[2053 by GPT-5.6 Sol] Make Windows cleanup-controller protocol complete and invocation-attributed

[propr-dev]

AI Implementation Summary

Closes #2053

Branch: 2053/gpt-5.6-sol-make-windows-cleanup-cont-20260901-2205-5eo
Commits: ✅ Changes committed (bb0a012)

---

AI Processing Completed

Execution Details:

• Issue: Make Windows cleanup-controller protocol complete and invocation-attributed #2053
• Repository: integry/propr
• Status: Success
• Execution Time: 16m 24s
• Tokens used: 5.14M tokens [5.1M input + 39.74K output]
• API cost: $4.50
• Timestamp: Sep 1, 2026, 10:21 PM UTC
• LLM Model: GPT-5.6 Sol
• Subscription usage: Weekly +2%

Summary:
Implemented issue #2053.

Key changes:

• Added explicitly flushed STARTUP and TERMINAL records in the cleanup controller body.
• Preserved four-class startup failures in the wrapper.
• Added fixed invocation identifiers to all cleanup-controller callsites.
• Added bounded parsing that rejects partial, malformed, oversized, duplicate, reordered, extra, and inconsistent records without transporting raw output.
• Added outer Job Object ownership, concurrent stream draining, cancellation/timeout handling, and complete tree termination in the Windows supervisor tests.
• Added focused protocol and lifecycle regressions, including stream races and termination failures.
• Updated release contract assertions in release-workflow.test.ts.

Validation:

• Desktop suite: 177 passed, 6 platform skips.
• Release workflow suite: 23 passed.
• Native Windows x64/ARM64 execution remains for CI.

Detailed Logs:

• Conversation: 111 messages
• Session: 01a05f02-6eda-7673-906d-a30b64c1c5fe

Log files stored at:

• conversation: /tmp/claude-logs/issue-2053-2026-09-01T22-21-45-958Z-conversation.json
• output: /tmp/claude-logs/issue-2053-2026-09-01T22-21-45-958Z-output.txt

Latest Conversation Messages

---

This PR was created automatically by ProPR after processing issue #2053.

---

💡 Need changes?

Comment on this PR to request refinements — the AI agent monitors comments and will update the implementation based on your feedback. Keep iterating until you're satisfied!

[integry]

Ultrafix follow-up on exact head bb0a012. Preserve the controller ownership/invocation framing and fix these three independently reproduced blockers:

1. Native Windows x64 and ARM64 both reach a valid two-line, zero-stderr, exit-125 terminal transport, but the invocation Job Object is queried for zero active processes immediately after root exit before accounting quiesces, causing false ACTIVE_TREE_AFTER_EXIT and termination. After root exit, boundedly wait/poll for the job active-process count to reach zero before classifying a lifecycle mismatch or terminating. Retain the mismatch and fail-closed termination if it remains nonzero at the deadline; do not weaken tree ownership.

2. The cancellation regression matrix currently iterates only false. Cover both cancellation before startup and cancellation after startup deterministically, with exact invocation attribution and bounded cleanup.

3. IsProtocolValid accepts mismatched fixed failure status/exit pairs. Enforce the exact mapping: MANIFEST_VALIDATION_FAILURE=20, CHILD_STDOUT=21, controller timeout/status-specific 122/123/124 as defined by the existing protocol, and generic controller/finalization failures=125. Add negative tests such as MANIFEST_VALIDATION_FAILURE with exit 125 and CHILD_STDOUT with exit 21, plus positive exact-pair tests.

Run focused/static tests and both native Windows architectures. Keep exactly one terminal line, fixed stderr/exit framing, durable controller-owned evidence, and bounded descendant cleanup. Report the exact new head.

[propr-dev]

✅ Applied the requested follow-up changes in commit a72c081

Summary of Changes

Implemented the three follow-up fixes:

• Bounded Job Object accounting quiescence before classifying/terminating an active tree.
• Deterministic before-startup and after-startup cancellation coverage with exact invocation attribution.
• Exact protocol status/exit mapping with positive and negative regression fixtures.

Validation:

• Desktop tests: 177 passed, 6 platform skips.
• Release workflow tests: 23 passed.
• git diff --check: passed.
• Native Windows x64/ARM64 could not run from this Linux-only worktree.

Per instruction, no commit was created. Current exact HEAD remains bb0a012b13c47b5fbd1228c1fd4df75979c3033f; the automation must report the new head after committing these changes.

---

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 6m 29s
• Tokens: 1,178,137 (1,163,892 in / 14,245 out)
• Cost: $1.47
• Subscription usage: Weekly +1%

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5501268411✓

[integry]

Correct only the exact native PowerShell parser failure on head a72c081. Both Windows x64 job 100052136488 and ARM64 job 100052136470 fail before tests at test-installed-windows-app-supervisor.ps1 line 1514 because the interpolated string contains $expectedLifecycle: and PowerShell treats the colon as part of an invalid variable reference. Use braced interpolation, for example ${expectedLifecycle}, anywhere a variable is immediately followed by a colon, and scan the newly added block for the same syntax pattern. Do not alter the audited bounded Job Object quiescence, false+true cancellation matrix, exact status-to-exit mapping, production behavior, or assertions. Run the script parser/focused supervisor tests on both Windows x64 and ARM64 and report the exact new head.

[propr-dev]

✅ Applied the requested follow-up changes in commit 331085d

Summary of Changes

Corrected only the parser failure in test-installed-windows-app-supervisor.ps1:

":LIFECYCLE:${expectedLifecycle}:"

Validation:

• Official PowerShell parser: passed.
• Newly added block scan for similar unbraced interpolation: passed.
• git diff --check: passed.
• Diff: one insertion, one deletion; no behavior or assertions changed.
• Native Windows x64/ARM64 focused tests could not run on this Linux x64 host; they require the post-commit CI runners.

Per instruction, I did not commit. Current HEAD remains a72c0814a1cf4fe6db1ffd59a7d9d309c7b8fdf7; the exact new head will be assigned by the system’s automatic commit.

---

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 3m 5s
• Tokens: 241,013 (235,765 in / 5,248 out)
• Cost: $0.40

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5501350657✓

[integry]

Ultrafix the deterministic native failure on exact head 331085d. Both Windows x64 job 100053705828 and ARM64 job 100053706106 pass FIXED_PROTOCOL, then fail in Test-WorkflowCleanupProtocolStateMachine at ONE_LINE_STARTUP because the diagnostic does not contain the expected fixed OBSERVED:STARTUP category. The current assertion hides the actual bounded diagnostic.

First make every state-machine assertion failure append only the already fixed, invocation-attributed Get-WorkflowCleanupProtocolMismatchDiagnostic value; it is bounded and path-free, but reassert no dummy installer/path is present before including it. Then reproduce and correct the underlying capture/lifecycle semantics. ONE_LINE_STARTUP emits one complete exact STARTUP:READY line plus CRLF and exits 125, so after bounded stream drain it must deterministically report OBSERVED:STARTUP, LINE_COUNT:1, LIFECYCLE:EXITED, TREE_TERMINATION:NOT_REQUIRED, STARTUP_CLASS:READY, LINE_NUMBER:1. Do not loosen the expected category or accept a terminal record. If asynchronous drain/exit ordering overwrites a valid complete startup category, fix the ordering under the existing bound. Preserve the exact status-to-exit mapping, bounded post-exit Job Object quiescence, cancellation before/after startup, two-line success protocol, fixed output, and production authority.

Run the complete focused supervisor state-machine test on both Windows x64 and ARM64, not only the parser. Report the actual pre-fix fixed diagnostic, root cause, and exact new head.

[propr-dev]

✅ Applied the requested follow-up changes in commit 2d8532d

Summary of Changes

Implemented the ultrafix in test-installed-windows-app-supervisor.ps1.

The pre-fix failing path resolves to:

PROPR_WORKFLOW_CLEANUP_FIXTURE:PROTOCOL_MISMATCH:INVOCATION:PROTOCOL_REGRESSION:OBSERVED:NONE:LINE_COUNT:0:STDERR_COUNT:0:PROCESS_EXIT:125:LIFECYCLE:TIMEOUT_BEFORE_STARTUP:TREE_TERMINATION:COMPLETE:STARTUP_CLASS:NONE:LINE_NUMBER:0

Root cause: immediate fixtures inherited a 250 ms deadline, racing native pwsh startup. Additionally, clean-exit classification could proceed to Job Object accounting before bounded stream drain had stabilized capture state.

Changes:

• Immediate protocol fixtures now use the existing bounded 1,000 ms window; deliberate timeout/tree-race fixtures remain at 250 ms.
• Clean exits drain streams before post-exit Job Object quiescence and snapshot the fixed exit first.
• ONE_LINE_STARTUP asserts the complete required tuple.
• State-machine mismatch assertions append the diagnostic only after proving it is path-free and exactly reproducible through Get-WorkflowCleanupProtocolMismatchDiagnostic.

Validation:

• PowerShell parser: passed.
• One-line capture: STARTUP|1|125|READY|1.
• Desktop suite: 177 passed, 6 skipped.
• Release workflow: 23 passed.
• git diff --check: passed.

Native Windows x64/ARM64 execution cannot be launched from this Linux worktree without committing/pushing, which the instructions prohibit. The uncommitted base remains 331085db6baf3ffca345eaaa6261bb92e85f5f09; the exact new head will be produced by the system’s automatic commit.

---

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 11m 23s
• Tokens: 2,719,903 (2,692,272 in / 27,631 out)
• Cost: $2.75

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5501424376✓

[integry]

Final deterministic timeout-fixture correction on exact head 2d8532d. Both native Windows x64 job 100057584487 and ARM64 job 100057584465 now pass FIXED_PROTOCOL and ONE_LINE_STARTUP, then fail identically at TIMEOUT_AFTER_STARTUP. The newly exposed fixed diagnostic is OBSERVED:NONE, LINE_COUNT:0, PROCESS_EXIT:125, LIFECYCLE:TIMEOUT_BEFORE_STARTUP, TREE_TERMINATION:COMPLETE, STARTUP_CLASS:NONE, LINE_NUMBER:0. The case is still given only 250ms, which is shorter than native pwsh startup; production correctly classifies what it observed, so the fixture expectation is nondeterministic.

Keep 250ms for TIMEOUT_BEFORE_STARTUP and deliberate stream-race cases. Give TIMEOUT_AFTER_STARTUP a separate bounded startup-capable window, preferably using the existing capture startup signal/phase so the fixture proves its complete STARTUP:READY record was observed before the timeout countdown/assertion; otherwise use the existing 5-second after-startup bound already used by the cancellation matrix and explicitly assert STARTUP/1/READY/1 before timeout classification. Do not relabel NONE as STARTUP, weaken capture rules, or change production timeout semantics. Retain the anchored path-free diagnostic validation, ONE_LINE exact proof, status-to-exit mapping, Job Object quiescence, and cancellation matrix.

Run the entire supervisor state-machine test through its final PASSED marker on both x64 and ARM64, not just the corrected case, and report the exact new head.

[propr-dev]

✅ Applied the requested follow-up changes in commit 25e00ef

Summary of Changes

Implemented the deterministic timeout-fixture correction in test-installed-windows-app-supervisor.ps1:

• Waits up to five seconds for the capture’s complete startup signal before starting the 250 ms after-startup countdown.
• Explicitly asserts OBSERVED:STARTUP, LINE_COUNT:1, STARTUP_CLASS:READY, and LINE_NUMBER:1.
• Applies the same startup synchronization to the tree-termination-failure case.
• Leaves production semantics, cancellation matrix, Job Object handling, and other 250 ms fixtures unchanged.

Validation:

• Desktop suite: 177 passed, 6 platform skips.
• Release workflow: 23 passed.
• git diff --check: passed.

Native x64/ARM64 final markers could not be run because this environment is Linux x64 without PowerShell. Per instruction, no commit was created; current HEAD remains 2d8532d415b64c9cee4cd0822b9815ddc4f1f9db. The automated commit/Windows CI must provide the new head and native final markers.

