Squirrel.Windows installer and automatic updates

[DingDingChae]

🚀 In progress — Squirrel.Windows and automatic updates

Started: 2026-08-06T00:00:00-04:00

Material Designer is migrating its Windows delivery from the legacy installer path to Squirrel.Windows on codex/squirrel-auto-update-20260806. The work covers the real Setup.exe, RELEASES, full and delta .nupkg feed assets, checksum-verified metadata, bounded startup/background checks, and the user-controlled Restart to install update / Later UI.

The current repository tip is 8e1ccb4129d3a69df8b9f6a5083a9ee413521589. Packaging and updater implementation lanes are in progress; release workflow wiring and CI verification remain pending.

廣東話：而家喺 codex/squirrel-auto-update-20260806 將 Windows 安裝流程搬去 Squirrel.Windows，會真係出 Setup.exe、RELEASES、full/delta .nupkg 同 checksum metadata。更新會喺啟動同背景按界線檢查，下載驗證完只會顯示 Restart to install update 同 Later，唔會偷偷重啟部機。現時仲係施工中，release workflow 同 CI 證據未完成。

[DingDingChae]

✅ Implementation lane committed

The Squirrel.Windows packaging and restartable update implementation is committed on codex/squirrel-auto-update-20260806 at 7ce7452.

English

• Windows packaging now defaults to Squirrel.Windows and stages Setup.exe, RELEASES, full .nupkg packages, any generated delta .nupkg packages, and project-owned metadata.json.
• Stable packaged Windows builds use https://github.com/Ding-Ding-Projects/material-designer/releases/latest/download/metadata.json; downloads are checksum-verified and the UI waits for the explicit Restart to install update action.
• Squirrel lifecycle switches are handled before normal Electron startup, and the Windows smoke path distinguishes Update.exe from the legacy NSIS uninstaller.
• Static verification passed: git diff --check, actionlint -shellcheck= .github/workflows/release.yml, and the design allowlist comparison reported zero missing entries.

繁體中文／香港口語

• Windows packaging 而家預設用 Squirrel.Windows，會準備 Setup.exe、RELEASES、full .nupkg、有就附埋 delta .nupkg，仲有專案自己嘅 metadata.json。
• Stable packaged Windows build 會讀 https://github.com/Ding-Ding-Projects/material-designer/releases/latest/download/metadata.json；下載先驗 checksum，介面等用戶明確撳 Restart to install update。
• Squirrel lifecycle switches 會喺正常 Electron startup 前處理，Windows smoke path 亦分清 Update.exe 同舊 NSIS uninstaller，唔再叫錯人做嘢。
• Static verification 已過：git diff --check、actionlint -shellcheck= .github/workflows/release.yml 同 design allowlist comparison 都係零 missing entries。

Warning

Hosted Windows CI, the new release assets, and the first published Squirrel feed are still unverified. No code-signing certificate is configured, so the release remains explicitly unsigned until that external infrastructure exists.

[DingDingChae]

🚀 Branch delivered for integration

English

• The implementation commit 7ce7452 and documentation commit 2cae835 are now on codex/squirrel-auto-update-20260806.
• The branch tip on GitHub is 2cae835a1a9b6b86352b0c3b083ff1a35c061ebc.
• Open issues were re-scanned in both Ding-Ding-Projects/material-designer and Ding-Ding-Projects/agent-global-memory; neither repository has an open issue.
• Next: fast-forward main, dispatch Verify and Release, and report their actual verdicts. No release asset or feed is called verified yet.

繁體中文／香港口語

• implementation commit 7ce7452 同 documentation commit 2cae835 已經去到 codex/squirrel-auto-update-20260806。
• GitHub 上面嘅 branch tip 係 2cae835a1a9b6b86352b0c3b083ff1a35c061ebc。
• Ding-Ding-Projects/material-designer 同 Ding-Ding-Projects/agent-global-memory 嘅 open issues 已再掃一次，兩邊都冇 open issue。
• 下一步係 fast-forward main，dispatch Verify 同 Release，再報告真正 verdict；未有 release asset 或 feed 會提早當 verified。

Warning

The branch is delivered, but the default branch, hosted Windows build, published Squirrel assets, and code-signing state are still pending verification.

