From 7687cfa5776a17e74068ec73003811b02c9de160 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Cezar=20Mois=C3=A9s?= <sac@securityops.co>
Date: Mon, 31 Aug 2026 20:32:42 -0300
Subject: [PATCH] release: prepare ZUPT 5.2.8

---
 .github/workflows/promote-release.yml   |   2 +-
 AUDIT.md                                |  75 ++++++++++++---
 CHANGELOG.md                            |  81 ++++++++++++----
 DISTRIBUTION.md                         |  55 ++++++-----
 INSTALL.md                              |  29 ++++--
 README.md                               | 118 +++++++++++++++---------
 SECURITY.md                             |  70 ++++++++++----
 THIRD-PARTY-NOTICES.md                  |   4 +-
 THREAT_MODEL.md                         |  73 ++++++++++-----
 doc/zupt-gui.1                          |   4 +-
 doc/zupt.1                              |   8 +-
 gui/README.md                           |  14 +--
 gui/packaging/deb/control               |   4 +-
 gui/packaging/windows/build-windows.bat |   2 +-
 include/zupt.h                          |   3 +-
 install.sh                              |   2 +-
 packaging/aur/PKGBUILD                  |   4 +-
 packaging/debian/changelog              |  14 +++
 packaging/guix/zupt.scm                 |   2 +-
 packaging/homebrew/zupt.rb              |   4 +-
 packaging/nix/flake.nix                 |   4 +-
 packaging/opensuse/README.md            |  40 +++++---
 packaging/opensuse/_service             |   2 +-
 packaging/opensuse/zupt.changes         |  15 +++
 packaging/opensuse/zupt.spec            |   2 +-
 packaging/portable/README.txt           |   4 +-
 packaging/rpm/zupt.spec                 |  11 ++-
 src/zupt_format.c                       |   2 +-
 tests/test_audit_flake.sh               |   4 +-
 29 files changed, 454 insertions(+), 198 deletions(-)

diff --git a/.github/workflows/promote-release.yml b/.github/workflows/promote-release.yml
index d05b427..e28d6c1 100644
--- a/.github/workflows/promote-release.yml
+++ b/.github/workflows/promote-release.yml
@@ -11,7 +11,7 @@ on:
         required: true
         type: number
       tag:
-        description: Existing annotated release tag, for example v5.2.7
+        description: Existing annotated release tag, for example v5.2.8
         required: true
         type: string
 
diff --git a/AUDIT.md b/AUDIT.md
index 62eaa08..7f46f35 100644
--- a/AUDIT.md
+++ b/AUDIT.md
@@ -1,12 +1,12 @@
 <!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
-# ZUPT 5.2.7 audit guide and finding history
+# ZUPT 5.2.8 audit guide and finding history
 
 This document describes review surfaces and reproducible checks. It is an
 upstream self-review, not an independent audit, certification, or guarantee.
 `SECURITY.md` defines reporting policy and `THREAT_MODEL.md` defines the
 security boundary.
 
-## 5.2.7 scope
+## 5.2.8 scope
 
 The baseline scope is the source-only CLI and its bundled source codec:
 
@@ -28,7 +28,7 @@ output.
 
 ## Source-only review
 
-The 5.2.7 baseline retains the source-only boundary introduced in 5.2.2, which
+The 5.2.8 baseline retains the source-only boundary introduced in 5.2.2, which
 removed incomplete SDK/PQBOX header snapshots and local precompiled-library
 expectations. Git and new upstream source
 archives are intended to contain no compiled executable, object, shared/static
@@ -42,10 +42,10 @@ scripts/check-source-only.sh
 
 # committed Git tree or immutable tag
 scripts/check-source-only.sh --tag HEAD
-scripts/check-source-only.sh --tag v5.2.7
+scripts/check-source-only.sh --tag v5.2.8
 
 # generated source archive
-scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
+scripts/check-source-only.sh --archive /path/to/zupt-5.2.8.tar.gz
 ```
 
 The scanner checks extensions and magic bytes, nested archives, symlink targets,
@@ -80,6 +80,7 @@ make -j"$(getconf _NPROCESSORS_ONLN 2>/dev/null || printf 1)" \
   WITH_SDK=0 WITH_PQBOX=0 V=1
 make WITH_SDK=0 WITH_PQBOX=0 check
 make WITH_SDK=0 WITH_PQBOX=0 test-all
+make sdk-test
 ```
 
 Relevant review layers include:
@@ -92,6 +93,7 @@ Relevant review layers include:
 | Archive behavior | quick/regression, traversal, argument-order, block-swap, nonce, and exact-size tests | Exercises current parser, integrity, and round-trip properties |
 | Password sources | `tests/test_password_sources.sh` | Exercises password-file, inherited-descriptor and explicit-prompt rejection paths without logging password contents |
 | Key files | native key regressions | Exercises no-replace private-file creation, POSIX mode `0600`/Windows current-user-only DACL, failed-partial behavior, checksum, and exact ZKEY/ZPQK version/flags/reserved/size/role validation |
+| SDK key publication | `make sdk-test` | Exercises atomic descriptor/handle-backed key copies, POSIX private/public modes, and symlink/hardlink target preservation; this now runs in `release-check` and hosted GCC/Clang Linux CI |
 | Terminal output | archive-comment regression | Requires displayed untrusted comments to contain no raw terminal-control sequence |
 | Prompt cleanup | PTY signal regression | Requires handled POSIX interruption to restore the saved terminal state |
 | Sanitizers | `make test-asan-run` | Builds and executes separate ASan/UBSan/LSan evidence where supported; not a substitute for normal tests |
@@ -109,7 +111,7 @@ without evidence.
 The following upstream self-audit results apply only to the 5.2.2 candidate at
 commit `ff99770` on the recorded local Linux environments. The immutable 5.2.2
 tag was not promoted after post-tag CI integration failures. These results are
-not independent certification, a 5.2.7 result, or evidence that release assets
+not independent certification, a 5.2.8 result, or evidence that release assets
 were published.
 
 | Gate | Result | Recorded evidence |
@@ -141,7 +143,7 @@ A separate local openSUSE Tumbleweed reproduction resolved the explicit
 produced exactly one `zupt-5.2.4.tar.gz`, which passed the source-only scanner.
 This isolates a release/test harness defect; it is not evidence of a product,
 archive-format, cryptographic, codec, or SDK ABI change. It also does not turn
-the skipped native jobs into passes or transfer any result to 5.2.7.
+the skipped native jobs into passes or transfer any result to 5.2.8.
 
 ## Prior 5.2.5 exact-tag native-gate evidence
 
@@ -164,7 +166,7 @@ GNU Bash 3.2.57 in a clean clone. All four exercised modes completed: the
 repository audit reported 609 files and one archive; `--tree` reported 204/0;
 `--archive` reported 201/1; and `--root` plus `--tag v5.2.5` reported 810/2.
 This is targeted scanner compatibility evidence only, not exact-v5.2.6 or
-v5.2.7 hosted CI, package, native-platform, or promotion evidence.
+v5.2.8 hosted CI, package, native-platform, or promotion evidence.
 
 ## Prior 5.2.6 exact-tag native-gate evidence
 
@@ -178,10 +180,52 @@ archive and diagnostic assertions.
 The 5.2.7 changes scope those helper declarations to supported x86 builds and
 carry the safe UTF-8 fixture across the Windows argument boundary without
 locale-dependent byte conversion. These are test/release integration changes,
-not archive-format, cryptographic, codec, or SDK ABI changes. They are not proof
-that any v5.2.7 native or hosted gate has passed.
+not archive-format, cryptographic, codec, or SDK ABI changes.
 
-The exact 5.2.7 candidate must repeat the required suite. Native Windows and
+## Prior 5.2.7 exact-tag native-gate evidence
+
+The immutable `v5.2.7` candidate was not promoted. Exact-tag GitHub Actions run
+`33445470664` concluded `cancelled` at `2026-08-31T23:11:19Z`, with 13
+successful jobs, one failed macOS job, and one cancelled Windows job. The macOS
+runner filesystem rejected creation of the
+raw-C1 filename fixture with `EILSEQ`. The hosted Windows job stalled in `make
+check`; a MinGW/Wine reproduction isolated the cause to
+`test --password-prompt ... </dev/null` entering `_getch`, and the remaining
+native job was cancelled.
+
+The 5.2.8 fixture treats that creation refusal as an explicit `SKIP`; on a
+filesystem that accepts the byte, the scanner must still reject the compiled
+magic and render the path without emitting the raw C1 byte. No result from the
+immutable tag transfers automatically to 5.2.8. The Windows prompt correction
+rejects a redirected/non-console standard input before entering `_getch` and
+adds a native EOF regression; it also requires fresh exact-candidate evidence.
+
+## 5.2.8 CodeQL High path-race corrections
+
+CodeQL High #5 identified SDK key-copy publication that reopened the output
+path and then applied `chmod` to that mutable name. The copy now uses the core
+atomic publisher, sets POSIX mode on the open temporary descriptor, checks
+read/close/publication failures, and replaces only the destination directory
+entry. `sdk-test` covers symlink and hardlink sentinels and expected key modes.
+
+CodeQL High #6 identified the POSIX disk-restore `lstat`-then-`open` sequence.
+Restore now opens once with `O_NOFOLLOW` and without truncation, classifies that
+descriptor with `fstat`, and retains the same raw-device descriptor through
+capacity checks and writes. Regular-file destinations retain the existing
+atomic publisher.
+
+CodeQL High #7 identified benchmark cleanup's `lstat`-then-recursive-path
+sequence. POSIX cleanup now pins each component with `openat` and removes leaves
+with `unlinkat`; Windows pins ancestors/children, opens reparse points without
+following them, recurses only into a plain directory held against rename, and
+after emptying a directory reopens it relative to the pinned parent, verifies
+its volume and file index against the traversal handle, and marks only that
+identity-checked handle for deletion. The live-workspace
+regression injects a directory symlink and verifies that its external sentinel
+survives. These are reviewed fixes and regression coverage,
+not independent certification or proof that a 5.2.8 hosted gate passed.
+
+The exact 5.2.8 candidate must repeat the required suite. Native Windows and
 macOS gates, hosted GitHub CI and release promotion, authenticated OBS
 validation, and resolution of the openSUSE automatic `debugsource` rpmlint
 `no-binary` finding remain pending until recorded otherwise.
@@ -203,7 +247,7 @@ AES implementation has documented cache-timing risk on hostile shared hardware.
 
 The following entries are retained as release history. Their regression tests
 should be rerun, but the historical resolution does not itself constitute a
-5.2.7 test result.
+5.2.8 test result.
 
 | First corrected | Severity | Finding | Resolution recorded at the time |
 |---|---|---|---|
@@ -223,6 +267,9 @@ should be rerun, but the historical resolution does not itself constitute a
 | 5.2.2 | Medium | A signal during an interactive POSIX password prompt could leave terminal echo/state altered | Restore saved terminal settings on handled interruptions; cover the behavior with a PTY regression |
 | 5.2.2 | Test reliability | `tests/regression.sh` used Bash syntax without making the interpreter contract explicit | Execute the suite explicitly with Bash and keep syntax/interpreter checks in release gates |
 | 5.2.2 | Documentation/licensing | Current documentation incorrectly denied historical MIT grants visible in published Git history | Added a factual erratum: current source follows current SPDX notices, while earlier grants and immutable tags remain valid and unmodified |
+| 5.2.8 | High | CodeQL #5: SDK key copies changed permissions through a re-resolved destination path | Publish through the core atomic output object and apply permissions to its open descriptor; run link-target/mode regressions through `sdk-test` |
+| 5.2.8 | High | CodeQL #6: POSIX disk restore classified a pathname before reopening it destructively | Open without truncation or symlink following, classify with `fstat`, and retain the same device descriptor through write |
+| 5.2.8 | High | CodeQL #7: benchmark cleanup classified entries before recursively resolving their path | Traverse pinned descriptors/handles, refuse link/reparse traversal, remove entries relative to pinned parents, and verify Windows directory identity before handle deletion |
 
 See `CHANGELOG.md` for the complete per-release history and compatibility notes.
 Old tags remain immutable and may contain artifacts or build assumptions removed
@@ -244,12 +291,12 @@ include SHA-256 checksums. The gated GUI set adds the architecture-independent
 DEB, noarch/source RPM, and source-only portable GUI ZIP. Package gates include
 exact payload/dependency and installed off-screen integration checks; the
 portable ZIP additionally receives source scans, an exact safe-member allowlist,
-and an extracted launcher test. An AppImage is not promoted by the 5.2.7
+and an extracted launcher test. An AppImage is not promoted by the 5.2.8
 policy; AppDir and Flatpak bundles, GUI platform installers, and bare
 Linux/Windows executables are also excluded. Windows ZIP and macOS DMG outputs
 remain CLI-only.
 