---

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 5m 1s
• Tokens: 681,590 (671,546 in / 10,044 out)
• Cost: $0.92

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5501554980✓

[integry]

Final deterministic stream-drain fixture correction on exact head 25e00ef82b4a052d60f08e5e2958c223cad4abca.

Both native Windows x64 job 100059540847 and ARM64 job 100059540844 now pass FIXED_PROTOCOL and the corrected TIMEOUT_AFTER_STARTUP case. Both fail identically only at the next STREAM_DRAIN_RACE case because it still gives native pwsh only 250 ms before a complete startup record can be emitted:
OBSERVED:NONE:LINE_COUNT:0:STDERR_COUNT:0:PROCESS_EXIT:125:LIFECYCLE:TIMEOUT_BEFORE_STARTUP:TREE_TERMINATION:COMPLETE:STARTUP_CLASS:NONE:LINE_NUMBER:0.

Make the narrow test-fixture correction:

• Keep the race fixture's strict 250 ms behavior window, but begin that countdown only after the capture has parsed its complete startup record, using the existing BeginTimeoutAfterStartup mechanism.
• Add exact assertions for the fixture's intended complete startup and terminal evidence (observed class, line count, READY startup class/line, terminal lifecycle/line as appropriate to the existing fixture contract), so it still genuinely tests the stream-drain race rather than merely surviving a longer timeout.
• Keep TIMEOUT_BEFORE_STARTUP at 250 ms from process launch.
• Preserve production cleanup controller, protocol parser, Job Object quiescence, cancellation semantics, fixed status-to-exit mapping, path-free diagnostics, and one-terminal-line rules unchanged.
• Require the complete controller state-machine final PASSED marker on native Windows x64 and ARM64, not just progress to another fixture.

[propr-dev]

✅ Applied the requested follow-up changes in commit 16a980f

Summary of Changes

Implemented the narrow fixture correction in test-installed-windows-app-supervisor.ps1:

• STREAM_DRAIN_RACE retains its 250 ms window but now uses BeginTimeoutAfterStartup.
• Added exact assertions for terminal observation, 2 lines, zero stderr, exit 125, READY startup, terminal line 2, ACTIVE_TREE_AFTER_EXIT, and complete tree termination.
• TIMEOUT_BEFORE_STARTUP remains launch-relative at 250 ms.
• No production files were changed.

Validation:

• Full desktop suite: 177 passed, 6 platform skips.
• Release-workflow contract: 23 passed.
• git diff --check: passed.

Native Windows execution is unavailable locally. CI must show PROPR_WINDOWS_SUPERVISOR_CONTROLLER_STATE_MACHINE:BOUNDED:PASSED on both x64 and ARM64 before acceptance. No commit was created.

---

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 3m 28s
• Tokens: 513,610 (508,407 in / 5,203 out)
• Cost: $0.66

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5501660217✓

[integry]

Ultrafix the real post-startup production protocol failure on exact head 16a980f36ecf8dd80226167318ee355be031fc08.

Both native Windows x64 job 100061099337 and ARM64 job 100061099388 now pass:

• PROPR_WINDOWS_SUPERVISOR_CONTROLLER_STARTUP:FIXED_PROTOCOL:PASSED
• PROPR_WINDOWS_SUPERVISOR_CONTROLLER_STATE_MACHINE:BOUNDED:PASSED

They then fail identically at the real REPLACEMENT_RETRY invocation:
OBSERVED:STARTUP:LINE_COUNT:1:STDERR_COUNT:0:PROCESS_EXIT:125:LIFECYCLE:EXITED:TREE_TERMINATION:NOT_REQUIRED:STARTUP_CLASS:READY:LINE_NUMBER:1.

This is not a drain or timeout issue: capture Finish completed, the Job Object is quiescent, and the wrapper genuinely exits 125 after a valid startup record without the mandatory terminal. The workflow-cleanup body normally emits the terminal at RESULT_EMISSION, but its emission catch currently calls Set-CaughtControllerFailure and exits 125 without any terminal.

Make an evidence-driven narrow production correction:

• Determine and fix the exact post-startup terminal-emission failure exercised by REPLACEMENT_RETRY; do not relabel the one-line result or weaken two-line/zero-stderr parsing.
• Once STARTUP:READY has been emitted, guarantee exactly one fixed allowlisted terminal record for every bounded exit path, including a failure during primary result construction/emission. Preserve the strict fixed status-to-exit mapping and never emit raw exception, path, manifest, SID, account, stdout, or stderr data.
• Do not emit duplicate startup or terminal records. Do not claim COMPLETE if cleanup/authority publication failed.
• Add deterministic protocol tests for a post-startup result-emission failure and for the exact replacement-retry path, proving STARTUP/1 + TERMINAL/2 + zero stderr + matching process/terminal exit.
• Preserve Job Object quiescence, cancellation handling, timeout bounds, cleanup authority validation, and all state-machine fixtures.
• Require both native Windows x64 and ARM64 jobs to pass beyond REPLACEMENT_RETRY through the final installed-app supervisor success marker.

[propr-dev]

✅ Applied the requested follow-up changes in commit db7f411

Summary of Changes

Implemented the narrow post-startup protocol correction on head 16a980f36ecf8dd80226167318ee355be031fc08 without committing.

Key changes:

• cleanup body

  • Validates every fixed result/status/exit tuple before emission.
  • Emits a single allowlisted fallback terminal on primary result-emission failure.
  • Prevents duplicate terminals when WriteLine completed but flushing fails.
  • Fails closed instead of claiming COMPLETE when cleanup-tree or authority finalization is unproven.

• native supervisor tests

  • Added deterministic post-startup RESULT_EMISSION failure coverage proving READY/1 + terminal/2 + zero stderr + exit 125.
  • Strengthened real REPLACEMENT_RETRY to require COMPLETE/0, READY line 1, terminal line 2, and zero stderr before the final architecture-specific success marker.

Validation passed:

• PowerShell parsing for all three scripts.
• Direct wrapper emission fixture: 2 lines, zero stderr, exit 125.
• Fixed status-to-exit mapping checks.
• Desktop suite: 177 passed, 6 platform skips.
• Release workflow contract: 23 passed.
• git diff --check.

Native Windows x64 and ARM64 execution remains pending CI after the system commits these changes; I did not claim those jobs passed locally.

---

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 12m 59s
• Tokens: 4,792,762 (4,763,387 in / 29,375 out)
• Cost: $3.97

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5504990403✓

[propr-dev]

✅ Applied the requested follow-up changes in commit 4af5b06

Summary of Changes

Implemented the narrow semantic attribution fix on head 30edcce07e2ca415aef6b30a450bfc44ab53b1d2. No commit made.

Changed:

• test-installed-windows-app-supervisor.ps1: moved Initialize digest validity inside BASELINE_DIGEST; changed direct BASELINE_DIGEST / FINAL_BASELINE_DIGEST assertions to generic fixture throws; preserved distinct recovery collision and rename-failure coverage.
• Added executable focused regressions for digest-invalid and equality-failure paths, asserting exact emitted tokens are BASELINE_DIGEST / FINAL_BASELINE_DIGEST and not broad HKCU_BASELINE_STATE.
• release-workflow.test.ts: updated static contract checks for the corrected semantics.

Preserved:

• Production cleanup/controller/runtime code unchanged.
• Native RegSetValueExW fixture producer unchanged.
• package-lock.json unchanged; qs / fast-uri untouched.

Validation run:

• npx tsx --test apps/desktop/src/release-workflow.test.ts passed.
• npm run test -w @propr/desktop passed: 177 passed, 6 skipped.
• npm run audit:runtime passed, 0 vulnerabilities.
• npm run desktop:audit:packaging passed, 0 vulnerabilities.
• git diff --check passed.
• Digest-wrapper scan passed: 13 digest wrapper candidates checked, none contained Get-HkcuFixtureBoundaryDiagnostic.

Not run:

• Real native Windows x64/ARM64 supervisor/package jobs. This container is Linux and has no pwsh; those jobs require the committed remote ref in desktop-release-guard.yml, and the task explicitly says not to commit.

---

🤖 Implementation Details

• Model: GPT-5.5 (high)
• Requested By: @integry
• Time: 11m 4s
• Tokens: 3,739,209 (3,713,901 in / 25,308 out)
• Cost: $3.29

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5513411134✓

[propr-dev]

CI failed: Validate unsigned win32-arm64 package

Please investigate and fix this CI failure.

• Check: Validate unsigned win32-arm64 package
• Result: failure
• Commit: 30edcce07e2c (30edcce07e2ca415aef6b30a450bfc44ab53b1d2)
• Details: View CI failure

Failure evidence

.github:26
Process completed with exit code 1.

[propr-dev]

CI failed: Validate unsigned win32-x64 package

Please investigate and fix this CI failure.

• Check: Validate unsigned win32-x64 package
• Result: failure
• Commit: 30edcce07e2c (30edcce07e2ca415aef6b30a450bfc44ab53b1d2)
• Details: View CI failure

Failure evidence

.github:28
Process completed with exit code 1.

[integry]

Queue this evidence-only attribution split after the active semantic digest task; do not overlap it and do not change the native producer yet.

Fresh x64 job 100346022992 on 30edcce passed FIXED_PROTOCOL, BOUNDED, TOTAL, PRE_EXISTING_AUTHORITIES, and APP_PATHS_PRE_EXISTING, then still failed at broad HKCU_INSTALLED_VALUE_OWNERSHIP / HKCU_BASELINE_RESTORE / FIXTURE_SETUP / REGRESSION_VALUE_SETUP / REGISTRY_VALUE. ARM64 100346022961 failed earlier at the unrelated MSI transaction marker and provides no HKCU predicate.

On the active task's resulting exact head, split REGRESSION_VALUE_SETUP into fixed, total, secret-free suboperations that distinguish at minimum:

• root/key creation,
• each conventional value-kind setup (or a fixed bounded VALUE_KIND_SETUP bucket),
• the REG_NONE native write itself with a fixed native return-code category/field,
• nested key creation,
• nested value setup.

Keep exact paths/names/bytes/native text out of diagnostics. Preserve the current fixture-only RegSetValueExW implementation unchanged until native x64 and ARM64 converge on a producer predicate. Add executable attribution tests, then rerun both real native jobs. Preserve production code and lock entries. Do not merge.

[integry]

ProPR follow-up on exact head 4af5b06.

Please close the two remaining exact Windows fixture proof gaps without changing production cleanup behavior or the canonical lockfile:

1. Restore-path byte preservation: after a successful Desktop -> Backup recovery rename, compute the moved-back BackupPath digest through the fixed-attributed Get-HkcuFixtureRegistryDigest operation and require it to equal BaselineDigest before rethrowing the originally saved failure. If that equality cannot be proven, retain both recoverable locations and report the fixed RECOVERY_RELOCATE operation. Add a behavioral regression that proves the exact digest equality, not merely Backup present/Desktop absent.
2. Split the remaining broad REGRESSION_VALUE_SETUP / REGISTRY_VALUE attribution into fixed sub-operations: root key creation, conventional value-kind setup, native REG_NONE write with fixed return-code evidence, and nested key/value setup. Preserve the current native writer until the evidence identifies a failing sub-operation.

Keep the already-correct generic assertion attribution, collision/rename preservation, bounded cleanup, and exact head scope. Run static tests plus native x64 and ARM64 and report the first fixed failing token if either native gate fails.

[propr-dev]

✅ Applied the requested follow-up changes in commit 54dddc8

Summary of Changes

Implemented the two requested fixture-only follow-ups on exact head 4af5b0609b1a53653aace43280ac9201081390cf.

