@@ -169,6 +169,8 @@ java-run 启动独立 Java 进程，不模拟自定义 `JavaExec` / `bootRun`
 
 当前支持 Maven `jar` 项目和启用了 Gradle Java 插件的项目，以及传统 `public static void main(String[])` 的 classpath 启动。主类发现只检查选定项目的已编译输出，不遍历所有依赖 Jar 寻找应用。JPMS、Android、native image、应用守护和热重启、部署不属于当前支持范围。
 
+Windows 的 Java 原生启动器按系统代码页转换命令行参数。classpath 文件 URL 可以保留中文路径，但主类名、JVM / 应用参数和传给构建工具的参数仍需能被该编码完整表示。java-run 会检测 JDK 的 `native.encoding` 并提前拒绝无法表示的参数，避免它们静默变成 `?`。需要传递任意 Unicode 参数时，应按系统要求启用 UTF-8 区域设置；`-Dfile.encoding=UTF-8` 控制应用文件编码，不能替代这项设置。自定义构建入口自行切换 JDK 时，还需核对其实际使用的工具链。[JDK Windows 启动器说明](https://www.oracle.com/java/technologies/javase/21-0-9-relnotes.html)
+
 开发与验证命令：
 
 ```sh
 
@@ -54,3 +54,13 @@
 核心实现提交为 `95f1b5f`，验收与 CI 提交为 `3005f8c`。评估与初始定位分别记录在 `4ba5822`、`40e87cf`，最终文档以本记录及 README 为准。
 
 包版本仍为旧 `0.0.5`，README 明确当前契约尚未发布。下一步正式发布前需确定开源许可证与版本号，实际运行三种原生系统的 CI，并据结果确认支持矩阵。性能、命名运行配置和新增运行模式按 [后续技术路线](product-design.md#后续技术路线) 推进，不以未运行的计划代替验证。
+
+## 首轮 CI 反馈与修复
+
+用户推送后的 [首轮 Check](https://github.com/Vanisper/java-run/actions/runs/37256647164) 对应 `2ad210c`。Linux / JDK 17、21 与 macOS / JDK 21 完成全部验收；macOS / JDK 17 的 Unicode 测试及两组 Windows 回归失败。
+
+macOS 的问题发生在测试源文件名：JDK 17 将文件路径转为 NFC，而 public 类使用 NFD。改用 ASCII 源文件名承载原有 NFD 类，保留主类发现和实际启动断言，JDK 17、21 都通过。
+
+Windows 原生 JDK 将系统代码页无法表示的参数替换为 `?`。修复包括 Gradle 通过临时脚本中的 UTF-8 请求读取目录和模块、使用 ASCII 根代理任务，Java / Jar 使用相对受控路径，以及执行前按真实 JDK 编码检查用户参数。中文 classpath 目录继续保留，无法表示的原始参数以明确错误结束。Maven 有效模型的输出路径统一归一化，依赖元数据输出固定 UTF-8。另增加实际 Windows 批处理进程树清理用例。
+
+修复后本地全量回归 91 项通过、3 项 Windows 专用测试跳过；新增 Maven 编码保护后专项 17 项通过。Gradle 8.14 在 JDK 17、21 下各 21 项验证通过，完整独立二进制 smoke 20 项全部通过。后续原生结果以 [分支 Check 运行](https://github.com/Vanisper/java-run/actions/workflows/check.yaml?query=branch%3Afeat%2Fopen-source-cli) 为准，不将本机结果替代 Windows 验收。
@@ -2,6 +2,7 @@ import { spawn } from 'node:child_process';
 import { cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { assertJavaArguments, readJavaNativeEncoding } from '../src/process/java-arguments';
 
 type Fixture = 'boot-single' | 'boot-reactor' | 'plain' | 'gradle-reactor';
 type Suite = 'quick' | 'full';
@@ -24,12 +25,12 @@ interface ProcessResult {
 interface Expectations {
   code?: number;
   stdout?: string[];
+  stderr?: string[];
   absent?: string[];
 }
 
 const projectRoot = path.resolve(import.meta.dir, '..');
 const fixtureNames: Fixture[] = ['boot-single', 'boot-reactor', 'plain', 'gradle-reactor'];
-const specialValue = 'hello world #中文%';
 
 function parseOptions(): SmokeOptions {
   let executable = path.join(projectRoot, 'dist', process.platform === 'win32' ? 'java-run.exe' : 'java-run');
@@ -130,6 +131,18 @@ async function main(): Promise<void> {
     await mkdir(repository, { recursive: true });
     await mkdir(gradleHome, { recursive: true });
     await mkdir(logDirectory);
+    const java = process.env.JAVA_HOME ? path.join(process.env.JAVA_HOME, 'bin', process.platform === 'win32' ? 'java.exe' : 'java') : 'java';
+    const nativeEncoding = await readJavaNativeEncoding(java, workspace);
+    let unicodeArguments = true;
+    try {
+      await assertJavaArguments(java, ['hello world #中文%'], workspace);
+    } catch (error) {
+      if (!(error instanceof Error) || !error.message.includes('无法完整表示')) throw error;
+      unicodeArguments = false;
+    }
+    const specialValue = unicodeArguments ? 'hello world #中文%' : 'hello world #%';
+    const configValue = unicodeArguments ? 'config value #中文%' : 'config value #%';
+    console.log(`Java native encoding: ${nativeEncoding}; Unicode argv: ${unicodeArguments ? 'supported' : 'explicit rejection required'}`);
