fix: complete V3 native flows and harden matched evaluation

.github/workflows/v3-benchmark-isolation.yml

@@ -0,0 +1,51 @@
+name: V3 benchmark isolation diagnostics
+on:
+  push:
+    branches: ['Evan/v3-finalization']
+    paths: ['benchmarks/**', 'tests/test_v3_protected_worker.py', '.github/workflows/v3-benchmark-isolation.yml']
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  isolation:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        python: ['3.12', '3.13']
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install Linux backend using the existing CI configuration
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y bubblewrap
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+      - name: Install project dependencies
+        run: python -m pip install -e '.[all]'
+      - name: Record diagnostic identity
+        shell: bash
+        run: |
+          git rev-parse HEAD > isolation-commit.txt
+          python -m pip freeze > isolation-dependencies.txt
+      - name: Exercise bounded protection and required full-preflight refusal
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m unittest tests.test_v3_protected_worker -v 2>&1 | tee isolation-tests.log
+      - name: Preserve diagnostics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: isolation-${{ matrix.os }}-py${{ matrix.python }}
+          path: |
+            isolation-commit.txt
+            isolation-dependencies.txt
+            isolation-tests.log

.github/workflows/v3-windows-reliability.yml

@@ -0,0 +1,82 @@
+name: V3 Windows cancellation investigation
+on:
+  push:
+    branches: ['Evan/v3-windows-cancellation-investigation-20261107']
+    paths: ['.github/workflows/v3-windows-reliability.yml', 'scripts/v3_windows_reliability.py', 'tests/test_v3_windows_reliability.py']
+  workflow_dispatch:
+    inputs:
+      candidate_sha:
+        description: Exact 40-character product commit to test (diagnostic code remains separate)
+        type: string
+        required: true
+        default: '7905fb634fe447243668c2d01179ce5cb2cdb275'
+      control:
+        description: Diagnostic load control (passing repetitions never establish historical cause)
+        type: choice
+        options: [baseline, cpu, sqlite, combined, all]
+        default: baseline
+      iterations:
+        description: Samples per control and Python version (1–50)
+        type: number
+        default: 50
+env:
+  PRODUCT_SHA: ${{ inputs.candidate_sha || '7905fb634fe447243668c2d01179ce5cb2cdb275' }}
+  ITERATIONS: ${{ github.event_name == 'workflow_dispatch' && format('{0}', inputs.iterations) || '50' }}
+permissions:
+  contents: read
+jobs:
+  cancellation:
+    runs-on: windows-latest
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ['3.12', '3.13']
+        control: ${{ fromJSON(inputs.control == 'all' && '["baseline","cpu","sqlite","combined"]' || format('["{0}"]', inputs.control || 'baseline')) }}
+    steps:
+      - name: Validate exact candidate identity
+        shell: pwsh
+        run: |
+          if ($env:PRODUCT_SHA -cnotmatch '^[0-9a-f]{40}$') { throw 'candidate_sha must be a full lowercase commit SHA' }
+          if ($env:ITERATIONS -cnotmatch '^[0-9]+$' -or [int]$env:ITERATIONS -lt 1 -or [int]$env:ITERATIONS -gt 50) { throw 'iterations must be 1–50' }
+      - name: Checkout diagnostic harness
+        uses: actions/checkout@v4
+        with:
+          path: diagnostic-source
+          fetch-depth: 0
+      - name: Checkout exact product
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.PRODUCT_SHA }}
+          path: product
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Verify checked-out product
+        shell: pwsh
+        working-directory: product
+        run: |
+          if ((git rev-parse HEAD) -cne $env:PRODUCT_SHA) { throw 'Checked-out candidate differs from requested commit' }
+          if (git status --porcelain --untracked-files=no) { throw 'Product checkout has tracked edits' }
+      - name: Install exact product dependencies
+        working-directory: product
+        run: python -m pip install -e '.[all]'
+      - name: Record dependency versions
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force windows-evidence | Out-Null
+          python -m pip freeze | Set-Content -Encoding utf8 windows-evidence/dependencies.txt
+          $env:GITHUB_SHA | Set-Content -Encoding utf8 windows-evidence/diagnostic-commit.txt
+      - name: Trace unchanged cancellation test under recorded load control
+        shell: pwsh
+        env:
+          LOAD_CONTROL: ${{ matrix.control }}
+        run: python diagnostic-source/scripts/v3_windows_reliability.py --repository product --output windows-evidence --iterations $env:ITERATIONS --control $env:LOAD_CONTROL --cpu-workers 2
+      - name: Upload investigation evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-cancellation-${{ matrix.python }}-${{ env.PRODUCT_SHA }}-${{ matrix.control }}
+          path: windows-evidence/
+          if-no-files-found: error

