fix: unblock Windows lifecycle tests and reduce Cursor blob admission cost

.github/workflows/ci.yml

@@ -751,7 +751,11 @@ jobs:
     # the same truncation as above. The bound is kept; the work per shard is cut instead.
     # Six shards put each leg at roughly two-thirds of the four-shard wall time, back
     # inside the margin 25 was chosen to provide.
-    timeout-minutes: 25
+    # Shard 1 of run 34036848646 then reached that wall with 2736 passing tests
+    # and no test failures. The matched tests were 25% slower than the prior
+    # complete run; about one minute of tests remained. Keep every test deadline
+    # and all six shards, but leave the whole batch and cleanup a 30-minute bound.
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:

devlog/_plan/260906_release_244_publish/000_plan.md

@@ -0,0 +1,16 @@
+# 2.44.0 release train
+
+Loop: satisfy-spec / C4. Trigger: maintainer explicitly requested main + preview merges and deployment after PR3771 CI passes, with cxc-loop. Goal: verified npm preview and stable2.44.0 plus release docs. Non-goals: local suites/typecheck/build, liveKiro, unrelated features, native stacks, rebase, direct protected-ref pushes, credential/settings changes. Verifier: GitHub exact-SHA jobs and actual Test steps, release workflow immutable SHA guards, npm metadata/digests and source-bound docs deploy. Stop: all five units done with receipts; never count pending/skipped as pass. Memory artifact: this numbered unit + .tmp/release-244 + bound goalplan. Outcomes: DONE only with published channel proof; failed gates remain unresolved; ambiguous publish requires registry inspection. Escalation: missing actual account authority or outstanding maintainer objection, unplanned security defect, or exhausted evidence-driven attempts. Existing GitHub/npm OIDC access only; user supplied no numeric token/time budget. Operational review checkpoint: six hours or five failed evidence-driven attempts per release surface; do not call that success. Leaves have read-only audit scope; main reclaims failed dispatches.
+
+## Dependency order
+1. Roadmap docs only (010).
+2. Exact regression candidate integration and freeze (020).
+3. dev pre-move2.45.0 (030).
+4. Independent preview promotion, dry run and publication (040).
+5. Independent stable promotion, dry run, publication and docs proof (050).
+
+Fresh baseline: main06ec553630fa2ee51a96b5cbf694089021249194/latest2.43.0; preview53c784c2a635b061799e4f7542432a921f548bf9/2.43.0-preview.20260906; devbd1cda99c162e3b4b41b14f6ad5ca2cf6f1a1f03. Candidate69f9e07c4fa7b80bcda9e4ba28e3c64f42187828 includes that dev. Service34034184142 all3pass; manualCI34034178072 completed with one Windows3/6 cold-restart apply deadlinefailure; originalWindows25 and macOScontrol20404/0 nowpass. #3763 deferred documentation remains user-withdrawn; #3644 field report remains unresolved, with no runtime-fix claim. This train does not silently reinstate either task.
+
+Authority: MAINTAINERS.md and scripts/release.ts / .github/workflows/release.yml. Local release helper is not invoked because it runs local suites and can push. Existing workflows perform build/audit/pack/publication on hosted runners. No new runtime field/enum or enforcement is added. GitHub required checks/immutable workflow guards are enforcement; manual admin integration remains bypassable owner authority and is documented accurately. SoT sync: no architecture/CLI contract changes; public release notes generated by the existing changelog builder. Existing dashboard evidence from prior verification is reused with exact source provenance, never claimed as a new render.
+
+Latest user steering: no heartbeat automation; track all CI and release workflows by direct bounded polling in this task. Automation3771-ci-dev is absent (delete returnednot_found). No replacement automation is authorized.

