merge: resolve master conflict on Directory.Packages.props (OneDNN 0.46.0)

Only conflict — AiDotNet.Native.OneDNN version:
  - HEAD (this branch): 0.46.0  (ecosystem-matching with Tensors 0.46.0 bump)
  - origin/master:      0.38.0  (stale)

Kept 0.46.0 since this PR's whole purpose is the Tensors-parity bump, and
native lib versions stay in lockstep with the Tensors major/minor they back.
NuGet confirms 0.46.0 exists (current is 0.48.0; not bumping further to
keep scope tight).

Build: net10.0 + net471 both clean post-merge.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: franklinic

src/ComputerVision/Weights/WeightDownloader.cs

@@ -1,4 +1,5 @@
 using System.Net.Http;
+using AiDotNet.Data;
 
 namespace AiDotNet.ComputerVision.Weights;
 
@@ -108,8 +109,10 @@ public async Task DownloadAsync(
                 }
             }
 
-            // Move completed download to final location
-            File.Move(tempPath, localPath);
+            // Move completed download to final location. Uses RobustFileOps
+            // so a transient Windows Defender / indexer lock doesn't abort
+            // the download (the finally block would wipe the temp file).
+            await RobustFileOps.MoveWithRetryAsync(tempPath, localPath, cancellationToken);
         }
         finally
         {

src/Data/DatasetDownloader.cs

@@ -73,23 +73,35 @@ public static async Task<bool> DownloadFileAsync(
         string tempPath = destinationPath + ".tmp";
         try
         {
-            using var response = await SharedHttpClient.GetAsync(url, HttpCompletionOption.ResponseHeadersRead, cancellationToken);
-            response.EnsureSuccessStatusCode();
+            using (var response = await SharedHttpClient.GetAsync(url, HttpCompletionOption.ResponseHeadersRead, cancellationToken))
+            {
+                response.EnsureSuccessStatusCode();
 
-            using var fileStream = new FileStream(tempPath, FileMode.Create, FileAccess.Write, FileShare.None);
+                // Close the file stream explicitly (via nested using) before
+                // File.Move runs. The nested scope guarantees the handle is
+                // released; otherwise the outer `using` would dispose *after*
+                // the move attempt.
+                using var fileStream = new FileStream(tempPath, FileMode.Create, FileAccess.Write, FileShare.None);
 #if NET6_0_OR_GREATER
-            await response.Content.CopyToAsync(fileStream, cancellationToken);
+                await response.Content.CopyToAsync(fileStream, cancellationToken);
+                await fileStream.FlushAsync(cancellationToken);
 #else
-            await response.Content.CopyToAsync(fileStream);
+                await response.Content.CopyToAsync(fileStream);
+                fileStream.Flush();
 #endif
+            }
 
-            // Move temp file to final location
+            // Move temp file to final location.
             if (File.Exists(destinationPath))
             {
                 File.Delete(destinationPath);
             }
 
-            File.Move(tempPath, destinationPath);
+            // Retry the rename. On Windows the freshly-written file can be
+            // briefly locked by antivirus (Defender) or the search indexer,
+            // which makes File.Move fail with a sharing violation even after
+            // the writer's handle is closed. Short backoff tolerates that.
+            await RobustFileOps.MoveWithRetryAsync(tempPath, destinationPath, cancellationToken);
             return true;
         }
         finally

