--- description: "Audit of tooling and host-facing contracts — SDK (Studio snapshots, typed commands, StorageUtil compat), debug server + protocol + byro-dbg, debug-ui panels, launcher/boot-request/settings-io handoff, install detection, byro-detect, texture-upscale" argument-hint: "--focus [--area sdk|debug|launcher|detect|tools]" --- # Tooling and Host-Contract Audit Read `_audit-common.md` and `_audit-severity.md` for shared protocol. Surfaces a modder, player or developer touches instead of the engine: a TCP command port evaluated against the live `World`, the renderer-independent SDK, the launcher's boot/settings handoff and the tool CLIs. Not here: `crates/mod-runtime` (`/audit-safety` Dim 8); debug-server locks/threads (`/audit-concurrency` Dim 7); the egui *pass* (`/audit-renderer`); VDF/ACF parsing (`/audit-parsers`); save schema (`/audit-save`). | Area | Code (docs) | |---|---| | sdk | `crates/sdk/src/` (identity, manifest, `service.rs`, `studio.rs`, `compatibility/`); adapters `byroredux/src/studio_host.rs`, `byroredux/src/commands/studio.rs`, `byroredux/src/extensions/` (`docs/engine/sdk-v0.1-development-plan.md`, `docs/engine/sdk-v0.1-next-action-plan.md`) | | debug | `crates/debug-server/src/{listener,system,evaluator,registration}.rs`, `crates/debug-protocol/src/{lib,wire,registry}.rs`, `byroredux/src/debug_load.rs`, `tools/byro-dbg/src/`, `crates/debug-ui/src/` (panels also host the player menu, inventory, HUD) (`docs/engine/debug-cli.md`) | | launcher | `crates/boot-request/src/`, `crates/settings-io/src/`, `crates/core/src/atomic_file.rs`, `tools/byro-launcher/src/`, `byroredux/src/boot/cli.rs` (`expand_boot_request`) (`docs/engine/launcher.md`) | | detect | `crates/game-detect/src/{catalog,steam,profiles,validate,overrides}.rs`, `crates/core/src/ecs/game_profiles.rs`, `assets/debug_profiles.toml`, `tools/byro-detect/src/main.rs` (`docs/engine/launcher.md` §3) | | tools | `tools/texture-upscale/src/` (`tools/nifskope` is vendored, not first-party) | ## Parameters (from $ARGUMENTS) - `--focus `: dimensions to run (default all 6). `--area `: one area. - Delta-first: run each `First step` and `git log --since= -- `; deep-audit only dimensions whose Paths changed. ## Extra Per-Finding Fields - **Dimension**: Debug Trust Boundary | Protocol & Registry | SDK Contract | Boot Handoff & Persistence | Install Detection | Tool CLIs - **Exposure**: who can reach it (any local process / launcher user / modder / developer only). Unauthenticated local file write or command execution in a stock build = HIGH; developer-only tool defect = LOW–MEDIUM; user data loss in a crash window = MEDIUM. ## Phase 1: Setup 1. `mkdir -p /tmp/audit/tooling`; `gh issue list --repo matiaszanolli/ByroRedux --limit 200 --json number,title,state,labels > /tmp/audit/tooling/issues.json`; dedup per `_audit-common.md`. 2. Read the newest `docs/audits/AUDIT_TOOLING_*.md` if any. 3. `cargo test` for `-p byroredux-{sdk,debug-server,debug-protocol,debug-ui,boot-request,settings-io,game-detect}` and `-p byro-{launcher,detect,texture-upscale}`; record counts. Do not launch a windowed engine to exercise the debug server (*feedback_no_parallel_engine_launch*). ## Phase 2: Dimensions (max 3 concurrent agents) ### Dimension 1: Debug-server trust boundary Paths: `crates/debug-server/src/{listener,system,evaluator}.rs`, `crates/debug-protocol/src/{lib,wire}.rs`, `byroredux/src/main.rs` (start site, `debug_server_allowed`), `byroredux/src/debug_load.rs` (cell-load path confinement), `byroredux/Cargo.toml`. First step: `grep -n 'bind\|MAX_\|fs::write\|create_new\|from_secs' crates/debug-server/src/*.rs crates/debug-protocol/src/wire.rs`. Facts (re-verified 2026-10-20): bind is the literal `("127.0.0.1", port)`; no authentication; `debug-server` is a `default` feature of `byroredux`, started from `main.rs` on `BYRO_DEBUG_PORT` (default 9876). Debug builds