fix: unblock Windows lifecycle tests and reduce Cursor blob admission cost

devlog/_plan/260906_release_244_publish/000_plan.md

@@ -0,0 +1,16 @@
+# 2.44.0 release train
+
+Loop: satisfy-spec / C4. Trigger: maintainer explicitly requested main + preview merges and deployment after PR3771 CI passes, with cxc-loop. Goal: verified npm preview and stable2.44.0 plus release docs. Non-goals: local suites/typecheck/build, liveKiro, unrelated features, native stacks, rebase, direct protected-ref pushes, credential/settings changes. Verifier: GitHub exact-SHA jobs and actual Test steps, release workflow immutable SHA guards, npm metadata/digests and source-bound docs deploy. Stop: all five units done with receipts; never count pending/skipped as pass. Memory artifact: this numbered unit + .tmp/release-244 + bound goalplan. Outcomes: DONE only with published channel proof; failed gates remain unresolved; ambiguous publish requires registry inspection. Escalation: missing actual account authority or outstanding maintainer objection, unplanned security defect, or exhausted evidence-driven attempts. Existing GitHub/npm OIDC access only; user supplied no numeric token/time budget. Operational review checkpoint: six hours or five failed evidence-driven attempts per release surface; do not call that success. Leaves have read-only audit scope; main reclaims failed dispatches.
+
+## Dependency order
+1. Roadmap docs only (010).
+2. Exact regression candidate integration and freeze (020).
+3. dev pre-move2.45.0 (030).
+4. Independent preview promotion, dry run and publication (040).
+5. Independent stable promotion, dry run, publication and docs proof (050).
+
+Fresh baseline: main06ec553630fa2ee51a96b5cbf694089021249194/latest2.43.0; preview53c784c2a635b061799e4f7542432a921f548bf9/2.43.0-preview.20260906; devbd1cda99c162e3b4b41b14f6ad5ca2cf6f1a1f03. Candidate69f9e07c4fa7b80bcda9e4ba28e3c64f42187828 includes that dev. Service34034184142 all3pass; manualCI34034178072 completed with one Windows3/6 cold-restart apply deadlinefailure; originalWindows25 and macOScontrol20404/0 nowpass. #3763 deferred documentation remains user-withdrawn; #3644 field report remains unresolved, with no runtime-fix claim. This train does not silently reinstate either task.
+
+Authority: MAINTAINERS.md and scripts/release.ts / .github/workflows/release.yml. Local release helper is not invoked because it runs local suites and can push. Existing workflows perform build/audit/pack/publication on hosted runners. No new runtime field/enum or enforcement is added. GitHub required checks/immutable workflow guards are enforcement; manual admin integration remains bypassable owner authority and is documented accurately. SoT sync: no architecture/CLI contract changes; public release notes generated by the existing changelog builder. Existing dashboard evidence from prior verification is reused with exact source provenance, never claimed as a new render.
+
+Latest user steering: no heartbeat automation; track all CI and release workflows by direct bounded polling in this task. Automation3771-ci-dev is absent (delete returnednot_found). No replacement automation is authorized.

devlog/_plan/260906_release_244_publish/010_roadmap.md

@@ -0,0 +1,6 @@
+# Roadmap lock
+Dependencies: none; consumes previous verification-only conclusion, whose no-release limit is superseded by the new explicit maintainer request.
+NEW local numbered000/010/020/030/040/050 documents and goalplan. No product delta or remote publication in this cycle. Before: no release-authorized active plan. After: dependency-ordered audited plans with all final-head/registry criteria. Review complete docs and live workflow inputs; source audit commands are read-only. Check `git diff --check`, required doc existence and nonempty criteria; these verify documents, not product runtime. Commit these records on codex/release-244-publish-07c0 only. Keep this commit out of PR3771's already-running head. D records independent audit and next020. Existing no-local-suite constraint still applies.
+
+## Locked CI event contract after independent audit
+Windows1/6 through6/6 and macOScontrol are RC/#3771 validation gates. For version-only independentpreview/main promotions, require each finalSHA's successful push-event Cross-platformCI and sameSHAServiceLifecycle; do not launch laneall on a releasebranch while its pushrun is active, because branch-ref cancel-in-progress can cancel the requiredpushrun. If any runtime/source drift from frozenRC appears, stoppromotion and returnto RCvalidation. An extra manualrun, if actuallyneeded, starts only afterpushCI completion. This is the predeclared gate mapping, not a waiver of a failedtest.