devlog/_plan/260906_release_244_publish/010_roadmap.md

@@ -0,0 +1,6 @@
+# Roadmap lock
+Dependencies: none; consumes previous verification-only conclusion, whose no-release limit is superseded by the new explicit maintainer request.
+NEW local numbered000/010/020/030/040/050 documents and goalplan. No product delta or remote publication in this cycle. Before: no release-authorized active plan. After: dependency-ordered audited plans with all final-head/registry criteria. Review complete docs and live workflow inputs; source audit commands are read-only. Check `git diff --check`, required doc existence and nonempty criteria; these verify documents, not product runtime. Commit these records on codex/release-244-publish-07c0 only. Keep this commit out of PR3771's already-running head. D records independent audit and next020. Existing no-local-suite constraint still applies.
+
+## Locked CI event contract after independent audit
+Windows1/6 through6/6 and macOScontrol are RC/#3771 validation gates. For version-only independentpreview/main promotions, require each finalSHA's successful push-event Cross-platformCI and sameSHAServiceLifecycle; do not launch laneall on a releasebranch while its pushrun is active, because branch-ref cancel-in-progress can cancel the requiredpushrun. If any runtime/source drift from frozenRC appears, stoppromotion and returnto RCvalidation. An extra manualrun, if actuallyneeded, starts only afterpushCI completion. This is the predeclared gate mapping, not a waiver of a failedtest.