Changed:

• test-installed-windows-app-supervisor.ps1: recovery relocation now computes the moved-back BackupPath digest through Get-HkcuFixtureRegistryDigest and requires exact BaselineDigest equality before rethrowing the saved baseline failure. If proof fails, it reports RECOVERY_RELOCATE.
• test-installed-windows-app-supervisor.ps1: split REGRESSION_VALUE_SETUP / REGISTRY_VALUE into fixed sub-operations for root key setup, value-kind setup, native REG_NONE write with NATIVE_RETURN_CODE, nested key setup, and nested value setup.
• release-workflow.test.ts: updated static regressions to require the new digest proof and reject the old broad setup attribution.

Validation:

• npx tsx --test apps/desktop/src/release-workflow.test.ts passed.
• npm run test -w @propr/desktop passed: 177 pass, 6 platform skips.
• git diff --check passed.

Native x64/ARM64 gates were not run locally: this container is Linux and has no pwsh, so there is no native Windows failing token to report from this environment. package-lock.json was not changed.

---

🤖 Implementation Details

• Model: GPT-5.5 (high)
• Requested By: @integry
• Time: 9m 35s
• Tokens: 3,374,558 (3,353,749 in / 20,809 out)
• Cost: $3.01

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5513619014✓

[propr-dev]

CI failed: Validate unsigned win32-x64 package

Please investigate and fix this CI failure.

• Check: Validate unsigned win32-x64 package
• Result: failure
• Commit: 4af5b0609b1a (4af5b0609b1a53653aace43280ac9201081390cf)
• Details: View CI failure

Failure evidence

.github:28
Process completed with exit code 1.

[propr-dev]

CI failed: Validate unsigned win32-arm64 package

Please investigate and fix this CI failure.

• Check: Validate unsigned win32-arm64 package
• Result: failure
• Commit: 4af5b0609b1a (4af5b0609b1a53653aace43280ac9201081390cf)
• Details: View CI failure

Failure evidence

.github:28
Process completed with exit code 1.

[propr-dev]

CI failed: Run Full Test Suite

Please investigate and fix this CI failure.

• Check: Run Full Test Suite
• Result: failure
• Commit: 4af5b0609b1a (4af5b0609b1a53653aace43280ac9201081390cf)
• Details: View CI failure

Failure evidence

.github:10
Process completed with exit code 1.

.github:43132
Process completed with exit code 1.

.github:9
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11d5960. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

[github-actions]

Full Test Suite Results

Validation failed during: Full test suite.

• Dependency install: success
• Workspace build: success
• Docs validation: success
• Redis startup: success
• Full test suite: failure

View Test Output

> propr@0.8.15 test:full:prepared
> npm run test:server


> propr@0.8.15 test:server
> node scripts/run-test-suite.mjs


[1/333] apps/desktop/scripts/assert-windows-mvp-package.test.mjs
TAP version 13
# Subtest: Windows MVP ASAR main entry
    # Subtest: uses the rooted listPackage representation accepted by extractFile
    ok 1 - uses the rooted listPackage representation accepted by extractFile
      ---
      duration_ms: 23.809775
      type: 'test'
      ...
    # Subtest: preserves the Windows separator after removing the one archive root
    ok 2 - preserves the Windows separator after removing the one archive root
      ---
      duration_ms: 0.203023
      type: 'test'
      ...
    # Subtest: rejects traversal, duplicate entries, and case-colliding main paths
    ok 3 - rejects traversal, duplicate entries, and case-colliding main paths
      ---
      duration_ms: 0.55159
      type: 'test'
      ...
    1..3
ok 1 - Windows MVP ASAR main entry
  ---
  duration_ms: 25.331633
  type: 'suite'
  ...
1..1
# tests 3
# suites 1
# pass 3
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 240.177137

[2/333] apps/desktop/scripts/build-windows-machine-installer.test.mjs
TAP version 13
# Subtest: sets explicit Windows-1252 MSI and summary code pages in probe and production WXS
ok 1 - sets explicit Windows-1252 MSI and summary code pages in probe and production WXS
  ---
  duration_ms: 1.354409
  type: 'test'
  ...
# Subtest: accepts the exact MSI ProductVersion boundary and retains version and upgrade identity in WXS
ok 2 - accepts the exact MSI ProductVersion boundary and retains version and upgrade identity in WXS
  ---
  duration_ms: 0.388613
  type: 'test'
  ...
# Subtest: rejects every unsupported ProductVersion at the direct installer builder entry point
ok 3 - rejects every unsupported ProductVersion at the direct installer builder entry point
  ---
  duration_ms: 1.321992
  type: 'test'
  ...
# Subtest: uses per-machine scope without explicitly authoring the derived ALLUSERS property
ok 4 - uses per-machine scope without explicitly authoring the derived ALLUSERS property
  ---
  duration_ms: 0.337833
  type: 'test'
  ...
# Subtest: authors the complete per-machine Start Menu contract for x64 and ARM64
ok 5 - authors the complete per-machine Start Menu contract for x64 and ARM64
  ---
  duration_ms: 0.70283
  type: 'test'
  ...
# Subtest: selects only the installed x64 WiX directory or an explicit ARM64 build directory
ok 6 - selects only the installed x64 WiX directory or an explicit ARM64 build directory
  ---
  duration_ms: 0.48758
  type: 'test'
  ...
# Subtest: uses a ten-minute timeout only for production Light
ok 7 - uses a ten-minute timeout only for production Light
  ---
  duration_ms: 0.252063
  type: 'test'
  ...
# Subtest: keeps WiX processes and their emitted diagnostics bounded
ok 8 - keeps WiX processes and their emitted diagnostics bounded
  ---
  duration_ms: 0.109781
  type: 'test'
  ...
# Subtest: emits WiX v3 default registry values without empty Name attributes
ok 9 - emits WiX v3 default registry values without empty Name attributes
  ---
  duration_ms: 0.316023
  type: 'test'
  ...
1..9
# tests 9
# suites 0
# pass 9
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 218.310039

[3/333] apps/desktop/scripts/packaged-smoke-support.test.mjs
TAP version 13
# Subtest: packaged smoke native window layout
    # Subtest: accepts the preferred size while retaining responsive containment
    ok 1 - accepts the preferred size while retaining responsive containment
      ---
      duration_ms: 1.433688
      type: 'test'
      ...
    # Subtest: accepts the 1024x720-clamped size while retaining responsive containment
    ok 2 - accepts the 1024x720-clamped size while retaining responsive containment
      ---
      duration_ms: 0.163377
      type: 'test'
      ...
    # Subtest: accepts the configured minimum size while retaining responsive containment
    ok 3 - accepts the configured minimum size while retaining responsive containment
      ---
      duration_ms: 0.096248
      type: 'test'
      ...
    # Subtest: accepts the undersized work area while retaining responsive containment
    ok 4 - accepts the undersized work area while retaining responsive containment
      ---
      duration_ms: 0.083839
      type: 'test'
      ...
    # Subtest: rejects an unclamped window or a viewport inconsistent with native content chrome
    ok 5 - rejects an unclamped window or a viewport inconsistent with native content chrome
      ---
      duration_ms: 0.420696
      type: 'test'
      ...
    # Subtest: accepts actual reduced native sizing only when both minimum constraints are exercised
    ok 6 - accepts actual reduced native sizing only when both minimum constraints are exercised
      ---
      duration_ms: 0.173312
      type: 'test'
      ...
    1..6
ok 1 - packaged smoke native window layout
  ---
  duration_ms: 3.382393
  type: 'suite'
  ...
# Subtest: packaged smoke child environment
    # Subtest: passes only platform launch inputs and private profile paths from a hostile parent
    ok 1 - passes only platform launch inputs and private profile paths from a hostile parent
      ---
      duration_ms: 14.806071
      type: 'test'
      ...
    # Subtest: keeps cleanup bounded to the generated profile root
    ok 2 - keeps cleanup bounded to the generated profile root
      ---
      duration_ms: 9.665573
      type: 'test'
      ...
    # Subtest: accepts only a normalized absolute Windows SystemRoot directory
    ok 3 - accepts only a normalized absolute Windows SystemRoot directory
      ---
      duration_ms: 1.333269
      type: 'test'
      ...
    # Subtest: contains no parent environment spread, enumeration, denylist, PATH, or shell launch
    ok 4 - contains no parent environment spread, enumeration, denylist, PATH, or shell launch
      ---
      duration_ms: 6.754867
      type: 'test'
      ...
    # Subtest: requires the adjacent packaged spawn options with LF or CRLF source
    ok 5 - requires the adjacent packaged spawn options with LF or CRLF source
      ---
      duration_ms: 1.323977
      type: 'test'
      ...
    1..5
ok 2 - packaged smoke child environment
  ---
  duration_ms: 34.283914
  type: 'suite'
  ...
1..2
# tests 11
# suites 2
# pass 11
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 247.298911

[4/333] apps/desktop/scripts/release-architecture.test.mjs
TAP version 13
# Subtest: machine-wide Windows artifacts require a real MSI compound file
ok 1 - machine-wide Windows artifacts require a real MSI compound file
  ---
  duration_ms: 7.573314
  type: 'test'
  ...
# Subtest: administrative MSI payload inspection
    # Subtest: uses exact fixed native extractor argv and minimal environments
    ok 1 - uses exact fixed native extractor argv and minimal environments
      ---
      duration_ms: 1.292877
      type: 'test'
      ...
    # Subtest: accepts only the canonical application with the one administrative root prefix
    ok 2 - accepts only the canonical application with the one administrative root prefix
      ---
      duration_ms: 8.759663
      type: 'test'
      ...
    # Subtest: rejects path escapes and case collisions from the Linux listing before extraction
    ok 3 - rejects path escapes and case collisions from the Linux listing before extraction
      ---
      duration_ms: 0.831934
      type: 'test'
      ...
    # Subtest: uses fixed missing and duplicate canonical-app codes with bounded counts
    ok 4 - uses fixed missing and duplicate canonical-app codes with bounded counts
      ---
      duration_ms: 5.880517
      type: 'test'
      ...
    # Subtest: distinguishes authority resources, unsafe trees, and architecture mismatch without path data
    ok 5 - distinguishes authority resources, unsafe trees, and architecture mismatch without path data
      ---
      duration_ms: 5.819659
      type: 'test'
      ...
    # Subtest: maps extractor failures to one redacted tool code
    ok 6 - maps extractor failures to one redacted tool code
      ---
      duration_ms: 2.248517
      type: 'test'
      ...
    # Subtest: retains compound-file, per-machine scope, and canonical PE evidence across extraction
    ok 7 - retains compound-file, per-machine scope, and canonical PE evidence across extraction
      ---
      duration_ms: 8.560178
      type: 'test'
      ...
    # Subtest: fails closed on extractor nonzero, stderr, output overflow, and timeout
    ok 8 - fails closed on extractor nonzero, stderr, output overflow, and timeout
      ---
      duration_ms: 125.278781
      type: 'test'
      ...
    1..8
ok 2 - administrative MSI payload inspection
  ---
  duration_ms: 159.624765
  type: 'suite'
  ...
# Subtest: DEB and RPM executable layouts
    # Subtest: accept only the canonical regular ELF payload and documented launcher symlink
    ok 1 - accept only the canonical regular ELF payload and documented launcher symlink
      ---
      duration_ms: 16.835104
      type: 'test'
      ...
    # Subtest: reject missing and extra payload names for both package formats
    ok 2 - reject missing and extra payload names for both package formats
      ---
      duration_ms: 11.93575
      type: 'test'
      ...
    # Subtest: reject unexpected same-name file types and non-ELF or cross-architecture payloads
    ok 3 - reject unexpected same-name file types and non-ELF or cross-architecture payloads
      ---
      duration_ms: 15.200083
      type: 'test'
      ...
    # Subtest: reject launcher escapes, cycles, and targets other than the canonical payload
    ok 4 - reject launcher escapes, cycles, and targets other than the canonical payload
      ---
      duration_ms: 12.956943
      type: 'test'
      ...
    # Subtest: reject special files with the executable name
    ok 5 - reject special files with the executable name
      ---
      duration_ms: 18.163017
      type: 'test'
      ...
    1..5
ok 3 - DEB and RPM executable layouts
  ---
  duration_ms: 75.514975
  type: 'suite'
  ...
# Subtest: DMG application layout
    # Subtest: accepts the real Forge tree with its install link and nested Electron helper bundles
    ok 1 - accepts the real Forge tree with its install link and nested Electron helper bundles
      ---
      duration_ms: 16.523919
      type: 'test'
      ...
    # Subtest: rejects a symbolic-link canonical helper bundle
    ok 2 - rejects a symbolic-link canonical helper bundle
      ---
      duration_ms: 6.424463
      type: 'test'
      ...
    # Subtest: rejects a symbolic-link canonical helper executable ancestor
    ok 3 - rejects a symbolic-link canonical helper executable ancestor
      ---
      duration_ms: 7.884616
      type: 'test'
      ...
    # Subtest: rejects every symbolic link outside canonical framework internals
    ok 4 - rejects every symbolic link outside canonical framework internals
      ---
      duration_ms: 9.748787
      type: 'test'
      ...
    # Subtest: rejects escaping, cyclic, missing, and case-mismatched framework symbolic links
    ok 5 - rejects escaping, cyclic, missing, and case-mismatched framework symbolic links
      ---
      duration_ms: 33.100106
      type: 'test'
      ...
    # Subtest: never treats Linux 7z sanitized install-link output as native layout evidence
    ok 6 - never treats Linux 7z sanitized install-link output as native layout evidence
      ---
      duration_ms: 7.418709
      type: 'test'
      ...
    # Subtest: rejects wrong bundles, alternate same-name executables, and canonical symlink escapes
    ok 7 - rejects wrong bundles, alternate same-name executables, and canonical symlink escapes
      ---
      duration_ms: 11.80464
      type: 'test'
      ...
    # Subtest: rejects alternate top-level application bundles
    ok 8 - rejects alternate top-level application bundles
      ---
      duration_ms: 6.318784
      type: 'test'
      ...
    # Subtest: rejects unsafe links inside the canonical application bundle
    ok 9 - rejects unsafe links inside the canonical application bundle
      ---
      duration_ms: 10.112913
      type: 'test'
      ...
    # Subtest: rejects non-helper nested application bundles
    ok 10 - rejects non-helper nested application bundles
      ---
      duration_ms: 9.278159
      type: 'test'
      ...
    # Subtest: rejects case-colliding top-level entries when the filesystem permits them
    ok 11 - rejects case-colliding top-level entries when the filesystem permits them
      ---
      duration_ms: 6.015508
      type: 'test'
      ...
    # Subtest: rejects special files inside the canonical application bundle
    ok 12 - rejects special files inside the canonical application bundle
      ---
      duration_ms: 10.941814
      type: 'test'
      ...
    1..12
ok 4 - DMG application layout
  ---
  duration_ms: 136.325392
  type: 'suite'
  ...
1..4
# tests 26
# suites 3
# pass 26
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 579.136925