-No Wine result is retained as release evidence for 5.2.7. Cross-compilation
+No Wine result is retained as release evidence for 5.2.8. Cross-compilation
 does not establish native-Windows behavior. Extended-length/device namespace
 paths, raw UNC output roots, and mapped/network-drive output are unsupported;
 the native Windows workflow remains a publication gate for the ZIP containing
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e28a59f..c6cdbef 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,49 @@
 # ZUPT Changelog
 
+## [5.2.8] — 2026-08-31 — Path-race hardening and native-fixture correction
+
+Corrective successor to the immutable, unpromoted `v5.2.7` candidate.
+Exact-tag GitHub Actions run `33445470664` reached a macOS failure because the
+runner filesystem rejected creation of the raw-C1 filename fixture with
+`EILSEQ`. The workflow concluded `cancelled` at `2026-08-31T23:11:19Z`, with
+13 successful jobs, one failed macOS job, and one cancelled Windows job.
+The hosted Windows job stalled in `make check`; a MinGW/Wine reproduction
+isolated the cause to `test --password-prompt ... </dev/null` entering
+`_getch` despite redirected standard input. The tag and its evidence remain
+unchanged.
+
+- Close CodeQL High #5 in SDK key saving by copying into the core atomic
+  publisher's already-open private object, applying POSIX key permissions with
+  `fchmod` on that descriptor, checking read/close/publication failures, and
+  replacing only the requested directory entry. Symlink and hardlink target
+  sentinels and private/public key modes are covered by the SDK regression.
+- Close CodeQL High #6 in POSIX disk restore by opening the target once without
+  truncation or final-symlink following, classifying that descriptor with
+  `fstat`, and retaining the same device descriptor through capacity checks and
+  writes. Regular-file restores continue to use atomic publication.
+- Close CodeQL High #7 in benchmark cleanup by resolving POSIX components with
+  `openat(..., O_NOFOLLOW)`, deleting relative to pinned descriptors with
+  `unlinkat`, and using pinned, reparse-point-aware handles for Windows
+  traversal. The regression injects a directory symlink into a live workspace
+  and verifies that cleanup does not visit its target.
+- Treat inability to create the raw-C1 scanner filename as an explicit fixture
+  skip on filesystems that reject the byte; when creation succeeds, the unsafe
+  diagnostic-escaping assertions still run unchanged.
+- Reject redirected or otherwise non-console Windows password prompts before
+  entering `_getch`, handle console EOF as an error, and cover the native
+  redirected-input path so it cannot hang a release gate.
+- Run `sdk-test` from both `release-check` and the hosted GCC/Clang Linux job so
+  the atomic key-save regression cannot silently fall outside release gates.
+- Carry the v5.2.7 archive format, cryptography, bundled codec release, and SDK
+  ABI forward unchanged. These are implementation and test-integration
+  corrections, not a wire-format or API change.
+- Realign current code, package, workflow, artifact, and documentation
+  references to 5.2.8. AUR/Homebrew SHA-256 and Guix content pins remain
+  pending until the final reproducible archive is generated.
+- Require fresh exact-`v5.2.8` source, checksum, hosted CI, native-platform,
+  package, OBS, and promotion evidence. This entry does not claim those gates
+  passed, and no v5.2.7 result transfers automatically.
+
 ## [5.2.7] — 2026-08-31 — Native test-harness portability corrections
 
 Corrective successor to the immutable, unpromoted `v5.2.6` candidate. Exact-tag
@@ -2433,7 +2477,7 @@ bump and packaging-syntax test expansion; archive format unchanged.
 ### `.github/workflows/ci.yml` — 8-job CI matrix
 
 Replaces the prior 4-job CI with a comprehensive matrix that mirrors
-the project's local-verification protocol from `PROMPT.md §6`:
+the project's historical local-verification protocol:
 
 | Job | What it does |
 |---|---|
@@ -3156,7 +3200,7 @@ size to run. It needs to be a sprint-protocol step, not a one-off.
 
 ### What changed
 
-**`PROMPT.md` — Prompt v2.**
+**Historical sprint instructions — version 2.**
 
 - **NEW §3.5: The exhaustive byte-sweep mandate.** Every
   format-touching change runs the full byte sweep before claiming
@@ -3176,7 +3220,7 @@ size to run. It needs to be a sprint-protocol step, not a one-off.
   with the regression-test names that catch each one. The table is
   the canonical "things that have shipped and must never recur"
   reference; keeping it current is part of every sprint.
-- **Footer stamp**: Prompt v2, 2026-05-20.
+- **Footer stamp**: historical instruction revision 2, 2026-05-20.
 
 **`Makefile`.** The help-target banner version is now derived
 from `include/zupt.h` via a `grep | awk` substitution:
@@ -3187,7 +3231,7 @@ help:
         include/zupt.h | awk -F'"' '{print $$2}') build targets:"
 ```
 
-This closes a recurring bug noted in `PROMPT.md §6 step 9` —
+This closes a recurring bug noted in the historical sprint checklist —
 prior sprints (2.3.0, 2.3.1) left the banner stale even after the
 sprint protocol said to bump it. Making it auto-derived removes
 the drift opportunity entirely.
@@ -3218,7 +3262,6 @@ the drift opportunity entirely.
 ### Files touched
 
 ```
-PROMPT.md            (§3.5 NEW, §6 step renumber, §10 kickoff, §11 rows, v2 stamp)
 Makefile             (help banner auto-derives version from header)
 include/zupt.h       (version 2.3.1 → 2.4.0)
 CHANGELOG.md         (this entry)
@@ -3402,7 +3445,7 @@ the footer.
 
 - **Encrypted modes**: AIT = `HMAC-SHA256(mac_key, hdr[0..63] || footer[0..23])`
 - **Plaintext modes**: AIT = `XXH64(...)` in the first 8 bytes, zeros in
-  the rest. Best-effort (`OPAQUE`-class per PROMPT.md §5).
+  the rest. Best-effort (`OPAQUE` structural-integrity class).
 
 The MAC input deliberately excludes `footer[24..31]` = `"ZEND" || u32 version`.
 Both are structurally validated by the read path (`locate_footer_v15`
@@ -3592,7 +3635,7 @@ so flipping it (e.g. from `0x02 INDEX` to `0x03 ENC_HEADER`) did
 not cause auth failure; the downstream parser was tolerant.
 Severity: low. Fix at `src/zupt_format.c` adds the structural
 check immediately after `read_block`. This makes the byte
-`OPAQUE`-class per PROMPT.md §5 (tamper detected by parser, not by
+`OPAQUE` structural-integrity class (tamper detected by parser, not by
 MAC).
 
 **F-02b — RECLASSIFIED.** The 2.2.4 hypothesis that the archive
@@ -3629,7 +3672,7 @@ other v2.3.0 changes than as a standalone patch.
 ### Verification
 
 - `make` — clean on plain GCC and Clang.
-- `make` with strict GCC flags (full set from PROMPT.md §6) — clean.
+- `make` with the historical strict GCC warning set — clean.
 - `make` with strict Clang flags — clean.
 - `make test` — **61/61 passing**.
 - `make test-vectors` — **14/14 passing**.
@@ -3665,8 +3708,8 @@ SECURITY.md                            (integrity statement reaffirmed)
 
 Patch release. No format changes, no feature changes, no on-disk
 compatibility impact. Five findings closed against the v2.2.3 baseline
-under the methodology in the new top-level `PROMPT.md` (continuous
-improvement prompt) and tracked in `docs/FINDINGS-2.x.md` (durable
+under the methodology in the then-current audit instructions and tracked in
+`docs/FINDINGS-2.x.md` (durable
 numbered ledger that survives between work sessions).
 
 ### Findings closed
@@ -3738,9 +3781,9 @@ preserved.
 
 ### New process artefacts
 
-- **`PROMPT.md`** — top-level "god-tier" continuous-improvement prompt.
-  Designed to be pasted verbatim into a fresh chat alongside the latest
-  source tarball. Encodes the methodology that produced this release:
+- **Historical continuous-improvement instructions** — removed from the
+  current source tree after their durable material was consolidated into the
+  audit and security documents. They encoded the methodology that produced this release:
   three-line workflow (survey → fix-with-test → ship), explicit
   authentication-coverage invariant (every archive byte covered by
   per-block HMAC OR a separate index MAC OR a footer MAC — no third
@@ -3788,7 +3831,7 @@ preserved.
 ### Files touched
 
 ```
-PROMPT.md                              (new, top-level)
+[historical sprint-instruction file]   (removed from the current tree)
 docs/FINDINGS-2.x.md                   (new)
 tests/test_audit_flake.sh              (new)
 src/zupt_main.c                        (F-01)
@@ -3900,20 +3943,20 @@ Two `make test` runs back-to-back, both clean. Cumulative test count:
 
 ### Documentation cleanup
 
-Four design/audit-prompt documents that were sprint-internal scratch
+Four design/audit-instruction documents that were sprint-internal scratch
 have been removed from the source tree (consolidated into the
 remaining permanent docs):
 
 | Removed | Where the content lives now |
 |---|---|
-| `AUDIT_PROMPT.md` | superseded by `FORMAL_AUDIT_PROMPT.md` |
+| Two historical audit-instruction files | consolidated into the permanent audit and security documents |
 | `ROOT_CAUSE_ANALYSIS.md` | reproducible-bug postmortems are now per-release entries in `CHANGELOG.md` |
 | `COMPAT.md` | the table moved into `README.md` § "Architecture & platform support" |
 | `DONATIONS.md` | one-liner moved into `README.md` § "Supporting Zupt" |
 
 Surviving canonical docs: `README.md`, `CHANGELOG.md` (this file),
 `SECURITY.md`, `INSTALL.md`, `LICENSE`, `THIRD-PARTY-NOTICES.md`,
-`AUDIT.md`, `FORMAL_AUDIT_PROMPT.md`, `ROADMAP.md`.
+`AUDIT.md` and the then-current roadmap.
 
 
 ## [2.2.2-final2] — 2026-05-01 — CLI help, man pages, deb copyright
@@ -4091,7 +4134,7 @@ the github-old → github-new migration sprint) deleted as obsolete.
 
 ## [2.2.2] god-tier audit — bug #16 (block-swap attack) fix
 
-Independent formal cryptographic audit (per FORMAL_AUDIT_PROMPT.md two-pass
+Independent formal cryptographic audit (using the then-current two-pass
 methodology) discovered a critical authenticated-encryption flaw in the
 shipped 2.2.2 binary. Investigation, root-cause, fix, regression test, and
 final verification documented below.
@@ -4290,7 +4333,7 @@ Compile-tested with `-Wpedantic` under GCC. Win32 code paths verified via
 - `AUDIT.md`: 2026-04-27 formal audit entry with cumulative test table
 - `README.md`: Security section bumped with audit confirmation
 - `doc/zupt.1`: SECURITY section mentions path-traversal protection
-- `FORMAL_AUDIT_PROMPT.md`: methodology document at repo root for future audits
+- the then-current formal-audit methodology document
 
 ## [2.2.2] — 2026-04-27
 
diff --git a/DISTRIBUTION.md b/DISTRIBUTION.md
index 13dd44e..30962e9 100644
--- a/DISTRIBUTION.md
+++ b/DISTRIBUTION.md
@@ -1,4 +1,4 @@
-# Distributing ZUPT 5.2.7
+# Distributing ZUPT 5.2.8
 
 This document describes the packaging material maintained in the ZUPT
 source repository. A recipe in `packaging/` is not evidence that a package has
@@ -14,8 +14,8 @@ https://github.com/cristiancmoises/zupt
 GitHub is the canonical source and release host. Packaging must never fetch
 `zupt-web` or substitute an asset from another project.
 
-The `v5.2.2`, `v5.2.3`, `v5.2.4`, `v5.2.5`, and `v5.2.6` tags are immutable
-non-promoted candidates.
+The `v5.2.2`, `v5.2.3`, `v5.2.4`, `v5.2.5`, `v5.2.6`, and `v5.2.7` tags are
+immutable non-promoted candidates.
 The v5.2.3 source-policy test assumed LF for a Windows `.bat` file that Git
 correctly checks out as CRLF. Exact-tag GitHub Actions run `33431386002` then
 recorded 12 successful v5.2.4 jobs, one openSUSE service-harness failure caused
@@ -27,11 +27,16 @@ Actions run `33434986357` completed 13 jobs successfully but failed the native
 Windows and macOS jobs. Its v5.2.6 corrections reached exact-tag run
 `33442264243`, where 13 jobs succeeded but macOS arm64 failed on unused x86
 SHA-NI test-helper declarations under `-Werror`, and Windows aborted during safe
-UTF-8 fixture argv transcoding. Corrective packages and release assets must use
-`v5.2.7`; never move or overwrite an earlier tag or checksum, and never
-transfer prior evidence automatically.
-This corrective version changes release/test integration only; the product,
-archive format, cryptography, codec, and SDK ABI remain unchanged.
+UTF-8 fixture argv transcoding. Version 5.2.7 corrected those failures, but
+exact-tag run `33445470664` ended with 13 successful jobs, a macOS raw-C1
+fixture failure with `EILSEQ`, and a cancelled Windows job after the hosted job
+stalled in `make check`; a MinGW/Wine reproduction isolated a non-console
+password-prompt hang in `_getch`.
+Corrective packages and release assets must use `v5.2.8`; never move or
+overwrite an earlier tag or checksum, and never transfer prior evidence
+automatically. Version 5.2.8 corrects those native test boundaries, hardens
+three path-race boundaries, and adds the SDK regression to release/hosted Linux
+gates. The archive format, cryptography, codec, and SDK ABI remain unchanged.
 
 ## Source-only boundary
 
@@ -61,7 +66,7 @@ Audit the current tree or a generated archive with:
 