always bind; release builds bind only with `BYRO_DEBUG_SERVER=1` (`debug_server_allowed`, guard `release_debug_server_requires_explicit_opt_in`; 63c0aee3b, #4752), so the exposure is every local process on a debug build or an opted-in release. Caps: `MAX_QUEUED_COMMANDS` 64, `MAX_CONCURRENT_CLIENTS` 8 (#3449), 300 s read timeout, 16 MB frame (`MAX_MESSAGE_SIZE`, enforced by both `encode` and `decode`), `MAX_WALK_DEPTH` 64. The timeout pair lives in `crates/debug-protocol/src/lib.rs`: `COMMAND_RESPONSE_TIMEOUT` 30 s (server wait) < `CLIENT_READ_TIMEOUT` 35 s (byro-dbg read), ordering pinned (cc5468813, #5140). Guards: `try_enqueue_rejects_when_queue_is_full`, `connections_past_the_cap_are_refused`, `occupied_port_is_reported_before_a_handle_is_returned` (`listener.rs`); `rejects_oversized_message`, `encode_rejects_response_payloads_over_the_protocol_limit` (`wire.rs`); `cancelled_screenshot_does_not_skip_same_frame_command_drain`, `cancelled_command_is_answered_without_evaluation`, `rejects_absolute_and_parent_paths` (`system.rs`); `walk_depth_is_capped_even_for_untrusted_requests` (`evaluator.rs`); `output_path_is_confined_to_the_dump_directory` (`commands/assets.rs`); `cell_load_paths_are_confined_to_startup_roots`, `confinement_rejects_a_symlink_out_of_the_root` (`debug_load.rs`); `the_listener_binds_loopback_only` (`listener.rs`; 224180508, #5149 closed) asserts `handle.local_addr().ip().is_loopback()` on a port-0 spawn, so a `0.0.0.0` bind now fails a test. Regression guards, both fixed in 72a63616b (#5147 closed): the default output names self-unique under `create_new` (`unique_default_dump_name_in` → `tex_dump.png`, `tex_dump_2.png`, …; `unique_screenshot_name_in` → `screenshot_.png`, `screenshot__2.png`; pinned by `repeated_bare_tex_dumps_take_free_suffixes`, `same_second_bare_screenshots_take_free_suffixes`), while an explicitly named output keeps the fail-rather-than-clobber contract; a constant default name is the regression. Checklist: - Capability surface = the whole console: `eval_request` dispatches every registered dotted command; `SetField` writes any registered component field. File *reads* are confined: `LoadNif` loose paths and the `LoadInteriorCell`/`LoadExteriorCell` ESM/master/archive paths all go through `confine_to_roots` against `startup_asset_roots()` (relative, normal components, canonicalised inside a startup `--esm`/`--master`/`--bsa` root; one rejected path rejects the whole load; 554259315, #5165). The syntactic half (relative, no `..`) lives once in `byroredux_core::ecs::is_root_relative_load_path`, which `confine_to_roots` uses and `eval_queue_load` (`evaluator.rs`) applies at enqueue through `PendingDebugLoad::first_non_root_relative_path`, so a client sending an absolute path gets an `Error` naming it instead of an `Ok` and a silently dropped load (cff99166e, #5290); only the root-existence/canonicalisation half still resolves engine-side at drain time. File *writes* are confined: `write_screenshot` (`system.rs`) takes a single filename under `screenshots/` with `create_new` (no overwrite), and `tex.dump` goes through `safe_tex_dump_path` (`byroredux/src/commands/assets.rs`, `texture-dumps/`). Archive-backed debug NIF loads (and `--mesh`/`--tree`) resolve their loose-file miss through `TextureProvider::extract_mesh` (last-listed-wins, BA2 dispatch, named corrupt-entry fall-through; 44219e881, #5009), and the hygiene guard `no_production_code_opens_archives_outside_the_provider_layer` (`byroredux/src/workspace_hygiene_tests.rs`) fails on a raw `BsaArchive`/`Ba2Archive` open in the bin crate. Check a new path-taking request goes through the same helpers and that no other command reads or writes a client-chosen path. Ask whether each mutating or file-writing command (`tex.dump`, screenshot, dumps) should be reachable unauthenticated in a *player* build; size by Exposure. - Evaluator