[DingDingChae]

✅ Integrated into main

English

• main was fast-forwarded to 2cae835, which contains the Squirrel implementation at 7ce7452 and its documentation/changelog at 2cae835.
• The GitHub main tip was verified as 2cae835a1a9b6b86352b0c3b083ff1a35c061ebc; the prior base 8e1ccb4129d3a69df8b9f6a5083a9ee413521589 is proven an ancestor.
• The implementation is now in the release path, but hosted Windows Verify and Release runs have not yet produced a verdict or new Squirrel assets.

繁體中文／香港口語

• main 已 fast-forward 到 2cae835，入面包括 7ce7452 嘅 Squirrel implementation，同埋 2cae835 嘅 documentation／changelog。
• GitHub main tip 已核實係 2cae835a1a9b6b86352b0c3b083ff1a35c061ebc；舊 base 8e1ccb4129d3a69df8b9f6a5083a9ee413521589 已證明係 ancestor。
• Implementation 而家入咗 release path，不過 hosted Windows Verify 同 Release 仲未有 verdict，亦未有新 Squirrel assets 可以講 verified。

Note

The next update will carry the exact workflow run links and the actual green, failed, or still-running state. The missing code-signing certificate remains an explicit external limitation.

[DingDingChae]

⏳ Hosted verification started

English

The default branch now carries 2cae835a1a9b6b86352b0c3b083ff1a35c061ebc.

• Verify run 31127492562 — queued for the main tip.
• Release run 31127492852 — pending for the main tip, with smoke=true and publish=true.

No Squirrel release asset, feed, installer smoke result, or CI success is claimed yet. The run must prove Setup.exe, RELEASES, full/delta .nupkg packages, metadata.json, install/start/health-check/uninstall, and the published release before this task can be called verified.

繁體中文／香港口語

Default branch 而家載住 2cae835a1a9b6b86352b0c3b083ff1a35c061ebc。

• Verify run 31127492562 — main tip queued。
• Release run 31127492852 — main tip pending，設定係 smoke=true 同 publish=true。

而家未有 Squirrel release asset、feed、installer smoke result 或 CI success 可以當 verified。個 run 要證明 Setup.exe、RELEASES、full/delta .nupkg、metadata.json、install/start/health-check/uninstall，同埋 published release，先可以話呢輪 verified。

[DingDingChae]

⚠️ Release concurrency blocker

English

GitHub Actions is holding the new Release behind obsolete run 31126707930, which targets the pre-task SHA 8e1ccb4129d3a69df8b9f6a5083a9ee413521589 and has remained queued since 2026-08-06T19:12:14Z without starting a job.

• Current Verify run 31127492562: queued.
• Current Release run 31127492852: pending behind the old release concurrency group.
• gh run cancel and the REST cancel endpoint both returned HTTP 502 for the obsolete run.
• gh run delete reached GitHub but returned HTTP 403; the run was not deleted.
• No self-hosted runners are registered; hosted-runner availability is still external and unverified.

The implementation is already merged into main at 2cae835. No release, installer, feed, or CI success is claimed until a current run produces evidence.

繁體中文／香港口語

GitHub Actions 而家將新 Release 卡喺舊 run 31126707930 後面；嗰個 run 係舊 SHA 8e1ccb4129d3a69df8b9f6a5083a9ee413521589，由 2026-08-06T19:12:14Z 開始一直 queued，連一個 job 都未開。

• 目前 Verify run 31127492562：queued。
• 目前 Release run 31127492852：喺舊 release concurrency group 後面 pending。
• gh run cancel 同 REST cancel endpoint 對舊 run 都回 HTTP 502。
• gh run delete 有到 GitHub，但回 HTTP 403；個 run 冇刪到。
• 冇 self-hosted runner 登記；hosted runner 幾時有位仍然係 external、未驗證。

Implementation 已經 merge 入 main，tip 係 2cae835。未有 current run 產生證據之前，唔會話 release、installer、feed 或 CI success 已 verified。

[DingDingChae]

✅ Documentation accuracy corrected

The user-facing install surfaces now point at the latest verified legacy release v0.16.1-r71.1 (Bamboo Shoot Har Gow · 筍尖蝦餃), with the exact installer, portable archive, checksum, smoke-test run, and asset sizes. The correction is 5cd1199, now fast-forwarded into main and dewed hui.