 ```sh
 scripts/check-source-only.sh
-scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
+scripts/check-source-only.sh --archive /path/to/zupt-5.2.8.tar.gz
 ```
 
 The scanner reports paths, not file contents, and exits nonzero on a violation.
@@ -75,8 +80,8 @@ the commit omits Git's commit-ID PAX header:
 
 ```sh
 SOURCE_DATE_EPOCH="$(git show -s --format=%ct HEAD)" \
-  make DIST_TARBALL=/tmp/zupt-5.2.7.tar.gz dist
-sha256sum /tmp/zupt-5.2.7.tar.gz
+  make DIST_TARBALL=/tmp/zupt-5.2.8.tar.gz dist
+sha256sum /tmp/zupt-5.2.8.tar.gz
 ```
 
 With identical committed input and `SOURCE_DATE_EPOCH`, repeated exports must
@@ -122,12 +127,12 @@ private-library RPATH.
 | openSUSE / OBS | `packaging/opensuse/` | source and binary RPM through OBS |
 | Debian / Ubuntu | `packaging/debian/`, `packaging/build-deb.sh` | Debian metadata and binary DEB after the target gate |
 | RPM release artifact | `packaging/opensuse/zupt.spec`, `packaging/build-rpm.sh` | source and binary RPM after the target gate |
-| GUI DEB | `packaging/build-gui-deb.sh` | `zupt-gui_5.2.7_all.deb` after payload/dependency and installed integration gates |
-| GUI RPM | `packaging/build-gui-rpm.sh` | `zupt-gui-5.2.7-1.noarch.rpm` and matching `.src.rpm` after package and installed integration gates |
-| Linux CLI archive | `.github/workflows/ci.yml` | `zupt-5.2.7-linux-x86_64.tar.xz` with notices after dependency, member, and extracted functional gates |
-| Portable GUI source | `packaging/portable/`, `.github/workflows/ci.yml` | `zupt-gui-5.2.7-portable.zip` after source scan, member allowlist, and extracted off-screen integration gate |
+| GUI DEB | `packaging/build-gui-deb.sh` | `zupt-gui_5.2.8_all.deb` after payload/dependency and installed integration gates |
+| GUI RPM | `packaging/build-gui-rpm.sh` | `zupt-gui-5.2.8-1.noarch.rpm` and matching `.src.rpm` after package and installed integration gates |
+| Linux CLI archive | `.github/workflows/ci.yml` | `zupt-5.2.8-linux-x86_64.tar.xz` with notices after dependency, member, and extracted functional gates |
+| Portable GUI source | `packaging/portable/`, `.github/workflows/ci.yml` | `zupt-gui-5.2.8-portable.zip` after source scan, member allowlist, and extracted off-screen integration gate |
 | Fedora / RPM-based systems | `packaging/rpm/zupt.spec` | downstream RPM starting point |
-| AppImage helper | `packaging/build-appimage.sh` | downstream-only helper; no 5.2.7 AppImage is promoted |
+| AppImage helper | `packaging/build-appimage.sh` | downstream-only helper; no 5.2.8 AppImage is promoted |
 | Windows | `.github/workflows/cross-platform.yml` | native ZIP (executable plus notices) after the required native gate |
 | macOS | `packaging/build-dmg.sh` | native-architecture DMG after the native gate |
 | Arch Linux | `packaging/aur/PKGBUILD` | AUR package recipe |
@@ -203,17 +208,17 @@ expectations, then test the installed launcher off-screen against the matching
 ### Portable and native release artifacts
 
 The Linux x86_64 gate packages the tested `zupt` executable as
-`zupt-5.2.7-linux-x86_64.tar.xz` beside README, changelog, security guidance,
+`zupt-5.2.8-linux-x86_64.tar.xz` beside README, changelog, security guidance,
 and every applicable public license and notice. Its dynamic-library allowlist,
 archive member allowlist, and extracted CLI functional suite must pass.
 
-The `zupt-gui-5.2.7-portable.zip` artifact is source-only: it contains the GUI
+The `zupt-gui-5.2.8-portable.zip` artifact is source-only: it contains the GUI
 Python source, shell/macOS/Windows launchers, icons, provenance, changelog, and
 licenses, but no Python, Qt, CLI, or compiled runtime. The gate scans both the
 assembled and extracted trees, verifies an exact safe member allowlist, and
 runs the extracted launcher off-screen against the tested CLI.
 
-AppImage creation is deliberately offline and is not a 5.2.7 release gate.
+AppImage creation is deliberately offline and is not a 5.2.8 release gate.
 Supply a locally verified `appimagetool`, type-2 runtime, and the complete
 license/source-relink compliance notice for those exact runtime bytes; the
 helper never downloads any input:
@@ -229,7 +234,7 @@ APPIMAGE_RUNTIME_COMPLIANCE_FILE=/verified/path/runtime-compliance.txt \
 The runtime inspected while preparing 5.2.2 omitted a linked component from
 its notice and did not provide the complete LGPL source/relink handoff required
 by this release policy. No AppImage produced by this helper is promoted by the
-upstream 5.2.7 workflow. AppDir and Flatpak bundles and GUI platform installers
+upstream 5.2.8 workflow. AppDir and Flatpak bundles and GUI platform installers
 are also excluded. Bare Linux and Windows executables are not promoted; their
 CLI programs appear only inside notice-bearing archives. The Windows ZIP and
 macOS DMG remain CLI-only.
@@ -244,8 +249,8 @@ DIST_DIR="$release_dir" RUN_CHECKS=1 packaging/build-dmg.sh
 The Windows ZIP (including its executable and notices) must be built and tested
 by the Windows job in `.github/workflows/cross-platform.yml`; it is not a
 cross-compiled release claim from a Linux build. No Wine result is retained as
-5.2.7 release evidence. Extended-length/device namespace paths, raw UNC output
-roots, and mapped/network-drive output are not supported in 5.2.7. Publish the
+5.2.8 release evidence. Extended-length/device namespace paths, raw UNC output
+roots, and mapped/network-drive output are not supported in 5.2.8. Publish the
 exact architecture recorded by the native job.
 These helpers create binary distribution artifacts for the release page, not
 content to be committed to Git or included in the source archive.
@@ -253,7 +258,7 @@ content to be committed to Git or included in the source archive.
 ### AUR, Homebrew, Guix, and Nix
 
 After calculating the final reproducible source archive, but before creating or
-publishing the immutable tag, update each recipe to version 5.2.7 and to the
+publishing the immutable tag, update each recipe to version 5.2.8 and to the
 exact digest or content hash expected by its package manager. These recipe
 directories are excluded from the source archive, so this does not create a
 checksum cycle. Commit the pinned recipes in the tagged tree, then build and
@@ -272,7 +277,7 @@ build.
 
 For every published artifact:
 
-1. start from the immutable `v5.2.7` tag;
+1. start from the immutable `v5.2.8` tag;
 2. keep `WITH_SDK=0 WITH_PQBOX=0` unless system dependencies are declared;
 3. record the exact OS, distribution release, architecture, and toolchain;
 4. run format validation plus installed `--version`, `--help`, and archive
@@ -290,7 +295,7 @@ than redirecting consumers to an unverified file.
 
 ## Downstream checklist
 
-- [ ] The source URL resolves to the immutable `v5.2.7` tag.
+- [ ] The source URL resolves to the immutable `v5.2.8` tag.
 - [ ] The source archive passes `scripts/check-source-only.sh --archive`.
 - [ ] The recipe checksum matches the downloaded source exactly.
 - [ ] `WITH_SDK=0 WITH_PQBOX=0` is explicit, or system dependencies are complete.
diff --git a/INSTALL.md b/INSTALL.md
index 17e0088..298378d 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -1,4 +1,4 @@
-# Installing ZUPT 5.2.7
+# Installing ZUPT 5.2.8
 
 This guide covers the ZUPT command-line program and the optional Python GUI.
 The canonical source repository is
@@ -30,16 +30,25 @@ archive format, cryptography, codec, and SDK ABI are unchanged. The immutable
 The immutable `v5.2.6` candidate was not promoted after run `33442264243`
 recorded 13 successful jobs and two native failures: unused x86 SHA-NI helper
 declarations on macOS arm64 under `-Werror`, and early Windows abortion while
-argv-transcoding a safe UTF-8 fixture. Version 5.2.7 corrects those test-harness
-boundaries, but still requires fresh gates. Do not treat any prior candidate's
-artifacts or evidence as 5.2.7 packages or validation.
+argv-transcoding a safe UTF-8 fixture. Version 5.2.7 corrected those boundaries
+but was not promoted after exact-tag run `33445470664`: 13 jobs succeeded,
+macOS failed because its filesystem rejected the raw-C1 filename fixture with
+`EILSEQ`, and Windows was cancelled after the hosted job stalled in `make
+check`; a MinGW/Wine reproduction isolated the cause to the non-console
+password-prompt test entering `_getch`. Version 5.2.8 makes both
+fixtures portable, hardens the three CodeQL High path-race boundaries described
+in the security documents, and adds `sdk-test` to release and hosted Linux
+gates. It still requires fresh exact-version validation. Do not treat any prior
+candidate's artifacts or evidence as 5.2.8 packages or validation.
 
-The 5.2.7 package set eligible for promotion after each target gate succeeds is:
+The 5.2.8 package set eligible for promotion after each target gate succeeds is
+exactly these 13 assets:
 
 | Component | Gated artifacts |
 |---|---|
-| CLI | `zupt-5.2.7.tar.gz`, `zupt_5.2.7_amd64.deb`, openSUSE x86_64 binary/source RPMs, `zupt-5.2.7-linux-x86_64.tar.xz`, `zupt-5.2.7-windows-x86_64.zip`, and `ZUPT-5.2.7-macOS-*.dmg` |
-| GUI | `zupt-gui_5.2.7_all.deb`, `zupt-gui-5.2.7-1.noarch.rpm`, `zupt-gui-5.2.7-1.src.rpm`, and `zupt-gui-5.2.7-portable.zip` |
+| Source and checksums | `zupt-5.2.8.tar.gz`, `zupt-5.2.8.tar.gz.sha256`, and `SHA256SUMS` |
+| CLI | `zupt_5.2.8_amd64.deb`, `zupt-5.2.8-0.x86_64.rpm`, `zupt-5.2.8-0.src.rpm`, `zupt-5.2.8-linux-x86_64.tar.xz`, `zupt-5.2.8-windows-x86_64.zip`, and exactly one `ZUPT-5.2.8-macOS-{x86_64\|arm64}.dmg` |
+| GUI | `zupt-gui_5.2.8_all.deb`, `zupt-gui-5.2.8-1.noarch.rpm`, `zupt-gui-5.2.8-1.src.rpm`, and `zupt-gui-5.2.8-portable.zip` |
 
 The GUI packages require the matching `zupt` CLI package and must pass exact
 payload/dependency checks plus an installed off-screen GUI/CLI integration
@@ -47,7 +56,7 @@ test. The source-only portable GUI ZIP bundles launchers, notices, and GUI
 source, but not Python, Qt, or the CLI. The Linux tar.xz carries the tested CLI
 beside the complete public license/notice payload. AppImage, AppDir, Flatpak
 bundles, GUI platform installers, and bare Linux/Windows executables are not
-promoted for 5.2.7. The Windows ZIP and macOS DMG contain the CLI only. Exact
+promoted for 5.2.8. The Windows ZIP and macOS DMG contain the CLI only. Exact
 target boundaries are listed in `README.md`.
 The release's `SHA256SUMS` and validation notes, not the mere presence of a
 download link, identify an artifact that completed its gate.
@@ -84,7 +93,7 @@ sudo pacman -S base-devel gzip
 ```
 
 Package names can differ by distribution release. These commands are examples,
-not a statement that 5.2.7 has been accepted into each distribution repository.
+not a statement that 5.2.8 has been accepted into each distribution repository.
 