[5/333] apps/desktop/scripts/release-artifacts.test.mjs
TAP version 13
# Subtest: desktop release artifacts
    # Subtest: stages named artifacts and finalizes unsigned validation metadata
    ok 1 - stages named artifacts and finalizes unsigned validation metadata
      ---
      duration_ms: 127.294209
      type: 'test'
      ...
    # Subtest: rejects extensionless, doubled-extension, case-conflicting, duplicate, wrong-kind, stale, and mixed-target names
    ok 2 - rejects extensionless, doubled-extension, case-conflicting, duplicate, wrong-kind, stale, and mixed-target names
      ---
      duration_ms: 319.175226
      type: 'test'
      ...
    # Subtest: rejects altered DMG bytes even when fragment artifact metadata is rewritten
    ok 3 - rejects altered DMG bytes even when fragment artifact metadata is rewritten
      ---
      duration_ms: 173.140103
      type: 'test'
      ...
    # Subtest: rejects permanent DMG replacement or in-place mutation during held inspection without emitting evidence
    ok 4 - rejects permanent DMG replacement or in-place mutation during held inspection without emitting evidence
      ---
      duration_ms: 10.199787
      type: 'test'
      ...
    # Subtest: keeps held A bytes, evidence, and publication stable when original and public pathnames change during inspection
    ok 5 - keeps held A bytes, evidence, and publication stable when original and public pathnames change during inspection
      ---
      duration_ms: 9.292612
      type: 'test'
      ...
    # Subtest: continues to reject a mutable pathname passed directly to DMG inspection
    ok 6 - continues to reject a mutable pathname passed directly to DMG inspection
      ---
      duration_ms: 0.39346
      type: 'test'
      ...
    # Subtest: requires explicit fixture authority for Windows-hosted DMG evidence tests
    ok 7 - requires explicit fixture authority for Windows-hosted DMG evidence tests # SKIP
      ---
      duration_ms: 0.097926
      type: 'test'
      ...
    # Subtest: accepts real Darwin mode-0700 directory and mode-0600 single-link file authority
    ok 8 - accepts real Darwin mode-0700 directory and mode-0600 single-link file authority # SKIP
      ---
      duration_ms: 0.212191
      type: 'test'
      ...
    # Subtest: rejects native Darwin broad mode, foreign owner, extra link, replacement type, and symlink with fixed authority codes
    ok 9 - rejects native Darwin broad mode, foreign owner, extra link, replacement type, and symlink with fixed authority codes # SKIP
      ---
      duration_ms: 0.356763
      type: 'test'
      ...
    # Subtest: accepts native xattr/ctime-only change when held bytes and identity are unchanged
    ok 10 - accepts native xattr/ctime-only change when held bytes and identity are unchanged # SKIP
      ---
      duration_ms: 0.214384
      type: 'test'
      ...
    # Subtest: does not emit claimed DMG layout evidence without the native-validation marker
    ok 11 - does not emit claimed DMG layout evidence without the native-validation marker
      ---
      duration_ms: 9.564778
      type: 'test'
      ...
    # Subtest: strictly rejects missing, mixed, stale, malformed, or fabricated native DMG evidence
    ok 12 - strictly rejects missing, mixed, stale, malformed, or fabricated native DMG evidence
      ---
      duration_ms: 604.083069
      type: 'test'
      ...
    # Subtest: rejects native DMG evidence copied between x64 and arm64 fragments
    ok 13 - rejects native DMG evidence copied between x64 and arm64 fragments
      ---
      duration_ms: 26.312752
      type: 'test'
      ...
    # Subtest: rejects duplicate target fragments before aggregation
    ok 14 - rejects duplicate target fragments before aggregation
      ---
      duration_ms: 24.362279
      type: 'test'
      ...
    # Subtest: rejects either Windows fragment when the installed ordinary-user application gate was skipped
    ok 15 - rejects either Windows fragment when the installed ordinary-user application gate was skipped
      ---
      duration_ms: 81.443968
      type: 'test'
      ...
    # Subtest: fails closed when trusted update signing configuration is incomplete
    ok 16 - fails closed when trusted update signing configuration is incomplete
      ---
      duration_ms: 64.227992
      type: 'test'
      ...
    # Subtest: signs cryptographically bound feeds only in the trusted release phase
    ok 17 - signs cryptographically bound feeds only in the trusted release phase
      ---
      duration_ms: 83.313846
      type: 'test'
      ...
    # Subtest: refuses to sign a renamed extensionless distributable
    ok 18 - refuses to sign a renamed extensionless distributable
      ---
      duration_ms: 51.926609
      type: 'test'
      ...
    # Subtest: refuses to sign when artifact bytes changed after unsigned finalization
    ok 19 - refuses to sign when artifact bytes changed after unsigned finalization
      ---
      duration_ms: 39.301474
      type: 'test'
      ...
    # Subtest: rejects unsigned production metadata and actual signer mismatches
    ok 20 - rejects unsigned production metadata and actual signer mismatches
      ---
      duration_ms: 149.411427
      type: 'test'
      ...
    # Subtest: rejects mixed Windows signers and tampered fingerprint evidence
    ok 21 - rejects mixed Windows signers and tampered fingerprint evidence
      ---
      duration_ms: 42.511074
      type: 'test'
      ...
    # Subtest: parses x64 and arm64 ELF, PE, and Mach-O executable fixtures
    ok 22 - parses x64 and arm64 ELF, PE, and Mach-O executable fixtures
      ---
      duration_ms: 1.948185
      type: 'test'
      ...
    # Subtest: derives Windows target architecture from the full NUPKG independently of its supported bootstrapper
    ok 23 - derives Windows target architecture from the full NUPKG independently of its supported bootstrapper
      ---
      duration_ms: 14.373338
      type: 'test'
      ...
    # Subtest: binds ZIP and NUPKG executables to exact maker-specific canonical paths
    ok 24 - binds ZIP and NUPKG executables to exact maker-specific canonical paths
      ---
      duration_ms: 3.416477
      type: 'test'
      ...
    # Subtest: rejects missing, corrupt, mismatched, and ambiguous packaged Windows authority helpers
    ok 25 - rejects missing, corrupt, mismatched, and ambiguous packaged Windows authority helpers
      ---
      duration_ms: 5.242666
      type: 'test'
      ...
    # Subtest: accepts only the real Forge macOS framework-internal symbolic-link layout
    ok 26 - accepts only the real Forge macOS framework-internal symbolic-link layout
      ---
      duration_ms: 3.896011
      type: 'test'
      ...
    # Subtest: rejects hostile macOS ZIP symbolic links before trusting their payloads
    ok 27 - rejects hostile macOS ZIP symbolic links before trusting their payloads
      ---
      duration_ms: 15.011993
      type: 'test'
      ...
    # Subtest: rejects unsafe, duplicate, shadowed, forged, alternate, and noncanonical archive layouts
    ok 28 - rejects unsafe, duplicate, shadowed, forged, alternate, and noncanonical archive layouts
      ---
      duration_ms: 4.912309
      type: 'test'
      ...
    # Subtest: rejects cross-labeled package architectures at staging and finalization
    ok 29 - rejects cross-labeled package architectures at staging and finalization
      ---
      duration_ms: 125.720575
      type: 'test'
      ...
    1..29
ok 1 - desktop release artifacts
  ---
  duration_ms: 1994.857569
  type: 'suite'
  ...
1..1
# tests 29
# suites 1
# pass 25
# fail 0
# cancelled 0
# skipped 4
# todo 0
# duration_ms 2208.839697

[6/333] apps/desktop/scripts/release-preflight.test.mjs
TAP version 13
# Subtest: desktop release preflight
    # Subtest: accepts only a new immutable tag reachable from protected main and a protected environment
    ok 1 - accepts only a new immutable tag reachable from protected main and a protected environment
      ---
      duration_ms: 2.588026
      type: 'test'
      ...
    # Subtest: accepts an authorization-visible bypass list and fails closed for hidden or denied ruleset details
    ok 2 - accepts an authorization-visible bypass list and fails closed for hidden or denied ruleset details
      ---
      duration_ms: 2.044496
      type: 'test'
      ...
    # Subtest: paginates repository rulesets and reads every full rule definition
    ok 3 - paginates repository rulesets and reads every full rule definition
      ---
      duration_ms: 2.630314
      type: 'test'
      ...
    # Subtest: requires an exact active bypass-free update and deletion tag ruleset
    ok 4 - requires an exact active bypass-free update and deletion tag ruleset
      ---
      duration_ms: 1.966764
      type: 'test'
      ...
    # Subtest: rejects ruleset mutation or deletion during preflight
    ok 5 - rejects ruleset mutation or deletion during preflight
      ---
      duration_ms: 2.001621
      type: 'test'
      ...
    # Subtest: requires the complete effective environment policy set to be exactly desktop-v* tags
    ok 6 - requires the complete effective environment policy set to be exactly desktop-v* tags
      ---
      duration_ms: 2.914483
      type: 'test'
      ...
    # Subtest: requires the separately protected preflight credential environment
    ok 7 - requires the separately protected preflight credential environment
      ---
      duration_ms: 0.75533
      type: 'test'
      ...
    # Subtest: paginates all environment policies and rejects a permissive policy on a later page
    ok 8 - paginates all environment policies and rejects a permissive policy on a later page
      ---
      duration_ms: 0.774355
      type: 'test'
      ...
    # Subtest: rejects missing or ambiguous environment protection and explicit API denial
    ok 9 - rejects missing or ambiguous environment protection and explicit API denial
      ---
      duration_ms: 1.295567
      type: 'test'
      ...
    # Subtest: rejects tags not created by this push, tags off main, and moved or existing releases
    ok 10 - rejects tags not created by this push, tags off main, and moved or existing releases
      ---
      duration_ms: 2.018926
      type: 'test'
      ...
    1..10
ok 1 - desktop release preflight
  ---
  duration_ms: 20.283293
  type: 'suite'
  ...
1..1
# tests 10
# suites 1
# pass 10
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 238.111942