src/Data/RobustFileOps.cs

@@ -0,0 +1,183 @@
+namespace AiDotNet.Data;
+
+/// <summary>
+/// Filesystem helpers that tolerate transient locks — particularly the
+/// "sharing violation" window that Windows Defender or the search indexer
+/// can hold on a freshly written file for a few hundred milliseconds after
+/// the writer's handle is released.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Every download path in this library writes to a temp file and then
+/// renames to the final location. On Windows, an antivirus scanner or the
+/// search indexer can hold a secondary handle on the temp file briefly
+/// after the writer closes it — long enough that the immediate
+/// <c>File.Move</c> fails with <see cref="IOException"/>. Without retry
+/// logic, a single transient lock aborts the entire download; the caller
+/// then typically wipes the temp file in a <c>finally</c> block and must
+/// re-download from scratch, which will race again the next time.
+/// </para>
+/// <para>
+/// <see cref="MoveWithRetryAsync"/> retries on <see cref="IOException"/>
+/// and <see cref="UnauthorizedAccessException"/> with linear backoff. The
+/// final attempt still propagates the real exception so callers see a
+/// clear failure rather than a silent no-op.
+/// </para>
+/// </remarks>
+internal static class RobustFileOps
+{
+    /// <summary>
+    /// Moves <paramref name="sourcePath"/> to <paramref name="destinationPath"/>,
+    /// tolerating transient Windows-style sharing violations.
+    /// </summary>
+    /// <param name="sourcePath">The source file path (typically a temp file).</param>
+    /// <param name="destinationPath">The destination path (final location).</param>
+    /// <param name="cancellationToken">Cancellation token.</param>
+    /// <param name="maxAttempts">Maximum total attempts (default 5).</param>
+    /// <param name="initialDelayMs">Initial delay between retries; each subsequent
+    /// retry waits <c>attempt * initialDelayMs</c> milliseconds (default 200 ms,
+    /// so default schedule is 200 / 400 / 600 / 800 ms).</param>
+    /// <exception cref="IOException">Final attempt failed with an IO error.</exception>
+    /// <exception cref="UnauthorizedAccessException">Final attempt failed with an access error.</exception>
+    /// <remarks>
+    /// <para>
+    /// The retry tolerates <see cref="IOException"/> (e.g. sharing violation on
+    /// Windows) and <see cref="UnauthorizedAccessException"/> (e.g. ACL
+    /// contention mid-move). Other exceptions are surfaced immediately.
+    /// </para>
+    /// </remarks>
+    internal static async Task MoveWithRetryAsync(
+        string sourcePath,
+        string destinationPath,
+        CancellationToken cancellationToken,
+        int maxAttempts = 5,
+        int initialDelayMs = 200)
+    {
+        ValidateRetryArguments(maxAttempts, initialDelayMs);
+
+        for (int attempt = 1; attempt <= maxAttempts; attempt++)
+        {
+            try
+            {
+                File.Move(sourcePath, destinationPath);
+                return;
+            }
+            // On the final attempt the `when` clause is false, so the
+            // catch is skipped and the original exception propagates to
+            // the caller — exactly the intended "clear failure" behavior.
+            catch (IOException) when (attempt < maxAttempts)
+            {
+                await Task.Delay(TimeSpan.FromMilliseconds(initialDelayMs * attempt), cancellationToken);
+            }
+            catch (UnauthorizedAccessException) when (attempt < maxAttempts)
+            {
+                await Task.Delay(TimeSpan.FromMilliseconds(initialDelayMs * attempt), cancellationToken);
+            }
+        }
+    }
+
+    /// <summary>
+    /// Synchronous sibling of <see cref="MoveWithRetryAsync"/>. For call sites
+    /// that can't go async (e.g. atomic index flushes from a sync save path).