bounds: `parse_expr` runs on the engine thread in the Late exclusive (depth caps in `crates/papyrus/src/parser/`); `WalkEntity.max_depth` is clamped by `bounded_walk_depth`; other entity/`Value` responses are unbounded until `encode` refuses them. - An over-limit response is replaced by an error response in `handle_client` (the `InvalidData` arm) rather than a torn frame — verify the fallback itself cannot exceed the limit and that the command's side effects already ran. A decode error (even an unknown variant) drops the connection: intended? - The drain system runs `evaluate` inline, so a slow query stalls a frame; is there a per-request cost bound? Lock *order* is `/audit-concurrency` (`debug_evaluator_acquires_locks_in_canonical_order`). Abandoned requests (`PendingCommand.cancel`, #1007) and the `SCREENSHOT_OWNER_*` claim must release on client timeout; the drain answers an already-cancelled command with an error instead of evaluating it, and keeps running while a native pause/settings/inventory page gates the scheduler (`Scheduler::run_exclusive_named`, 00115f7a5, #5141), naming the system through the shared `DRAIN_SYSTEM_NAME` constant (`crates/debug-server/src/system.rs`) with a `debug_assert` on the returned bool (8a9989070, #5292; source-scan guard in `byroredux/src/scheduler_access_tests.rs`) — a paused frame path that skips the drain, or a hand-typed copy of the name, re-creates the burst-on-unpause replay. ### Dimension 2: Protocol and registry completeness, wire compat Paths: `crates/debug-protocol/src/{lib,registry}.rs`, `crates/debug-server/src/registration.rs`, `tools/byro-dbg/src/{main,display,tui}.rs`, `docs/engine/debug-cli.md`. First step: `grep -c 'register_component::<' crates/debug-server/src/registration.rs`; diff against inspect-derived components (`grep -rn 'cfg_attr(feature = "inspect"' crates/core/src`). - Re-derive counts: `docs/engine/debug-cli.md` must report N in both the "Currently registered (N components)" heading and the `byro> components` example transcript (`debug_cli_component_counts_match_the_registry` requires ≥2 occurrences since f2d0b6ea0, #5417). N = the production-text `register_component::<` calls plus the hand-built `register_faction_reputation` descriptor: 73 + 1 = **74** (re-verified 2026-10-20) (67 → 71: the M42 Eat/Sleep trio plus `EditorPlacement`, #5391; 71 → 72: `CreatureActor`, 9bb8bc475 #5495; 72 → 74: `CharacterLevel`, dbe562c1f, and `LevelUpPoints`, f0ca6eda1). A whole-file `grep -c` prints 76 because the test module's own needles add lines; count production text. The same test now also requires a `| `Name` |` table row in the doc for every registered name (3ad23b3e4, #5694: the table had carried 67 of 72 rows under a passing count). - Completeness guards (`registration.rs`): `every_inspectable_component_is_registered` walks `crates/core/src` for every type carrying the `inspect` derive **and** implementing `Component` and fails unless each is registered (977793679, #4755, took the registry 49 → 67), plus the older `every_ai_procedure_behavior_component_is_registered` (#4063). Remaining gap class: components outside `crates/core/src` (engine-crate or other-crate components with `inspect` derives) the walk does not see — enumerate those and judge which hold user-visible state. - Wire: 4-byte BE length + JSON, serde-tagged `DebugRequest`; no version or handshake field, so engine and `byro-dbg` must come from one workspace commit. Guards: `round_trip_request`, `round_trip_response` (`wire.rs`). Metrics ride `DebugResponse::Metrics(MetricsPayload)` (f64a299ec, #5822: byro-dbg stores the payload as-is, debug-ui reads core's `MetricsSnapshot` directly); the one remaining cross-seam copy is `eval_metrics` (`evaluator.rs`). The `metrics_response_mirrors_core_snapshot` guard that the variant's doc and #5822 cite **does not exist** (never did, per `git log -S`): a field added