[7/333] apps/desktop/scripts/release-publish.test.mjs
TAP version 13
# Subtest: atomic desktop release publication
    # Subtest: creates a draft, paginates and verifies the exact final assets, then publishes
    ok 1 - creates a draft, paginates and verifies the exact final assets, then publishes
      ---
      duration_ms: 133.919886
      type: 'test'
      ...
    # Subtest: leaves a partial upload as a recoverable draft and resumes only matching assets
    ok 2 - leaves a partial upload as a recoverable draft and resumes only matching assets
      ---
      duration_ms: 9.523835
      type: 'test'
      ...
    # Subtest: rejects unexpected, duplicate, size, and content-digest asset mismatches without publishing
    ok 3 - rejects unexpected, duplicate, size, and content-digest asset mismatches without publishing
      ---
      duration_ms: 7.178784
      type: 'test'
      ...
    # Subtest: rejects tag drift before publishing the verified draft
    ok 4 - rejects tag drift before publishing the verified draft
      ---
      duration_ms: 4.077133
      type: 'test'
      ...
    # Subtest: rejects local files outside or missing from finalized checksums
    ok 5 - rejects local files outside or missing from finalized checksums
      ---
      duration_ms: 2.289539
      type: 'test'
      ...
    1..5
ok 1 - atomic desktop release publication
  ---
  duration_ms: 158.271714
  type: 'suite'
  ...
1..1
# tests 5
# suites 1
# pass 5
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 356.664776

[8/333] apps/desktop/scripts/verify-darwin-image.test.mjs
TAP version 13
# Subtest: Darwin image verification retries only bounded documented resource states
ok 1 - Darwin image verification retries only bounded documented resource states
  ---
  duration_ms: 11.25525
  type: 'test'
  ...
# Subtest: Darwin image verification does not retry malformed/truncated images or accept mutation
ok 2 - Darwin image verification does not retry malformed/truncated images or accept mutation
  ---
  duration_ms: 11.955283
  type: 'test'
  ...
# Subtest: Darwin image verification holds a fixed hdiutil image behind a real mutation and replacement barrier
ok 3 - Darwin image verification holds a fixed hdiutil image behind a real mutation and replacement barrier # SKIP
  ---
  duration_ms: 0.23471
  type: 'test'
  ...
1..3
# tests 3
# suites 0
# pass 2
# fail 0
# cancelled 0
# skipped 1
# todo 0
# duration_ms 212.996535

[9/333] apps/desktop/src/deep-link-delivery.test.ts
TAP version 13
# Subtest: desktop deep-link delivery
    # Subtest: queues links received after did-finish-load until the ready window is registered
    ok 1 - queues links received after did-finish-load until the ready window is registered
      ---
      duration_ms: 1.058132
      type: 'test'
      ...
    # Subtest: delivers a queued initial Connect URL before packaged smoke asserts it and only once
    ok 2 - delivers a queued initial Connect URL before packaged smoke asserts it and only once
      ---
      duration_ms: 0.405067
      type: 'test'
      ...
    1..2
ok 1 - desktop deep-link delivery
  ---
  duration_ms: 2.344644
  type: 'suite'
  ...
1..1
# tests 2
# suites 1
# pass 2
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 215.405633

[10/333] apps/desktop/src/ipc.test.ts
TAP version 13
# Subtest: desktop session IPC operations
    # Subtest: logs out through the active Electron session with credentials and without following redirects
    ok 1 - logs out through the active Electron session with credentials and without following redirects
      ---
      duration_ms: 18.189446
      type: 'test'
      ...
    # Subtest: rejects untrusted logout endpoints before making a session request
    ok 2 - rejects untrusted logout endpoints before making a session request
      ---
      duration_ms: 0.572002
      type: 'test'
      ...
    1..2
ok 1 - desktop session IPC operations
  ---
  duration_ms: 19.766894
  type: 'suite'
  ...
1..1
# tests 2
# suites 1
# pass 2
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 254.652134

[11/333] apps/desktop/src/preload-bridge.test.ts
TAP version 13
# Subtest: desktop preload bridge
    # Subtest: exposes only the narrow frozen namespaces
    ok 1 - exposes only the narrow frozen namespaces
      ---
      duration_ms: 2.067845
      type: 'test'
      ...
    # Subtest: maps profile and credential operations to fixed channels
    ok 2 - maps profile and credential operations to fixed channels
      ---
      duration_ms: 0.601408
      type: 'test'
      ...
    # Subtest: does not expose Electron event objects to deep-link listeners
    ok 3 - does not expose Electron event objects to deep-link listeners
      ---
      duration_ms: 0.330023
      type: 'test'
      ...
    # Subtest: buffers startup and second-instance deep links until the renderer subscribes
    ok 4 - buffers startup and second-instance deep links until the renderer subscribes
      ---
      duration_ms: 0.262866
      type: 'test'
      ...
    1..4
ok 1 - desktop preload bridge
  ---
  duration_ms: 4.536358
  type: 'suite'
  ...
1..1
# tests 4
# suites 1
# pass 4
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 237.992565

[12/333] apps/desktop/src/profile-store.test.ts
TAP version 13
# Subtest: desktop profile store
    # Subtest: persists validated profiles and active selection
    ok 1 - persists validated profiles and active selection
      ---
      duration_ms: 42.697412
      type: 'test'
      ...
    # Subtest: encrypts credentials before writing app-owned storage
    ok 2 - encrypts credentials before writing app-owned storage
      ---
      duration_ms: 4.854339
      type: 'test'
      ...
    # Subtest: serializes concurrent credential writes with last-write semantics
    ok 3 - serializes concurrent credential writes with last-write semantics
      ---
      duration_ms: 4.180029
      type: 'test'
      ...
    # Subtest: orders concurrent credential writes and removals by invocation
    ok 4 - orders concurrent credential writes and removals by invocation
      ---
      duration_ms: 5.053954
      type: 'test'
      ...
    # Subtest: refuses plaintext fallback when encryption is unavailable or basic_text
    ok 5 - refuses plaintext fallback when encryption is unavailable or basic_text
      ---
      duration_ms: 2.238217
      type: 'test'
      ...
    # Subtest: rejects unsafe endpoints and path-like profile identifiers
    ok 6 - rejects unsafe endpoints and path-like profile identifiers
      ---
      duration_ms: 4.358633
      type: 'test'
      ...
    1..6
ok 1 - desktop profile store
  ---
  duration_ms: 64.690638
  type: 'suite'
  ...
1..1
# tests 6
# suites 1
# pass 6
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 283.592711

[13/333] apps/desktop/src/release-config.test.ts
TAP version 13
# Subtest: desktop release configuration
    # Subtest: keeps Linux maker executables aligned with the packaged executable
    ok 1 - keeps Linux maker executables aligned with the packaged executable
      ---
      duration_ms: 498.62857
      type: 'test'
      ...
    # Subtest: propagates an explicit independent desktop version
    ok 2 - propagates an explicit independent desktop version
      ---
      duration_ms: 0.402241
      type: 'test'
      ...
    # Subtest: accepts the exact MSI ProductVersion numeric boundary for Windows releases
    ok 3 - accepts the exact MSI ProductVersion numeric boundary for Windows releases
      ---
      duration_ms: 0.164646
      type: 'test'
      ...
    # Subtest: preserves the stable SemVer diagnostic for malformed Windows release versions
    ok 4 - preserves the stable SemVer diagnostic for malformed Windows release versions
      ---
      duration_ms: 0.496325
      type: 'test'
      ...
    # Subtest: rejects canonical stable Windows versions outside MSI bounds with one fixed actionable diagnostic
    ok 5 - rejects canonical stable Windows versions outside MSI bounds with one fixed actionable diagnostic
      ---
      duration_ms: 0.215476
      type: 'test'
      ...
    # Subtest: preserves stable SemVer policy outside the Windows MSI path
    ok 6 - preserves stable SemVer policy outside the Windows MSI path
      ---
      duration_ms: 0.181326
      type: 'test'
      ...
    # Subtest: keeps updates disabled unless they are explicitly enabled
    ok 7 - keeps updates disabled unless they are explicitly enabled
      ---
      duration_ms: 0.100813
      type: 'test'
      ...
    # Subtest: requires a signed build and a complete trusted update configuration
    ok 8 - requires a signed build and a complete trusted update configuration
      ---
      duration_ms: 0.79871
      type: 'test'
      ...
    # Subtest: parses canonical Windows certificate or SPKI SHA-256 pin allowlists for artifact signing
    ok 9 - parses canonical Windows certificate or SPKI SHA-256 pin allowlists for artifact signing
      ---
      duration_ms: 0.580133
      type: 'test'
      ...
    # Subtest: fails closed to unsupported Windows updates even when every update variable is configured or malformed
    ok 10 - fails closed to unsupported Windows updates even when every update variable is configured or malformed
      ---
      duration_ms: 0.389482
      type: 'test'
      ...
    # Subtest: preserves opaque signing credentials while normalizing non-secret members
    ok 11 - preserves opaque signing credentials while normalizing non-secret members
      ---
      duration_ms: 0.15423
      type: 'test'
      ...
    # Subtest: rejects whitespace-only and partially configured signing groups with fixed diagnostics
    ok 12 - rejects whitespace-only and partially configured signing groups with fixed diagnostics
      ---
      duration_ms: 0.201888
      type: 'test'
      ...
    # Subtest: fails closed when a production signing or notarization condition is absent
    ok 13 - fails closed when a production signing or notarization condition is absent
      ---
      duration_ms: 0.407091
      type: 'test'
      ...
    1..13
ok 1 - desktop release configuration
  ---
  duration_ms: 504.184991
  type: 'suite'
  ...
1..1
# tests 13
# suites 1
# pass 13
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 768.2003