 ## Build and test from source
 
@@ -104,7 +113,7 @@ From a release archive, run the scanner as follows before extraction or from a
 trusted checkout after download:
 
 ```sh
-scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
+scripts/check-source-only.sh --archive /path/to/zupt-5.2.8.tar.gz
 ```
 
 The default build provides the native password, ML-KEM-768 + X25519 hybrid
diff --git a/README.md b/README.md
index 3d62ca2..252a1c4 100644
--- a/README.md
+++ b/README.md
@@ -1,32 +1,56 @@
-# ZUPT 5.2.7
+# ZUPT 5.2.8
 
 ZUPT is a command-line backup archiver written in C11. It combines the
 bundled VaptVupt compression codec with authenticated AES-256-CTR +
 HMAC-SHA256 encryption, native ML-KEM-768/X25519 hybrid encryption, archive
 integrity checks, multithreaded operation, and a Python/Qt graphical frontend.
 
-Version 5.2.7 corrects two test-harness portability defects exposed after the
-immutable `v5.2.6` tag. Exact-tag GitHub Actions run `33442264243` completed 13
-jobs successfully, but the native macOS job failed because x86 SHA-NI test
-helper declarations were unused on arm64 under `-Werror`, and the native
-Windows job aborted while argv transcoding a safe UTF-8 fixture before its
-intended assertions. No 5.2.6 assets were promoted. These are release/test
-integration corrections; they do not change the archive format, cryptography,
-bundled codec, or SDK ABI. No v5.2.6 evidence transfers automatically to
-v5.2.7.
+Version 5.2.8 closes three CodeQL High path-race findings: SDK key copies now
+publish atomically through an already-open private object, POSIX disk restore
+classifies and retains the descriptor it actually opened, and benchmark cleanup
+traverses only pinned descriptors or handles without following links or Windows
+reparse points. It also makes the raw-C1 scanner fixture explicitly skip a
+filesystem that rejects creation with `EILSEQ`, and brings `sdk-test` into the
+release and hosted Linux gates. Windows password prompts now reject redirected
+input before entering `_getch` and treat console EOF as an error. These
+corrections do not change archive format v1.6, cryptography, the bundled codec
+release, or the SDK ABI.
+
+The predecessor `v5.2.7` tag is immutable and was not promoted. Exact-tag run
+`33445470664` concluded `cancelled` at `2026-08-31T23:11:19Z`, with 13
+successful jobs, a macOS raw-C1/EILSEQ fixture failure, and a cancelled Windows
+job. The hosted Windows job stalled in `make check`; a MinGW/Wine reproduction
+attributed the stall to a non-console password prompt entering `_getch`. No
+v5.2.7 evidence transfers automatically to v5.2.8.
 
 Version 5.2.2 restored the original ZUPT product name and the `zupt` command.
 The `.zupt` archive extension, format v1.6, magic bytes, codec identifiers, and
 SDK ABI remain unchanged. An optional `vaptvupt` command alias may be provided
 for scripts written against versions 3.0.0 through 5.2.1.
 
-## Corrective changes in 5.2.7
+## Corrective changes in 5.2.8
 
-The SHA-NI regression now keeps x86-only helper declarations out of unsupported
+SDK key saves use atomic descriptor/handle-backed publication and preserve the
+requested private/public modes without reopening the destination. Disk restore
+opens a POSIX target once before its type, identity, and device-capacity
+decisions, and benchmark cleanup is descriptor-relative on POSIX and
+handle/reparse-point aware on Windows. The live-workspace symlink regression,
+SDK link-target/mode regression, static path-race guards, portable raw-C1
+fixture, native redirected-prompt regression, and `sdk-test` CI step cover
+these boundaries. All current release paths move to 5.2.8 and require fresh
+exact-tag hosted CI, package,
+native-platform, source-only, checksum, OBS, and promotion evidence.
+
+## Corrective changes introduced in 5.2.7
+
+The SHA-NI regression keeps x86-only helper declarations out of unsupported
 arm64 builds, and the safe UTF-8 Windows fixture crosses the argv boundary in a
-byte-stable representation. All current release paths move to 5.2.7 and require
-fresh exact-tag hosted CI, package, native-platform, source-only, checksum, OBS,
-and promotion evidence. The `v5.2.6` tag remains immutable and unpromoted.
+byte-stable representation. Those test-harness changes did not alter the
+archive format, cryptography, codec, or SDK ABI. Exact-tag run `33445470664`
+subsequently exposed the separate macOS raw-C1/EILSEQ fixture failure; Windows
+was cancelled after the hosted job stalled in `make check`; MinGW/Wine then
+isolated the stall to a non-console password prompt entering `_getch`. The run recorded 13 successful jobs, one
+failure, and one cancellation; v5.2.7 remained unpromoted.
 
 ## Corrective changes introduced in 5.2.6
 
@@ -151,9 +175,9 @@ users. Those assets must be built from the tagged source, tested on their target
 environment, and kept outside Git and the source archive. A format that was not
 built and tested is not presented as supported.
 
-## 5.2.7 release artifacts
+## 5.2.8 release artifacts
 
-The 5.2.7 release workflow is defined to produce the following files only after
+The 5.2.8 release workflow is defined to produce exactly the following 13 files only after
 the corresponding target gate succeeds. `SHA256SUMS` records the exact promoted
 filenames and digests. The release notes identify the tested commit and the
 manually dispatched CI run; that run's job definitions and logs are the runtime
@@ -162,23 +186,26 @@ skips. This table is not a substitute for that evidence.
 
 | Format | Intended target and validation boundary |
 | --- | --- |
-| `zupt-5.2.7.tar.gz` | Reproducible, source-only archive; scanned twice-built input plus SHA-256. |
-| `zupt_5.2.7_amd64.deb` | Ubuntu 24.04 amd64 package; install, functional round trip, and uninstall gate. |
-| `zupt-5.2.7-*.x86_64.rpm` and `.src.rpm` | openSUSE Tumbleweed x86_64 source/binary RPM gate; package inspection, install, round trip, and uninstall. |
-| `zupt-5.2.7-linux-x86_64.tar.xz` | Linux x86_64 CLI plus the complete public license/notice payload; dependency allowlist and extracted-package functional gate. |
-| `zupt-gui_5.2.7_all.deb` | Architecture-independent Python/Qt GUI package; exact dependency/payload checks plus installed off-screen GUI/CLI integration gate. |
-| `zupt-gui-5.2.7-1.noarch.rpm` | Architecture-independent Python/Qt GUI RPM; package inspection plus installed off-screen GUI/CLI integration gate. |
-| `zupt-gui-5.2.7-1.src.rpm` | Source RPM corresponding exactly to the gated noarch GUI RPM. |
-| `zupt-gui-5.2.7-portable.zip` | Source-only GUI and launchers with licenses/provenance; source scan, exact member allowlist, and extracted off-screen GUI/CLI gate. |
-| `zupt-5.2.7-windows-x86_64.zip` | Native Windows x86_64 executable with notices; extracted-ZIP round-trip gate. |
-| `ZUPT-5.2.7-macOS-*.dmg` | Native macOS image; mounted packaged executable round-trip gate, with the actual architecture in the filename. |
+| `zupt-5.2.8.tar.gz` | Reproducible, source-only archive; scanned twice-built input plus SHA-256. |
+| `zupt-5.2.8.tar.gz.sha256` | SHA-256 sidecar for the reproducible source archive. |
+| `zupt_5.2.8_amd64.deb` | Ubuntu 24.04 amd64 package; install, functional round trip, and uninstall gate. |
+| `zupt-5.2.8-0.x86_64.rpm` | openSUSE Tumbleweed x86_64 binary RPM; package inspection, install, round trip, and uninstall gate. |
+| `zupt-5.2.8-0.src.rpm` | Source RPM corresponding exactly to the gated openSUSE binary RPM. |
+| `zupt-5.2.8-linux-x86_64.tar.xz` | Linux x86_64 CLI plus the complete public license/notice payload; dependency allowlist and extracted-package functional gate. |
+| `zupt-gui_5.2.8_all.deb` | Architecture-independent Python/Qt GUI package; exact dependency/payload checks plus installed off-screen GUI/CLI integration gate. |
+| `zupt-gui-5.2.8-1.noarch.rpm` | Architecture-independent Python/Qt GUI RPM; package inspection plus installed off-screen GUI/CLI integration gate. |
+| `zupt-gui-5.2.8-1.src.rpm` | Source RPM corresponding exactly to the gated noarch GUI RPM. |
+| `zupt-gui-5.2.8-portable.zip` | Source-only GUI and launchers with licenses/provenance; source scan, exact member allowlist, and extracted off-screen GUI/CLI gate. |
+| `zupt-5.2.8-windows-x86_64.zip` | Native Windows x86_64 executable with notices; extracted-ZIP round-trip gate. |
+| Exactly one `ZUPT-5.2.8-macOS-{x86_64\|arm64}.dmg` | Native macOS image; mounted packaged executable round-trip gate, with the actual runner architecture in the filename. |
+| `SHA256SUMS` | Deterministic manifest covering the other 12 promoted files. |
 
 An asset absent from the release was not promoted through its mandatory gate.
 Do not infer support for another distribution release, OS version, CPU
 architecture, raw UNC/SMB destination, or package manager from a similarly
 named file. Binary assets are release outputs, never source-build inputs.
 
-No AppImage is promised for 5.2.7. The inspected upstream type-2 runtime lacked
+No AppImage is promised for 5.2.8. The inspected upstream type-2 runtime lacked
 a complete notice/source-relink handoff for every statically linked component,
 so redistributing it would not meet this release's provenance gate. AppDir and
 Flatpak bundles and GUI platform installers are likewise outside the promoted
@@ -208,8 +235,8 @@ bash tests/test_source_only.sh
 For a tag or an existing source archive:
 
 ~~~sh
-bash scripts/check-source-only.sh --tag v5.2.7
-bash scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
+bash scripts/check-source-only.sh --tag v5.2.8
+bash scripts/check-source-only.sh --archive /path/to/zupt-5.2.8.tar.gz
 ~~~
 
 Unknown `.bin` files fail the scan. A necessary binary data fixture may be
@@ -313,6 +340,7 @@ The principal source-only gates are:
 ~~~sh
 make WITH_SDK=0 WITH_PQBOX=0 check
 make WITH_SDK=0 WITH_PQBOX=0 test-all
+make sdk-test
 make test-asan
 make test-asan-run
 make audit-licenses
@@ -345,7 +373,7 @@ sanitizer-detected crash. An earlier off-screen GUI smoke run remains supporting
 evidence rather than an exact-candidate package result.
 
 Those results are historical upstream self-audit evidence, not independent
-certification and not 5.2.7 results. Post-tag CI integration failures prevented
+certification and not 5.2.8 results. Post-tag CI integration failures prevented
 5.2.2 promotion. The immutable 5.2.3 candidate was also not promoted because its
 source-policy test assumed LF for a `.bat` checkout that correctly used CRLF.
 The immutable v5.2.4 candidate then recorded 12 successful jobs in exact-tag CI
@@ -353,20 +381,25 @@ run `33431386002`; the sole openSUSE service-harness job failed because the
 standalone executor did not enter its service directory, so dependent Windows
 and macOS jobs were skipped. A local Tumbleweed reproduction proved the explicit
 tag ref and corrected working-directory contract, but neither that reproduction
-nor the successful v5.2.4 jobs are v5.2.7 evidence. The immutable v5.2.5
+nor the successful v5.2.4 jobs are v5.2.8 evidence. The immutable v5.2.5
 candidate was not promoted after exact-tag GitHub Actions run `33434986357`:
 13 jobs succeeded, but the native Windows hostile-path fixture and macOS
 build/check gate failed. Their 5.2.6 corrections were followed by exact-tag run
 `33442264243`, which also completed 13 jobs successfully but failed native
 macOS on arm64-unused SHA-NI helper declarations under `-Werror` and native
 Windows during safe UTF-8 fixture argv transcoding. The immutable v5.2.6 tag was
-not promoted. The exact 5.2.7 candidate must repeat all required gates. Native Windows and macOS,
+not promoted. The immutable v5.2.7 tag was also not promoted: exact-tag run
+`33445470664` reached the macOS raw-C1 filename-creation failure with `EILSEQ`,
+recorded 13 successful jobs, and cancelled Windows after the hosted job stalled
+in `make check`; a MinGW/Wine reproduction isolated the stall to
+`test --password-prompt ... </dev/null` entering `_getch`. The
+exact 5.2.8 candidate must repeat all required gates. Native Windows and macOS,
 hosted GitHub CI/release promotion, authenticated OBS, and resolution of the
 openSUSE automatic `debugsource` rpmlint `no-binary`
 finding remain pending until recorded otherwise. Unexecuted gates are `SKIP`,
 never `PASS`.
 
-On Windows, 5.2.7 scopes output handling to normal local Win32 paths. A MinGW
+On Windows, 5.2.8 scopes output handling to normal local Win32 paths. A MinGW
 cross-build or Wine run is not native-Windows evidence; the `windows-latest`
 package job, including its Unicode round trip, remains a mandatory publication
 gate. Win32 extended-length and device-namespace paths, raw UNC output roots
@@ -388,7 +421,7 @@ downgrading authentication of header and footer metadata.
 `disk restore`, and exists only to recover a known, trusted archive created
 before AIT was introduced. Do not use that override for an archive from
 untrusted or attacker-writable storage; verify and migrate the recovered data to
-a newly created 5.2.7 archive. Compression and disk backup never create a
+a newly created 5.2.8 archive. Compression and disk backup never create a
 no-AIT archive.
 
 `info` is deliberately different: it reports unauthenticated framing metadata,
@@ -406,7 +439,7 @@ lists, tests, extracts, and restores it byte-exact. The full local Linux gate
 passed on commit `ff99770`. This is not a claim that a 5.2.1 reader understands every new
 flag-gated 5.2.2 encoding or that every historical combination was tested.
 
-The candidate commands and outcome fields for 5.2.7 are maintained in the
+The candidate commands and outcome fields for 5.2.8 are maintained in the
 release handoff and
 [packaging/opensuse/README.md](packaging/opensuse/README.md). They must be
 updated from the final release candidate before tagging. No architecture or
@@ -418,9 +451,9 @@ Generate the reproducible source archive outside the repository:
 