to core's `MetricsSnapshot` is silently dropped from the wire. Report it until a test lands. - A new `DebugRequest` / `DebugResponse` variant must reach the evaluator dispatch, `parse_shorthand` and `display.rs` in `byro-dbg`, and `handle_response` / `variant_name` in `tui.rs`; a `_ =>` arm in any of them hides a missing variant. `byro-dbg` sets its socket read timeout to `CLIENT_READ_TIMEOUT` (`configure_read_timeout`, guard `read_timeout_exceeds_the_server_response_timeout`); the TUI net thread treats a read timeout as "engine busy", not a disconnect. Its only other test is `parses_common_shorthand_requests` — variant coverage in `display.rs` / `tui.rs` is untested. The never-constructed `DebugResponse::Screenshot` variant was deleted (6f38b335d, #5150); a dead variant still matched by the client is the same class. - Console docs vs the dispatch table (`registry.register(` in `byroredux/src/commands/mod.rs`): `every_registered_command_is_named_in_debug_cli_docs` (same file) requires the doc's `Current registered commands (**N**)` to equal the live registry and every registered name to appear (130 after ab34039b8, #6056; re-derive). It does not check the reverse (a documented command that no longer exists), so diff that by hand. `set_field` never panics on bad JSON. ### Dimension 3: SDK contract surface Paths: `crates/sdk/src/`, `byroredux/src/{studio_host.rs,commands/studio.rs}`, `crates/debug-ui/src/panels.rs`, the two SDK plan docs. First step: `cargo tree -p byroredux-sdk --depth 1` and `grep -rn 'byroredux_core::' crates/sdk/src`. - Facts (2026-09-19): `#![forbid(unsafe_code)]`; deps are `byroredux-core` (only `math::Vec3` used), `semver`, `serde`, `thiserror`; `StudioSession` is `pub(crate)` in `byroredux/src/studio_host.rs`, not the SDK. - Plan gates: an explicit checked dependency list (no renderer/UI/platform/archive/Wasmtime), "Rust/WIT schema drift fails CI" (`crates/mod-runtime/wit/host.wit`), warning-free docs, and "no supported SDK value exposes an ECS ID or engine pointer". Find the test or CI step for each (none found for the dependency list, 2026-09-19). The plan is `In progress`: report only gates the docs call *delivered*. - API leak: a `pub` SDK item exposing an engine type (`Entity`, `World`, `FormId`, glam beyond `Vec3`) instead of a stable id (`ObjectId`, `AssetId`, `EntityRef`, `FormRef`); `pub` value-type fields are unvalidated by construction. - Actor-value projection: `ActorValueState` has no `set_override` slot, so `extensions/capture.rs` folds the #5412 layer into `base` (`base + set_override`) and a mod reads back its own routed `SetBase` (627149b62, #5508); a projection that drops the layer, or re-sums the layers by hand instead of `ActorValue::undamaged()`, is the regression (`byroredux/src/extensions/tests.rs`). - Validation lives in the host: `valid_transform` / `valid_material` in `studio_host.rs` reject non-finite values, while the clamps (`sanitize_transform`, `sanitize_material`) sit in the egui panel; every non-UI command path (extensions, `commands/studio.rs`) must reach the host validators. - Snapshot determinism: ids come from a sorted canonical set (plan Phase 1); check no `HashMap` iteration order reaches a `StudioSnapshot` or serialized output. Identity guards: `object_ids_reserve_zero_and_assign_one_based_ordinals`, `namespaced_ids_reject_path_and_whitespace_spoofing`, `capability_sets_are_validated_and_deduplicated`. - Every `*_CAPABILITY` constant in `service.rs` is checked at a real call site (count by grep); an unchecked one is a grant without a gate (enforcement is `/audit-safety` Dim 8). - StorageUtil / list verbs (`crates/sdk/src/compatibility/storage_util/` — `mod.rs` scalar + codecs, `list.rs`, `declarations.rs`): bounded sizes and deterministic order per the plan's compatibility table; every provider alias maps to a route, policy and fixture; the unsupported