[14/333] apps/desktop/src/release-workflow.test.ts
TAP version 13
# Subtest: desktop trusted release workflow
    # Subtest: keeps pull-request packaging unsigned and completely secretless
    ok 1 - keeps pull-request packaging unsigned and completely secretless
      ---
      duration_ms: 1.259132
      type: 'test'
      ...
    # Subtest: allows production only from a new protected-main desktop tag after protected read-only preflight
    ok 2 - allows production only from a new protected-main desktop tag after protected read-only preflight
      ---
      duration_ms: 1.078062
      type: 'test'
      ...
    # Subtest: grants the preflight token Environments read for both environment API calls without exposing it
    ok 3 - grants the preflight token Environments read for both environment API calls without exposing it
      ---
      duration_ms: 0.329203
      type: 'test'
      ...
    # Subtest: keeps every certificate and the update private key inside preflight-dependent environment jobs
    ok 4 - keeps every certificate and the update private key inside preflight-dependent environment jobs
      ---
      duration_ms: 0.333897
      type: 'test'
      ...
    # Subtest: fails closed for every production signing, notarization, update, and signer condition
    ok 5 - fails closed for every production signing, notarization, update, and signer condition
      ---
      duration_ms: 0.672236
      type: 'test'
      ...
    # Subtest: preserves the opaque Windows certificate password for package and MSI signing
    ok 6 - preserves the opaque Windows certificate password for package and MSI signing
      ---
      duration_ms: 0.323728
      type: 'test'
      ...
    # Subtest: rechecks package architecture in staging and finalization and publishes only signed new releases
    ok 7 - rechecks package architecture in staging and finalization and publishes only signed new releases
      ---
      duration_ms: 0.545815
      type: 'test'
      ...
    # Subtest: retains the exact native matrix when the workflow checkout uses CRLF
    ok 8 - retains the exact native matrix when the workflow checkout uses CRLF
      ---
      duration_ms: 0.999185
      type: 'test'
      ...
    # Subtest: runs the native DMG layout suite on both macOS architectures
    ok 9 - runs the native DMG layout suite on both macOS architectures
      ---
      duration_ms: 1.592822
      type: 'test'
      ...
    # Subtest: keeps both Windows architectures and the complete machine-scope installer contract mandatory
    ok 10 - keeps both Windows architectures and the complete machine-scope installer contract mandatory
      ---
      duration_ms: 2.35283
      type: 'test'
      ...
    # Subtest: revalidates each real WiX MSI first on native Windows and then from the same staged bytes on Linux
    ok 11 - revalidates each real WiX MSI first on native Windows and then from the same staged bytes on Linux
      ---
      duration_ms: 0.675875
      type: 'test'
      ...
    # Subtest: supplementary lint retains installed Windows worker lifecycle contracts
    ok 12 - supplementary lint retains installed Windows worker lifecycle contracts
      ---
      duration_ms: 8.683009
      type: 'test'
      ...
    # Subtest: runs executable supervisor acceptance on both Windows architectures and keeps supplementary contracts
    ok 13 - runs executable supervisor acceptance on both Windows architectures and keeps supplementary contracts
      ---
      duration_ms: 118.531449
      type: 'test'
      ...
    # Subtest: supplementary lint retains fail-closed installed-app cleanup guards
    ok 14 - supplementary lint retains fail-closed installed-app cleanup guards
      ---
      duration_ms: 1.20452
      type: 'test'
      ...
    # Subtest: uses bounded network logon impersonation with secure native credential cleanup
    ok 15 - uses bounded network logon impersonation with secure native credential cleanup
      ---
      duration_ms: 0.371032
      type: 'test'
      ...
    # Subtest: requires the exact ordinary-user SID before bounded presence and absence checks
    ok 16 - requires the exact ordinary-user SID before bounded presence and absence checks
      ---
      duration_ms: 0.31452
      type: 'test'
      ...
    # Subtest: keeps shortcut proof output fixed and redacted and rejects the legacy process proof
    ok 17 - keeps shortcut proof output fixed and redacted and rejects the legacy process proof
      ---
      duration_ms: 0.304297
      type: 'test'
      ...
    # Subtest: emits fixed uninstall and cleanup substages without masking the primary failure
    ok 18 - emits fixed uninstall and cleanup substages without masking the primary failure
      ---
      duration_ms: 1.062778
      type: 'test'
      ...
    # Subtest: keeps the canonical common shortcut and exact-identity cleanup
    ok 19 - keeps the canonical common shortcut and exact-identity cleanup
      ---
      duration_ms: 0.57439
      type: 'test'
      ...
    # Subtest: replaces a hostile privileged parent environment with the exact smoke child allowlist
    ok 20 - replaces a hostile privileged parent environment with the exact smoke child allowlist
      ---
      duration_ms: 0.777596
      type: 'test'
      ...
    # Subtest: keeps spaced and unspaced smoke argv values as distinct ArgumentList entries
    ok 21 - keeps spaced and unspaced smoke argv values as distinct ArgumentList entries
      ---
      duration_ms: 0.220014
      type: 'test'
      ...
    # Subtest: opens installed Windows smoke evidence with a bounded, redacted reader
    ok 22 - opens installed Windows smoke evidence with a bounded, redacted reader
      ---
      duration_ms: 0.680678
      type: 'test'
      ...
    # Subtest: configures signed updates only for macOS and never advertises a Windows update feed
    ok 23 - configures signed updates only for macOS and never advertises a Windows update feed
      ---
      duration_ms: 0.204198
      type: 'test'
      ...
    1..23
ok 1 - desktop trusted release workflow
  ---
  duration_ms: 145.059064
  type: 'suite'
  ...
1..1
# tests 23
# suites 1
# pass 23
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 420.521998

[15/333] apps/desktop/src/security.test.ts
TAP version 13
# Subtest: desktop URL security
    # Subtest: only accepts HTTPS and loopback HTTP API endpoints
    ok 1 - only accepts HTTPS and loopback HTTP API endpoints
      ---
      duration_ms: 1.382348
      type: 'test'
      ...
    # Subtest: denies unsafe external browser schemes and credential-bearing URLs
    ok 2 - denies unsafe external browser schemes and credential-bearing URLs
      ---
      duration_ms: 0.229376
      type: 'test'
      ...
    # Subtest: requires an exact loopback development origin
    ok 3 - requires an exact loopback development origin
      ---
      duration_ms: 0.19211
      type: 'test'
      ...
    # Subtest: retains IPC trust for hash-routed packaged renderer URLs only
    ok 4 - retains IPC trust for hash-routed packaged renderer URLs only
      ---
      duration_ms: 0.195538
      type: 'test'
      ...
    # Subtest: allowlists custom protocol actions and extracts them from argv
    ok 5 - allowlists custom protocol actions and extracts them from argv
      ---
      duration_ms: 0.332218
      type: 'test'
      ...
    # Subtest: accepts a normal internal dashboard route from an open deep link
    ok 6 - accepts a normal internal dashboard route from an open deep link
      ---
      duration_ms: 0.709841
      type: 'test'
      ...
    # Subtest: revalidates open links after canonical serialization
    ok 7 - revalidates open links after canonical serialization
      ---
      duration_ms: 1.448033
      type: 'test'
      ...
    # Subtest: rejects encoded delimiters combined with encoded traversal
    ok 8 - rejects encoded delimiters combined with encoded traversal
      ---
      duration_ms: 0.817789
      type: 'test'
      ...
    # Subtest: rejects malformed and unsafe open deep-link paths
    ok 9 - rejects malformed and unsafe open deep-link paths
      ---
      duration_ms: 0.925339
      type: 'test'
      ...
    # Subtest: publishes a restrictive production policy
    ok 10 - publishes a restrictive production policy
      ---
      duration_ms: 0.646681
      type: 'test'
      ...
    # Subtest: relaxes inline scripts only while Vite serves the development renderer
    ok 11 - relaxes inline scripts only while Vite serves the development renderer
      ---
      duration_ms: 0.258919
      type: 'test'
      ...
    1..11
ok 1 - desktop URL security
  ---
  duration_ms: 9.80068
  type: 'suite'
  ...
1..1
# tests 11
# suites 1
# pass 11
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 232.79461

[16/333] apps/desktop/src/signed-update-policy.test.ts
TAP version 13
# Subtest: Windows signed-update public boundary is fixed unsupported with zero external or apply calls
ok 1 - Windows signed-update public boundary is fixed unsupported with zero external or apply calls
  ---
  duration_ms: 1.31149
  type: 'test'
  ...
# Subtest: signed macOS feeds accept only the canonical ZIP extension and matching artifact URL
ok 2 - signed macOS feeds accept only the canonical ZIP extension and matching artifact URL
  ---
  duration_ms: 2.301908
  type: 'test'
  ...
# Subtest: macOS signed-update check remains check-only and verifies its exact feed and artifact
ok 3 - macOS signed-update check remains check-only and verifies its exact feed and artifact # SKIP
  ---
  duration_ms: 0.141119
  type: 'test'
  ...
1..3
# tests 3
# suites 0
# pass 2
# fail 0
# cancelled 0
# skipped 1
# todo 0
# duration_ms 265.369398

[17/333] apps/desktop/src/smoke-test-authorization.test.ts
TAP version 13
# Subtest: packaged smoke profile authorization
    # Subtest: requires both argv and environment smoke triggers with the explicit isolated directory
    ok 1 - requires both argv and environment smoke triggers with the explicit isolated directory
      ---
      duration_ms: 1.666148
      type: 'test'
      ...
    # Subtest: rejects a dual-authorized smoke invocation when the isolated directory is missing
    ok 2 - rejects a dual-authorized smoke invocation when the isolated directory is missing
      ---
      duration_ms: 0.254071
      type: 'test'
      ...
    # Subtest: rejects relative, default, non-smoke, and duplicate directories
    ok 3 - rejects relative, default, non-smoke, and duplicate directories
      ---
      duration_ms: 0.384573
      type: 'test'
      ...
    # Subtest: does not enable mutating smoke behavior in development or without a trigger
    ok 4 - does not enable mutating smoke behavior in development or without a trigger
      ---
      duration_ms: 0.151334
      type: 'test'
      ...
    # Subtest: terminates a malformed packaged smoke attempt without an interactive failure path
    ok 5 - terminates a malformed packaged smoke attempt without an interactive failure path
      ---
      duration_ms: 0.600254
      type: 'test'
      ...
    # Subtest: authorizes the isolated directory before profile and lifecycle construction
    ok 6 - authorizes the isolated directory before profile and lifecycle construction
      ---
      duration_ms: 0.304255
      type: 'test'
      ...
    # Subtest: registers one-shot lifecycle shutdown before smoke window creation and preserves required evidence order
    ok 7 - registers one-shot lifecycle shutdown before smoke window creation and preserves required evidence order
      ---
      duration_ms: 1.597765
      type: 'test'
      ...
    1..7
ok 1 - packaged smoke profile authorization
  ---
  duration_ms: 6.371382
  type: 'suite'
  ...
1..1
# tests 7
# suites 1
# pass 7
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 234.427938

[18/333] apps/desktop/src/smoke-test-evidence.test.ts
TAP version 13
# Subtest: packaged smoke evidence
    # Subtest: does not create evidence for a non-smoke run
    ok 1 - does not create evidence for a non-smoke run
      ---
      duration_ms: 1.504258
      type: 'test'
      ...
    # Subtest: writes only fixed allowlisted event-only records and suppresses duplicates
    ok 2 - writes only fixed allowlisted event-only records and suppresses duplicates
      ---
      duration_ms: 2.417918
      type: 'test'
      ...
    # Subtest: flushes the bounded lifecycle in emission order
    ok 3 - flushes the bounded lifecycle in emission order
      ---
      duration_ms: 30.657611
      type: 'test'
      ...
    1..3
ok 1 - packaged smoke evidence
  ---
  duration_ms: 35.546015
  type: 'suite'
  ...
1..1
# tests 3
# suites 1
# pass 3
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 272.792147

[19/333] apps/desktop/src/vite-file-system-url.test.ts
TAP version 13
# Subtest: Vite filesystem renderer URLs
    # Subtest: preserves an absolute POSIX path after the /@fs/ prefix
    ok 1 - preserves an absolute POSIX path after the /@fs/ prefix
      ---
      duration_ms: 0.76246
      type: 'test'
      ...
    # Subtest: normalizes a Windows drive-letter path and separators
    ok 2 - normalizes a Windows drive-letter path and separators
      ---
      duration_ms: 0.214209
      type: 'test'
      ...
    1..2
ok 1 - Vite filesystem renderer URLs
  ---
  duration_ms: 2.138023
  type: 'suite'
  ...
1..1
# tests 2
# suites 1
# pass 2
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 237.091602