devlog/_plan/260906_release_244_publish/020_integrate.md

@@ -0,0 +1,23 @@
+# Regression integration and immutable RC
+Dependencies: roadmap. Initial pre-diagnostic scope: no new production code was planned; the later test-only SPAWN_BUDGET_MS change for apply.child.exited is recorded below. PR3771 already contains tests/preload.ts, tests/ci-workflows/test-runner.test.ts, src/adapters/cursor/native-exec.ts and tests/providers/cursor/cursor-blob.test.ts. Before: open draft69f9e07c4. After: reviewed green PR squashed into dev and recorded integrated RC with package2.44.0.
+Read `gh pr view 3771 --json headRefOid,baseRefName,state,statusCheckRollup,reviews` and GraphQL reviewThreads plus live maintainer permission. Read manualCI34034178072 and lifecycle34034184142, asserting head equality and actual Windows1..6 Test/macOScontrol execution. Original25 Windows cases must pass; Cursor4096/4097 original bound and added expiry/accounting tests must pass. Trigger scenarios are original failures and missingcapability/expired-pin cases already encoded in regression tests. If red, inspect failing job logs and only repair the scoped cause in an amended unit; no retry-as-fix.
+When all required exacthead checks/reviews pass, record maintainer integration evidence in PR body, mark ready and `gh pr merge 3771 --admin --squash --match-head-commit <fresh-head>`. Validate dev base immediately before merge. Fetchdev, verify merge commit ancestry, and record RC as the integrateddev commit. Any later devcommit is not silently added to RC. No directdevpush. Host CI verifier APIs already ran successfully (exit0) and read this exact head, while final conclusions remain pending.
+
+## Fresh release blocker discovered during roadmap audit
+At69f9e07c4 manualCI34034178072 Windows3/6 job101489123778 fails tests/claude-integration/claude-desktop-remote-hub.test.ts stored-profile=true on its30second RemoteDesktop apply deadline; falsecase passes in61.7seconds total. macOScontrol is nowgreen. Extend this unit to diagnose/fix the newly observed Windows release-validation failure using explicit hypotheses and hosted baseline/candidate evidence, preserving original behavior assertions and isolation. Candidate file scope is that fixture and its direct CLI apply dependency only if diagnosis establishes runtimecause. No change justified by merely increasingbudget/retrying. Update this plan with exactdiff and independentreview before implementation. #3771 cannotmerge until allgates pass.
+
+## Diagnostic diff before repair
+PreviousD locked releaseorder and gateeventcontract. H1 loopbackdownloadfails5secondbound; H2 Windowschildnativework (PowerShell/icacls) occupies30seconddeadline; H3 commandfails to reachprocess.exit. Falsifiers: fetchstart/endtiming, nativeprocesscategory+duration, processexitmarker and alive-at-deadline. Per-process timers afterprocess.exit cannotexplainfailure.
+FirstB diagnostic only: temporarycontents:read Windowsworkflow on separatecodex/diagnose-desktop-apply-07c0 rooted at69f9; pinnedcheckout/setup, existinginstall/build. MODIFY tests/fixtures/claude-desktop-network-guard.ts onrunner to wrapBun.spawnSync/fetch/process.exit with fixedevent/category/millisecond receipts to a fixtureownedfile; preserveoriginalnetworkpermit. MODIFY failingtest onrunner only to print atmost512fixedrecords in a finallyblock aroundunchanged30000msdeadline. No rawargs/URLs/tokens/stdout/stderr or productionpatch. Exact instrumentation and workflow are .tmp/release-244/ci-repair/instrument-desktop-apply.py anddesktop-apply-ci.yml. BaselineWindowstrue/falsepassed82.1/79.5seconds total; candidate69.3failure/61.7pass doesnotisolateapplycost. Reviewdiagnosticthenexecute; use findings to amend exactrepairdiff and re-audit before production/testpatch.