boundary (file-backed state, JContainers JSON/Lua, menu mutation) fails explicitly, never no-ops. ### Dimension 4: Launcher boot handoff and persistence Paths: `crates/boot-request/src/`, `crates/settings-io/src/`, `crates/core/src/atomic_file.rs`, `crates/game-detect/src/overrides.rs`, `tools/byro-launcher/src/`, `byroredux/src/boot/cli.rs`, `byroredux/src/cli_args.rs`. First step: `grep -n 'fs::write\|atomic_write\|CONTRACT_VERSION\|SETTINGS_VERSION' crates/boot-request/src crates/settings-io/src crates/game-detect/src tools/byro-launcher/src`. Guards: version — `an_unknown_contract_version_is_refused_by_version_not_by_field`, `a_missing_version_is_a_mismatch_not_a_default`; precedence (`docs/engine/launcher.md` §2.4) — `explicit_command_line_flags_suppress_their_request_counterparts` (`crates/boot-request/src/args.rs`), `boot_request_seam_tests` in `boot/cli.rs`; settings — `saving_a_partial_registry_preserves_keys_it_does_not_know`, `stale_and_invalid_values_do_not_block_valid_siblings`, `a_save_does_not_revert_another_frontends_newer_value`, `save_refuses_when_the_existing_file_does_not_parse`, `save_refuses_to_downgrade_a_newer_version_file`, `the_shipped_presets_apply_cleanly_to_the_real_builtin_registry`; durability — `atomic_file.rs::{failed_rename_removes_the_temp, clobber_guard_accepts_the_writer_shape_and_rejects_fallbacks}`, `save_has_no_nonatomic_clobber_fallback` (boot-request, settings-io), `merge_uses_the_shared_atomic_file_writer` + `merging_preserves_comments_and_formatting` (`overrides.rs`); supervision — `the_engine_is_invoked_with_the_boot_request_path_and_profiles_env`, `the_log_tail_is_bounded_and_keeps_the_most_recent_lines`, and (da3f62128: `EngineProcess::poll` lets the stderr reader reach EOF, bounded by `READER_DRAIN_TIMEOUT` 250 ms, before snapshotting the crash tail) `a_crash_tail_waits_for_the_stderr_reader_to_drain`, `a_crash_report_is_not_held_hostage_by_a_lingering_descendant` (`tools/byro-launcher/src/engine.rs`). Checklist: - CLI flag reads (`byroredux/src/cli_args.rs`, owned here): only the space-separated `--flag value` form is accepted, and `parse_string_arg` warns on the `--flag=value` spelling instead of silently dropping it (`the_equals_form_is_reported_rather_than_silently_dropped`). Plain value lookups (`--esm`, `--cell`, `--grid`, `--wrld`, `--radius`, `--kf`, `--rotation-mode`, `--bench-frames`) and the repeatable `--master` collectors go through `parse_string_arg` / `parse_all_string_args` (`parse_all_string_args_collects_repeats_and_skips_flag_values`) and `esm_discovery_root`, never a hand-rolled `args.iter().position(..)` (d8a6e58bf, #5598). The raw-by-design flags (`--swf`, `--bsa`, `--menu`, `--studio`, `--cmd`, ...) error on a missing value, which `parse_string_arg`'s `None` would weaken; a new flag reader should pick one deliberately. - `atomic_write` (unique hidden temp sibling -> fsync -> read-back -> rename -> parent fsync, #3472) is the durability contract, used by all three writers: `BootRequest::save`, `RootOverrides::merge_into_file`, settings-io `save_to_path`. The non-atomic "Windows rename" `fs::write` fallback is gone (2e95f0bbf, #5143) and any staging error removes the temp (69fd54fb2, #5163); each writer is pinned by the shared structural scan `atomic_file::assert_no_clobber_fallback` over production text only (#5164). A fallback, a second `atomic_write` call, or an `fs::write`/`fs::rename` reappearing in a writer is the regression. `merge_into_file` now edits a `toml_edit::DocumentMut`, touching only changed `[roots]` entries and skipping the write when nothing changed (7f2cee3e8, #5166). - Version policies: `boot-request` refuses a mismatch; `settings-io` load logs and "attempts compatible values", while save refuses a newer-version file (no silent downgrade), copies an unparseable file aside as `.bad` and refuses, and refuses a non-`NotFound` read error (2e95f0bbf, #5144). - Lost updates: there is still no file lock, but `SettingsPersistence` keeps a per-frontend baseline (shared through an `Arc` across clones) and `save_to_path` writes only ids whose value moved off it; the launcher reloads on opening Settings and on engine exit (c9f95283a, #5162). Check a new save path goes through the baseline, not a full-registry write. - Precedence: settings path is `SETTINGS_PATH_ENV`, then the platform config dir, then a cwd fallback (`discover_settings_path`); games root is `--games-root`, `BYROREDUX_GAMES_ROOT`, then `DEFAULT_GAMES_ROOT`, one developer's path (`crates/game-detect/src/profiles.rs`) — a player's machine silently resolves to a missing directory; does anything say so? `discover_settings_path`'s sibling for profiles is `user_profiles_path()` (`crates/game-detect/src/profiles.rs`, one per-user path shared by launcher, `byro-detect` and the engine); `$BYRO_PROFILES` redirects every per-user layer (profile merge and both `[roots]` passes) and the launcher exports it on the engine it spawns, so a custom `--profiles` file stays self-consistent (322c36626, #5294) — a private `~/.byroredux/profiles.toml` copy is the regression. 61ad29da3 (#5476) finished it: the `[defaults]` layer (`game`, `games_root`, `light_atten_*`) now runs through `selected_user_path()` too (`ordered_config_paths_with`), the launcher's `LauncherState::load/refresh` and `byro-detect` build their registry with `load_with_user_path(Some(&profiles_path))` (not `load_default()`), and a relative `--profiles` is made absolute before the engine spawns with `current_dir(engine.parent())`. A path that still reads `~/.byroredux/profiles.toml` directly, or a launcher registry built from the process's own home, is the regression. The strict `--profiles` arm and `absolutise_against_cwd` live once in `crates/game-detect/src/profiles.rs` (`parse_profiles_arg`; 0f07131a8, #5739), taking `OsString` arguments so a non-UTF-8 path is accepted rather than panicking (b3ca11cf1, #5911; `accepts_a_non_utf8_profiles_path_without_panicking`, `rejects_an_empty_profiles_path` in both tools); an explicit profiles file also supplies the `[roots]` overrides (`root_overrides_path`; 21538a9d0, #5910; `explicit_profile_file_also_supplies_root_overrides`). A private flag-arm copy in a tool is the regression. boot.toml paths are absolute and never `~`-expanded (`docs/engine/launcher.md` §2.2) while `profiles.rs` expands `~/` on roots — check they agree. - The launcher must run when the engine cannot (no Vulkan): `cargo tree -p byro-launcher` may show `ash` (pre-flight probe) but not the renderer, `byroredux-ui` or any `wgpu` (eframe runs on `glow`; `cargo tree -p byro-launcher -i wgpu` empty after the 2026-10 egui 0.36 / wgpu 30 bump, `docs/engine/launcher.md`); `a_directory_with_the_engine_name_is_not_the_engine` guards `locate_engine`. The preflight probe (`tools/byro-launcher/src/preflight.rs`) reads extension and device names through bounded `from_bytes_until_nul` accessors, scanned by the renderer's `device_names_read_through_bounded_accessors` guard (d3225bb2f, #5717). ### Dimension 5: Install detection and profile registry Paths: `crates/game-detect/src/{catalog,steam,profiles,validate}.rs`, `crates/core/src/ecs/game_profiles.rs`, `byroredux/src/game_profiles.rs` (re-export shim), `assets/debug_profiles.toml`, `tools/byro-detect/src/main.rs`. First step: `cargo test -p byroredux-game-detect` and `git log --since= -- crates/game-detect assets/debug_profiles.toml`. - Steam only today (`~/.steam/*`, `~/.local/share/Steam`, Flatpak, macOS, Windows `ProgramFiles*`; the registry probe is marked "still to do"); GOG/Epic and Wine prefixes are not probed — a Wine install is reachable only via a manual `[roots]` entry, which `byro-detect` says when nothing is found. A manifest `installdir` must pass `is_bare_install_dir` (non-empty, not `.