 ~~~sh
 make dist
-sha256sum /tmp/zupt-5.2.7.tar.gz
+sha256sum /tmp/zupt-5.2.8.tar.gz
 bash scripts/check-source-only.sh \
-    --archive /tmp/zupt-5.2.7.tar.gz
+    --archive /tmp/zupt-5.2.8.tar.gz
 ~~~
 
 Archive ordering, ownership and timestamps are normalized. The default epoch is
@@ -436,7 +469,7 @@ final digest before the tag is published.
 ## openSUSE and OBS
 
 The maintained upstream recipe is in packaging/opensuse. It is prepared for an
-immutable v5.2.7 tag, disables submodules and Git LFS, builds with
+immutable v5.2.8 tag, disables submodules and Git LFS, builds with
 WITH_SDK=0 WITH_PQBOX=0, runs real checks, and installs without the renamed-era
 `vaptvupt` alias.
 
@@ -479,7 +512,7 @@ The optional GUI is under `gui/`. It invokes the `zupt` CLI and needs Python 3
 plus PySide6 or PyQt6. GUI image assets are data files whose purpose,
 provenance and license are recorded in [gui/assets/README.md](gui/assets/README.md).
 The integrated source and lightweight consistency checks do not constitute a
-target-native audit of every historical GUI format. The 5.2.7 artifact promise
+target-native audit of every historical GUI format. The 5.2.8 artifact promise
 is limited to the gated GUI DEB, noarch/source RPM, and source-only portable ZIP
 listed above; AppImage, AppDir, Flatpak bundles, and platform GUI installers
 remain excluded.
@@ -489,13 +522,14 @@ remain excluded.
 Cristian Cezar Moisés is the creator and current upstream maintainer of ZUPT and
 the author of the current upstream source, build, test, documentation, and
 packaging changes, including the 5.2.2 baseline and corrective
-5.2.3/5.2.4/5.2.5/5.2.6/5.2.7 work.
+5.2.3/5.2.4/5.2.5/5.2.6/5.2.7/5.2.8 work.
 
 Alessandro de Oliveira Faria (Cabelo) is credited as the openSUSE collaborator
 and downstream package maintainer. He reviews the handoff, commits it in the
 OBS project he maintains, and may make the additional openSUSE-side adjustments
 he considers necessary. That downstream role is not attribution of ZUPT source
-authorship or of the upstream 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, or 5.2.7 changes.
+authorship or of the upstream 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, or
+5.2.8 changes.
 
 ## License
 
diff --git a/SECURITY.md b/SECURITY.md
index aa2118e..e227e39 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,4 +1,4 @@
-# Security Policy — ZUPT 5.2.7
+# Security Policy — ZUPT 5.2.8
 
 ## Reporting vulnerabilities
 
@@ -49,6 +49,9 @@ On POSIX terminals, the explicit prompt saves terminal state and installs
 signal-aware cleanup so a handled interruption restores echo and other changed
 settings before termination. This behavior is covered by a PTY regression and
 passed in the full local Linux gate for commit `ff99770`.
+On Windows, the prompt requires a real console input handle before entering
+`_getch`; redirected input and console EOF fail instead of blocking a native
+release gate.
 
 ## Native key files
 
@@ -66,7 +69,7 @@ partially accepted.
 
 ### Optional integrations
 
-The 5.2.7 default is `WITH_SDK=0 WITH_PQBOX=0`:
+The 5.2.8 default is `WITH_SDK=0 WITH_PQBOX=0`:
 
 - `WITH_SDK=1` enables libvuptsdk-backed features, including the SDK PQ mode
   and Argon2id support, using a separately installed system development package.
@@ -78,6 +81,13 @@ downloads it. A missing requested dependency is a build error. Security
 properties of these optional libraries are outside the source-only CLI audit
 unless their exact source package and version are reviewed separately.
 
+The in-repository SDK adapter saves copied keys through the core atomic output
+publisher. POSIX permissions are applied to its already-open temporary
+descriptor, and publication replaces only the requested directory entry after
+copy/close checks succeed. `make sdk-test` exercises private/public modes and
+preservation of pre-existing symlink and hardlink targets. This covers the
+adapter boundary; it does not certify the separately installed SDK library.
+
 ## Cryptographic construction
 
 Encrypted blocks use a fresh 128-bit nonce, AES-256-CTR, and HMAC-SHA256. The
@@ -133,7 +143,7 @@ can compromise archives encrypted to it.
 
 ## Constant-time and side-channel scope
 
-Portable C is the 5.2.7 default. Sensitive comparisons and selections use
+Portable C is the 5.2.8 default. Sensitive comparisons and selections use
 branchless helpers, but generated machine-code behavior remains dependent on
 the compiler and platform. This is not a formal whole-program constant-time
 claim. The C AES implementation uses table lookups and is unsuitable for a
@@ -190,21 +200,37 @@ appropriate. Extract untrusted archives as a dedicated unprivileged user into
 a new empty directory, inspect the result before moving it, and apply OS
 sandboxing where available.
 
+Benchmark workspaces are random private directories. POSIX cleanup opens each
+directory component without following links and removes entries relative to
+pinned descriptors. Windows retains no-delete-sharing handles for the resolved
+ancestors and refuses reparse-point recursion. After emptying a directory, it
+reopens that entry relative to the pinned parent, verifies the volume and file
+index against the traversal handle, and marks only the identity-checked handle
+for deletion. An injected link is removed as a link rather than traversed to
+its target.
+
 Disk restore has a separate destructive-device boundary. It measures and
 copies the compacted archive to an exclusively created, auto-deleted private
-scratch file before opening the target, then performs both validation and
-restoration from that same snapshot. `ZUPT_TMPDIR` is an explicit existing
-scratch-directory override; an invalid override fails without fallback. Raw
-block devices are opened only after their capacity has been determined and
-shown sufficient on supported Linux, macOS, or FreeBSD interfaces. Unknown
-device capacity, an undersized device, a source/destination identity match, or
-a snapshot failure stops before the first target write. These checks do not
+scratch file, then performs validation and restoration from that same snapshot.
+`ZUPT_TMPDIR` is an explicit existing scratch-directory override; an invalid
+override fails without fallback. On POSIX, the target is opened once without
+truncation or final-symlink following, classified with `fstat`, and—when it is
+a supported Linux, macOS, or FreeBSD raw block device—the same descriptor is
+retained through capacity checks and writes. Regular files continue through
+atomic publication. Unknown device capacity, an undersized device, a
+source/destination identity match, or a snapshot failure stops before the
+first target write. These checks do not
 make raw-device restore non-destructive: verify both operands and keep recovery
 media before proceeding.
 
+These changes address the three 5.2.8 CodeQL High reports: #5 at SDK key
+publication, #6 at POSIX disk-target classification/use, and #7 at benchmark
+workspace cleanup. The regressions and source review are project evidence, not
+an independent certification or a claim that exact-v5.2.8 CI has passed.
+
 The Windows handle-relative implementation is scoped to normal local Win32
 paths. Win32 extended-length and device-namespace paths, raw UNC output roots,
-and mapped/network-drive output are not supported in 5.2.7. Cross-build and
+and mapped/network-drive output are not supported in 5.2.8. Cross-build and
 Wine results are not native-Windows evidence; the `windows-latest` package gate
 must pass its Unicode round trip before Windows assets are published. Restore
 to a normal local directory first and move verified output to network storage
@@ -247,7 +273,7 @@ shared/static library, or distribution package. Audit them with:
 
 ```sh
 scripts/check-source-only.sh
-scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
+scripts/check-source-only.sh --archive /path/to/zupt-5.2.8.tar.gz
 ```
 
 Nested archive inspection is required to enforce bounded recursion, member
@@ -257,13 +283,13 @@ limit violations. On commit `ff99770`, the source-only scanner suite passed
 
 DEB, binary RPM, SRPM, notice-bearing Linux tar.xz, source-only portable GUI
 ZIP, Windows ZIP, and macOS DMG release assets are separate outputs. An
-AppImage is not promoted for 5.2.7. A bare Linux or Windows executable is also
+AppImage is not promoted for 5.2.8. A bare Linux or Windows executable is also
 excluded; executables are distributed only inside their notice-bearing
 archives. Trust an artifact only when its exact format has a recorded build,
 content/metadata inspection, extracted or installed smoke test, and applicable
 archive round trip. Never treat an unexecuted platform as passing.
 
-The gated 5.2.7 set is the CLI package/archive set plus the exact GUI DEB,
+The gated 5.2.8 set is the CLI package/archive set plus the exact GUI DEB,
 noarch/source RPM, and source-only portable ZIP documented in the README. The
 portable GUI ZIP contains no compiled runtime and is scanned as source before
 and after extraction. Other GUI packages, AppImage, AppDir and Flatpak bundles,
@@ -280,6 +306,7 @@ make -j"$(getconf _NPROCESSORS_ONLN 2>/dev/null || printf 1)" \
   WITH_SDK=0 WITH_PQBOX=0 V=1
 make WITH_SDK=0 WITH_PQBOX=0 check
 make WITH_SDK=0 WITH_PQBOX=0 test-all
+make sdk-test
 ```
 
 Where the compiler supports them, run the sanitizer target separately:
@@ -303,7 +330,7 @@ result.
 
 Post-tag CI integration failures prevented 5.2.2 promotion. Those upstream
 self-audit results are not independent certification and do not transfer to
-5.2.7. The immutable 5.2.3 candidate was not promoted because its source-policy
+5.2.8. The immutable 5.2.3 candidate was not promoted because its source-policy
 test assumed LF for a Windows `.bat` file checked out as CRLF. The immutable
 v5.2.4 candidate was not promoted after exact-tag GitHub Actions run
 `33431386002`: 12 jobs succeeded, the sole openSUSE job failed in its
@@ -313,7 +340,7 @@ Tumbleweed reproduction confirmed that `refs/tags/v5.2.4` is valid and that
 `os.chdir(service_dir)` lets `obs_scm`, `tar`, and `recompress` complete with a
 source-scanned archive. This was a release/test integration defect, not a
 product, archive, cryptographic, codec, or SDK ABI change, and its evidence does
-not transfer automatically to 5.2.7. The immutable v5.2.5 candidate was also
+not transfer automatically to 5.2.8. The immutable v5.2.5 candidate was also
 not promoted: exact-tag GitHub Actions run `33434986357` recorded 13 successful
 jobs and failed native Windows/macOS jobs. Its Windows fixture-byte and macOS
 secure-wipe/Bash 3.2 defects were corrected for 5.2.6. A targeted clean-clone
@@ -324,8 +351,15 @@ then completed 13 jobs successfully but failed native macOS because x86 SHA-NI
 test helpers were unused on arm64 under `-Werror`, and failed native Windows
 when argv transcoding aborted the safe UTF-8 fixture. Those are test-harness
 integration defects, not product, archive, cryptographic, codec, or SDK ABI
-changes; v5.2.6 remained unpromoted. The exact 5.2.7 candidate must
-repeat the required suite. Native Windows and macOS, hosted GitHub CI/release
+changes; v5.2.6 remained unpromoted. The exact 5.2.8 candidate must
+repeat the required suite. The immutable v5.2.7 candidate was likewise not
+promoted: exact-tag run `33445470664` concluded `cancelled` at
+`2026-08-31T23:11:19Z`, with 13 successful jobs, one failed macOS job after
+raw-C1 fixture creation returned `EILSEQ`, and one cancelled Windows job after
+the hosted job stalled in `make check`; a MinGW/Wine reproduction isolated the
+cause to a redirected password prompt entering `_getch`. Version 5.2.8 makes both test boundaries fail
+or skip without hanging, but this is not exact-candidate evidence. Native
+Windows and macOS, hosted GitHub CI/release
 promotion, authenticated OBS, and the openSUSE automatic `debugsource` rpmlint
 `no-binary` finding remain pending until recorded otherwise. An unavailable or
 unexecuted environment remains `SKIP`, never `PASS`.
diff --git a/THIRD-PARTY-NOTICES.md b/THIRD-PARTY-NOTICES.md
index 0d8091d..025f76d 100644
--- a/THIRD-PARTY-NOTICES.md
+++ b/THIRD-PARTY-NOTICES.md
@@ -159,7 +159,7 @@ grant attached to their unchanged Git blobs, are recorded in
 
 ## AppImage type-2 runtime
 
-No AppImage is a promised or promoted 5.2.7 release asset. The upstream
+No AppImage is a promised or promoted 5.2.8 release asset. The upstream
 type-2 runtime inspected during the 5.2.2 review statically linked musl, libfuse,
 squashfuse, zstd, zlib, and mimalloc, but its own license notice did not list
 mimalloc and the available release inputs did not provide a complete
@@ -171,7 +171,7 @@ no network input and requires the operator to supply both a locally verified
 runtime and `APPIMAGE_RUNTIME_COMPLIANCE_FILE`, containing the license notices,
 source correspondence or offer, and relink information applicable to those
 exact runtime bytes. An artifact produced independently with that helper is
-not covered by the 5.2.7 upstream release gates.
+not covered by the 5.2.8 upstream release gates.
 