+    /// Uses <see cref="Thread.Sleep"/> between attempts; prefer the async
+    /// variant when an awaitable context is available.
+    /// </summary>
+    internal static void MoveWithRetry(
+        string sourcePath,
+        string destinationPath,
+        int maxAttempts = 5,
+        int initialDelayMs = 200)
+    {
+        ValidateRetryArguments(maxAttempts, initialDelayMs);
+
+        for (int attempt = 1; attempt <= maxAttempts; attempt++)
+        {
+            try
+            {
+                File.Move(sourcePath, destinationPath);
+                return;
+            }
+            // Final attempt falls through `when (attempt < maxAttempts)`,
+            // so the underlying exception naturally propagates.
+            catch (IOException) when (attempt < maxAttempts)
+            {
+                Thread.Sleep(initialDelayMs * attempt);
+            }
+            catch (UnauthorizedAccessException) when (attempt < maxAttempts)
+            {
+                Thread.Sleep(initialDelayMs * attempt);
+            }
+        }
+    }
+
+    /// <summary>
+    /// Atomically replaces <paramref name="destinationPath"/> with
+    /// <paramref name="sourcePath"/>, optionally keeping a backup at
+    /// <paramref name="destinationBackupPath"/>. Retries on transient
+    /// <see cref="IOException"/> / <see cref="UnauthorizedAccessException"/>
+    /// with linear backoff, mirroring <see cref="MoveWithRetry"/>.
+    /// Synchronous; used by atomic index / checkpoint flush paths that are
+    /// not async.
+    /// </summary>
+    /// <remarks>
+    /// On Windows <see cref="File.Replace(string, string, string)"/> is the
+    /// in-place atomic rename, but it can still fail with a sharing
+    /// violation if Windows Defender or the search indexer is mid-scan of
+    /// either file.
+    /// </remarks>
+    internal static void ReplaceWithRetry(
+        string sourcePath,
+        string destinationPath,
+        string? destinationBackupPath,
+        int maxAttempts = 5,
+        int initialDelayMs = 200)
+    {
+        ValidateRetryArguments(maxAttempts, initialDelayMs);
+
+        for (int attempt = 1; attempt <= maxAttempts; attempt++)
+        {
+            try
+            {
+                File.Replace(sourcePath, destinationPath, destinationBackupPath);
+                return;
+            }
+            // Final attempt: the `when` gate is false so the exception
+            // propagates directly to the caller.
+            catch (IOException) when (attempt < maxAttempts)
+            {
+                Thread.Sleep(initialDelayMs * attempt);
+            }
+            catch (UnauthorizedAccessException) when (attempt < maxAttempts)
+            {
+                Thread.Sleep(initialDelayMs * attempt);
+            }
+        }
+    }
+
+    /// <summary>
+    /// Validates retry parameters. Rejects silent-success configurations —
+    /// <c>maxAttempts &lt; 1</c> would exit the retry loop without ever
+    /// touching the filesystem and without throwing, which is a confusing
+    /// failure mode for any caller that forwards user-supplied config.
+    /// </summary>
+    /// <exception cref="ArgumentOutOfRangeException"><paramref name="maxAttempts"/>
+    /// is less than 1, or <paramref name="initialDelayMs"/> is negative.</exception>
+    private static void ValidateRetryArguments(int maxAttempts, int initialDelayMs)
+    {
+        if (maxAttempts < 1)
+        {
+            throw new ArgumentOutOfRangeException(
+                nameof(maxAttempts),
+                maxAttempts,
+                "maxAttempts must be at least 1.");
+        }
+
+        if (initialDelayMs < 0)
+        {
+            throw new ArgumentOutOfRangeException(
+                nameof(initialDelayMs),
+                initialDelayMs,
+                "initialDelayMs must be non-negative.");
+        }
+    }
+}