`/`..`, no `/`, `\` or `:`; aad5dfd75, #5016; `only_a_bare_directory_name_is_a_valid_installdir`) — a `Path::is_absolute`-style check reappearing misses Windows `\X` / `D:X` shapes. - Alternate releases (`[[profiles..releases]]`, chosen by files on disk via `GameProfileEntry::for_data_dir`): guards `an_alternate_release_is_validated_against_its_own_archives`, `the_primary_release_wins_when_its_archives_are_all_present`, `a_release_replaces_only_the_lists_it_names`. The launcher validator, the engine's `expand_game_profile_args` (`byroredux/src/boot/cli.rs`) and `studio_host.rs` must all go through `for_data_dir`, not a private copy; sibling rules come from `byroredux_bsa::numeric_sibling_paths`. - Env-var spelling: canonical is `BYROREDUX__DATA` (`crates/plugin/src/esm/test_paths.rs`, e.g. `BYROREDUX_SKYRIMSE_DATA`). `63c0aee3b` (Session 91) unified the Skyrim SE split; the legacy *BYROREDUX_SKYRIM_DATA* survives only as a repo-variable fallback in `.github/workflows/playable-smoke.yml` (#4760 closed; its Rust/script readers are gone). A new reader of the old name is a regression of that unification (#3741 was the earlier same-class failure). - `validate.rs`: a zero-byte or truncated `.esm` / archive must fail at the right `Severity`, not pass and then abort the engine. `esm_opens` reads only a bounded 1 MiB TES4 prefix and fails closed on an over-declared header (d6b495f2a, #5145); a whole-file read on the launcher UI thread is the regression. - `byro-detect`: exit failure when nothing is found, text output only, `--write` records `[roots]` via the formatting-preserving merge (Dim 4); arguments parse strictly (the launcher's `--profiles` too, #5294) — an unknown flag, a missing/flag-shaped or repeated `--profiles` value is a usage error (exit 2, nothing written; ad6967fa9, #5167; `rejects_an_unknown_flag`) — check `--help` matches behaviour. ### Dimension 6: Tool CLIs Paths: `tools/texture-upscale/src/`. First step: `cargo test -p byro-texture-upscale`. - texture-upscale (`MANIFEST_VERSION` 1, `Manifest::validate`): `output_png_path` follows `validate_asset_path` (rejects absolute, `.`, `..`, empty segments); overwrite refused without `--overwrite`; `--dry-run` creates nothing (`dry_run_checks_the_plan_without_creating_output_or_launching_the_model`); dimensions overflow-checked (`scaled_dimensions_reject_overflow`); disk space checked first (`insufficient_space_is_rejected_before_writes`), and a read-only output or scratch volume is refused by role through the pure `refuse_read_only` (`space.rs`; e7913ec21, #5695; `read_only_output_or_scratch_is_refused_by_role`). - Trust: the upscaler is `Command::new(&manifest.upscaler.program)` with `.args(..)` (no shell), so the manifest is executable trusted input; README/`--help` must say so. - Output collisions and per-set failure are fixed (#4761/#4762): `validate` claims each source's output PNG across every set (`manifest_rejects_sources_that_share_an_output_png`); a bad set is reported, not batch-fatal (`one_bad_set_does_not_abort_the_batch`), while an unlaunchable upscaler still aborts (`an_unlaunchable_upscaler_still_aborts_the_batch`). Check: `SourceStack` "later overrides earlier" matches the engine's last-wins order (`/audit-parsers` Dim 6). ## Phase 3: Merge and Cleanup Write `docs/audits/AUDIT_TOOLING_.md`: Executive Summary (findings by severity, areas swept), deduplicated Findings, and an Exposure Matrix (surface x {reachable by, authenticated, size-capped, persistence atomic}). Cross-audit dedup: debug-server locks `/audit-concurrency` Dim 7; sandbox enforcement `/audit-safety` Dim 8; save schema `/audit-save`; VDF/archive parsing `/audit-parsers`. Then `rm -rf /tmp/audit/tooling` and suggest `/audit-publish docs/audits/AUDIT_TOOLING_.md` (labels: `tech-debt` for debug-server/launcher/tools, which have no label of their own; `doc-rot`, `test-gap` as fitting).