 ## Reporting attribution issues
 
diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md
index 4d45192..413269b 100644
--- a/THREAT_MODEL.md
+++ b/THREAT_MODEL.md
@@ -1,4 +1,4 @@
-# ZUPT 5.2.7 threat model
+# ZUPT 5.2.8 threat model
 
 This document defines the security boundary of the ZUPT archive tool. It is
 not a certification, a guarantee against every hostile input, or a substitute
@@ -17,7 +17,7 @@ plausibly deniable.
 
 ## Baseline considered here
 
-The upstream baseline is built from the 5.2.7 source with:
+The upstream baseline is built from the 5.2.8 source with:
 
 ```sh
 make WITH_SDK=0 WITH_PQBOX=0
@@ -88,6 +88,8 @@ duplicates but shares the underlying stream/offset and may buffer beyond the
 line, so callers should provide a descriptor dedicated to that password read.
 On POSIX, handled prompt interruptions restore the saved terminal state before
 termination; an exact-candidate PTY regression is required before release.
+On Windows, a prompt is entered only for a real console input handle;
+redirected input and console EOF fail instead of blocking in `_getch`.
 
 Native private-key generation uses no-replace creation with POSIX mode `0600`
 or a Windows current-user-only DACL. A failed write, flush/fsync, or close leaves
@@ -99,6 +101,13 @@ and public/private role validation. This prevents role confusion and
 partial/trailing-key acceptance; it does not protect a key after endpoint or
 account compromise.
 
+When the optional system SDK is enabled, the in-repository adapter copies a key
+through the core atomic publisher, applies POSIX mode through the already-open
+temporary descriptor, and publishes only after copy/close checks succeed. Its
+`sdk-test` regression preserves existing symlink/hardlink targets and verifies
+private/public modes. This narrows the adapter boundary; it does not extend the
+baseline assessment to the external SDK implementation.
+
 ### Encrypted archive integrity
 
 Current encrypted archives authenticate ciphertext, canonical block metadata,
@@ -175,22 +184,37 @@ temporary through its descriptor or handle. These controls reduce traversal,
 link, race, and partial-output risks, but do not establish that no parser or
 filesystem bug can exist.
 
-The Windows handle-relative boundary in 5.2.7 covers normal local Win32 paths.
+Benchmark scratch data lives in a random private directory. Cleanup resolves
+POSIX components without following links and deletes relative to pinned
+descriptors. On Windows it retains no-delete-sharing ancestor handles, refuses
+reparse-point recursion, then reopens each emptied directory relative to its
+pinned parent and verifies its filesystem identity before handle-based
+deletion. An attacker who inserts a link can cause cleanup failure, but the
+cleanup must not traverse to the link target.
+
+The Windows handle-relative boundary in 5.2.8 covers normal local Win32 paths.
 Win32 extended-length and device-namespace paths, raw UNC output roots, and
 mapped/network-drive output are not supported. Cross-build and Wine results are
 not a substitute for the required native `windows-latest` Unicode package
 gate. Restore locally before moving verified output to network storage.
 
 Disk restore copies the measured compacted archive into one exclusively
-created, auto-deleted scratch file before it opens a destructive destination.
-Preflight and restoration consume that same open snapshot. An explicit
-`ZUPT_TMPDIR` selects an existing scratch directory; failure there does not
-fall back to consuming the mutable source pathname. On supported Linux, macOS,
-and FreeBSD interfaces, a raw block-device target is rejected before writing if
-its capacity is unknown or smaller than the image. These controls reduce source
-exchange and immediate overrun risk but do not protect against a compromised
-kernel/device, a wrongly selected sufficiently large device, power loss, or
-hardware failure.
+created, auto-deleted scratch file. Preflight and restoration consume that same
+open snapshot. An explicit `ZUPT_TMPDIR` selects an existing scratch directory;
+failure there does not fall back to consuming the mutable source pathname. On
+POSIX, the destination is opened once without truncation or final-symlink
+following, classified with `fstat`, and the same raw-device descriptor is
+retained for supported Linux, macOS, and FreeBSD capacity checks and writes.
+Regular-file output retains atomic publication. A raw target is rejected before
+writing if its capacity is unknown or smaller than the image. These controls
+reduce source exchange, target exchange, and immediate overrun risk but do not
+protect against a compromised kernel/device, a wrongly selected sufficiently
+large device, power loss, or hardware failure.
+
+The SDK publication, POSIX disk-target, and benchmark-cleanup changes address
+CodeQL High #5, #6, and #7 respectively. Their source review and regressions
+are project evidence, not independent certification or proof that the exact
+5.2.8 hosted/native gates passed.
 
 For an untrusted archive:
 
@@ -250,9 +274,9 @@ tagged source. Each artifact extends the trust boundary to its builder,
 toolchain, runner image, and packaging scripts. Treat it as validated only when
 the exact target has a recorded build, content/package inspection, extracted or
 installed smoke test, and applicable archive round trip. An AppImage is not
-promoted for 5.2.7; bare Linux and Windows executables are also excluded.
+promoted for 5.2.8; bare Linux and Windows executables are also excluded.
 
-For 5.2.7, that gated artifact scope covers the CLI files plus the exact GUI
+For 5.2.8, that gated artifact scope covers the CLI files plus the exact GUI
 DEB, noarch/source RPM, and source-only portable ZIP named in the README. The
 portable ZIP contains no compiled runtime and crosses the release boundary only
 after source scans and an exact safe-member check. AppDir and Flatpak bundles
@@ -265,7 +289,7 @@ strict Clang, GCC `-fanalyzer`, the 9/9 tool-enabled static-analysis run,
 ASan/UBSan/LSan, and 1,000 mutation-fuzz iterations passed. Earlier off-screen
 GUI smoke evidence is retained separately. Post-tag CI integration failures
 prevented 5.2.2 promotion. This upstream self-review is not an independent
-certification and is not 5.2.7 evidence. The immutable 5.2.3 candidate was not
+certification and is not 5.2.8 evidence. The immutable 5.2.3 candidate was not
 promoted because its source-policy test assumed LF for a Windows `.bat` checkout
 that correctly used CRLF. The immutable v5.2.4 candidate was not promoted after
 exact-tag GitHub Actions run `33431386002`: 12 jobs succeeded, the sole openSUSE
@@ -275,17 +299,24 @@ Tumbleweed reproduction established that the explicit `refs/tags/v5.2.4`
 revision works and that `os.chdir(service_dir)` completes the source-service
 chain. This narrows the failure to release/test integration; it changes no
 product, archive, cryptographic, codec, or SDK ABI boundary and supplies no
-automatic 5.2.7 evidence. The immutable v5.2.5 candidate was not promoted after
+automatic 5.2.8 evidence. The immutable v5.2.5 candidate was not promoted after
 exact-tag GitHub Actions run `33434986357`: 13 jobs succeeded, but native
 Windows and macOS failed on fixture-byte preservation and Darwin/Bash 3.2
 portability respectively. The corresponding 5.2.6 corrections were followed by
 exact-tag run `33442264243`: 13 jobs succeeded, while native macOS failed on
 x86-only SHA-NI helper declarations unused on arm64 under `-Werror`, and native
 Windows aborted during safe UTF-8 fixture argv transcoding. The v5.2.6 tag was
-not promoted. The corresponding 5.2.7 test-harness corrections do not establish
-their own test result. Hosted GitHub CI and release promotion, native
+not promoted. Version 5.2.7 corrected those two boundaries, but its exact-tag
+run `33445470664` concluded `cancelled` at `2026-08-31T23:11:19Z`, with 13
+successful jobs, one failed macOS job after raw-C1 filename creation returned
+`EILSEQ`, and one cancelled Windows job after the hosted job stalled in `make
+check`; a MinGW/Wine reproduction isolated the cause to a redirected password
+prompt entering `_getch`.
+The corresponding 5.2.8 fixture and prompt corrections do not establish their
+own test result. CI now exercises `sdk-test`, but its inclusion is not a pass.
+Hosted GitHub CI and release promotion, native
 Windows/macOS, authenticated OBS, and the openSUSE automatic `debugsource`
-rpmlint `no-binary` finding remain pending until an exact 5.2.7 candidate
+rpmlint `no-binary` finding remain pending until an exact 5.2.8 candidate
 records them.
 
 ## Historical compatibility notes
@@ -313,7 +344,7 @@ These are historical facts about earlier releases, retained to support recovery:
   combinations remain unclaimed.
 
 Historical test counts in the changelog describe those releases. They do not
-automatically become 5.2.7 results; current outcomes belong in the release
+automatically become 5.2.8 results; current outcomes belong in the release
 validation record, with unavailable environments marked `SKIP`. In particular,
 runs made before the final positional-AAD and mandatory-AIT changes are not
 final release gates for the resulting candidate.
@@ -324,4 +355,4 @@ Email **zupt@riseup.net** with `[security]` in the subject. Include the version,
 platform, impact, and a minimal non-sensitive reproducer. Do not disclose the
 issue publicly until a coordinated timeline has been agreed.
 
-Document version: 5.2.7, 2026-08-31.
+Document version: 5.2.8, 2026-08-31.
diff --git a/doc/zupt-gui.1 b/doc/zupt-gui.1
index 2c37b87..cecb070 100644
--- a/doc/zupt-gui.1
+++ b/doc/zupt-gui.1
@@ -1,6 +1,6 @@
 .\" SPDX-License-Identifier: AGPL-3.0-or-later
 .\" Copyright (c) 2025-2026 Cristian Cezar Moisés
-.TH ZUPT-GUI 1 "2026-08-31" "ZUPT 5.2.7" "User Commands"
+.TH ZUPT-GUI 1 "2026-08-31" "ZUPT 5.2.8" "User Commands"
 .SH NAME
 zupt-gui \- Qt interface for the ZUPT backup utility
 .SH SYNOPSIS
@@ -47,7 +47,7 @@ or
 only when libvuptsdk or libpqvaptvupt is independently reported enabled.
 These two optional integrations are detected separately.
 .PP
-The gated 5.2.7 GUI release set is limited to the architecture-independent DEB,
+The gated 5.2.8 GUI release set is limited to the architecture-independent DEB,
 noarch/source RPM, and source-only portable ZIP named in the project README.
 Package gates require exact checks and installed off-screen GUI/CLI integration.
 The portable ZIP receives source scans, an exact safe-member allowlist, and an
diff --git a/doc/zupt.1 b/doc/zupt.1
index ed48a17..d871e25 100644
--- a/doc/zupt.1
+++ b/doc/zupt.1
@@ -1,6 +1,6 @@
 .\" SPDX-License-Identifier: AGPL-3.0-or-later
 .\" Copyright (c) 2025-2026 Cristian Cezar Moisés
-.TH ZUPT 1 "2026-08-31" "ZUPT 5.2.7" "User Commands"
+.TH ZUPT 1 "2026-08-31" "ZUPT 5.2.8" "User Commands"
 .
 .SH NAME
 zupt \- source-built backup compression and authenticated-encryption utility
@@ -89,7 +89,7 @@ Git and the upstream source tarball are source-only. Separately built CLI DEB,
 binary RPM, SRPM, notice-bearing Linux tar.xz, Windows ZIP, and macOS DMG assets
 may be published from the immutable tag only after their target-specific gates
 pass; they never enter Git or the source tarball. An AppImage is not promoted
-for 5.2.7; neither are AppDir/Flatpak bundles, GUI platform installers, or bare
+for 5.2.8; neither are AppDir/Flatpak bundles, GUI platform installers, or bare
