fix: independent v0.1.1 review R1-R7 — rollback restores user INI, exclusive restore copies, random exclusive temps, real glibc floor via CArchive ELF parse, backup validation, doctor session scope, staged kit refresh

Author: ztwzeroo

.github/workflows/release.yml

@@ -75,15 +75,50 @@ jobs:
           test ! -e "$SGAME/version.dll" && test ! -e "$SGAME/dlssg_sm86.ini"
           test -f "$SGAME/game.exe"
           echo "packaged binary smoke OK"
-      - name: Measure glibc requirement (linux)
+      - name: Measure real glibc floor (extract embedded ELF libs)
         if: matrix.platform == 'linux-x64'
         id: glibc
         shell: bash
         run: |
-          # 全文件扫描（含 PyInstaller 内嵌 .so），避免只看外层启动器漏掉真实下限
-          FLOOR=$(grep -ao 'GLIBC_[0-9.]*' "dist/${{ matrix.binary }}" | sort -Vu | tail -1 | cut -d_ -f2)
-          echo "floor=$FLOOR" >> "$GITHUB_OUTPUT"
-          echo "measured glibc symbol floor: $FLOOR"
+          set -e
+          python - <<'PY'
+          # 单文件程序内嵌的 .so 是 zlib 压缩的，外层字符串扫描会漏报真实下限
+          # （v0.1.1 独立复核 R4）。解包 CArchive、解析每个内嵌 ELF 的动态符号版本。
+          import glob, os, re, subprocess, sys, tempfile
+          from PyInstaller.archive.readers import CArchiveReader
+
+          app = "dist/dlss-combo"
+
+          def glibc_max(path):
+              out = subprocess.run(
+                  ["objdump", "-T", path], capture_output=True, text=True
+              ).stdout
+              best = (0, 0)
+              for m in re.finditer(r"GLIBC_(\d+)\.(\d+)", out):
+                  best = max(best, (int(m.group(1)), int(m.group(2))))
+              return best
+
+          overall = glibc_max(app)  # 外层启动器
+          with tempfile.TemporaryDirectory() as td:
+              reader = CArchiveReader(app)
+              for name in list(reader.toc.keys()):
+                  try:
+                      reader.extract(name, td)
+                  except Exception:
+                      continue
+              for p in glob.glob(os.path.join(td, "**"), recursive=True):
+                  if os.path.isfile(p):
+                      with open(p, "rb") as fh:
+                          if fh.read(4) == b"\x7fELF":
+                              overall = max(overall, glibc_max(p))
+          if overall == (0, 0):
+              sys.exit("no GLIBC version references found - measurement failed")
+          floor = f"{overall[0]}.{overall[1]}"
+          print("measured real glibc floor (CArchive-extracted ELF .gnu.version_r):", floor)
+          with open("glibc_floor.txt", "w") as fh:
+              fh.write(floor)
+          PY
+          echo "floor=$(cat glibc_floor.txt)" >> "$GITHUB_OUTPUT"
       - name: Write build info and quickstart into package
         shell: bash
         run: |
@@ -164,6 +199,10 @@ jobs:
           merge-multiple: true
       - name: Merge checksums
         run: cat dist-artifacts/SHA256SUMS-*.txt > dist-artifacts/SHA256SUMS.txt
+      - name: Read measured glibc floor
+        run: |
+          FLOOR=$(grep -o 'GLIBC_[0-9.]*' dist-artifacts/build-info.txt | head -1 | cut -d_ -f2-)
+          echo "GLIBC_FLOOR=${FLOOR:-unknown}" >> "$GITHUB_ENV"
       - name: Create GitHub Release (pre-release)
         uses: softprops/action-gh-release@v2
         with:
@@ -202,10 +241,10 @@ jobs:
             ### Linux x86-64 — experimental
 
             `dlss-combo-${{ github.ref_name }}-linux-x64.zip`. Built on Ubuntu
-            22.04; the whole-binary GLIBC symbol floor is measured at build
-            time and ships in `build-info.txt` (current build: 2.14). Other
-            distros are unverified — glibc >= 2.17 (manylinux2014-era) is the
-            conservative recommendation, or run from source. For Steam games, find the real game folder via
+            22.04. The real glibc floor is measured at build time by extracting
+            the embedded ELF libraries from the PyInstaller archive (outer-file
+            string scans under-report); this build: **glibc >= ${{ env.GLIBC_FLOOR }}**
+            (see `build-info.txt`). Other distros are unverified — or run from source. For Steam games, find the real game folder via
             Steam → Manage → *Browse local files*, then target the folder
             containing the rendering EXE. Proton launch options some setups
             use (`WINEDLLOVERRIDES="version=n,b" PROTON_ENABLE_NVAPI=1

CHANGELOG.md

@@ -5,6 +5,41 @@ All notable changes to this project are documented here. The format follows
 [SemVer](https://semver.org/) with a `0.x` experimental prefix. Evidence links
 point to files in this repository (`docs/`) so the trail is auditable offline.
 