[20/333] apps/desktop/src/window-options.test.ts
TAP version 13
# Subtest: desktop BrowserWindow security
    # Subtest: isolates and sandboxes the renderer without Node or webviews
    ok 1 - isolates and sandboxes the renderer without Node or webviews
      ---
      duration_ms: 1.290086
      type: 'test'
      ...
    # Subtest: uses the native inset title bar only on macOS
    ok 2 - uses the native inset title bar only on macOS
      ---
      duration_ms: 0.155119
      type: 'test'
      ...
    # Subtest: retains the preferred and minimum responsive window sizes
    ok 3 - retains the preferred and minimum responsive window sizes
      ---
      duration_ms: 0.124329
      type: 'test'
      ...
    # Subtest: centers the initial window within the selected display work area
    ok 4 - centers the initial window within the selected display work area
      ---
      duration_ms: 0.213435
      type: 'test'
      ...
    1..4
ok 1 - desktop BrowserWindow security
  ---
  duration_ms: 2.693935
  type: 'suite'
  ...
# Subtest: desktop BrowserWindow display sizing
    # Subtest: clamps preferred and minimum sizing for a normal work area
    ok 1 - clamps preferred and minimum sizing for a normal work area
      ---
      duration_ms: 0.259632
      type: 'test'
      ...
    # Subtest: clamps preferred and minimum sizing for a exactly bounded work area
    ok 2 - clamps preferred and minimum sizing for a exactly bounded work area
      ---
      duration_ms: 0.072657
      type: 'test'
      ...
    # Subtest: clamps preferred and minimum sizing for a narrow work area
    ok 3 - clamps preferred and minimum sizing for a narrow work area
      ---
      duration_ms: 0.112987
      type: 'test'
      ...
    # Subtest: clamps preferred and minimum sizing for a short work area
    ok 4 - clamps preferred and minimum sizing for a short work area
      ---
      duration_ms: 0.235745
      type: 'test'
      ...
    # Subtest: clamps preferred and minimum sizing for a work area smaller in both dimensions
    ok 5 - clamps preferred and minimum sizing for a work area smaller in both dimensions
      ---
      duration_ms: 0.117006
      type: 'test'
      ...
    # Subtest: selects the display nearest the cursor for multi-display window placement
    ok 6 - selects the display nearest the cursor for multi-display window placement
      ---
      duration_ms: 0.341203
      type: 'test'
      ...
    # Subtest: falls back deterministically to the primary display
    ok 7 - falls back deterministically to the primary display
      ---
      duration_ms: 0.132711
      type: 'test'
      ...
    1..7
ok 2 - desktop BrowserWindow display sizing
  ---
  duration_ms: 1.574354
  type: 'suite'
  ...
1..2
# tests 11
# suites 2
# pass 11
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 233.455551

[21/333] packages/api/test/agentLoginRoutes.test.ts
TAP version 13
# Subtest: agent login session manager
    # Subtest: builds an allowlisted Docker login container without forwarding host secrets
    ok 1 - builds an allowlisted Docker login container without forwarding host secrets
      ---
      duration_ms: 6.181279
      type: 'test'
      ...
    # Subtest: maps a ProPR-managed account to the managed host root and marks its container ownership as safe to normalize
    ok 2 - maps a ProPR-managed account to the managed host root and marks its container ownership as safe to normalize
      ---
      duration_ms: 1.204817
      type: 'test'
      ...
    # Subtest: creates a ProPR-managed credential directory before starting Docker
    ok 3 - creates a ProPR-managed credential directory before starting Docker
      ---
      duration_ms: 2.003474
      type: 'test'
      ...
    # Subtest: fails clearly instead of resolving a default home path inside a containerized API
    ok 4 - fails clearly instead of resolving a default home path inside a containerized API
      ---
      duration_ms: 0.612106
      type: 'test'
      ...
    # Subtest: rejects unsafe credential roots and option-like image names
    ok 5 - rejects unsafe credential roots and option-like image names
      ---
      duration_ms: 0.375307
      type: 'test'
      ...
    # Subtest: streams sanitized output, accepts input, and records successful completion
    ok 6 - streams sanitized output, accepts input, and records successful completion
      ---
      duration_ms: 1.476785
      type: 'test'
      ...
    # Subtest: prevents concurrent logins that write the same credential directory
    ok 7 - prevents concurrent logins that write the same credential directory
      ---
      duration_ms: 0.57695
      type: 'test'
      ...
    # Subtest: pulls a missing agent image before creating the login container
    ok 8 - pulls a missing agent image before creating the login container
      ---
      duration_ms: 0.563641
      type: 'test'
      ...
    # Subtest: renews the session deadline when the user sends input
    ok 9 - renews the session deadline when the user sends input
      ---
      duration_ms: 0.587137
      type: 'test'
      ...
    # Subtest: sweeps only orphaned login containers from the current stack scope
    ok 10 - sweeps only orphaned login containers from the current stack scope
      ---
      duration_ms: 0.431463
      type: 'test'
      ...
    1..10
ok 1 - agent login session manager
  ---
  duration_ms: 15.20929
  type: 'suite'
  ...
# Subtest: agent login routes
    # Subtest: starts and returns only the requesting user login session
    ok 1 - starts and returns only the requesting user login session
      ---
      duration_ms: 0.688972
      type: 'test'
      ...
    # Subtest: accepts the same agent alias on start and follow-up calls, including while disabled
    ok 2 - accepts the same agent alias on start and follow-up calls, including while disabled
      ---
      duration_ms: 0.515932
      type: 'test'
      ...
    # Subtest: rejects interactive login for an unsupported agent type
    ok 3 - rejects interactive login for an unsupported agent type
      ---
      duration_ms: 0.383268
      type: 'test'
      ...
    1..3
ok 2 - agent login routes
  ---
  duration_ms: 1.709063
  type: 'suite'
  ...
# [2026-09-02 17:24:45.735 +0000] �[32mINFO�[39m: �[36mSQLite database connection established successfully�[39m
#     filename: "/tmp/propr-test-suite-XesJcv/021-agentLoginRoutes.test.ts/propr.test.sqlite"
#     environment: "test"
# [2026-09-02 17:24:45.745 +0000] �[32mINFO�[39m: �[36mSQLite database connection closed�[39m
# [2026-09-02 17:24:45.745 +0000] �[32mINFO�[39m: �[36mShutting down queue...�[39m
# [2026-09-02 17:24:45.745 +0000] �[32mINFO�[39m: �[36mQueue was never initialized, nothing to shutdown�[39m
1..2
# tests 13
# suites 2
# pass 13
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 1942.198749

[22/333] packages/api/test/agentRuntimeRoutes.test.ts
TAP version 13
# Subtest: agent runtime package routes
    # Subtest: queues one validated package profile for the unified agent image
    ok 1 - queues one validated package profile for the unified agent image
      ---
      duration_ms: 6.914946
      type: 'test'
      ...
    # Subtest: persists a failed state when queue submission fails
    ok 2 - persists a failed state when queue submission fails
      ---
      duration_ms: 0.818097
      type: 'test'
      ...
    # Subtest: rejects a package missing from an effective runtime before queueing
    ok 3 - rejects a package missing from an effective runtime before queueing
      ---
      duration_ms: 0.648024
      type: 'test'
      ...
    # Subtest: times out slow runtime package validation before queueing
    ok 4 - times out slow runtime package validation before queueing
      ---
      duration_ms: 5.563204
      type: 'test'
      ...
    # Subtest: returns package suggestions from configured runtimes
    ok 5 - returns package suggestions from configured runtimes
      ---
      duration_ms: 0.751422
      type: 'test'
      ...
    # Subtest: enforces PROPR_ADMIN_USERS when configured
    ok 6 - enforces PROPR_ADMIN_USERS when configured
      ---
      duration_ms: 0.232777
      type: 'test'
      ...
    # Subtest: denies runtime package changes by default when no admin policy is configured
    ok 7 - denies runtime package changes by default when no admin policy is configured
      ---
      duration_ms: 0.276533
      type: 'test'
      ...
    # Subtest: requires runtime-management permission before returning runtime package state
    ok 8 - requires runtime-management permission before returning runtime package state
      ---
      duration_ms: 0.27091
      type: 'test'
      ...
    # Subtest: warms the package catalog when an admin loads runtime package state
    ok 9 - warms the package catalog when an admin loads runtime package state
      ---
      duration_ms: 0.360543
      type: 'test'
      ...
    # Subtest: does not warm the package catalog when a member is rejected
    ok 10 - does not warm the package catalog when a member is rejected
      ---
      duration_ms: 2.371124
      type: 'test'
      ...
    # Subtest: resolves the runtime build queue lazily when queueing
    ok 11 - resolves the runtime build queue lazily when queueing
      ---
      duration_ms: 0.85429
      type: 'test'
      ...
    # Subtest: reports apply load failures through the route response
    ok 12 - reports apply load failures through the route response
      ---
      duration_ms: 0.329466
      type: 'test'
      ...
    # Subtest: verifies the current effective images through the runtime-management boundary
    ok 13 - verifies the current effective images through the runtime-management boundary
      ---
      duration_ms: 0.331584
      type: 'test'
      ...
    # Subtest: rejects runtime verification without runtime-management permission
    ok 14 - rejects runtime verification without runtime-management permission
      ---
      duration_ms: 0.243591
      type: 'test'
      ...
    1..14
ok 1 - agent runtime package routes
  ---
  duration_ms: 21.37882
  type: 'suite'
  ...
# [2026-09-02 17:24:47.421 +0000] �[32mINFO�[39m: �[36mSQLite database connection established successfully�[39m
#     filename: "/tmp/propr-test-suite-XesJcv/022-agentRuntimeRoutes.test.ts/propr.test.sqlite"
#     environment: "test"
# [2026-09-02 17:24:47.437 +0000] �[32mINFO�[39m: �[36mSQLite database connection closed�[39m
1..1
# tests 14
# suites 1
# pass 14
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 1692.706479

[23/333] packages/api/test/attachmentUploadCleanup.test.ts
TAP version 13
# Subtest: upload handler removes Multer files rejected before attachment processing
ok 1 - upload handler removes Multer files rejected before attachment processing
  ---
  duration_ms: 9.316831
  type: 'test'
  ...
# Subtest: attachment processing removes temporary and final files when persistence fails
ok 2 - attachment processing removes temporary and final files when persistence fails
  ---
  duration_ms: 4.600967
  type: 'test'
  ...
# Subtest: temporary cleanup refuses paths outside its configured root
ok 3 - temporary cleanup refuses paths outside its configured root
  ---
  duration_ms: 0.580682
  type: 'test'
  ...
# Subtest: temporary cleanup rejects dot-segment paths that resolve above its root
ok 4 - temporary cleanup rejects dot-segment paths that resolve above its root
  ---
  duration_ms: 0.435734
  type: 'test'
  ...
# Subtest: attachment processing rejects path-like draft IDs and still cleans its temp file
ok 5 - attachment processing rejects path-like draft IDs and still cleans its temp file
  ---
  duration_ms: 1.427442
  type: 'test'
  ...
# [2026-09-02 17:24:49.208 +0000] �[32mINFO�[39m: �[36mSQLite database connection established successfully�[39m
#     filename: "/tmp/propr-test-suite-XesJcv/023-attachmentUploadCleanup.test.ts/propr.test.sqlite"
#     environment: "test"
# [2026-09-02 17:24:49.221 +0000] �[32mINFO�[39m: �[36mSQLite database connection closed�[39m
1..5
# tests 5
# suites 0
# pass 5
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 1657.861364

[24/333] packages/api/test/authGithubTokens.test.ts
TAP version 13
# Refreshing GitHub token for user octocat (force=true)
# Successfully refreshed GitHub token for user octocat
# Refreshing GitHub token for user octocat (force=true)
# GitHub token refresh failed with status 503
# Refreshing GitHub token for user octocat (force=true)
# Subtest: isGitHubTokenExpired handles missing, future, exact, and past expiry values
ok 1 - isGitHubTokenExpired handles missing, future, exact, and past expiry values
  ---
  duration_ms: 2.097891
  type: 'test'
  ...
# Subtest: ensureAuthenticated refreshe

...(truncated)

View Workflow

[integry]

Independent follow-up on exact head 54dddc8.

