[liuyinchu]

Problem

Interrupted renders can resume with changed asset content after a symlink is retargeted: only the old canonical target is recorded, so unchanged target files pass both input checks while different segments load different content. Reproduced with the real resource server and checkpoint store, including project-root and directory aliases.

Changes

Record logical resource paths alongside resolved files using the same content digest, preserve project-root aliases through capture setup, and retain canonical confinement checks. Cover directory indexes and ranged media without hashing aliases twice; same-content retargets remain reusable.

Protection applies to newly recorded checkpoints. Historical manifests without alias mappings cannot be repaired retrospectively. This does not claim an atomic filesystem snapshot or fix existing in-place large-file cache/hash-versus-stream races.

Validation

• Eight new deterministic regressions pass; seven fail on unchanged upstream.
• Existing focused server/checkpoint/path checks and release:check pass. Independent review completed.
• Full renderer suite: baseline 234 passed / 67 failed / 123 skipped; patched 242 passed / 69 failed / 123 skipped. Existing failure names are unchanged; the two additional real-render tests are blocked at browser startup.
• Pinned Chromium downloads returned invalid/truncated ZIPs; installed system Chromium could not launch in this sandbox. No actual video/render, Windows/macOS, or GPU validation is claimed. Cross-platform/render CI must run before merge.

The published tree matches the locally tested tree exactly: f5d74331682d93f1103e7cb3f525cb78fee4450a. Separate from the existing config-lock draft.

AI disclosure

Implemented and independently reviewed with an OpenAI coding assistant. Reproductions and reported checks were actually run; browser and cross-platform limitations are explicit.

[LBEILC]

Merged, thank you! The reproduction and the clear limits in the description made this easy to review.

I checked it locally on Windows 11 as well: the new alias tests pass, using junctions (the file-symlink case is skipped without Developer Mode, as the test intends), and so do the existing server, resume and resources tests. CI passed on all three platforms. One small observation, not a blocker: on Windows, if --root is written with different letter case from the real path, each input is recorded under both paths, so resume hashes it twice. The outcome is the same, so I left it as is.

This will ship in 0.3.14, with credit in the release notes.