+## [0.1.2] — 2026-09-20
+
+### Fixed (independent v0.1.1 review, R1–R7)
+
+- **R1**: first-install failures now restore the user's original INI at every
+  failure point (DLL copy, manifest write, backup write; reinstall failures
+  restore the previous working state). Covered by fault-injection tests in
+  `tests/test_review4.py`.
+- **R2**: uninstall never overwrites any existing file or symlink when saving
+  a restore copy — copies are created exclusively (`O_CREAT|O_EXCL`) with
+  numbered fallback names (`*.pre-existing.1`, …).
+- **R3**: temporary files use random, exclusively-created names
+  (`tempfile.mkstemp`, same directory) — predictable-name symlink attacks are
+  inert — and cleanup touches only paths registered by the current operation.
+- **R4**: the Linux glibc floor is now measured by extracting the embedded
+  ELF libraries from the PyInstaller CArchive and parsing their
+  `.gnu.version_r` requirements (outer-file string scans under-report);
+  docs state the real floor (**glibc >= 2.35**, from the embedded
+  libpython3.13) and the release notes read the measured value per build.
+- **R5**: a missing or corrupted pre-existing backup aborts uninstall before
+  any deletion (backups now record a SHA256 that is verified when present).
+- **R6**: doctor treats the newest log as the diagnostic scope; a newer
+  session without route events reports "未验证/unverified" while older
+  route events are labelled historical.
+- **R7**: kit refreshes download into a staging directory and switch only
+  after every file is fetched — an interrupted refresh leaves the previous
+  kit fully valid (offline fallback preserved).
+
+The eight reproduced scenarios from
+[`docs/reviews/2026-09-20-v0.1.1-independent-repro.py`](docs/reviews/2026-09-20-v0.1.1-independent-repro.py)
+all assert fixed, and are migrated into formal regressions
+(`tests/test_review4.py`). Docs consistency: STATUS links/counts, README
+quick-start no longer forces `--arch` (auto-detection first), Linux
+requirements updated.
+
 ## [0.1.1] — 2026-09-20
 
 ### Fixed
@@ -84,5 +119,6 @@ The nine reproduced problem behaviors are pinned by
 `docs/reviews/2026-09-20-repro.py` (all report fixed) and migrated into
 regression tests (`tests/test_review2.py`).
 
+[0.1.2]: https://github.com/ztwzeroo/DLSS5-FrameGen/releases/tag/v0.1.2
 [0.1.1]: https://github.com/ztwzeroo/DLSS5-FrameGen/releases/tag/v0.1.1
 [0.1.0]: https://github.com/ztwzeroo/DLSS5-FrameGen/releases/tag/v0.1.0

README.md

@@ -78,7 +78,7 @@ Use an independently backed-up or disposable game copy. Uninstall validates its
 
 ```powershell
 .\dlss-combo.exe fetch
-.\dlss-combo.exe install "C:/Games/TestCopy/Binaries/Win64" --mfg 4x
+.\dlss-combo.exe install "C:/Games/TestCopy/Binaries/Win64"
 ```
 
 **From source:** [download the source ZIP](https://github.com/ztwzeroo/DLSS5-FrameGen/archive/refs/heads/main.zip), extract it, and open PowerShell in the extracted folder. Then run:
@@ -137,11 +137,11 @@ Use `py -m dlss_combo --help` or `py -m dlss_combo install --help` for the full
 