 Linux/Windows executables. The Python/Qt frontend remains available as source;
 its gated architecture-independent DEB, noarch/source RPM, and source-only
 portable ZIP are included in the release claim. The portable ZIP contains no
@@ -477,7 +477,7 @@ then traverse below a pinned directory descriptor with no-follow operations.
 Windows builds use handle-relative traversal and
 no-replace publication for normal local Win32 destinations. Extended-length and
 device-namespace paths, raw UNC output roots, and mapped/network-drive output
-are not supported in 5.2.7. Cross-compilation and Wine results are not native
+are not supported in 5.2.8. Cross-compilation and Wine results are not native
 Windows evidence; the native Windows package gate, including its Unicode round
 trip, is separate and mandatory before publication.
 .
@@ -577,7 +577,7 @@ and the encrypted-dedup linear AAD sequence published through 5.2.1. The narrow
 compatibility fixture is an actual v5.2.1 password-encrypted
 DATA/DATA/REF/DATA disk archive stored as hexadecimal text with source and hash
 provenance. The candidate lists, tests, extracts, and restores that fixture
-byte-exact. The exact 5.2.7 candidate must repeat the gate. It does not imply
+byte-exact. The exact 5.2.8 candidate must repeat the gate. It does not imply
 that a 5.2.1 reader
 accepts every new 5.2.2 archive or that every historical encrypted mode was
 retested.
diff --git a/gui/README.md b/gui/README.md
index 1937c1d..378fda5 100644
--- a/gui/README.md
+++ b/gui/README.md
@@ -1,6 +1,6 @@
 # ZUPT GUI
 
-The ZUPT GUI is a Python/Qt front end for the ZUPT 5.2.7 command-line
+The ZUPT GUI is a Python/Qt front end for the ZUPT 5.2.8 command-line
 program. It starts the CLI as a subprocess; compression, archive parsing, and
 cryptography remain in the C program.
 
@@ -83,10 +83,10 @@ operating systems and must be tested on the target system.
 Release pages provide only these GUI artifacts after their separate package and
 installed off-screen GUI/CLI integration gates pass:
 
-- `zupt-gui_5.2.7_all.deb`;
-- `zupt-gui-5.2.7-1.noarch.rpm`;
-- `zupt-gui-5.2.7-1.src.rpm`;
-- `zupt-gui-5.2.7-portable.zip`.
+- `zupt-gui_5.2.8_all.deb`;
+- `zupt-gui-5.2.8-1.noarch.rpm`;
+- `zupt-gui-5.2.8-1.src.rpm`;
+- `zupt-gui-5.2.8-portable.zip`.
 
 The DEB/RPM packages install the Python/Qt source and depend on the matching
 `zupt` CLI package. The portable ZIP contains source, launchers, icons, licenses,
@@ -97,7 +97,7 @@ An absent artifact did not pass its gate and must not be inferred from another
 format's result.
 
 GUI AppImage, AppDir and Flatpak bundles, and Windows/macOS GUI installers are
-not promoted by the upstream 5.2.7 release gates.
+not promoted by the upstream 5.2.8 release gates.
 `packaging/build-gui-appimage.sh` is a downstream-only helper and fails unless
 its operator supplies the exact verified runtime plus a complete
 license/source-relink notice through `APPIMAGE_RUNTIME_COMPLIANCE_FILE`; that
@@ -110,7 +110,7 @@ notices. It fails unless the directory also has non-empty
 `PYTHON-NOTICE.txt`, `PYINSTALLER-NOTICE.txt`, `QT-NOTICE.txt`, and either
 `PYSIDE6-NOTICE.txt` or `PYQT6-NOTICE.txt`. The installer includes that
 directory together with every ZUPT license and notice. This requirement does
-not make the untested GUI installer a 5.2.7 release asset. The promoted Windows
+not make the untested GUI installer a 5.2.8 release asset. The promoted Windows
 ZIP and macOS DMG are CLI-only.
 
 Packaging recipes and scripts under `gui/packaging/` and `packaging/` are build
diff --git a/gui/packaging/deb/control b/gui/packaging/deb/control
index a3632d2..65765c6 100644
--- a/gui/packaging/deb/control
+++ b/gui/packaging/deb/control
@@ -1,9 +1,9 @@
 Package: zupt-gui
-Version: 5.2.7
+Version: 5.2.8
 Section: utils
 Priority: optional
 Architecture: all
-Depends: python3 (>= 3.9), python3-pyqt6 | python3-pyside6.qtwidgets, zupt (= 5.2.7)
+Depends: python3 (>= 3.9), python3-pyqt6 | python3-pyside6.qtwidgets, zupt (= 5.2.8)
 Maintainer: Cristian Cezar Moisés <sac@securityops.co>
 Homepage: https://github.com/cristiancmoises/zupt
 Description: Qt graphical interface for the ZUPT backup utility
diff --git a/gui/packaging/windows/build-windows.bat b/gui/packaging/windows/build-windows.bat
index 544286f..36c23d6 100644
--- a/gui/packaging/windows/build-windows.bat
+++ b/gui/packaging/windows/build-windows.bat
@@ -13,7 +13,7 @@ rem runtime files embedded by this local build.
 setlocal EnableExtensions
 for %%I in ("%~dp0\..\..\..") do set "REPO_ROOT=%%~fI"
 set "VERSION=%~1"
-if not defined VERSION set "VERSION=5.2.7"
+if not defined VERSION set "VERSION=5.2.8"
 if not defined ZUPT_DIST_DIR set "ZUPT_DIST_DIR=%TEMP%\zupt-release"
 if not defined ZUPT_CLI_EXE set "ZUPT_CLI_EXE=%REPO_ROOT%\zupt.exe"
 set "WORK=%TEMP%\zupt-gui-build-%RANDOM%-%RANDOM%"
diff --git a/include/zupt.h b/include/zupt.h
index c9923ab..4136770 100644
--- a/include/zupt.h
+++ b/include/zupt.h
@@ -122,7 +122,8 @@ static inline int zupt_win_mkdir_utf8(const char *path) {
 /* v5.2.5 corrects the OBS service harness cwd; format remains v1.6. */
 /* v5.2.6 corrects native release-gate portability; format remains v1.6. */
 /* v5.2.7 corrects native test-harness portability; format remains v1.6. */
-#define ZUPT_VERSION_STRING "5.2.7"
+/* v5.2.8 hardens three path-race boundaries; format remains v1.6. */
+#define ZUPT_VERSION_STRING "5.2.8"
 /* Vendored codec release (upstream tag) — single source for display strings.
  * The codec's own VV_VERSION_* is its internal API version, not the release. */
 #define ZUPT_CODEC_RELEASE "2.65.3"
diff --git a/install.sh b/install.sh
index 88a8221..d7e22d5 100644
--- a/install.sh
+++ b/install.sh
@@ -6,7 +6,7 @@
 set -Eeuo pipefail
 umask 077
 
-VERSION=${VERSION:-5.2.7}
+VERSION=${VERSION:-5.2.8}
 PREFIX=${PREFIX:-/usr/local}
 
 echo "🔧 Installing ZUPT..."
diff --git a/packaging/aur/PKGBUILD b/packaging/aur/PKGBUILD
index 1f0e406..e833860 100644
--- a/packaging/aur/PKGBUILD
+++ b/packaging/aur/PKGBUILD
@@ -11,7 +11,7 @@
 # Test locally with `makepkg -s` after the release archive is published.
 
 pkgname=zupt
-pkgver=5.2.7
+pkgver=5.2.8
 pkgrel=1
 pkgdesc='Pure-C11 post-quantum backup compression utility (AES-256-CTR + HMAC-SHA256 + ML-KEM-768 + X25519)'
 arch=('x86_64')
@@ -22,7 +22,7 @@ makedepends=('gcc' 'git' 'make')
 checkdepends=('python')
 
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/cristiancmoises/zupt/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
-# Byte-reproducible upstream v5.2.7 source archive.
+# Byte-reproducible upstream v5.2.8 source archive.
 sha256sums=('4db1badbb9a62676176829326b6fd4bab5fe67be6631a7f6d341bdc6c7265c04')
 
 build() {
diff --git a/packaging/debian/changelog b/packaging/debian/changelog
index fcc4b75..cbed093 100644
--- a/packaging/debian/changelog
+++ b/packaging/debian/changelog
@@ -1,3 +1,17 @@
+zupt (5.2.8-1) UNRELEASED; urgency=medium
+
+  * Close CodeQL High path-race findings in SDK key publication, disk-restore
+    target handling, and benchmark workspace cleanup.
+  * Treat a filesystem refusal to create the macOS raw-C1 scanner fixture as
+    an explicit skip; reject redirected Windows prompts before _getch; and run
+    sdk-test in the release and hosted Linux gates.
+  * Preserve immutable, unpromoted v5.2.7 run 33445470664: 13 jobs succeeded,
+    macOS failed the raw-C1 fixture, and Windows was cancelled after the hosted
+    job stalled; a MinGW/Wine reproduction isolated redirected _getch entry.
+    Require fresh 5.2.8 evidence.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Mon, 31 Aug 2026 23:30:00 +0000
+
 zupt (5.2.7-1) UNRELEASED; urgency=medium
 
   * Scope SHA-NI test helpers to supported x86 builds so macOS arm64 strict
diff --git a/packaging/guix/zupt.scm b/packaging/guix/zupt.scm
index 456451a..32e24ad 100644
--- a/packaging/guix/zupt.scm
+++ b/packaging/guix/zupt.scm
@@ -62,7 +62,7 @@
         xcb-util-renderutil xcb-util-wm xcb-util-cursor
         libinput-minimal mtdev libevdev eudev))
 
-(define %zupt-version "5.2.7")
+(define %zupt-version "5.2.8")
 
 (define %zupt-source
   (origin
diff --git a/packaging/homebrew/zupt.rb b/packaging/homebrew/zupt.rb
index 887bccc..bedf037 100644
--- a/packaging/homebrew/zupt.rb
+++ b/packaging/homebrew/zupt.rb
@@ -22,8 +22,8 @@
 class Zupt < Formula
   desc "Post-quantum backup compression utility (ML-KEM-768 + AES-256-CTR + HMAC-SHA256)"
   homepage "https://github.com/cristiancmoises/zupt"
-  url "https://github.com/cristiancmoises/zupt/releases/download/v5.2.7/zupt-5.2.7.tar.gz"
-  version "5.2.7"
+  url "https://github.com/cristiancmoises/zupt/releases/download/v5.2.8/zupt-5.2.8.tar.gz"
+  version "5.2.8"
   sha256 "4db1badbb9a62676176829326b6fd4bab5fe67be6631a7f6d341bdc6c7265c04"
   license all_of: ["AGPL-3.0-or-later", "GPL-3.0-or-later", "BSD-2-Clause", "BSD-3-Clause", "CC0-1.0"]
 
diff --git a/packaging/nix/flake.nix b/packaging/nix/flake.nix
index 5ccfdbf..aba67e8 100644
--- a/packaging/nix/flake.nix
+++ b/packaging/nix/flake.nix
@@ -9,7 +9,7 @@
 #   nix flake check                     # lint the flake
 #
 # To consume from another flake:
-#   inputs.zupt.url = "github:cristiancmoises/zupt/v5.2.7";
+#   inputs.zupt.url = "github:cristiancmoises/zupt/v5.2.8";
 #   ...packages.x86_64-linux.default = inputs.zupt.packages.x86_64-linux.zupt;
 #
 # `make dist` has its own reproducibility gate. This development flake has no
@@ -30,7 +30,7 @@
 
         zupt = pkgs.stdenv.mkDerivation {
           pname = "zupt";
-          version = "5.2.7";
+          version = "5.2.8";
 
           # When publishing, replace this with `fetchurl` against the
           # release tarball. For local development the flake assumes it
diff --git a/packaging/opensuse/README.md b/packaging/opensuse/README.md
index c29f480..1236273 100644
--- a/packaging/opensuse/README.md
+++ b/packaging/opensuse/README.md
@@ -1,4 +1,4 @@
-# ZUPT 5.2.7 for openSUSE Build Service
+# ZUPT 5.2.8 for openSUSE Build Service
 
 This directory is the upstream, source-only OBS recipe for ZUPT. It is a
 handoff for the downstream maintainer; its presence does not mean that the
@@ -10,14 +10,14 @@ changes in this handoff. Alessandro de Oliveira Faria (Cabelo) is credited only
 as the openSUSE collaborator and downstream OBS package maintainer: he reviews
 the handoff, commits it through the portal/project he maintains, and may make
 the openSUSE-side adjustments he considers necessary. This role does not
-attribute upstream code or the 5.2.2/5.2.3/5.2.4/5.2.5/5.2.6/5.2.7 upstream changes to
-Cabelo.
+attribute upstream code or the
+5.2.2/5.2.3/5.2.4/5.2.5/5.2.6/5.2.7/5.2.8 upstream changes to Cabelo.
 
 ## Files and source policy
 
 | File | Purpose |
 |---|---|
-| `_service` | Fetch the immutable `v5.2.7` tag and create `Source0` at build time. |
+| `_service` | Fetch the immutable `v5.2.8` tag and create `Source0` at build time. |
 | `zupt.spec` | Build and test the CLI with optional external system integrations disabled. |
 | `zupt.changes` | openSUSE-format package history. |
 | `source-audit.sh` | Handoff wrapper for the repository scanner; run it from the complete handoff tree. |
@@ -30,11 +30,11 @@ https://github.com/cristiancmoises/zupt.git
 ```
 
 `obs_scm` stores an `.obscpio` plus `.obsinfo`. The `tar` and `recompress`
-services reconstruct `zupt-5.2.7.tar.gz` inside the build environment, which
+services reconstruct `zupt-5.2.8.tar.gz` inside the build environment, which
 matches `Source0` in the spec.
 