     await writeFile(settings, '<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0"/>\n');
     for (const fixture of fixtureNames) {
       const destination = path.join(workspace, `${fixture} 空格#中文%`);
@@ -151,6 +164,9 @@ async function main(): Promise<void> {
       for (const marker of expected.stdout ?? []) {
         if (!result.stdout.includes(marker)) violations.push(`缺少 stdout 标记: ${marker}`);
       }
+      for (const marker of expected.stderr ?? []) {
+        if (!result.stderr.includes(marker)) violations.push(`缺少 stderr 标记: ${marker}`);
+      }
       for (const marker of expected.absent ?? []) {
         if ((result.stdout + result.stderr).includes(marker)) violations.push(`出现禁止标记: ${marker}`);
       }
@@ -227,17 +243,30 @@ async function main(): Promise<void> {
       await check('plain', argumentsFor('plain', ...directArguments, '--build-arg=-Pci', ...commonArguments), {
         stdout: ['[fixture] kind=plain', '[fixture] dependency-version=2.18.0', ...mavenMarkers, ...withoutTests],
       });
+      if (!unicodeArguments) {
+        const unsupportedValue = 'token-secret-中文';
+        for (const [name, argument] of [
+          ['plain-unrepresentable-application-argument', `--arg=${unsupportedValue}`],
+          ['plain-unrepresentable-jvm-argument', `--jvm-arg=-Dfixture.jvm=${unsupportedValue}`],
+        ]) {
+          await check(name!, argumentsFor('plain', ...directArguments, '--build=none', argument!), {
+            code: 1,
+            stderr: ['无法完整表示', '系统区域设置'],
+            absent: ['[fixture]', unsupportedValue],
+          });
+        }
+      }
       if (options.suite === 'full') {
         const configPath = path.join(projects.get('plain')!, '.java-run.json');
         await writeFile(configPath, JSON.stringify({
           mainClass: 'org.javarun.fixture.PlainApplication',
           build: 'none',
           buildArgs: mavenBuildArguments,
-          jvmArgs: ['-Dfixture.jvm=config value #中文%'],
+          jvmArgs: [`-Dfixture.jvm=${configValue}`],
           applicationArgs: ['--from-config'],
         }, null, 2));
         await check('project-config-default', [], {
-          stdout: ['[fixture] kind=plain', '[fixture] jvm-value=config value #中文%', '[fixture] arg=--from-config'],
+          stdout: ['[fixture] kind=plain', `[fixture] jvm-value=${configValue}`, '[fixture] arg=--from-config'],
         }, projects.get('plain')!);
         await check('project-config-override', ['--main=org.javarun.fixture.PlainApplication', '--jvm-arg=-Dfixture.jvm=cli value', '--arg=--from-cli'], {
           stdout: ['[fixture] jvm-value=cli value', '[fixture] arg=--from-config', '[fixture] arg=--from-cli'],
 
@@ -1,7 +1,8 @@
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
+import { isAbsolute, join, relative, resolve } from 'node:path';
 import { CommandError, runCommand } from '../process/exec';
+import { assertJavaArguments } from '../process/java-arguments';
 import type { BuildPlan, CommandSpec, PreparedProject, RunConfig } from '../core/types';
 
 const projectFiles = ['settings.gradle', 'settings.gradle.kts', 'build.gradle', 'build.gradle.kts'];
@@ -52,23 +53,20 @@ function commandSpecification(config: RunConfig, workspace: string, discovery =
     throw new Error(`找不到 Gradle settings 或 build 文件：${config.cwd}`);
   }
   validateBuildArguments(config.buildArgs);
-  const target = discovery ? ':' : targetPath(config.module);
+  if (!discovery) targetPath(config.module);
   const paths = metadataPaths(workspace);