 ## Linux / Steam Proton
 
-Windows games running through Proton are still Windows processes, so the frame-generation layer is expected to apply the same way — **not yet verified end-to-end by this project on Linux**. Grab `dlss-combo-<version>-linux-x64.zip`, then point the CLI at the folder containing the game's **rendering EXE**. The reliable way to find it is Steam → *Manage* → **Browse local files** (for Proton installs that lands you inside the prefix's `drive_c`; don't assume a fixed prefix layout — always locate the actual EXE folder):
+Windows games running through Proton are still Windows processes, so the frame-generation layer is expected to apply the same way — **not yet verified end-to-end by this project on Linux**. Grab `dlss-combo-<version>-linux-x64.zip`, then point the CLI at the folder containing the game's **rendering EXE**. The reliable way to find it is Steam → *Manage* → **Browse local files** (Proton installs often live under the prefix's `drive_c`, but the layout is not guaranteed — the Browse-local-files location is the reliable reference):
 
 ```bash
 chmod +x dlss-combo
-./dlss-combo install "/path/to/Game/Binaries/Win64" --arch sm86
+./dlss-combo install "/path/to/Game/Binaries/Win64"
 ```
 
 Some setups add Steam launch options so Wine loads the proxy and Proton exposes
@@ -154,7 +154,7 @@ WINEDLLOVERRIDES="version=n,b" PROTON_ENABLE_NVAPI=1 PROTON_NVIDIA_NVCUDA=1 %com
 > These options are community convention (the route [DLSS Unlocked](https://github.com/ShyVortex/DLSS-Unlocked) documents), **not verified with this toolkit** — check your Proton version's behavior against [Valve's config notes](https://github.com/ValveSoftware/Proton#runtime-config-options) before relying on them. Substitute the actual proxy name (`winmm`/`dbghelp`/…) if it is not `version.dll`.
 
 - The image layer (DLSS5-Swapper) is a Windows GUI app; running it via Wine is upstream-experimental — on Linux, validate the frame-generation layer first.
-- **Linux binaries**: built on Ubuntu 22.04; the whole-binary GLIBC symbol floor is measured per build (current: 2.14, in each zip's `build-info.txt`). Other distros are unverified — glibc >= 2.17 (manylinux2014-era) is the conservative recommendation, or run from source.
+- **Linux binaries require glibc >= 2.35** — the real floor is measured per build by extracting the embedded ELF libraries from the PyInstaller archive (an outer-file string scan under-reports it; the current build's floor is in each zip's `build-info.txt`). Other distros are unverified; to target older systems, run from source.
 
 ## What has actually been tested?
 

README.zh-CN.md

@@ -21,8 +21,8 @@ Windows EXE 与 Linux x64 二进制（GitHub Actions 从打 tag 的提交构建
 
 > Linux/Steam Proton（实验性）：用 Steam“浏览本地文件”定位含渲染 EXE 的实际目录；
 > 启动选项 `WINEDLLOVERRIDES="version=n,b" PROTON_ENABLE_NVAPI=1 …` 为社区惯例、未经本组合实测。
-> Linux 包由 Ubuntu 22.04 构建，全文件 GLIBC 符号下限按构建实测（当前 2.14，见包内 build-info.txt）；
-> 其他发行版未验证，保守建议 glibc ≥ 2.17，或直接源码运行。
+> Linux 包需 glibc ≥ 2.35：下限按构建时解包 PyInstaller 归档、解析内嵌 ELF 实测（外层字符串扫描会漏报；
+> 当前值见包内 build-info.txt）。其他发行版未验证；要跑更旧系统请用源码方式。
 
 [How it works / 工作原理](#how-it-works--工作原理) · [Getting started / 开始使用](#getting-started--开始使用) · [Known issues / 已知问题](docs/reviews/2026-09-20-project-review.md) · [Report results / 反馈实测](https://github.com/ztwzeroo/DLSS5-FrameGen/issues)
 

docs/STATUS.md

@@ -4,17 +4,21 @@
 
 **This is an experimental source preview, not a stable installer.** It is intended for contributors and experienced modders working on disposable directories or independently backed-up game copies.
 
-This page describes the tree after the 2026-09-20 review fixes landed (see [the review](2026-09-20-project-review.md) and [repro script](2026-09-20-repro.py); all nine reproduced behaviors now assert fixed). In-game behavior remains unverified.
+This page describes the tree after the 2026-09-20 review fixes landed (see [the review](reviews/2026-09-20-project-review.md) and [repro script](reviews/2026-09-20-repro.py), plus the [v0.1.1 independent review](reviews/2026-09-20-v0.1.1-independent-review.md) and its [repro](reviews/2026-09-20-v0.1.1-independent-repro.py) — all seventeen reproduced behaviors now assert fixed). In-game behavior remains unverified.
 