 This source policy does not prohibit separately built release-page packages.
-The upstream 5.2.7 gates may publish the CLI source tarball, DEB, binary RPM,
+The upstream 5.2.8 gates may publish the CLI source tarball, DEB, binary RPM,
 SRPM, notice-bearing Linux tar.xz, Windows ZIP, and macOS DMG, together with a
 GUI DEB, noarch RPM, GUI SRPM, and source-only portable GUI ZIP after each
 format-specific test succeeds. None of those files is an OBS `Source0` input
@@ -139,7 +139,7 @@ reconstructed by the build-time services. Neither `%build` nor `%check` may
 access the network.
 
 For a source RPM check outside OBS, place the service-produced
-`zupt-5.2.7.tar.gz` next to the spec and use a disposable RPM build tree:
+`zupt-5.2.8.tar.gz` next to the spec and use a disposable RPM build tree:
 
 ```sh
 rpm_top=$(mktemp -d)
@@ -167,7 +167,7 @@ unavailable rather than passing it. Earlier off-screen GUI smoke evidence is
 supporting evidence, not an exact-commit package result.
 
 Post-tag CI integration failures prevented 5.2.2 promotion. These historical
-local results do not establish 5.2.7, native Windows or macOS success, hosted
+local results do not establish 5.2.8, native Windows or macOS success, hosted
 GitHub CI/release promotion, authenticated OBS acceptance, or resolution of the
 automatic openSUSE `debugsource` rpmlint `no-binary` finding. The immutable
 5.2.3 candidate was not promoted because its source-policy test assumed LF for
@@ -194,7 +194,7 @@ This result establishes that the explicit tag revision works and isolates a
 release/test harness defect. It does not change the product, archive format,
 cryptography, codec, or SDK ABI; it does not make skipped native jobs pass or
 establish authenticated OBS/Factory acceptance. No v5.2.4 evidence transfers
-automatically to v5.2.7. The exact v5.2.7 candidate must repeat every applicable
+automatically to v5.2.8. The exact v5.2.8 candidate must repeat every applicable
 gate, and the automatic openSUSE `debugsource` rpmlint `no-binary` finding
 remains unresolved and unsuppressed.
 
@@ -216,9 +216,23 @@ macOS arm64 SHA-NI test build treated unused x86-only helper declarations as
 errors under `-Werror`; Windows argv transcoding aborted the safe printable
 UTF-8 fixture before its intended path assertions. The 5.2.7 changes correct
 those test-harness boundaries without an archive-format, cryptographic, codec,
-or SDK ABI change. They do not establish 5.2.7 hosted, native, OBS, or promotion
+or SDK ABI change. They do not establish 5.2.8 hosted, native, OBS, or promotion
 evidence.
 
+## Prior 5.2.7 exact-tag native-gate evidence
+
+The immutable v5.2.7 candidate was not promoted. Exact-tag GitHub Actions run
+`33445470664` concluded `cancelled` at `2026-08-31T23:11:19Z`, with 13
+successful jobs, one failed macOS job, and one cancelled Windows job. macOS
+rejected creation of the raw-C1 scanner fixture
+with `EILSEQ`; the hosted Windows job stalled in `make check`, and a MinGW/Wine
+reproduction isolated the cause to a redirected password prompt entering
+`_getch`. Version 5.2.8 makes those test
+boundaries fail or skip without hanging, addresses CodeQL High #5/#6/#7 in SDK
+key publication, disk restore, and benchmark cleanup, and adds `sdk-test` to
+release and hosted Linux gates. None of those changes establishes an exact
+5.2.8 OBS, native, hosted-CI, or promotion result.
+
 ## Prior openSUSE packaging validation
 
 The local results below were produced on 2026-08-24 from the 5.2.2 candidate
@@ -256,11 +270,11 @@ gate.
 ## Handoff procedure for Alessandro/Cabelo
 
 1. Upstream completes every applicable pre-tag source and local audit gate,
-   then creates and verifies the annotated `v5.2.7` tag. Exact-tag hosted,
+   then creates and verifies the annotated `v5.2.8` tag. Exact-tag hosted,
    native-platform, package, and promotion gates must pass before release or
    downstream handoff; the tag itself is never moved to repair a failure.
 2. With Git, `file`, bsdtar, tar, zip, unzip and SHA-256 tools installed, run
-   `scripts/export-opensuse-package.sh v5.2.7`. Verify the reported ZIP and
+   `scripts/export-opensuse-package.sh v5.2.8`. Verify the reported ZIP and
    SHA-256 outside the Git index. The handoff includes both
    `packaging/opensuse/source-audit.sh` and its required
    `scripts/check-source-only.sh`; keep that relative layout while auditing.
@@ -272,7 +286,7 @@ gate.
    ```
 
 4. From the extracted handoff root, run
-   `packaging/opensuse/source-audit.sh --archive /path/to/zupt-5.2.7.tar.gz`.
+   `packaging/opensuse/source-audit.sh --archive /path/to/zupt-5.2.8.tar.gz`.
    Then copy `_service`, `zupt.spec`, `zupt.changes` and `README.md`
    into the flat OBS package checkout. The audit wrapper is not an OBS build
    source and must not be copied without its companion `scripts/` directory.
diff --git a/packaging/opensuse/_service b/packaging/opensuse/_service
index 226388a..7fc42da 100644
--- a/packaging/opensuse/_service
+++ b/packaging/opensuse/_service
@@ -4,7 +4,7 @@
   <service name="obs_scm" mode="manual">
     <param name="url">https://github.com/cristiancmoises/zupt.git</param>
     <param name="scm">git</param>
-    <param name="revision">refs/tags/v5.2.7</param>
+    <param name="revision">refs/tags/v5.2.8</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="versionrewrite-pattern">^v(.*)$</param>
     <param name="versionrewrite-replacement">\1</param>
diff --git a/packaging/opensuse/zupt.changes b/packaging/opensuse/zupt.changes
index f73d7e7..476816b 100644
--- a/packaging/opensuse/zupt.changes
+++ b/packaging/opensuse/zupt.changes
@@ -1,3 +1,18 @@
+-------------------------------------------------------------------
+Mon Aug 31 23:30:00 UTC 2026 - Cristian Cezar Moisés <sac@securityops.co>
+
+- Update to 5.2.8:
+  * Close CodeQL High path-race findings in SDK key publication,
+    descriptor-first disk restore, and benchmark workspace cleanup.
+  * Make the raw-C1 scanner fixture explicitly skip filesystems that reject
+    the byte with EILSEQ, reject redirected Windows prompts before _getch, and
+    add sdk-test to release/hosted Linux gates.
+  * Preserve immutable, unpromoted v5.2.7 run 33445470664: 13 jobs succeeded,
+    macOS failed the raw-C1 fixture, and Windows was cancelled after the hosted
+    job stalled; a MinGW/Wine reproduction isolated redirected _getch entry.
+  * Pin the OBS source service to the immutable v5.2.8 tag and require fresh
+    exact-candidate evidence before promotion.
+
 -------------------------------------------------------------------
 Mon Aug 31 23:00:00 UTC 2026 - Cristian Cezar Moisés <sac@securityops.co>
 
diff --git a/packaging/opensuse/zupt.spec b/packaging/opensuse/zupt.spec
index def34ff..f4a6573 100644
--- a/packaging/opensuse/zupt.spec
+++ b/packaging/opensuse/zupt.spec
@@ -18,7 +18,7 @@
 #
 
 Name:           zupt
-Version:        5.2.7
+Version:        5.2.8
 Release:        0
 Summary:        Backup compression with authenticated and post-quantum encryption
 License:        AGPL-3.0-or-later AND GPL-3.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND CC0-1.0
diff --git a/packaging/portable/README.txt b/packaging/portable/README.txt
index 815f3aa..05b06ae 100644
--- a/packaging/portable/README.txt
+++ b/packaging/portable/README.txt
@@ -27,7 +27,7 @@ Requirements
 ------------
   1. Python 3.9 or newer.
   2. PySide6 6.5 or newer, or a compatible PyQt6 package.
-  3. ZUPT 5.2.7, installed as `zupt` on PATH or placed beside the launcher
+  3. ZUPT 5.2.8, installed as `zupt` on PATH or placed beside the launcher
      (`zupt.exe` on Windows). A local command must have been built
      and tested independently; this bundle never downloads one.
 
@@ -46,7 +46,7 @@ Troubleshooting
 ---------------
   * "requires PySide6 or PyQt6": install one Qt binding through your operating
     system package manager or another trusted, preconfigured Python source.
-  * "zupt not found": install ZUPT 5.2.7 or place its command beside
+  * "zupt not found": install ZUPT 5.2.8 or place its command beside
     the launcher.
   * Set ZUPT_DEBUG=1 to print command-discovery diagnostics to stderr.
 
diff --git a/packaging/rpm/zupt.spec b/packaging/rpm/zupt.spec
index 0feb67a..cdefc2a 100644
--- a/packaging/rpm/zupt.spec
+++ b/packaging/rpm/zupt.spec
@@ -20,7 +20,7 @@
 # installed smoke test.
 
 Name:           zupt
-Version:        5.2.7
+Version:        5.2.8
 Release:        1%{?dist}
 Summary:        Backup compression with authenticated and post-quantum encryption
 
@@ -101,6 +101,15 @@ comments. Plain archives use non-cryptographic checksums.
 %endif
 
 %changelog
+* Mon Aug 31 2026 Cristian Cezar Moisés <sac@securityops.co> - 5.2.8-1
+- Close CodeQL High path-race findings in SDK key save, disk restore, and
+  benchmark cleanup; add the SDK gate, portable raw-C1 fixture handling, and
+  redirected Windows password-prompt rejection.
+- Preserve immutable, unpromoted v5.2.7 run 33445470664: 13 jobs succeeded,
+  macOS failed the raw-C1 fixture, and Windows was cancelled after the hosted
+  job stalled; a MinGW/Wine reproduction isolated redirected _getch entry.
+- Require fresh 5.2.8 gates.
+
 * Mon Aug 31 2026 Cristian Cezar Moisés <sac@securityops.co> - 5.2.7-1
 - Correct native test integration: scope SHA-NI helpers away from macOS arm64
   and preserve safe UTF-8 fixture bytes across the Windows argv boundary.
diff --git a/src/zupt_format.c b/src/zupt_format.c
index ef54a6c..f127d98 100644
--- a/src/zupt_format.c
+++ b/src/zupt_format.c
@@ -4221,7 +4221,7 @@ static zupt_error_t open_archive(FILE *f, zupt_options_t *opts,
      * parser ignored block_type at this position and decoded whatever it
      * found — making the byte truly unauthenticated. Now it is structurally
      * validated (rejected at parse time on mismatch), which is the
-     * OPAQUE-class coverage promised by PROMPT.md §5. */
+     * OPAQUE-class structural coverage recorded in the audit history. */
     if (ib.block_type != ZUPT_BLOCK_INDEX) {
         free(ib.payload);
         return ZUPT_ERR_CORRUPT;
diff --git a/tests/test_audit_flake.sh b/tests/test_audit_flake.sh
index f6ce7ec..b48724a 100755
--- a/tests/test_audit_flake.sh
+++ b/tests/test_audit_flake.sh
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 # Copyright (c) 2025-2026 Cristian Cezar Moisés
 #
-# Flake-stress harness — §3 of PROMPT.md.
+# Repeated-suite flake-stress harness.
 #
 # Runs every short test suite N times (default 50) and aborts on the
 # first non-deterministic outcome. Specifically targeted at the audit
@@ -21,7 +21,7 @@ set -u
 # F-02's repro needed 50 runs to be statistically convincing (~10%
 # baseline flake rate), but at 20 runs we still have ~88% chance of
 # catching a 10%-flake — fine for routine CI. For a hardened audit
-# pass, invoke with 50 or 100 (see PROMPT.md §3).
+# pass, invoke with 50 or 100 for a deeper audit run.
 N="${1:-20}"
 ZUPT_BIN="${ZUPT_BIN:-./zupt}"