The Squirrel implementation remains at 7ce7452 with its documentation at 2cae835. The current hosted runs still target 2cae835: Verify 31127492562 is queued and Release 31127492852 is pending behind obsolete queued run 31126707930; no new Squirrel release is claimed.

繁體中文／香港口語

User-facing install surfaces 而家已經指向最新已驗證嘅 legacy release v0.16.1-r71.1（Bamboo Shoot Har Gow · 筍尖蝦餃），installer、portable archive、checksum、smoke-test run 同 asset sizes 都對齊。Correction 係 5cd1199，已經 fast-forward 入 main 同 dewed hui。

Squirrel implementation 仍然係 7ce7452，documentation 係 2cae835。目前 hosted runs 仲係 target 2cae835：Verify 31127492562 queued，Release 31127492852 喺舊 queued run 31126707930 後面 pending；未有新 Squirrel release 可以話 verified。

[DingDingChae]

🟡 Handoff: implementation landed, hosted verification blocked

English

The requested Squirrel.Windows and automatic-update implementation is merged into main and dewed hui.

Evidence	State
Main tip	5cd1199 — verified against origin/main
Squirrel implementation	7ce7452 — packaging, lifecycle, updater UI, workflow
Feature documentation/changelog	2cae835
Release-link accuracy	5cd1199 — latest verified legacy v0.16.1-r71.1
Static checks	git diff --check, actionlint -shellcheck= .github/workflows/release.yml, and allowlist comparison passed
Open issues	None in material-designer or agent-global-memory
Current Verify	31127492562 — queued
Current Release	31127492852 — pending

The current Release is blocked behind obsolete queued run 31126707930 for the pre-task SHA. Cancellation returned HTTP 502 and deletion returned HTTP 403, so no current Squirrel asset, feed, installer smoke result, or new release is claimed. No code-signing certificate is configured; the implementation documents that boundary explicitly.

繁體中文／香港口語

要求嘅 Squirrel.Windows 同 automatic-update implementation 已 merge 入 main，亦已經 dewed hui。

證據	狀態
Main tip	5cd1199 — 已對返 origin/main
Squirrel implementation	7ce7452 — packaging、lifecycle、updater UI、workflow
Feature documentation/changelog	2cae835
Release-link accuracy	5cd1199 — 最新已驗證 legacy v0.16.1-r71.1
Static checks	git diff --check、actionlint -shellcheck= .github/workflows/release.yml、allowlist comparison 都 pass
Open issues	material-designer 同 agent-global-memory 都冇
Current Verify	31127492562 — queued
Current Release	31127492852 — pending

Current Release 卡喺舊 queued run 31126707930 後面，嗰個係 task 前嘅 SHA。Cancel 回 HTTP 502，delete 回 HTTP 403，所以未有 current Squirrel asset、feed、installer smoke result 或新 release 可以話 verified。Code-signing certificate 仲未配置，implementation 已經清楚寫低呢個界線。

Warning

This is an external GitHub Actions blocker, not an uncommitted local change. The main checkout is clean and the delivered commits are preserved.

[DingDingChae]

🧭 UI audit in progress

Start: 2026-08-06T16:43:16-04:00

The Squirrel.Windows updater delivery is already on main; this pass is auditing the visible experience and its safety seams before calling it complete.

Findings established

Surface	Evidence	State
Update dialog	Modal focus is not trapped/restored; reduced-motion still animates download progress	Fix lane running
Update restart	Renderer save work is not part of the quit barrier	High-severity fix lane running
Figma import	URL and notes controls rely on placeholders; constrained modal content can clip	Fix lane running
Context menu	Long bilingual labels ellipsize; dismissal drops focus	Fix lane running
Command palette	Search exposes only a reduced regex affordance, not the full local builder	Fix lane running

No local Node, pnpm, or Electron commands have been run. The hosted Squirrel verification remains pending, with the obsolete queued Release run still blocking the newer run.