devlog/_plan/260906_release_244_publish/020_integrate.md

@@ -0,0 +1,43 @@
+# Regression integration and immutable RC
+Dependencies: roadmap. Initial pre-diagnostic scope: no new production code was planned; the later test-only SPAWN_BUDGET_MS change for apply.child.exited is recorded below. PR3771 already contains tests/preload.ts, tests/ci-workflows/test-runner.test.ts, src/adapters/cursor/native-exec.ts and tests/providers/cursor/cursor-blob.test.ts. Before: open draft69f9e07c4. After: reviewed green PR squashed into dev and recorded integrated RC with package2.44.0.
+Read `gh pr view 3771 --json headRefOid,baseRefName,state,statusCheckRollup,reviews` and GraphQL reviewThreads plus live maintainer permission. Read manualCI34034178072 and lifecycle34034184142, asserting head equality and actual Windows1..6 Test/macOScontrol execution. Original25 Windows cases must pass; Cursor4096/4097 original bound and added expiry/accounting tests must pass. Trigger scenarios are original failures and missingcapability/expired-pin cases already encoded in regression tests. If red, inspect failing job logs and only repair the scoped cause in an amended unit; no retry-as-fix.
+When all required exacthead checks/reviews pass, record maintainer integration evidence in PR body, mark ready and `gh pr merge 3771 --admin --squash --match-head-commit <fresh-head>`. Validate dev base immediately before merge. Fetchdev, verify merge commit ancestry, and record RC as the integrateddev commit. Any later devcommit is not silently added to RC. No directdevpush. Host CI verifier APIs already ran successfully (exit0) and read this exact head, while final conclusions remain pending.
+
+## Fresh release blocker discovered during roadmap audit
+At69f9e07c4 manualCI34034178072 Windows3/6 job101489123778 fails tests/claude-integration/claude-desktop-remote-hub.test.ts stored-profile=true on its30second RemoteDesktop apply deadline; falsecase passes in61.7seconds total. macOScontrol is nowgreen. Extend this unit to diagnose/fix the newly observed Windows release-validation failure using explicit hypotheses and hosted baseline/candidate evidence, preserving original behavior assertions and isolation. Candidate file scope is that fixture and its direct CLI apply dependency only if diagnosis establishes runtimecause. No change justified by merely increasingbudget/retrying. Update this plan with exactdiff and independentreview before implementation. #3771 cannotmerge until allgates pass.
+
+## Diagnostic diff before repair
+PreviousD locked releaseorder and gateeventcontract. H1 loopbackdownloadfails5secondbound; H2 Windowschildnativework (PowerShell/icacls) occupies30seconddeadline; H3 commandfails to reachprocess.exit. Falsifiers: fetchstart/endtiming, nativeprocesscategory+duration, processexitmarker and alive-at-deadline. Per-process timers afterprocess.exit cannotexplainfailure.
+FirstB diagnostic only: temporarycontents:read Windowsworkflow on separatecodex/diagnose-desktop-apply-07c0 rooted at69f9; pinnedcheckout/setup, existinginstall/build. MODIFY tests/fixtures/claude-desktop-network-guard.ts onrunner to wrapBun.spawnSync/fetch/process.exit with fixedevent/category/millisecond receipts to a fixtureownedfile; preserveoriginalnetworkpermit. MODIFY failingtest onrunner only to print atmost512fixedrecords in a finallyblock aroundunchanged30000msdeadline. No rawargs/URLs/tokens/stdout/stderr or productionpatch. Exact instrumentation and workflow are .tmp/release-244/ci-repair/instrument-desktop-apply.py anddesktop-apply-ci.yml. BaselineWindowstrue/falsepassed82.1/79.5seconds total; candidate69.3failure/61.7pass doesnotisolateapplycost. Reviewdiagnosticthenexecute; use findings to amend exactrepairdiff and re-audit before production/testpatch.
+
+Diagnostic audit synthesis: reviewerconfirmedpermissions/pins/networkguard/30sdeadline andprivacyscope. Added asynchronousBun.spawn completiontraces (not justspawnSync) tocover asyncACL. Removedredundantglobal--timeout60000 fromisolateddiagnostic (eachcasealready240000 andcleanup90000). JSONLsplit findingrebuffed withgeneratedTS static inspection: Pythonwrites oneescaped\\n intoTSstring, whose runtimevalueisnewline; replacingitwithphysicalnewlinewouldbreakTS. No repositorytests/typecheck/buildran; onlyfilegenerationintoscratchwasinspected.
+
+## Measured cause and proposed one-file harness repair
+Diagnostic34035944642 at9358fad1: apply25,929ms exit0; nativeknownfolderPowerShell22,811ms, SID197ms, hubdownload10ms, ACLsteps16-19ms each, registry24/16ms, process.exit0. H1downloadstall and H3exit/lingeringhandle rejected in this trace. H2 refined to actualWindowsknownfolder lookup cost, notACL. src/codex/user-identity.ts explicitly gives this lookup30seconds; an end-to-end30secondapply test budget can expire before a validnear-budget lookup plus requiredCLIwork finishes. Producttimeout remains30seconds.
