[MrScripty]

Legacy library selection could exit the desktop before showing recovery. After upgrading download metadata, a retained failed download whose recorded destination folder is absent could also abort backend startup and leave a claim that blocked reopening.

The desktop now shows actionable recovery and offers a metadata-only upgrade using the canonical helper. It backs up only downloads.json, preserves its lifecycle partitions, requires the stopped-reader/writer and no-downgrade acknowledgments, and opens the library in the same window after backend readiness. Cancellation makes no changes, and close waits for an active upgrade. Model files are never copied or rewritten by the upgrade.

Startup retains missing-destination download records and their exact queue custody without creating folders or finalizing nonexistent outputs. Other capability and inventory errors still propagate. The recovery screen distinguishes successful metadata conversion from failed backend opening. Generic failed-construction claims retain their existing conservative ownership contract; this change does not introduce automatic dead-PID claim takeover.

Release validation also fixes platform-aware Python invocation, current-version notice packaging, and tests that incorrectly included fixture setup or elapsed cooldown in their behavioral deadlines.

Repair verification — 2026-10-12

Current head: 036bed9cb60a91a440034b7324fd6f611ea58c2a. Four repair commits and one portable-fixture follow-up repair the reviewed desktop regressions and the two CI failure mechanisms. The existing branch and prior commits are preserved; no duplicate PR or playground code is included.

• Backend recovery: failed replacement startups continue the admitted retry sequence with the existing backoff and maximum-attempt limit. Initial migration/unavailable refusals still do not begin automatic recovery. Regressions cover both initial refusals and exhaustion of all three replacement attempts.
• Minimum-window accessibility: the recovery view scrolls without shrinking its confirmation card. A real Chromium check of the production renderer at 360×400 proves pointer scrolling, cancellation without an upgrade call, keyboard access to both acknowledgments, and exactly one confirmed submission. Its IPC bridge is simulated; it does not migrate a library.
• GGUF acknowledgement evidence: the fault matrix drains the background owner before injecting faults, reopens an independent reader and proves its positive path, then retains all twelve refusal cases. A controlled interleaving reproduced the prior CI signature: a canonical reindex between primary lookup and descriptor resolution repairs an index-only fault. Four explicit repair transitions now run after both refusal assertions. Production eligibility/security code is unchanged.
• Frozen audio acquisition: the qualification-only selector uses the existing owned installer with public indexes disabled and only the existing recipe's wheel URLs/hash fragments advertised. Named dependency roots are preserved so pip's installed metadata remains unchanged. Managed interpreter identity is checked before wheel acquisition; the whole artifact set is checked before moving or executing staged packages. All source pins and retained-byte/confinement assertions remain unchanged. Ordinary runtime selection is unaffected.

Current-head Build 38247599905 passed: all nine applicable jobs succeeded, including full Rust quality, headless no-inference, frontend/desktop contracts, and native Torch QA on Ubuntu, macOS and Windows. The separate current-head CodeQL analyses also passed. Tag-only release/package jobs were skipped as designed; this is PR acceptance evidence, not release approval.

The audio qualification job installed and validated the exact frozen cohort, passed real Linux confinement, imported Torch/Cohere dependencies and performed a CPU operation. Its receipt reports child_tree_drained=true, production_available=false; all three controlled private-session lifecycle tests passed. It did not load a pretrained model or transcribe audio. The Linux inference review built/extracted the exact-source archive and passed import/load/finite 256-dimensional embedding/unload/graceful shutdown through real pinned ORT with an untrained synthetic graph. This does not qualify Nomic or learned embedding quality. Audio and ONNX evidence artifacts are attached to the run with seven-day retention.

Local verification:

• App-manager: 326 passed, 3 existing ignored with test-support, plus one ignored doctest; all-target/all-feature Clippy and Rust formatting passed. The initial aggregate attempt failed nine tests because the sandbox home config directory was read-only; the complete rerun with a task-owned XDG_CONFIG_HOME passed.
• GGUF integration target: 10 passed, including the complete twelve-fault matrix and positive repair transitions.
• Electron: 271 passed, 1 designated native-preload skip; lint, types and build passed.
• Frontend: 921 passed, 1 designated skip; lint, types and production build passed. The new browser regression failed against the old layout and passed after repair.
• Python: 347 passed, plus headless-owner checks 8 passed, 1 platform skip; Ruff lint/format passed across 93 files using the repository's development requirements. Tiny locally generated wheels with real pip prove byte-identical installed manifests for named versus pinned-link discovery and refusal of a wrong wheel hash. No model/runtime weights were downloaded.
• Release scripts: 33 passed; dependency ownership, version alignment, default/S3 attribution and diff checks passed.

Independent review covered desktop, GGUF and audio repairs with no remaining blocking finding. Local evidence does not claim native Electron packaging, live-library migration, complete installed audio confinement or pretrained-model inference. The earlier audio artifact transfer returned proxy HTTP 403; its exact differing selection field remains unverified. The source-level acquisition drift is repaired without guessing that artifact's contents. The playground's separate mixed-length ONNX batch limitation and planned download-location reconciliation are outside these changes.

Earlier author-reported validation (not all rerun at current head by this review):

• Full Rust workspace (excluding the BEAM-only Rustler NIF), integrations and doctests passed; core 2,101, app-manager 322, RPC 410, UniFFI 17 unit tests passed. All-feature/all-target Clippy and formatting passed.
• Frontend: 921 passed, one designated skip; types, lint and production build passed. Electron: 269 passed including the native production-sandbox preload; current script lint passed.
• Python unit/release/consumer/qualification, acceptance self-test, native Torch, launcher and release-script checks passed on the unchanged source portions.
• Rebuilt optimized backend, Debian and AppImage; both extracted installers passed resource checks, RPC readiness and native ORT smoke.
• Native packaged upgrade with a retained missing-folder download reached readiness in the same window, closed cleanly, and reopened cleanly. Cancellation, both acknowledgments, exact private metadata backup, unchanged retained download/custody and absent-folder preservation were verified.
• Metadata-only CLI upgrade with a 4 TiB sparse model preserved inode, size, allocated blocks and all filesystem timestamps and created no model backup.

Reviewed one observed failed-start claim separately under a native physical-root lock, with the exact unchanged generation rechecked in a transaction and a private metadata-only registry backup. Upgraded library metadata remained byte-identical; no model payloads were read or changed. No private configuration, registry data, binaries or original checkout edits are included in the commits.

The latest Debian artifact was rebuilt from commit 1a78ea8 (SHA256 7689df1f3b28fa9d8d0580193ab0c27fbabb4abaee5681d008f0e6917191efb7). Published history is preserved. The review worktree is retained and locked for PR/artifact consumers, owned by the user; no automatic sync/rewrite/merge, retirement only after PR disposition and artifact preservation with commit reachability verified.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2828820c-3b3b-4c82-a0db-1fc28279aa31

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 4/5

[Medium impact] Test stabilization and release notice path updates.

Fix the missing timeout constant on non-Linux-x86_64 test builds before merging.

Findings

1.  Tests fail on other platforms ▶

Summary

The PR packages the notices for 0.8.0-rc.1 and updates both attribution inventories.

• Electron packages include notices for the current workspace version.
• Rust install tests allow fixture setup before checking their timing behavior.
• The cache test accounts for time spent reopening before checking cooldown.
• Local-start tests wait for inherited handles to release the physical lease.
• RPC and embedding tests start behavior checks after fixture setup.
• The release-gating test selects Python using the platform or environment.

_{Reviews (1) · Last reviewed commit: "test(discovery): await fork-inherited le..." · Reviewed by Greptile}