[swjnxyf]

Admin Project registration and creation rejected ordinary Windows absolute paths such as D:\projects\demo with HTTP 400 because their shared adapter validator required a leading /. Reuse webcodex_core::runtime_contract::validate_project_op_path, already used by the ordinary runtime, so the Server accepts Runner-native path shapes independently of its own OS. Keep the admin 4096-byte limit, reject empty/relative/NUL-containing inputs, and leave Runner namespace, canonicalization, allowed-roots and authorization checks intact.

Related to the latest Windows compatibility report in #1361. This addresses its registration-path follow-up; the allow_patch update was already implemented by #1393.

Add in-process HTTP regressions for both admin routes, including drive-letter, UNC, verbatim, POSIX, malformed and size-boundary inputs. The valid-path cases reach Runner lookup with an empty registry; they do not claim filesystem acceptance or native Windows E2E coverage. Keep the shared HTTP fixture's temporary database directory alive for the service lifetime. Document Windows spelling/JSON escaping and the unchanged Runner restrictions in both Runner guides.

Validation on macOS:

• Before the fix, the new HTTP regressions reproduced rejection of D:\projects\demo and missing early NUL rejection.
• cargo test --locked -p webcodex --lib admin_ — 47 passed, including authorization, same-origin and strict-JSON coverage.
• cargo test --locked -p webcodex-core project_op_path — 1 passed.
• cargo fmt --all -- --check, python3 scripts/check_markdown_links.py, and git diff --check — passed.

Native Windows Server/Runner E2E was not rerun locally. The report's native evidence concerns #1393; this PR makes no claim about release availability or active detached Job continuity.

[swjnxyf]

Reviewed PR #1413 at 067011a186754feaad344abdc77f45591fbd1049 on the mini main checkout. No blocking findings. The admin adapter now reuses the existing cross-platform validate_project_op_path contract instead of a POSIX-only leading-slash test. Admin/same-origin authorization and the Runner's native canonicalization/allowed_roots remain in their existing layers. The test DB lifetime fix is scoped to the HTTP test fixture.

Independent local checks passed: cargo test --locked -p webcodex --lib admin_project_paths (2/2), cargo test --locked -p webcodex --lib admin_ (47/47), cargo test --locked -p webcodex-core project_op_path (1/1), cargo fmt --all -- --check, python3 scripts/check_markdown_links.py, and git diff --check origin/main...HEAD. Working tree is clean; no additional review commit was needed.

Scope note: the HTTP tests intentionally verify validation/Runner dispatch with an empty registry, not successful registration on a live native Windows Runner. That E2E acceptance, as well as cross-platform CI completion, remains separate. Please wait for all required CI checks before merging.