   const task = discovery ? `${paths.task}_discover` : paths.task;
   const build = discovery ? 'none' : config.build;
   const args = [
-    '--no-daemon', '--console=plain', '--no-configuration-cache', '-I', paths.script,
+    '--no-daemon', '--console=plain', '--no-configuration-cache', '-I', relative(config.cwd, paths.script),
     ...config.buildArgs,
-    `-DjavaRun.root=${resolve(config.cwd)}`,
-    `-DjavaRun.target=${target}`,
-    `-DjavaRun.output=${discovery ? join(resolve(workspace), 'gradle-projects.json') : paths.output}`,
     `-DjavaRun.metadataTask=${task}`,
     `-DjavaRun.build=${build}`,
     `-DjavaRun.includeTests=${discovery ? false : config.includeTests}`,
     `-DjavaRun.discover=${discovery}`,
   ];
   if (build === 'none') args.push('-Porg.gradle.java.installations.auto-download=false');
-  args.push(`${target === ':' ? ':' : `${target}:`}${task}`);
+  args.push(`:${task}`);
   return { command: gradleCommand(config), args, cwd: config.cwd, stage: discovery ? 'Gradle 项目选择' : 'Gradle 项目准备' };
 }
 
@@ -82,25 +80,30 @@ export function planGradle(config: RunConfig, workspace: string): BuildPlan {
     tool: 'gradle',
     commands: [commandSpecification(config, workspace)],
     notes: [
+      `目标 Gradle 项目：${targetPath(config.module)}`,
       config.build === 'auto'
         ? 'Gradle 任务图准备目标项目和运行依赖，不执行测试'
         : '不构建源码，要求目标项目和运行依赖已有可用产物',
       '主类、运行类路径和 Java 工具链将在执行 Gradle 后解析',
+      '项目根、目标模块和输出路径由临时脚本读取 UTF-8 请求，不经 Java 原生命令行编码转换',
     ],
   };
 }
 
 const initScript = String.raw`
 import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
 import org.gradle.api.GradleException
 import org.gradle.api.plugins.JavaApplication
 import org.gradle.api.plugins.JavaPluginExtension
 import org.gradle.api.tasks.SourceSetContainer
 import org.gradle.jvm.toolchain.JavaToolchainService
 
+def javaRunRequest = new JsonSlurper().parseText(new String('@JAVA_RUN_REQUEST@'.decodeBase64(), 'UTF-8'))
+
 gradle.projectsEvaluated {
     // init script 也会进入辅助构建，元数据任务只注册到请求的主构建
-    def requestedRoot = new File(System.getProperty('javaRun.root')).canonicalFile
+    def requestedRoot = new File(javaRunRequest.root).canonicalFile
     if (gradle.rootProject.projectDir.canonicalFile != requestedRoot) {
         return
     }
@@ -113,14 +116,14 @@ gradle.projectsEvaluated {
                 }.sort { a, b -> a.path <=> b.path }.collect {
                     [value: it.path, label: it.path + '（入口待解析）']
                 }
-                def output = new File(System.getProperty('javaRun.output'))
+                def output = new File(javaRunRequest.output)
                 output.parentFile.mkdirs()
                 output.setText(JsonOutput.toJson(candidates), 'UTF-8')
             }
         }
         return
     }
-    def requestedPath = System.getProperty('javaRun.target')
+    def requestedPath = javaRunRequest.target
     def target = gradle.rootProject.findProject(requestedPath)
     if (target == null) {
         throw new GradleException("找不到 Gradle 项目：" + requestedPath + "，请用 --module 指定实际项目路径")
@@ -133,7 +136,7 @@ gradle.projectsEvaluated {
     def includeTests = Boolean.parseBoolean(System.getProperty('javaRun.includeTests'))
     def selected = sourceSets.getByName(includeTests ? 'test' : 'main')
     def included = includeTests ? [sourceSets.getByName('test'), sourceSets.getByName('main')] : [selected]
-    target.tasks.register(taskName) {
+    def metadataTask = target.tasks.register(taskName) {
         if (System.getProperty('javaRun.build') == 'auto') {
