pull ref 审计。
• 有效 diff 说明:标题里的「non-blocking startup self-check」半部(warnIfLowIntegrityRuntime)已随 [Bug][dsh] EPERM on startup data writes: the real switch is the node runtime's NTFS mandatory integrity label (Low IL), not Defender/ACL — reproducible A/B, and it explains the #5096 crash loop #5154 单独合入 master——本 PR 实际承载的是剩余 delta:integrityLabelDiagnosis() 共享诊断助手 + 日志重开 warn / persist-EPERM 告警两处的证据序接线(完整性标签排第一)+ CONFIGURATION.md + 两个排序门测试。标题按归属规则不动,此处留痕。
• 本地验证:typecheck(tsc --noEmit)干净;定向测试 tests/persist-eperm.test.ts + tests/storage-cantopen-hint.test.ts 22/22 绿。全量回归看 CI。
• 状态:behind=0、单提交、diff 干净,等 CI 绿即可由你合并。