The production recovery change and fixed setup split audit clean, but the new post-recovery mismatch regression injects its bad digest at the wrong read. Its mock returns $recoveryProofBadDigest for BackupPath immediately, so the pre-restore BASELINE_DIGEST gate reads the bad value and never reaches the intended primary Backup->Desktop rename plus post-recovery Backup digest comparison.

Correct only the regression fixture:

• delegate the first/pre-restore BackupPath digest read to the real function;
• return the bad digest only on the second, post-recovery BackupPath read (use a bounded mutable call counter or an equivalently narrow post-recovery flag);
• assert exact call order/count and RECOVERY_RELOCATE;
• after restoring the original function, prove the real final retained backup digest still equals the original baseline.

Preserve the audited production recovery code, all five fixed REGRESSION_VALUE_SETUP sub-operations, native producer, lockfile, and total cleanup. Run static tests and let fresh native x64/ARM64 identify the real first setup token.

[propr-dev]

✅ Applied the requested follow-up changes in commit b911a90

Summary of Changes

Implemented the follow-up fixture fix on exact head 54dddc835e8847195f1c7d97716d5d2cadc6bf6e.

Changed:

• test-installed-windows-app-supervisor.ps1: recovery proof mock now delegates the first BackupPath digest read, returns the bad digest only on the second BackupPath read, then delegates later reads. It asserts exact call count/order and the RECOVERY_RELOCATE diagnostic, restores the original function, then proves the retained backup’s real digest equals the original baseline.
• release-workflow.test.ts: tightened static coverage for that exact fixture behavior.

Validation:

• git diff --check passed.
• npx tsx --test apps/desktop/src/release-workflow.test.ts passed: 23/23.
• npm --workspace apps/desktop test -- src/release-workflow.test.ts passed the desktop suite: 177 passed, 6 skipped.
• Native Windows x64/ARM64 were not run locally because pwsh is not installed in this Linux environment.

---

🤖 Implementation Details

• Model: GPT-5.5 (high)
• Requested By: @integry
• Time: 3m 48s
• Tokens: 488,277 (481,081 in / 7,196 out)
• Cost: $0.70

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5513775588✓

[propr-dev]

CI failed: Validate unsigned win32-x64 package

Please investigate and fix this CI failure.

• Check: Validate unsigned win32-x64 package
• Result: failure
• Commit: 54dddc835e88 (54dddc835e8847195f1c7d97716d5d2cadc6bf6e)
• Details: View CI failure

Failure evidence

.github:26
Process completed with exit code 1.

[propr-dev]

CI failed: Validate unsigned win32-arm64 package

Please investigate and fix this CI failure.

• Check: Validate unsigned win32-arm64 package
• Result: failure
• Commit: b911a90f460e (b911a90f460e5b3dd29ed7d6d03cb8e9aea54611)
• Details: View CI failure

Failure evidence

.github:28
Process completed with exit code 1.

[propr-dev]

CI failed: Validate unsigned win32-x64 package

Please investigate and fix this CI failure.

• Check: Validate unsigned win32-x64 package
• Result: failure
• Commit: b911a90f460e (b911a90f460e5b3dd29ed7d6d03cb8e9aea54611)
• Details: View CI failure

Failure evidence

.github:28
Process completed with exit code 1.

[integry]

Native follow-up on exact head b911a90.

Fresh hosted x64 job 100357573048 and ARM64 job 100357573049 converge after all prior markers at:
REGRESSION_VALUE_KIND_SETUP / REGISTRY_VALUE.

This proves the native REG_NONE writer is not the current first failure; one conventional .NET registry value-kind setup call fails earlier. Implement attribution-only refinement:

1. Split REGRESSION_VALUE_KIND_SETUP into one fixed, allowlisted sub-operation per exact conventional call: DEFAULT_STRING, STRING, EXPAND_STRING, BINARY, DWORD, QWORD, and MULTI_STRING. If key acquisition/open is distinct, attribute it separately as KEY_OPEN.
2. Each sub-operation must have a fixed operation token and fixed category, wrap only its exact producer call, and preserve total cleanup/evidence. Never include registry paths, names, values, SIDs, handles, exception text, or other dynamic data.
3. Update static/behavioral regressions to require every exact token and reject the old broad VALUE_KIND_SETUP attribution.
4. Do not change any SetValue arguments, types, values, native REG_NONE writer, production code, recovery behavior, or lockfile yet.
5. Rerun native x64 and ARM64 and report the first exact converged token.

Preserve the audited recovery digest proof, five outer setup tokens, collision/rename semantics, and recoverable bytes.

[propr-dev]

✅ Applied the requested follow-up changes in commit 7b8dcfc

Summary of Changes

Implemented the attribution-only split on exact head b911a90f....

Changed:

• test-installed-windows-app-supervisor.ps1: replaced broad REGRESSION_VALUE_KIND_SETUP allowlist entry with fixed tokens for KEY_OPEN, DEFAULT_STRING, STRING, EXPAND_STRING, BINARY, DWORD, QWORD, MULTI_STRING.
• test-installed-windows-app-supervisor.ps1: updated attribution-totality behavioral cases for every exact token.
• test-installed-windows-app-supervisor.ps1: split the setup so Get-Item is under REGRESSION_VALUE_KIND_KEY_OPEN / REGISTRY_PATH, and each existing .SetValue(...) call is under its own fixed REGISTRY_VALUE token. No SetValue arguments/types/values or native REG_NONE code changed.
• release-workflow.test.ts: updated static regressions to require the exact tokens and reject the old broad REGRESSION_VALUE_KIND_SETUP.

Validation:

• npm --workspace @propr/desktop exec -- tsx --test src/release-workflow.test.ts passed.
• npm --workspace @propr/desktop test passed: 177 passed, 6 skipped.
• git diff --check passed.

Native x64/ARM64 were not rerun: this Linux host has no pwsh, and hosted native Actions cannot exercise these uncommitted changes without committing/pushing, which the request explicitly forbids. New first converged native token is therefore not available from this run.

---

🤖 Implementation Details

• Model: GPT-5.5 (high)
• Requested By: @integry
• Time: 7m 1s
• Tokens: 1,420,352 (1,406,316 in / 14,036 out)
• Cost: $1.56

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5513954655✓

[propr-dev]

CI failed: Validate unsigned win32-arm64 package

Please investigate and fix this CI failure.

• Check: Validate unsigned win32-arm64 package
• Result: failure
• Commit: 7b8dcfccc342 (7b8dcfccc3426d2cb1dd6cc941908979ffe6ff2b)
• Details: View CI failure

Failure evidence

.github:26
Process completed with exit code 1.

[propr-dev]

CI failed: Validate unsigned win32-x64 package

Please investigate and fix this CI failure.

• Check: Validate unsigned win32-x64 package
• Result: failure
• Commit: 7b8dcfccc342 (7b8dcfccc3426d2cb1dd6cc941908979ffe6ff2b)
• Details: View CI failure

Failure evidence

.github:28
Process completed with exit code 1.

[integry]

Follow-up on exact head 7b8dcfccc3426d2cb1dd6cc941908979ffe6ff2b. Native Windows x64 job 100363079183 now reaches the split fixture setup and gives the decisive first failure:

PROPR_WINDOWS_SUPERVISOR_INVOCATION:TEST:HKCU_INSTALLED_VALUE_OWNERSHIP:SCENARIO:HKCU_BASELINE_RESTORE:PHASE:FIXTURE_SETUP:CALLSITE:REGRESSION_VALUE_KIND_DEFAULT_STRING:FIELD:REGISTRY_VALUE:FAILED

REGRESSION_VALUE_KIND_KEY_OPEN / REGISTRY_PATH succeeded immediately before it. This proves the Registry-provider Get-Item object can be read but was not opened writable for .SetValue; it is not evidence against the default-string kind and does not justify changing the native REG_NONE writer.

Make the narrow fixture-only writable-handle correction:

1. Add a helper that accepts only canonical Registry::HKEY_CURRENT_USER\\Software\\ProPRSupervisorFixture\\... paths, rejects root/foreign/malformed traversal or empty relative paths, strips the exact HKCU provider prefix, and opens the subkey from [Microsoft.Win32.Registry]::CurrentUser with write access (OpenSubKey(..., $true) or an equivalent explicit ReadWriteSubTree API). Assert the returned key is non-null.
2. In Set-HkcuFixtureBoundaryValueKinds, use that explicit writable key for the existing default/String/ExpandString/Binary/DWord/QWord/MultiString calls and the existing native REG_NONE handle. Preserve every exact value name, kind, data, bytes, callsite, field, and execution order. Dispose the writable key deterministically in finally.
3. Audit the later HKCU fixture-only direct (Get-Item ...).SetValue(...)/read-view .SetValue sites in this regression and route them through the same bounded writable helper (or provider-native write primitive with identical value-kind semantics) so CI does not merely move to the next deterministic read-only-handle failure. Do not alter production cleanup/controller code or broaden registry authority.
4. Add focused/static coverage for accepted nested fixture paths, rejection of the HKCU root/foreign prefix/malformed paths, explicit writable open, and deterministic disposal. Preserve the totality allowlist, hostile diagnostic sanitization, b911 recovery digest proof, and exact split invocation tokens.
5. Run focused PowerShell/static/typecheck tests and git diff --check. The required acceptance is fresh native x64 and ARM64 reaching and passing the complete HKCU boundary/value-kind/digest/recovery proof; report the exact new head and leave unmerged for independent audit.

[propr-dev]

✅ Applied the requested follow-up changes in commit fd333cc

Summary of Changes

Implemented the narrow fixture-only writable-handle correction.

Changed:

• Added bounded HKCU supervisor fixture writable opener in test-installed-windows-app-supervisor.ps1, restricted to canonical Registry::HKEY_CURRENT_USER\Software\ProPRSupervisorFixture\... paths.
• Updated Set-HkcuFixtureBoundaryValueKinds to use the explicit writable key for all existing value-kind writes and the native REG_NONE writer, with deterministic Dispose() in finally.
• Routed later HKCU fixture setup .SetValue sites through the helper where paths are under ProPRSupervisorFixture; for Software\ProPR\Desktop, switched to New-ItemProperty with explicit String/DWord property types.
• Added focused static coverage in release-workflow.test.ts for accepted/rejected fixture paths, writable OpenSubKey(..., $true), disposal, and prevention of the old read-view .SetValue pattern.

Validation run:

• npx tsx --test apps/desktop/src/release-workflow.test.ts passed.
• npx tsc --noEmit --project apps/desktop/tsconfig.json passed.
• git diff --check passed.

I could not run native PowerShell/x64/ARM64 validation here because pwsh is not installed in this Linux container. Per instruction, I did not commit; current checked-out HEAD remains 7b8dcfccc3426d2cb1dd6cc941908979ffe6ff2b with the two intended files modified.

---

🤖 Implementation Details

• Model: GPT-5.5 (high)
• Requested By: @integry
• Time: 9m 12s
• Tokens: 2,118,697 (2,096,320 in / 22,377 out)
• Cost: $2.22

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5514216622✓

[propr-dev]

CI failed: Validate unsigned win32-x64 package

Please investigate and fix this CI failure.

• Check: Validate unsigned win32-x64 package
• Result: failure
• Commit: fd333cc161d4 (fd333cc161d46f08c54fe7812b52e505eeea1e3c)
• Details: View CI failure

Failure evidence

.github:28
Process completed with exit code 1.

[propr-dev]

CI failed: Validate unsigned win32-arm64 package

Please investigate and fix this CI failure.

• Check: Validate unsigned win32-arm64 package
• Result: failure
• Commit: fd333cc161d4 (fd333cc161d46f08c54fe7812b52e505eeea1e3c)
• Details: View CI failure

Failure evidence

.github:28
Process completed with exit code 1.