             dependsOn selected.classesTaskName
             dependsOn selected.runtimeClasspath.buildDependencies
@@ -155,7 +158,7 @@ gradle.projectsEvaluated {
             }
             def mainClass = application == null ? null : application.mainClass.orNull
             def jvmArgs = application == null ? [] : application.applicationDefaultJvmArgs.collect { it.toString() }
-            def output = new File(System.getProperty('javaRun.output'))
+            def output = new File(javaRunRequest.output)
             output.parentFile.mkdirs()
             output.setText(JsonOutput.toJson([
                 directory: target.projectDir.absolutePath,
@@ -167,9 +170,35 @@ gradle.projectsEvaluated {
             ]), 'UTF-8')
         }
     }
+    if (target != gradle.rootProject) {
+        // 根任务固定为 ASCII，目标模块的名称只从 UTF-8 请求读取
+        gradle.rootProject.tasks.register(taskName) {
+            dependsOn metadataTask
+        }
+    }
 }
 `.trimStart();
 
+function initializationScript(config: RunConfig, workspace: string, discovery = false): string {
+  const request = {
+    root: resolve(config.cwd),
+    target: discovery ? ':' : targetPath(config.module),
+    output: discovery ? join(resolve(workspace), 'gradle-projects.json') : metadataPaths(workspace).output,
+  };
+  const encoded = Buffer.from(JSON.stringify(request), 'utf8').toString('base64');
+  return initScript.replace('@JAVA_RUN_REQUEST@', encoded);
+}
+
+async function executeGradle(spec: CommandSpec): Promise<void> {
+  const java = process.env.JAVA_HOME
+    ? join(process.env.JAVA_HOME, 'bin', process.platform === 'win32' ? 'java.exe' : 'java')
+    : 'java';
+  await assertJavaArguments(java, spec.args, spec.cwd);
+  console.error(`java-run：${spec.stage}`);
+  const result = await runCommand(spec, { capture: true });
+  if (result.exitCode !== 0) throw new CommandError(spec, result);
+}
+
 function readProject(output: string): PreparedProject {
   let metadata: unknown;
   try {
@@ -210,12 +239,10 @@ export async function prepareGradle(config: RunConfig, workspace: string): Promi
   const plan = planGradle(config, workspace);
   const paths = metadataPaths(workspace);
   mkdirSync(resolve(workspace), { recursive: true });
-  writeFileSync(paths.script, initScript);
+  writeFileSync(paths.script, initializationScript(config, workspace));
   rmSync(paths.output, { force: true });
   const spec = plan.commands[0]!;
-  console.error(`java-run：${spec.stage}`);
-  const result = await runCommand(spec, { capture: true });
-  if (result.exitCode !== 0) throw new CommandError(spec, result);
+  await executeGradle(spec);
   return readProject(paths.output);
 }
 
@@ -229,11 +256,9 @@ export async function discoverGradleProjects(config: RunConfig, workspace: strin
   const paths = metadataPaths(workspace);
   const output = join(resolve(workspace), 'gradle-projects.json');
   mkdirSync(resolve(workspace), { recursive: true });
-  writeFileSync(paths.script, initScript);
+  writeFileSync(paths.script, initializationScript(config, workspace, true));
   rmSync(output, { force: true });
-  console.error(`java-run：${spec.stage}`);
-  const result = await runCommand(spec, { capture: true });
-  if (result.exitCode !== 0) throw new CommandError(spec, result);
+  await executeGradle(spec);
   const candidates: unknown = JSON.parse(readFileSync(output, 'utf8'));
   if (!Array.isArray(candidates) || candidates.some(candidate =>
     !candidate || typeof candidate.value !== 'string' || !candidate.value.startsWith(':') || typeof candidate.label !== 'string')) {