[SashaMIT]

Summary

docs/WINDOWS.md records how the Linux Runtime behaves inside WSL2. Each statement cites the code by file and line. Rust paths are relative to elastos/crates/elastos-server/src/.

Merge order: this PR must merge after #394. docs/WINDOWS.md links to docs/LAUNCHER_CONTRACT.md#readiness-and-home-url, which only exists once #394 lands on develop. Merged first, the link is broken.

• Proof status. Issue Windows: prove the installed Runtime journey under WSL2 #265 owns the WSL2 proof. It is open and none of its acceptance items is ticked, so the note no longer calls it an "executed proof". It says the section is a target until Windows: prove the installed Runtime journey under WSL2 #265's items are proven.
• Home origin (decided). The Home origin is localhost everywhere. docs/LAUNCHER_CONTRACT.md (Define the launcher contract for gateway supervision #394, "Readiness and Home URL", lines 55-73 at the Define the launcher contract for gateway supervision #394 head) is the one source: localhost is the one Home origin, the passkey relying party id is localhost, an IP-literal origin is refused with HTTP 403, and Home page requests on a loopback IP get a 308 to localhost. The note says browsers refuse passkeys (WebAuthn) on an IP-address origin such as http://127.0.0.1:8090, so passkeys work only on localhost. Runtime facts kept, with citations: elastos home --browser binds localhost at BROWSER_HOME_PORT (gateway_entry.rs:17-31, update_controller.rs:2288-2289). The URL keeps the given host (api/gateway_server.rs:96-101, :117). HOME_ROUTE is /home/ (api/gateway.rs:440). /home, /apps/home, and /apps/home/ redirect there (api/gateway.rs:1222-1235). The update controller accepts readiness on localhost, 127.0.0.1, or [::1] (update_controller.rs:2291-2299). Hidden elastos gateway defaults to 127.0.0.1 (main.rs:438-441).
• Launcher. The earlier "open gap" (launcher on 127.0.0.1) is out of date: elastos-launcher Home 0.7.1: first-run seed, chrome fixes, lock face, Documents, Library menu, dock motion, capsule-owned service icons #54 now starts and opens localhost:8090 and treats 127.0.0.1:8090 only as a legacy gateway to restart (src/main/targets/runtimeGateway.ts:93-101, branch cursor/runtime-audit-fixes-950d at 7cd4f6f). The note no longer records a launcher/contract mismatch.
• Tools in the distro (new). The installer needs curl, python3, and sha256sum or shasum (scripts/install.sh:35), and stops before any download when they are missing or python3 does not run (scripts/install.sh:1177-1191; first download is :1277). python3 runs verify_signature (:683) and validate_release_identity (:830). A distro without python3 cannot install.
• Second tab. elastos home --browser calls open_browser (gateway_entry.rs:33-40, main.rs:2268-2283), which starts wslview or xdg-open and does not check that a page opened. A second tab is possible, not certain: it depends on those tools being in the distro and reaching a Windows browser. elastos gateway (gateway_entry.rs:1-15, ready callback None at gateway_cmd.rs:34) opens no browser.
• Other docs. docs/MAC.md:71-80 and docs/HOME_LOCAL_SETUP.md:37-47,204 use a developer gateway at localhost:61180/apps/home/. HOME_LOCAL_SETUP.md:46-48 calls 8090 "only a script default, not product authority", which conflicts with update_controller.rs:2288 ("The browser Home always listens here"). These are not changed here.
• Release checks. verify_signature (scripts/install.sh:678-825, called at :1286 and :1313), validate_release_identity (:827-863), and sha256_check (:356-364, called at :1354). The trust anchor is the MAINTAINER_DID written into install.sh (:45-48, refused when empty or malformed at :1167-1172). So a launcher must verify install.sh itself and must not set ELASTOS_MAINTAINER_DID. Tamper tests are cited by name and line in scripts/install-bootstrap-test.py.
• Older release. An existing installation already refuses an older signed release (install_release, update.rs:505-513; test older_installer_after_update_is_refused_without_changes, update.rs:5067). Only a new installation has no version floor. That is the stated gap.
• Update path. The signed head sets the channel (scripts/install.sh:1290-1293), and the installer records it in sources.json (:1406-1425). elastos update (main.rs:550-570) refuses an older release (update.rs:1233-1237) and another channel (verify_source_channel, update.rs:170-183). A canary subscription also follows stable. elastos source switch-channel changes the channel (sources.rs:465-475).
• Browser on WSL2. browser_available is true only for darwin-arm64 (setup/browser_config.rs:166-168). On every Linux host, elastos setup removes scripts/browser-vm-linux-network.py (retire_host, :300-355) before the installer host step (scripts/install.sh:950-952). prepare_browser_linux_host then returns at scripts/install.sh:914. Browser fails closed. Test: linux_setup_installs_no_browser_host_helpers_or_image (setup/browser_config.rs:808).