src/Data/TimeSeries/M4DatasetLoader.cs

@@ -366,12 +366,16 @@ private async Task DownloadFileAtomicAsync(string url, string targetPath, string
             // Write to temp file first
             await FilePolyfill.WriteAllTextAsync(tempPath, content, cancellationToken);
 
-            // Atomically move to final location
+            // Atomically move to final location. Uses RobustFileOps to
+            // tolerate a transient Windows Defender / indexer lock on the
+            // freshly written temp file (File.Move would otherwise fail
+            // with a sharing violation and the finally block would wipe
+            // the content).
             if (File.Exists(targetPath))
             {
                 File.Delete(targetPath);
             }
-            File.Move(tempPath, targetPath);
+            await RobustFileOps.MoveWithRetryAsync(tempPath, targetPath, cancellationToken);
         }
         finally
         {

src/Data/Vision/Benchmarks/Cifar100DataLoader.cs

@@ -99,7 +99,9 @@ protected override async Task LoadDataCoreAsync(CancellationToken cancellationTo
             if (!nchw)
                 sampleTensor = AiDotNetEngine.Current.TensorPermute(sampleTensor, [1, 2, 0]);
 
-            sampleTensor.AsSpan().CopyTo(featuresData.AsSpan(featureOffset, ppi));
+            // Tensor<T>.CopyTo handles the strided post-permute case in a
+            // single pass; see Cifar10DataLoader for the rationale.
+            sampleTensor.CopyTo(featuresData.AsSpan(featureOffset, ppi));
 
             if (label >= 0 && label < _numClasses)
                 labelsData[i * _numClasses + label] = NumOps.One;

src/Data/Vision/Benchmarks/Cifar10DataLoader.cs

@@ -112,7 +112,11 @@ protected override async Task LoadDataCoreAsync(CancellationToken cancellationTo
             if (!nchw)
                 sampleTensor = AiDotNetEngine.Current.TensorPermute(sampleTensor, [1, 2, 0]);
 
-            sampleTensor.AsSpan().CopyTo(featuresData.AsSpan(featureOffset, pixelsPerImage));
+            // Tensor<T>.CopyTo handles both contiguous and strided (post-permute)
+            // layouts in a single pass. Using AsSpan() here would throw
+            // "Cannot get a contiguous span from a non-contiguous tensor view"
+            // on the NHWC default path.
+            sampleTensor.CopyTo(featuresData.AsSpan(featureOffset, pixelsPerImage));
 
             if (label >= 0 && label < 10)
                 labelsData[i * 10 + label] = NumOps.One;

src/Data/Vision/Benchmarks/EuroSatDataLoader.cs

@@ -125,11 +125,13 @@ protected override async Task LoadDataCoreAsync(CancellationToken cancellationTo
             bool nchw = _options.Layout == ImageTensorLayout.NCHW;
             if (nchw)
             {
-                // VisionLoaderHelper returns HWC [H,W,3]; permute to CHW [3,H,W]
+                // VisionLoaderHelper returns HWC [H,W,3]; permute to CHW [3,H,W].
+                // Tensor<T>.CopyTo handles the strided post-permute view in a
+                // single pass without allocating an intermediate contiguous tensor.
                 var hwcTensor = new Tensor<T>([ImageSize, ImageSize, 3]);
                 pixels.AsSpan(0, available).CopyTo(hwcTensor.AsWritableSpan());
                 var chwTensor = AiDotNetEngine.Current.TensorPermute(hwcTensor, [2, 0, 1]);
-                chwTensor.AsSpan().CopyTo(featuresData.AsSpan(featureOffset, pixelsPerImage));
+                chwTensor.CopyTo(featuresData.AsSpan(featureOffset, pixelsPerImage));
             }
             else
             {

src/ModelLoading/HuggingFaceModelLoader.cs

@@ -2,6 +2,7 @@
 using System.Net.Http.Headers;
 using System.Security.Cryptography;
 using System.Text;
+using AiDotNet.Data;
 using AiDotNet.Interfaces;
 using Newtonsoft.Json.Linq;
 
@@ -259,12 +260,15 @@ public async Task<string> DownloadFileAsync(
                 }
             }
 
-            // Move temp to final location (overwrite parameter not available in .NET Framework 4.7.1)
+            // Move temp to final location (overwrite parameter not available in .NET Framework 4.7.1).
+            // RobustFileOps tolerates a transient antivirus / indexer lock on
+            // the freshly written temp file that would otherwise fail with a
+            // sharing violation.
             if (File.Exists(localPath))
             {
                 File.Delete(localPath);
             }
-            File.Move(tempPath, localPath);
+            await RobustFileOps.MoveWithRetryAsync(tempPath, localPath, cancellationToken);
         }
         catch (HttpRequestException ex)
         {

src/Onnx/OnnxModelDownloader.cs

@@ -2,6 +2,7 @@
 using System.Net.Http.Headers;
 using System.Security.Cryptography;
 using System.Text.Json;
+using AiDotNet.Data;
 using AiDotNet.Interfaces;
 using AiDotNet.Validation;
 
@@ -306,15 +307,18 @@ private async Task DownloadFileAsync(
             }
         }
 
-        // Move completed download to final location
+        // Move completed download to final location. RobustFileOps
+        // tolerates a transient antivirus / indexer lock on the freshly
+        // written temp file that would otherwise fail with a sharing
+        // violation and lose the download.
         fileStream.Close();
 
         if (File.Exists(localPath))
         {
             File.Delete(localPath);
         }
 
-        File.Move(tempPath, localPath);
+        await RobustFileOps.MoveWithRetryAsync(tempPath, localPath, cancellationToken);
         progress?.Report(1.0);
     }