粵語摘要：Squirrel.Windows 個更新流程已經落咗 main，而家逐個檢查畫面同安全位：更新對話框要守焦點、重啟要等儲存完成、Figma 表單要有清楚標籤、右鍵選單唔可以截斷長字串，command palette 亦要有真正完整嘅 regex builder。修正未驗證完成，CI 仍然係 pending。

[DingDingChae]

🧩 UI audit and CI runner milestone

The task branch now contains the source fixes, the self-hosted CI contract, and synchronized documentation:

Commit	State	Evidence
f2e71c8	pushed to codex/ui-audit-20260806	renderer save barrier, Squirrel authorization marker/re-arm, narrow overlays, focus and reduced-motion fixes
39fc2e1	pushed in the task branch	root Verify, Release, and Pages use labelled self-hosted runners and install dependencies from the lockfile
1486e69	pushed to codex/ui-audit-20260806	README, roadmap, handoff, changelog and update documentation reflect the current evidence

The local toolchain was not run because this repository requires the CI path for Node, pnpm and Electron work. git diff --check passed. The Windows Git Bash port check still reports the known checkout line-ending baseline: 10033 byte differences, 1 OID mismatch, 0 stale notices and 0 undeclared paths.

Queue state

• Verify 31127492562 is cancelled.
• Release 31127492852 is still queued for main at 2cae835a1a9b6b86352b0c3b083ff1a35c061ebc.
• Retried cancellation through gh; GitHub returned HTTP 502 for the queued Release run, so it is not described as cancelled.

粵語小結

UI audit、Squirrel restart safety 同 self-hosted CI 合約已經落咗 task branch；本機冇行 Node/pnpm/Electron，git diff --check 就係綠。Verify 31127492562 已取消，但 Release 31127492852 仲排緊隊，gh 再試取消都收到 HTTP 502，所以未當佢消失。

[DingDingChae]

🧩 UI audit and CI runner milestone

The task branch now contains the source fixes, the self-hosted CI contract, and synchronized documentation:

Commit	State	Evidence
f2e71c8	pushed to codex/ui-audit-20260806	renderer save barrier, Squirrel authorization marker/re-arm, narrow overlays, focus and reduced-motion fixes
39fc2e1	pushed in the task branch	root Verify, Release, and Pages use labelled self-hosted runners and install dependencies from the lockfile
1486e69	pushed to codex/ui-audit-20260806	README, roadmap, handoff, changelog and update documentation reflect the current evidence

The local toolchain was not run because this repository requires the CI path for Node, pnpm and Electron work. git diff --check passed. The Windows Git Bash port check still reports the known checkout line-ending baseline: 10033 byte differences, 1 OID mismatch, 0 stale notices and 0 undeclared paths.

Queue state

• Verify 31127492562 is cancelled.
• Release 31127492852 is still queued for main at 2cae835a1a9b6b86352b0c3b083ff1a35c061ebc.
• Retried cancellation through gh; GitHub returned HTTP 502 for the queued Release run, so it is not described as cancelled.

粵語小結

UI audit、Squirrel restart safety 同 self-hosted CI 合約已經落咗 task branch；本機冇行 Node/pnpm/Electron，git diff --check 就係綠。Verify 31127492562 已取消，但 Release 31127492852 仲排緊隊，gh 再試取消都收到 HTTP 502，所以未當佢消失。

🧰 Implementation push

Commit b5f0db6 is pushed to codex/ui-audit-20260806 and verified with git ls-remote. It adds the remaining adversarial fixes: internal context-menu scrolling, HTML save preparation and file-switch-safe renderer handoff, Figma tabpanel semantics and keyboard navigation, Escape consumption, command-palette wrapping, retryable failed installer handoffs, and clear-cache revocation of deferred installer markers. It also adds pinned user-scoped CI-tool bootstrap for gh, jq, and 7-Zip.

The focused regression specs are committed, but the Node/pnpm/Electron suites and the labelled self-hosted CI run remain unverified. Open issue scans for material-designer and agent-global-memory are empty.