+
+Diagnostic audit synthesis: reviewerconfirmedpermissions/pins/networkguard/30sdeadline andprivacyscope. Added asynchronousBun.spawn completiontraces (not justspawnSync) tocover asyncACL. Removedredundantglobal--timeout60000 fromisolateddiagnostic (eachcasealready240000 andcleanup90000). JSONLsplit findingrebuffed withgeneratedTS static inspection: Pythonwrites oneescaped\\n intoTSstring, whose runtimevalueisnewline; replacingitwithphysicalnewlinewouldbreakTS. No repositorytests/typecheck/buildran; onlyfilegenerationintoscratchwasinspected.
+
+## Measured cause and proposed one-file harness repair
+Diagnostic34035944642 at9358fad1: apply25,929ms exit0; nativeknownfolderPowerShell22,811ms, SID197ms, hubdownload10ms, ACLsteps16-19ms each, registry24/16ms, process.exit0. H1downloadstall and H3exit/lingeringhandle rejected in this trace. H2 refined to actualWindowsknownfolder lookup cost, notACL. src/codex/user-identity.ts explicitly gives this lookup30seconds; an end-to-end30secondapply test budget can expire before a validnear-budget lookup plus requiredCLIwork finishes. Producttimeout remains30seconds.
+Proposed MODIFY tests/claude-integration/claude-desktop-remote-hub.test.ts ONLY: importexistingSPAWN_BUDGET_MS from ../helpers/test-budget; replace apply.exited30_000 withSPAWN_BUDGET_MS(45_000). Explain measuredlookupcost in comment. Preserveoveralltest240s, cleanup90s, networkguard and allmodel/profile/restartassertions. No productguard/ACL/identity changes. Beforepermanentedit, hostedcontrolledslowlookup: nativePowerShell command pads its realexecution to28s inside the unchangedproduct30sbound, only in diagnosticclient. Original30sbudget mustfaildeadline;45s candidate mustpassoriginalassertions. Then removeinjectedslowlookup and mutate productionapplysnapshotchosenalias20260211->validbutwrong20260911; the45s test mustfailonmodelassertion (notdeadline), satisfyingtests/helpers/test-budget.ts requiredablation. Followwith uninstrumentedexactheadall-laneCI andlifecycle. No retry-as-fix and no change to4096/4097or original25cases.
+
+Independent Hilbert review: VERDICT PASS. The30s wholeCLI deadline is narrower than the product's30s lookup plus measuredrequiredwork; existing45sSPAWN_BUDGET remainsbelow240stest. Acceptance remainsconditional on controlledvalid28slookup red/green and wrongalias modelassertion ablation. Diagnostic34036362222 at29fa76f07 isrunning these onhostedWindows with unchangedproductguards. No permanenttestbudgetedit yet. Primaryoperator explicitly requested directpoll; noheartbeat exists.
+
+## Hosted proof and permanent delta
+34036362222 (29fa76f07): controllednativeknownfolderlookup28,226ms completedwithinproduct30s; oldwholeCLIdeadlinefailed30,004ms withchildstillalive. Canonical45s case exited0 at31,381ms andall22originalassertionspassed. Itsablationstep didnotexecute because diagnosticPythondefaultCP1252 couldnotreadKoreanUTF8source; notaproductfailure.
+34036626846 (247651739): UTF8-correct standaloneablationran with45sbudget; validbutwrong20260911aliasmadeoriginalwritten.inferenceModels.toEqual(snapshot.models) fail in57,052ms testcase, withoutapplydeadlinefailure. This proves thelongerbudgetdoesnotmaskthemodelidentityregression. Permanentdelta nowonlyimportsSPAWN_BUDGET_MS andusesitforapply.child.exited; allproducttimeouts/guards/assertions unchanged. Fulluninstrumentedlatest-headCI/lifecyclewillrunagain beforeintegration. Diagnosticworkflows andfaultinjections remainoffPR.

