[jahands]

Result: Windows arm64 release job 579s → 225–280s (−52% to −61%)

Wall-clock from "JS bundle ready" to "Windows arm64 done", measured on this fork in the same run as the unchanged baseline. Unsigned, because the fork has no Azure signing secrets:

	Baseline (windows-11-arm builds everything)	#1 (tuned windows-11-arm)	This PR (Linux build + arm64 verify)
Bundle ready → Windows arm64 done	486–579s	300–316s (−37%)	225–280s (−52% to −61%); the upper end is a run that waited 64s for the Linux arm64 WSL tarball
Desktop packaging step	114–125s	114–128s	24–25s
pnpm install	170–280s	41–48s	2–3s (Linux, cached)

Upstream production, for reference: this job took 610–780s signed on recent nightlies and was the last desktop job to finish, so Publish GitHub Release waited on it. At ~225–280s it finishes before macOS arm64 (~344s) and the release test shards (~310–360s), so it is no longer the release's critical path.

The Windows arm64 release job ran entirely on GitHub's windows-11-arm (4 vCPU) and took 610–780s per nightly upstream, against ~234s for Windows x64. Almost none of that work needs Windows arm64: it packages a prebuilt JS bundle with prebuilt arm64 natives and signs it.

This builds and signs the Windows arm64 installer and CLI archive on a 16-vCPU Blacksmith Linux x64 runner, and keeps only the checks that execute arm64 code on windows-11-arm:

• release-desktop.yml gains verify_runner. When set, the build job skips everything that runs the packaged binaries, uploads the unpacked app plus esbuild-bundled verify scripts, and a verify job on that runner loads the packaged natives (fff probe, bundle self-check) and smoke-tests the CLI zip. No checkout or install there.
• Cross-host pieces: CLI SEA via build-exe --target win-arm64, zip via zip, resource monitor via cargo xwin (cache miss only), signing via jsign (Azure Trusted Signing) through electron-builder's signtoolOptions.sign hook and the CLI archive signer. The NSIS uninstaller is read out of the stub with electron-builder's own UninstallerReader (its macOS path) via a one-line app-builder-lib patch, so no wine.
• Linux jobs build/upload their CLI archive before the AppImage, so Windows gets its WSL runtime ~90s earlier.
• Runner size, bundle ready → verify done: 8 vCPU 242s, 16 vCPU 225s, 32 vCPU 222s (desktop packaging 35s / 24s / 25s). The rest of the job is uploads, downloads and waiting on the Linux arm64 CLI archive, which more cores don't change.

Parity checks: CLI zip file list matches the upstream nightly's except node-pty/build/Release/conpty/*, which node-pty's postinstall only creates on a Windows host and which nothing loads (natives load from prebuilds/win32-arm64, which ships the same conpty files). Signed files match production's list (27 desktop files incl. uninstaller and installer, plus t3.exe), verified with a self-signed certificate through the same hook.

Implications:

• Signing with Azure is untested — the fork has no Azure secrets. The jsign path was exercised end to end with a self-signed PKCS12 keystore; jsign reads AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET itself. First real nightly is the proof.
• The Linux-built installer was installed and run on a Windows ARM machine by hand.
• The CLI archive is now built before the desktop artifact on every platform (resource monitor built explicitly on cache miss, branding applied first). On macOS this moves the CLI keychain import before electron-builder, untested here.

Alternative to #1, which keeps the build on windows-11-arm and gets ~37%.

Built with Claude Opus 5.5 via Claude Code.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.9 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	2	—	8	✅
Claude	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	21.2 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	2	—	8	✅

Baseline: unavailable · PR result: a5c036c · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[jahands]

Replaced by #4. This PR's branch also backs pingdotgg#22428 and was rebased onto upstream main.