Development record

fsutil.ValidRelPath is slash-only, so a backslash traversal escapes on a Windows target: path.Clean leaves backslashes untouched, so '..\\..\\x' passes ValidRelPath and, after filepath.Join/FromSlash on GOOS=windows, can walk out of the intended root. The gap is shared by every ValidRelPath caller (installsurface dirTree, positioning surfaces, lifeboat manifests) and is pre-existing, not introduced by the path-canonicalisation batch. Decide whether Windows is a target that ingests attacker-controlled relative config/manifest paths; if so, ValidRelPath should reject a segment containing filepath.Separator (or any backslash) as well as forward-slash traversal.