devlog/_plan/260906_release_244_publish/030_dev_bump.md

@@ -0,0 +1,5 @@
+# Development version pre-move
+Dependencies: integrated frozen RC. MODIFY package.json only in a PR based on currentdev: version2.44.0 ->2.45.0, or NOOP only when freshdev already strictly outranks intendedstable2.44.0. No runtime/code/lock dependency change. Keep frozenRC at2.44.0.
+Inspect the defaultmain version of dev-version-bump.yml. If workflow_dispatch exists, dispatch frommain with intended-version=2.44.0 mode=pre-move and use generatedPR. If older main has onlyworkflow_call, create the established one-file versionPR via scripts/bump-dev-version.ts (--help/CLI inspected first) or exact JSON version rewrite. No local build/tests. Push scopedbranch --no-verify; require hosted exacthead CI and reviewed version-onlydiff, then authorizedadminPR merge todev. Verify origin/dev:package.json and ancestry fresh. Releaseworkflow assert-ahead independently enforces pre-move. A version collision is a blocker, not an automatic unreviewed versionchoice. Capture sourceSHA/version/PR/run proof in this unit.
+
+Current defaultmain workflow_dispatch was fetched and confirmed (exit0) on2026-09-06; the manual workflow path is selected.

devlog/_plan/260906_release_244_publish/040_preview.md

@@ -0,0 +1,4 @@
+# Preview promotion and publication
+Dependencies: frozenRC plus verified dev-ahead. NEW ordinary promotionbranch from freshpreview; MERGE immutableRC with normalmerge (no rebase/force); resolve only reviewed branch/version conflicts. MODIFY package.json fromRC2.44.0 to2.44.0-preview.YYYYMMDD (execution-day UTCdate, choose next suffix only if existing version requires it after explicit freshregistry inspection). All other source tree entries must equalRC; assert `git diff --exit-code RC HEAD -- . ':(exclude)package.json'` after resolving history. No2.45.0dev pre-move in releasecandidate.
+Open template-complete preview promotionPR; include actualprior dashboard screenshot and exact source evidence because release delta includes dashboard changes. Target exemption is release promotion, not a featurePR. Inspect required checks and maintainer objections; user explicitly authorizes this promotion. Merge using allowedPR method/admin as authorized with exacthead guard; neverdirectpreviewpush. Fetch finalpreviewSHA, proveRCancestor and packageversion.
+For finalpreviewSHA require successful ci.yml eventpush and service-lifecycle.yml sameSHA (manual lifecycle if auto absent); Windows6 and macOScontrol are already required on the unchangedRC; do not claim push'sskippedWindows tested. Never dispatch manualCI on preview/main while the requiredpushrun is active (sharedref concurrency cancels it). Runtime drift returns toRCvalidation beforepromotion. RC all-lane evidence is separate from final push gate; source-only-equivalent versiondelta is documented. Dry-run release.yml frompreview with version, tag=preview, expected-sha full40 and dry-run=true. Waitsuccess, inspect dry-run buildpack, then sameSHA dry-run=false. Neveroverlap publish workflows; existing release concurrencyserializes. Read back npm exactversion metadata+dist-tag+gitHead+dist.integrity+attestations, verify tarball digest andprovenance against releaseSHA; verify vversiontag and prerelease. No localinstall/suite/build. If publish response ambiguous inspectregistry/tagfirst, never duplicatepublish. Oldpublishedversion remainsrollback installtarget; changing dist-tag/rollback is onlydone if actuallyneeded andauthorized, not as a test.

devlog/_plan/260906_release_244_publish/050_stable.md

@@ -0,0 +1,4 @@
+# Stable promotion, publication, and closure
+Dependencies: previewpublished proof, immutableRC and devahead. NEW ordinary main promotionbranch from freshmain; merge the SAME RC independently, preservingmainhistory. Finaltree equalsRC and package2.44.0; do not merge previewversion ordev2.45.0. Resolve explicit conflicts and verify RC ancestry and tree identity. PromotionPR uses full template, release exemption, previous dashboard screenshot/evidence and author attribution preserved by originalhistory. Honor outstandingmaintainer objections and exacthead checks; allowedadminmerge remains explicitowner action, not independentapproval.
+After mainPRmerge fetchfinalmainSHA and require sameSHA successful push-event CI plus a successful `service-lifecycle.yml` run for the same finalmainSHA, covering all three jobs. Run hosted release.yml dry-run=true then false frommain, version=2.44.0 tag=latest `expected-sha=<full 40-character finalmainSHA>`; serialize afterpreviewpublication. Verify npm latest/version/gitHead/integrity/provenance, tagv2.44.0 and GitHub release target. Read deploy-docs.yml triggers and default branchsource; wait successful Pages deployment for finalmainSHA or dispatch the existingworkflow if required bypathfilters, then inspect site response/sourceproof. If workflowredafter acceptednpm publish, inspectactualregistry/tag/release state before recovery; create only missingmetadata using existing validatedchangelog, never republishsameversion.
+Finalcheck rereads dev/main/preview refs and versions, verifiesboth tags/artifactdigests and publishedinstall-smoke evidence from releaseCI. Record GUI/runtime field limitations accurately (Kiroquota absent, Windowsquota fieldissue3644 not newlyvalidated). Update boundgoalplan/ledger and verify no heartbeat automation remains and complete directpoll tracking after allcriteria met. Keep cleanup scoped: no worktreedeletion, no massbranchcleanup, no localdaemon/installmutation. D reports both publishedversions and proofURLs. Any incompletegate remainsopen.