Named gaps: no version floor on a new installation, no /mnt data-root guard, a possible second tab from elastos home --browser, the stop signal (issue #265), how Windows forwards localhost into WSL2 (untested, LAUNCHER_CONTRACT.md:29-30), and root-owned helper files that an earlier release may have left are not removed (#418 adds a notice).

The owning issue is #265.

Head: 8bdc3803. Draft against develop. Do not merge. Docs only. The branch also carries the zip 9 merge (ba88f427, from #417, so CI can run cargo-audit) and a port of develop 50515055 (38e2d777, journal test lock retry, #381); those are not part of this change. This branch sits beside the Intel stack.

Verification

• 8bdc3803: git diff --check clean. node scripts/public-copy-entropy-check.mjs: PASS. node scripts/check-product-data.mjs: ok. Each new citation was re-read at this head (install.sh:35, :683, :830, :1177-1191, :1277; gateway_entry.rs:1-15, :33-40; gateway_cmd.rs:34; main.rs:2268-2283) and against docs/LAUNCHER_CONTRACT.md at the Define the launcher contract for gateway supervision #394 head.
• Earlier (15f65e9b): the cited installer tamper tests pass: test_signature_and_binding_failures_reject_before_artifacts_in_populated_installation, test_corrupt_artifacts_fail_before_changes_then_clean_rerun_installs, test_binding_precedes_artifacts, and test_altered_message_signature_and_key. Rust: cargo test -p elastos-server --lib linux_setup_ passes 4 of 4. Mutation check: with sha256_check at install.sh:1354 disabled, the corrupt-binary test fails ('SHA-256 mismatch' not found); with verify_signature at :1313 disabled, the tampered-release case fails ('Signature verification FAILED' not found). Both were restored. 8bdc3803 changes only docs/WINDOWS.md.

Principles check

• P10. One source for the Home origin (the launcher contract). This note cites it and states the decision (localhost everywhere) without copying the URL.
• P12. Each installer and update claim cites code and a test. Gaps stay gaps; Windows: prove the installed Runtime journey under WSL2 #265 is not called a proof.
• P11 fail closed, then explain. The note records that Browser is absent on Linux, and that the installer stops without python3.
• P15 signed trust. The note names the pinned MAINTAINER_DID in install.sh as the trust anchor, so the launcher must verify install.sh itself.
• AGENTS.md release-neutral docs. The note carries no branch name and no release status; the merge-order note lives here in the body, not in the doc.

[SashaMIT]

8bdc3803: docs/WINDOWS.md no longer calls #265 a proof, states localhost everywhere (browsers refuse passkeys on IP origins; LAUNCHER_CONTRACT.md from #394), adds curl/python3/SHA-256 to the distro tools (install.sh:35, :1177-1191, :683), and says a second tab is possible, not certain.
Docs only; each new citation re-read at this head. Must merge after #394 (the contract link breaks otherwise).

---

Generated by Claude Code

[SashaMIT]

Round 3 review: PASS (A). Docs match the code. Merge after #394.