 ## Evidence so far
 
-- 107 offline Python tests pass; CI runs them on Windows/Linux/macOS on every push.
+- 122 offline Python tests pass; CI runs them on Windows/Linux/macOS on every push.
 - A Python wheel builds, and an isolated CLI version check succeeds.
 - The nine reproduced problem behaviors from the 2026-09-20 review are fixed and covered by regression tests; the repro script reports all nine as fixed.
 - No Windows/NVIDIA game session, image-quality comparison, latency test or FPS benchmark has been validated by this project.
 
 Upstream support claims and configuration limits are not a substitute for testing the combined setup. A `4x` or `6x` setting is a frame-generation ceiling, not a measured performance improvement.
 
+## Fixed in v0.1.2 (independent v0.1.1 review, R1–R7)
+
+First-install rollback now restores the user's original INI at every failure point (DLL/manifest/backup write); uninstall never overwrites any existing file or symlink when saving a restore copy (exclusive `O_CREAT|O_EXCL` with numbered fallbacks); temp files are random and exclusively created, and only paths registered by the current operation are cleaned; a missing or corrupted pre-existing backup aborts uninstall before any deletion; doctor treats the newest log as the diagnostic scope and labels older route events as historical; interrupted kit refreshes stage and switch atomically, leaving the previous kit usable. Evidence: `tests/test_review4.py` and the flipped independent repro script (all eight scenarios fixed). The glibc floor is now measured from the CArchive-extracted embedded ELF libraries (see the release workflow).
+
 ## Known issues
 
 ### File deletion and ownership — FIXED 2026-09-20
@@ -55,6 +59,6 @@ The project targets Windows 10/11 x64, RTX 20/30, and D3D12 games with native DL
 
 Prioritize bounded filesystem operations, ownership checks, original-file restoration, strict checksums, and failure recovery. Regression tests should assert that unrelated files remain byte-for-byte unchanged.
 
-The [detailed audit (Chinese)](reviews/2026-09-20-project-review.md) includes file locations, reproduction results and acceptance criteria. The [reproduction script](reviews/2026-09-20-repro.py) uses temporary files and does not launch real binaries. **Its successful completion means the known bugs are reproducible, not that the tool is safe.**
+The [detailed audit (Chinese)](reviews/2026-09-20-project-review.md) includes file locations, reproduction results and acceptance criteria. The [reproduction script](reviews/2026-09-20-repro.py) uses temporary files and does not launch real binaries. **Since v0.1.2 both scripts assert the FIXED behavior: successful completion means the reproduced defects no longer trigger — a specific regression guard, not proof that all file-safety concerns are resolved.**
 
 For real game reports, use the [game-test form](https://github.com/ztwzeroo/DLSS5-FrameGen/issues/new?template=game-test.yml). Include unsuccessful attempts and clearly label what you did and did not measure.

docs/devlog/2026-09-20.md

@@ -60,6 +60,17 @@
 - **产出**：[v0.1.1 Release](https://github.com/ztwzeroo/DLSS5-FrameGen/releases/tag/v0.1.1)
   （110 测试，两平台烟雾测试通过，SHA256 校验实测）。
 
+### 第 6 轮 · v0.1.1 独立复核 → v0.1.2
+
+- 详档：[2026-09-20-v0.1.1-independent-review.md](../reviews/2026-09-20-v0.1.1-independent-review.md)；
+  复现脚本：[2026-09-20-v0.1.1-independent-repro.py](../reviews/2026-09-20-v0.1.1-independent-repro.py)（8 场景）。
+- **R1–R7 全部修复**：首装回滚还原用户 INI（四类故障注入测试）、卸载副本排他创建、
+  随机排他临时件 + 登记式清理、备份缺失拒绝删除（含备份 SHA256）、doctor 最新会话范围、
+  kit 刷新 staging 切换、glibc 真实量测（解包 CArchive 解析内嵌 ELF，实测 ≥ 2.35，
+  外层字符串扫描确会漏报）。
+- 测试 110 → 122；新旧复现脚本合计 17 场景全部断言"已修复"。
+- **产出**：[v0.1.2 Release](https://github.com/ztwzeroo/DLSS5-FrameGen/releases/tag/v0.1.2)。
+
 ## 尚未验证的事项（如实）
 
 - Windows + RTX 20/30 真机：游戏内加载代理、DLSS-G 后端激活、画质层生效、