README.ja.md

@@ -14,19 +14,21 @@
 
 ## インストール
 
+V3 は未リリースです。以下のコマンドは公開済み安定版 **v2.0.8** をインストールします。
+
 OpenKyrozen は Python **3.12 と 3.13** をサポートします。Python 3.14 は対象外です。
 
 ### macOS または Linux
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v3.0.0/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v2.0.8/install.sh | sh
 kyrozen
 ```
 
 ### Windows PowerShell
 
 ```powershell
-irm https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v3.0.0/install.ps1 | iex
+irm https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v2.0.8/install.ps1 | iex
 kyrozen
 ```
 
@@ -53,7 +55,7 @@ make run
 ### 検証済み release wheel を直接インストール
 
 ```bash
-uv tool install --python 3.12 --force --with fastapi --with uvicorn https://github.com/EvanProgramming/OpenKyrozen/releases/download/v3.0.0/openkyrozen-3.0.0-py3-none-any.whl
+uv tool install --python 3.12 --force --with fastapi --with uvicorn https://github.com/EvanProgramming/OpenKyrozen/releases/download/v2.0.8/openkyrozen-2.0.8-py3-none-any.whl
 ```
 
 ## クイックスタート

README.ko.md

@@ -14,19 +14,21 @@
 
 ## 설치
 
+V3는 아직 출시되지 않았습니다. 아래 명령은 공개된 안정 버전 **v2.0.8**을 설치합니다.
+
 OpenKyrozen은 Python **3.12와 3.13**을 지원합니다. Python 3.14는 지원 대상이 아닙니다.
 
 ### macOS 또는 Linux
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v3.0.0/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v2.0.8/install.sh | sh
 kyrozen
 ```
 
 ### Windows PowerShell
 
 ```powershell
-irm https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v3.0.0/install.ps1 | iex
+irm https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v2.0.8/install.ps1 | iex
 kyrozen
 ```
 
@@ -53,7 +55,7 @@ make run
 ### 검증된 release wheel 직접 설치
 
 ```bash
-uv tool install --python 3.12 --force --with fastapi --with uvicorn https://github.com/EvanProgramming/OpenKyrozen/releases/download/v3.0.0/openkyrozen-3.0.0-py3-none-any.whl
+uv tool install --python 3.12 --force --with fastapi --with uvicorn https://github.com/EvanProgramming/OpenKyrozen/releases/download/v2.0.8/openkyrozen-2.0.8-py3-none-any.whl
 ```
 
 ## 빠른 시작

README.md

@@ -12,19 +12,19 @@
 
 ## Install
 
-This release is **v3.0.0**. It supports Python 3.12 and 3.13; Python 3.14 is outside the supported range.
+V3 is not yet released. The commands below install the published stable **v2.0.8**. It supports Python 3.12 and 3.13; Python 3.14 is outside the supported range.
 
 macOS or Linux:
 
 ```sh
-curl -fsSL https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v3.0.0/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v2.0.8/install.sh | sh
 kyrozen
 ```
 
 Windows PowerShell:
 
 ```powershell
-irm https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v3.0.0/install.ps1 | iex
+irm https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v2.0.8/install.ps1 | iex
 kyrozen
 ```
 

README.zh-CN.md

@@ -14,19 +14,21 @@
 
 ## 安装
 
+V3 尚未发布。下方命令安装已发布的稳定版 **v2.0.8**。
+
 OpenKyrozen 支持 Python **3.12 和 3.13**。Python 3.14 暂不支持。
 
 ### macOS 或 Linux
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v3.0.0/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v2.0.8/install.sh | sh
 kyrozen
 ```
 
 ### Windows PowerShell
 
 ```powershell
-irm https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v3.0.0/install.ps1 | iex
+irm https://raw.githubusercontent.com/EvanProgramming/OpenKyrozen/v2.0.8/install.ps1 | iex
 kyrozen
 ```
 
@@ -53,7 +55,7 @@ make run
 ### 直接安装已验证的 release wheel
 
 ```bash
-uv tool install --python 3.12 --force --with fastapi --with uvicorn https://github.com/EvanProgramming/OpenKyrozen/releases/download/v3.0.0/openkyrozen-3.0.0-py3-none-any.whl
+uv tool install --python 3.12 --force --with fastapi --with uvicorn https://github.com/EvanProgramming/OpenKyrozen/releases/download/v2.0.8/openkyrozen-2.0.8-py3-none-any.whl
 ```
 
 ## 快速开始