粵語小結

b5f0db6 已經推上 codex/ui-audit-20260806，亦用 git ls-remote 對過。今次補埋 menu 內捲、HTML save、轉檔 race、Figma tab、Escape、palette 換行、installer retry 同 clear-cache 收回 marker，CI 工具亦會自己入 user-scoped cache。Focused specs 已寫入，但 Node/pnpm/Electron 同 labelled self-hosted CI 仲未有真正 verdict；兩個 repo 都冇 open issue。

[DingDingChae]

🧩 UI audit and CI runner milestone

The task branch now contains the source fixes, the self-hosted CI contract, and synchronized documentation:

Commit	State	Evidence
f2e71c8	pushed to codex/ui-audit-20260806	renderer save barrier, Squirrel authorization marker/re-arm, narrow overlays, focus and reduced-motion fixes
39fc2e1	pushed in the task branch	root Verify, Release, and Pages use labelled self-hosted runners and install dependencies from the lockfile
1486e69	pushed to codex/ui-audit-20260806	README, roadmap, handoff, changelog and update documentation reflect the current evidence

The local toolchain was not run because this repository requires the CI path for Node, pnpm and Electron work. git diff --check passed. The Windows Git Bash port check still reports the known checkout line-ending baseline: 10033 byte differences, 1 OID mismatch, 0 stale notices and 0 undeclared paths.

Queue state

• Verify 31127492562 is cancelled.
• Release 31127492852 is still queued for main at 2cae835a1a9b6b86352b0c3b083ff1a35c061ebc.
• Retried cancellation through gh; GitHub returned HTTP 502 for the queued Release run, so it is not described as cancelled.

粵語小結

UI audit、Squirrel restart safety 同 self-hosted CI 合約已經落咗 task branch；本機冇行 Node/pnpm/Electron，git diff --check 就係綠。Verify 31127492562 已取消，但 Release 31127492852 仲排緊隊，gh 再試取消都收到 HTTP 502，所以未當佢消失。

🧰 Implementation push

Commit b5f0db6 is pushed to codex/ui-audit-20260806 and verified with git ls-remote. It adds the remaining adversarial fixes: internal context-menu scrolling, HTML save preparation and file-switch-safe renderer handoff, Figma tabpanel semantics and keyboard navigation, Escape consumption, command-palette wrapping, retryable failed installer handoffs, and clear-cache revocation of deferred installer markers. It also adds pinned user-scoped CI-tool bootstrap for gh, jq, and 7-Zip.

The focused regression specs are committed, but the Node/pnpm/Electron suites and the labelled self-hosted CI run remain unverified. Open issue scans for material-designer and agent-global-memory are empty.

粵語小結

b5f0db6 已經推上 codex/ui-audit-20260806，亦用 git ls-remote 對過。今次補埋 menu 內捲、HTML save、轉檔 race、Figma tab、Escape、palette 換行、installer retry 同 clear-cache 收回 marker，CI 工具亦會自己入 user-scoped cache。Focused specs 已寫入，但 Node/pnpm/Electron 同 labelled self-hosted CI 仲未有真正 verdict；兩個 repo 都冇 open issue。

🛡️ dffb87f hardening milestone

English

The second independent refutation pass found three concrete follow-ups in the new CI/updater code, and commit dffb87f now closes them:

• design/apps/desktop/src/main/updater/deferred-launch.ts rechecks the one-shot installer authorization marker after the 1.5-second handoff delay, so clear-cache can still stop a helper that has not passed its final check.
• design/apps/desktop/src/main/updater.ts distinguishes a missing helpers directory from an unreadable one, verifies marker removal, and returns installer-authorization-revoke-failed before resetting state when revocation cannot be proven.
• scripts/bootstrap-ci-tools.sh and scripts/bootstrap-ci-tools.ps1 serialize shared cache updates, ignore stale PATH tools, validate pinned versions, verify pinned SHA-256 package hashes, and cover tail/paste used by the root workflows. The CI documentation states that downloaded packages are authenticated while the persistent runner cache remains trusted runner state rather than a cryptographic boundary.

Read-only structural evidence: Bash syntax, PowerShell AST parsing, actionlint -shellcheck= -ignore 'label "material-designer"', and git diff --check passed. No Node, pnpm, Electron, runtime suite, or labelled self-hosted workflow was run locally. Rawls and Anscombe independently found no material blocker under the documented boundary.

Remote state: codex/ui-audit-20260806 contains dffb87f01cf5edcafd13e89ececd7b5756a0e1eb, and the remote tip matches exactly. No branch CI verdict exists yet. Verify 31127492562 is cancelled; Release 31127492852 remains queued after cancellation returned HTTP 502, so the queue is not empty and no green result is claimed.