+Proposed MODIFY tests/claude-integration/claude-desktop-remote-hub.test.ts ONLY: importexistingSPAWN_BUDGET_MS from ../helpers/test-budget; replace apply.exited30_000 withSPAWN_BUDGET_MS(45_000). Explain measuredlookupcost in comment. Preserveoveralltest240s, cleanup90s, networkguard and allmodel/profile/restartassertions. No productguard/ACL/identity changes. Beforepermanentedit, hostedcontrolledslowlookup: nativePowerShell command pads its realexecution to28s inside the unchangedproduct30sbound, only in diagnosticclient. Original30sbudget mustfaildeadline;45s candidate mustpassoriginalassertions. Then removeinjectedslowlookup and mutate productionapplysnapshotchosenalias20260211->validbutwrong20260911; the45s test mustfailonmodelassertion (notdeadline), satisfyingtests/helpers/test-budget.ts requiredablation. Followwith uninstrumentedexactheadall-laneCI andlifecycle. No retry-as-fix and no change to4096/4097or original25cases.
+
+Independent Hilbert review: VERDICT PASS. The30s wholeCLI deadline is narrower than the product's30s lookup plus measuredrequiredwork; existing45sSPAWN_BUDGET remainsbelow240stest. Acceptance remainsconditional on controlledvalid28slookup red/green and wrongalias modelassertion ablation. Diagnostic34036362222 at29fa76f07 isrunning these onhostedWindows with unchangedproductguards. No permanenttestbudgetedit yet. Primaryoperator explicitly requested directpoll; noheartbeat exists.
+
+## Hosted proof and permanent delta
+34036362222 (29fa76f07): controllednativeknownfolderlookup28,226ms completedwithinproduct30s; oldwholeCLIdeadlinefailed30,004ms withchildstillalive. Canonical45s case exited0 at31,381ms andall22originalassertionspassed. Itsablationstep didnotexecute because diagnosticPythondefaultCP1252 couldnotreadKoreanUTF8source; notaproductfailure.
+34036626846 (247651739): UTF8-correct standaloneablationran with45sbudget; validbutwrong20260911aliasmadeoriginalwritten.inferenceModels.toEqual(snapshot.models) fail in57,052ms testcase, withoutapplydeadlinefailure. This proves thelongerbudgetdoesnotmaskthemodelidentityregression. Permanentdelta nowonlyimportsSPAWN_BUDGET_MS andusesitforapply.child.exited; allproducttimeouts/guards/assertions unchanged. Fulluninstrumentedlatest-headCI/lifecyclewillrunagain beforeintegration. Diagnosticworkflows andfaultinjections remainoffPR.
+
+## Replan after remaining product refusal
+C at9d624987c: Windows3/6 run34036848646 job101496387805 returnedclient_lifecycle_lock_failed in storedprofiletrue (72.4scase), whilefalsepassed102.8s. Thisisnot45sdeadline; nofurtherbudgetraise. Cdidnotpass, resettoPwithsameunfinishedunit. H1 identitylookuprefusal/timeout (knownfoldertrace22.8s); H2 ACL/filesystempreparation failure; H3 SQLite/namespace safetyrefusal. Classify error.cause codes usingfixedallowlist andidentity-timeout/namespacebooleans inthrowawaydiagnostic, plusnativeexitcode/timedOutflags. Threefreshsamplesmeasurefailurecondition ratherthanretryingforgreen; noobservedfailuremeansunresolved, notsuccess. Scriptsinstrument-lifecycle-cause.py/lifecycle-cause-ci.yml stay.tmp anddiagnosticrefonly, basedon921docsheadwhichpreserves9druntime. FutureFFIlookupoptionsare read-onlyresearch untilcauseconfirmed andsecurityreviewed. Priorinternalattemptcountisareviewcheckpoint, notuser-requestedterminationbudget; do not abandonthereleasegoalorclaimcompletion.
+
+Three-sample diagnostic34038264294 didnotreproduceclientrefusal (allpass; apply25.8-26.3s, nofailureflags). ItdoesnotclearfullCI. Nextboundedprobe keepsfullWindows3/6context alongsideisolatedcase, addingonlyfixedPowerShellphase timings aroundAdd-Type andSHGetKnownFolderPath. This separatescompiler/startupcost fromnativeAPIlatency beforeconsideringanyin-processFFIcall; a slowOSAPIwouldmake synchronousFFIanunsafeperformancefix. Exactscriptinstrument-known-folder-stages.py andworkflowknown-folder-stages-ci.yml arediagnosticonly. No budgetincrease orproductionlookupedit authorizedbyemptyflags.
+
+Newfixture hypothesis fromworkingcomparison: tests/codex-integration/codex-user-identity.test.ts givesrealchildprocessesownedTEMP/TMP andexistingLOCALAPPDATA within10schild/20stestbounds; Desktopfixtureallowlist omitsTEMP/TMP andpointsAPPDATA/LOCALAPPDATA atuncreateddirectories. Isolate missing/temp-only/profile-only/both withunchangedproductionlookupandallassertions. This canexplaincompilerlatencywithoutaproductrewrite; fixture-onlyrepairpreferredifmeasured. Diagnosticfixture-environment-ci.yml usesfourfixedmodes, freshWindowsjobs andprivateownedfolders. No nativeAPIcodechange.
+
+Fixtureenv experiment34039649747 rejectsTEMP/AppData-onlyrootcause: missing/temp/profile/both allretain22-27scompilationcost; no failureflags. Separatestageprobe establishesAdd-Type17.8s versusnativeAPI16ms, andfullshardclientcasespassed with16.7scompiler (hygiene failuresareexpectedbecauseitsdiagnosticCIyamlreplacesnormalworkflow). Thisdoesnotidentifytheoldgenericrefusal, butitproves a removablecompilerhotspot threatening the existing30schildbudget.
