[addisdev]

LOOP-PLAN.md Phase 6 (the four CI items; the identity-provider item waits on WB-350) and two of the Release hygiene checks (changelog coverage, generated counts). The mermaid check is left to the docs session (#90); docs.yml is untouched.

New GitHub-hosted jobs (all path-filtered through ci.yml like their siblings)

• fleet / launchd smoke (macos-latest): fleet service install → plist lints → collector answers /api/v1/health → agent registers → fleet service status exits 0 → reinstall (hits the bootout/bootstrap race; the log shows "launchd is still letting go of the old job; waiting" and recovery) → uninstall → nothing answers, plist gone, launchctl print gui/<uid>/com.addisdev.fleet fails, status exits non-zero. The runner does have a gui/501 domain; the job prints it first.
• fleet / windows task smoke (windows-latest): same lifecycle for the scheduled task.
• fleet / container smoke (arm64): the existing container job became a two-row matrix; the arm64 row builds natively on ubuntu-24.04-arm and asserts the container says aarch64. The amd64 check keeps its name.
• desktop / launch smoke (ubuntu-latest): cargo build --features custom-protocol, then desktop/ci/launch-smoke.sh under Xvfb. Half 1: launch the binary with no config, sidecar's collector answers and its agent registers, app still up after 20 s, SIGTERM stops the app and its sidecar. Half 2: tauri-driver + plain W3C WebDriver over curl: title Fleet, window.__TAURI__ present, get_status over IPC says running: true, headline renders Running: brain, agent · :8788, screenshot uploaded as the desktop-launch-smoke artifact. So WebDriver, not just process-level.

Bugs the jobs found, fixed here

1. The Windows scheduled task had never started anything. /TR was built with \" escaping; execFile quotes the argument itself, so the task stored \"C:\...\node.exe\" and failed with 0x80070002 (file not found). Now bare quotes (windowsTaskCommand, unit-tested). Uninstall/stop also kill fleet up's tree by the supervisor pid (only while the task reports Running) before /End, since deleting a task does not stop it. With the fix, a Windows agent registered against a real collector for the first time.
2. Desktop: SIGTERM orphaned the sidecar (first run: "after SIGTERM to the app: its sidecar is STILL RUNNING"), and RunEvent::ExitRequested refused every exit, including Quit's app.exit(0). Now SIGTERM/SIGINT/SIGHUP take the Quit path via signal-hook (new dependency, unix only), and only the implicit exit (code == None) is prevented. The smoke asserts it.

Release hygiene

• changelog coverage (job in ci.yml, in ci-ok's needs; skipped unless the head is release/* or it's develop→main): scripts/changelog-coverage.mjs + scripts/changelog-coverage.test.mjs. First-parent merge/squash subjects on the PR head since the newest v* tag, against the text between ## [Unreleased] and the last tag's heading; no-changelog label (created) and Dependabot exempt; labels looked up with gh only for unmentioned PRs. Documented in CONTRIBUTING (release branches must be named release/X.Y.Z; changelog bullets end with a PR link). The two existing [Unreleased] bullets got their PR links (Installers copy skills/ from the release #86, Docs catch up with 0.8.0 and the explore work #88), which the check otherwise flags.
• Generated counts: <!-- count:workloads -->N markers on the 7 hand-written counts (README ×2, collector/README, docs/index, docs/workloads/index, getting-started's "thirty-odd" → exact, install/macos's stale "thirty"). scripts/check-counts.mjs reads catalog.ts as text (no npm ci) and runs in a new unconditional repo scripts job, so docs-only PRs are checked too; markers inside code spans are ignored. The collector suite gained a step that checks that text count against the real imported CATALOG (collector/scripts/check-counts.ts).

Not verified

• Nothing macOS-specific about the desktop app: tray, menu items (Quit's path is now exercised via SIGTERM, the item itself never clicked), dashboard window, notifications, bundle, signing, the Local Network bet.
• Any service surviving a reboot; a graceful stop on Windows (the tree is killed, the collector does not drain). Whether /End alone would have left the children running was not tested separately; the tree kill is from reasoning about Windows process semantics.
• The changelog job against a real release: exercised on a throwaway release/* PR ([throwaway] exercise the changelog coverage job (do not merge) #91, closed, branch deleted). It passed with Installers copy skills/ from the release #86/Docs catch up with 0.8.0 and the explore work #88 mentioned, and failed naming #88 Docs catch up with 0.8.0 and the explore work once that mention was removed, so the gh lookup works with GITHUB_TOKEN.
• Desktop shim on Linux prefers /usr/local/bin/node over PATH; GitHub's image has an old Node there, so the smoke sets FLEET_NODE. Recorded in desktop/README, not changed.

Test evidence

• All 29 checks on this PR green, including the four new jobs, repo scripts and the docs build.
• ultra: collector CI=true npm test → ALL PASS (incl. ok scripts/check-counts.mjs and CATALOG agree: 34 shipped workloads); fleet npm test → tests 81, pass 79, fail 0, skipped 2 (the two end-to-end tests skip there without runner-machine deps; CI's fleet matrix runs them); node --test scripts/*.test.mjs → tests 15, pass 15, fail 0; node scripts/check-counts.mjs → ok -- 7 marked count(s) agree: 34 workloads.

🤖 Generated with Claude Code

[addisdev]

Self-review: launchd/Windows task/arm64 container/desktop launch smokes, the Windows schtasks quoting fix and desktop signal handling, changelog-coverage and count checks. All 29 checks green. Merging (LOOP-PLAN Phase 6 + release hygiene).