粵語小結

第二輪獨立 refutation 搵到三個 CI/updater 尾巴，dffb87f 已經補返：installer marker 喺 handoff delay 後再驗一次；clear-cache 如果睇唔到或者刪唔走 marker 就報 installer-authorization-revoke-failed，唔會扮 reset 成功；self-hosted bootstrap 有 cache lock、版本檢查、下載 package hash，同埋 tail/paste 工具檢查。文件亦講清楚 package hash 保護下載，persistent runner cache 就係受信任嘅 runner state，唔扮 cryptographic boundary。

Bash、PowerShell AST、actionlint -shellcheck= -ignore 'label "material-designer"' 同 git diff --check 都過。冇喺本機跑 Node、pnpm、Electron、runtime suite 或 labelled runner；兩位 refuter 都確認按文件講明嘅 boundary 冇 material blocker。

codex/ui-audit-20260806 嘅 remote tip 同 dffb87f01cf5edcafd13e89ececd7b5756a0e1eb 一樣。冇新 branch CI verdict；Verify 31127492562 已取消，Release 31127492852 仲 queued，取消時 GitHub 回 HTTP 502，所以 queue 未清，亦唔會扮有綠燈。

[DingDingChae]

🧯 Packer correction and branch update

The queued Release run has now completed and the remote result is failure, not a hang:
31127492852
reached pnpm install --frozen-lockfile, resolved the workspace, and then failed in
Build Windows application → Install dependencies when the post-install packer
typecheck reported src/win/lifecycle.ts(473,95): error TS2345 for
"uninstall-legacy" passed to an invokeNsis action typed as "install" | "uninstall".

Commit 5d66600
passes the supported "uninstall" action while preserving the separate
runTimed(..., "uninstall-legacy") timing label. Commit
1e60df9
records the failure and the correction across the README, CI guide, roadmap,
handoff and changelog. The task branch is now pushed to
codex/ui-audit-20260806, and git ls-remote matches
1e60df98b3cc17df52580a41823925517880ac9f exactly.

No queued or in-progress workflow is currently listed. Verify
31127492562 is cancelled; the failed Release run is no longer queued. No
corrected labelled-runner or installed-build verdict is claimed yet. The next
step is safe integration into main; the pack-squirrel linked worktree remains
preserved because it still holds uncommitted work.

粵語小結

Release 個隊列而家唔係卡死，而係真係行完再紅：31127492852 去到 frozen
install，先喺 packer typecheck 撞到 "uninstall-legacy" 個 type contract。
5d66600 傳返合法 "uninstall"，但 runTimed 個 legacy label 照留；
1e60df9 就將 failure 同修正寫入文件。Task branch 已經推送，
git ls-remote 對到完整 SHA；而家冇 queued 或 in-progress workflow，
但 corrected labelled-runner 同 installed-build 仲未有 verdict。下一步係安全
整合入 main，pack-squirrel 個 linked worktree 仲有未提交 work，所以會保留，唔會亂清。

[DingDingChae]

🧹 Queue cancellation checkpoint

English

The superseded b103004 workflow runs that appeared after the integration push were cancelled:

Run	Workflow	Final state
31129554265	Verify	completed / cancelled
31129554313	Pages	completed / cancelled
31129554253	Release	completed / cancelled

The final gh run list --status queued and gh run list --status in_progress checks return [] for both Ding-Ding-Projects/material-designer and Ding-Ding-Projects/agent-global-memory. No new workflow result is being treated as verification for f008cd8; the earlier Release failure 31127492852 remains the exact red CI evidence until a corrected labelled run exists.

粵語

b103004 呢批已經過時嘅 Verify、Pages 同 Release run 全部取消咗，三個 run 最後都係 completed / cancelled。兩個 repository 最後查 queued 同 in_progress 都係 []，冇再留住排隊工作。唔會將冇新 workflow result 當成 f008cd8 已驗證；之前嘅 Release failure 31127492852 仍然係唯一嗰份明確 red CI 證據，等真正 corrected labelled run 先可以改 verdict。

[DingDingChae]

🧯 Current release failure isolated to the Squirrel harness seam

English

Release run 31186802259 for f6549861 is failed, not running:

• Typecheck, focused Windows tests, unsigned Squirrel packaging, NotSigned, self-contained scanning, and installer artifact upload passed.
• The packaged smoke test timed out after 720000ms at design/e2e/specs/win.spec.ts:542:3.
• The smoke artifact contains only the top-level suite result and build manifest; there is no lifecycle timing file, screenshot, or ui-states.json.
• Publication was skipped, so the latest verified release remains v0.16.1-r71.1.