+
+Proposed experimentalruntime delta, notyetappliedtoproduct: replaceonlythefixedknown-folderAdd-Typebinding with public.NETFramework Reflection.Emit metadata in the same trustedPowerShellchild. Keep30stimeout, outputUTF16/base64, successfulcache, SIDquery, GUID, DEFAULT_PATH0x400/null-currenttoken, canonicalization andACLchecks. Noin-processFFI/unboundednativecall. DefinePInvokeMethod signatureGuid&,UInt32,IntPtr,IntPtr& ->Int32, Winapi,Unicode; PreserveSig required; outparameter metadata; FreeCoTaskMemfinallyevenfailure. DLLpathcomesfrom.NETSystemDirectory, notenv. Hostedprototype comparesunchangedlegacyC#referencepath, envshadowpath, negativeGUIDHRESULT, andfocusedidentity/Desktoptests beforepermanentpatch. Exactemit-known-folder.py andknown-folder-conformance.ts in.tmp. PrimaryMicrosoftDefinePInvokeMethod/AppDomain/PreserveSigdocs were opened; generatedpublicAPIexampleconfirms thismetadataapproach. Nativegenericfailure remainsunclassifieduntilfullgate; donotclaimitfixedfromprototypealone.
+
+Prototype security review (Locke): PASS forprototype-onlydispatch; originalreference savedbeforeedit, 9-argentrypoint/PreserveSig/finally-free,30sproductionbound,45slegacyoracleonly, no rawpathlogging. Run34040992290 atad982feb53 uses thisprobe andexistingfocusedtests. No productionlookupedit yet.
+
+Windows1 whole-job bound: cancelledrun completed2736passingtests versus2981in priorcompletedrun. Matchedtests took1244s vs996s (25%slower); remaining245tests took49.4s previously, about61.7s atobservedratio. Therewere no reportedtestfailuresbeforejobcancellation. Proposedci.yml platform-windows timeout25->30minutes gives finitebatch/cleanupmargin whilepreserving allsixshards, everytestcommand, per-testdeadlines and crash-onlyretry. Updateexistingci-workflows.test.ts budgetexpectation25->30. This isnot a code-failurewaiver and must stillcompletealltests; securityreviewmustconfirmno trigger/permission/runner/pin changes.
+
+Prototype34040992290 passedsamepath/shadow/HRESULTconformance (legacy3579ms, emitted402ms, shadow382ms, productionbound30000), and9focusedtests. Howeverminimal-environmentDesktopcasesstilltook82.7/76.9s. Thereforedo notlandtheproductionrewrite: itdoesnotremovefixture-pathlatency. Nextdiagnostic34041357794 isolatesPSModulePath, executablePATH/PATHEXT, andWindowsinfrastructureenv asfourstaticmodeswithoriginalproductionlookup. Theseareonlyrunner-localdiagnosticchanges; fullPATHinheritanceisnotauthorizedasapermanentfixturefixbecauseitwouldwidenexecutablevisibility.
+
+Confirmedfixturecause: keybisect34041973010 andsingle-variable34042207026 isolatePSModuleAnalysisCachePath. Inheritedpreparedcache: apply3731ms/AddType215ms; missing27309/22840ms, NUL23473/20008ms, emptyowned25964/22720ms. Thusfreshcacheanalysis—notjustC#binding—is thecost. Owned-copy34042446427 preservesoriginalcacheisolation andpassesoriginalscenario in12.9s withapply4632ms/AddType190ms. No productionlookuprewrite willland.
+Permanentfixturechange: Windows-only ownedmodule-analysis-cache path seededbycopy from anabsolute, regular, non-symlinkparentcachewhenavailable; no blanketenv/PATHinheritance. Missing/staleseedorchangedsizefallsbacktocoldownedcache; otherIOfailuresremainfailureswithoutloggingprivatepaths. Alloriginalmodel/credential/restartassertionsandguardsremain. KeplerindependentreviewPASS forownedseedingandracehandling; Windows30minwholejobbound separatelyPASS. Fulllatest-headCIstillrequired. Allinterpreter/FFIexperimentsremainonlyondiagnosticrefs.

devlog/_plan/260906_release_244_publish/030_dev_bump.md

@@ -0,0 +1,5 @@
+# Development version pre-move
+Dependencies: integrated frozen RC. MODIFY package.json only in a PR based on currentdev: version2.44.0 ->2.45.0, or NOOP only when freshdev already strictly outranks intendedstable2.44.0. No runtime/code/lock dependency change. Keep frozenRC at2.44.0.
+Inspect the defaultmain version of dev-version-bump.yml. If workflow_dispatch exists, dispatch frommain with intended-version=2.44.0 mode=pre-move and use generatedPR. If older main has onlyworkflow_call, create the established one-file versionPR via scripts/bump-dev-version.ts (--help/CLI inspected first) or exact JSON version rewrite. No local build/tests. Push scopedbranch --no-verify; require hosted exacthead CI and reviewed version-onlydiff, then authorizedadminPR merge todev. Verify origin/dev:package.json and ancestry fresh. Releaseworkflow assert-ahead independently enforces pre-move. A version collision is a blocker, not an automatic unreviewed versionchoice. Capture sourceSHA/version/PR/run proof in this unit.
+
+Current defaultmain workflow_dispatch was fetched and confirmed (exit0) on2026-09-06; the manual workflow path is selected.