The prior app.exit(0) lifecycle repair is present in the packaged entry, but the harness still invokes Setup.exe through promisified execFile. That API waits for captured pipe closure; Squirrel descendants may inherit those handles after the installer process exits. The next focused change will use ignored stdio and the direct child exit event, with a source contract preventing a return to buffered execFile. A longer test timeout would only make the same deadlock take longer to admit defeat.

Main Verify 31186802470 remains queued because the Linux self-hosted runner is offline. No fresh release or green CI result is claimed.

廣東話（香港）

f6549861 嘅 Release run 31186802259 已經確定係 failed。前面啲 Typecheck、Windows tests、unsigned Squirrel build、NotSigned、self-contained scan 同 artifact upload 都過晒；packaged smoke 喺第一個 install operation 等足 720000ms，冇 lifecycle timing、冇 screenshot、冇 ui-states.json，所以 publication 跳過。

Packaged entry 個 app.exit(0) 修正有入 build，但 harness 仲用 promisified execFile 開 Setup.exe。Squirrel descendant 可以繼承 captured pipe handle，installer 自己走咗，harness 仍然等 EOF——個咪已經熄燈，後台仲有人唔肯交返條線。下一個 focused fix 會改用 ignored stdio，再按 direct child exit event 收結；拉長 timeout 只係將同一齣戲加長版。

Main Verify 31186802470 因 Linux self-hosted runner offline 仲 queued；而家冇新 release 或 green CI 可以聲稱。

Verification: failed; focused repair in progress

[DingDingChae]

⚠️ Correction — the old run did not identify its active lifecycle action

English

The previous Discussion comment correctly marks Release 31186802259 as failed, but its statement that the first install operation held the full timeout is not supported by the retained artifact. No step journal or lifecycle timing was persisted. The run proves only that the smoke timed out before UI capture; pre-clean uninstall, install, start, or another earlier tools-pack action could have remained pending.

The focused patch therefore does two things together: it avoids buffered Squirrel stdio/pipe closure and adds per-action timeout, descendant-tree termination, and append-only smoke-steps.jsonl evidence. This makes the next run diagnostic even if the pipe hypothesis is not the whole cause. No timeout increase or release claim is involved.

廣東話（香港）

上一個 comment 話 Release 31186802259 failed 係啱，但舊 artifact 冇 step journal 同 lifecycle timing，所以唔可以斷言一定係第一個 install operation 卡足全程。實際只證明 smoke 喺 UI capture 前 timeout，pre-clean uninstall、install、start 或另一個早期 tools-pack action 都有可能。

Focused patch 會一齊處理 buffered Squirrel pipe，同時加每個 action 嘅 timeout、Windows descendant-tree cleanup 同 append-only smoke-steps.jsonl。就算 pipe hypothesis 唔係全部原因，下一個 run 都會點名真正卡住嗰步。冇加長 timeout，亦冇聲稱 release 成功。

Verification: correction recorded; CI pending

[DingDingChae]

📦 Preservation index branch published

The neutral branch preservation/emergency-index-20260828 now provides one recovery map for every unfinished preservation ref.

• Index commit: 16c078005c5d39f3d4baa03e732d21a9f9c37238
• Index file: PRESERVATION.md
• Verification: the remote branch was read back at the exact index commit.

The index records 21 preservation branches and their immutable commit ids. It does not merge the unfinished trees together and does not mark any feature complete.

廣東話摘要

preservation/emergency-index-20260828 而家有一份完整 recovery map，列出 21 個 preservation branch 同 exact commit。呢個索引只係方便搵返 work，唔代表功能完成或者可以直接合併。

[ChongLeung]

✅ Local build manually published

Download Material Designer 0.21.532 for Windows
· Release notes and all twelve assets

Evidence	Verified result
Published	2026-09-06T23:07:03Z
Source and release tag target	6715b18e5094ad335d65bec40a6895c89e14187f
Numeric release id	383738303
Setup bytes	502918656
Setup SHA-256	e239c3f3946856045771bcf9cff50da7c311f9e1211a1ccee5e21e0e4872e4df
Full Squirrel package bytes	508206519
Delta packages	None produced
Download proof	All 12 assets, 1011209926 total bytes, matched before and after publication
Signature	NotSigned
Handoff and publication tooling	02635ae2156c6d99c5c35a6db9ccb90c9bab68dd, pushed and verified

The production renderer passed local compilation, strict TypeScript, and page
generation. The genuine Squirrel package validator passed. This publication used
local output and manual upload; hosted publication runs were cancelled. The
handoff-only commit does not request a duplicate binary release.

Handoff: desktop completion remains open

The packaged executable reached its first-run model-source screen on an isolated
hidden desktop with a live daemon and version 0.21.532. Its updated-at field
displayed Not set, which remains an open finding. The genuine capture is
retained locally but has not been promoted to the public evidence inventory.
All eight owned processes stopped and the named desktop ceased to exist.

Full installation, task execution, updater-cycle verification, all 30 canonical
desktop features, ten destinations, and the complete visual/accessibility matrix
remain incomplete. Six existing lock-panel/QR test failures were reproduced on
prior source and are not reported as passing. This issue remains open.

Remaining source is preserved under six preservation/desktop-completion-*-20260906
tags. The shell tag contains a source snapshot without its unpublished historical
metadata. All original local branches remain retained. Four earlier retained
branches were left unchanged. No archive-backed cleanup or deletion occurred.
Untracked diagnostic logs remain local because they are not public source.

The goal has reached its 90-percent work-budget boundary. No new implementation
lane is starting; the next owner should resume from this handoff and the exact
preservation refs, revalidate the live baseline, and investigate the retained
front-screen timestamp finding before claiming complete desktop verification.

廣東話

0.21.532 已喺本機建立並手動發佈。十二個附件發佈前後都下載比對過，位元組同
SHA-256 一致，Squirrel 安裝程式確定未簽署。上面提供直接下載同完整證據。

包裝版本喺隔離隱藏桌面成功去到首次設定畫面，daemon 正常，版本顯示正確；
更新時間仍顯示 Not set，已如實留待修理。八個所屬程序全部停止。
完整安裝、工作執行、更新循環、30 項功能同全套版面矩陣仍未完成，所以 issue
保持開啟。剩低來源已有六個 preservation tag 保留，原有分支同本機日誌冇刪除。

[ChongLeung]

✅ Provenance source repair preserved, fresh package still required

Integrated and pushed af3698b901bae0dd737165e99ea0c898242f3f47.
The original delivery source is additionally preserved by
preservation/desktop-completion-delivery-provenance-20260906 at
7d3f5feaf34bb37d5fb6d795acdf180408a6773d.

The released full package was inspected directly. Its exact
lib/net45/resources/open-design-config.json entry contains version 0.21.532
but omits buildVersion, buildSourceCommit, and buildUpdatedAt. This explains
the observed first-screen Not set timestamp without blaming the formatter.

The actual CLI resolver imported src/config.ts; provenance had only been added
to the separate src/config/index.ts. The repair updates the live resolver,
includes all three fields in Windows package-cache identity, and passes resolved
expectations into materialized-output validation at all production call sites.

Executed verification: 13 focused tests pass after pre-fix red proof. The
tests use the real CLI resolver and manifest writer, change each cache input,
reject every missing or stale field, and preserve unavailable provenance.
Packaging source typechecking, independent review, and imported-source checks
pass. The unrelated existing icon-count assertion still differs, expected 4 and
observed 7; its suite reports 8 passed and 1 failed.

No fresh installer, corrected runtime capture, or new release was produced.
v0.21.532-r531.1 remains unchanged. Full desktop completion remains open.
The goal passed its 95-percent implementation cutoff, so implementation stopped
and only preservation and handoff followed. A renewed work budget and a fresh
source-bound build are required to continue verification.

廣東話

已直接核對發佈包裝，確認三個 provenance 欄位真係冇入到去。原因係真正 CLI
用緊另一份 config，唔係時間格式顯示器出錯。現已修理實際 resolver、cache
身分同包裝結果驗證，十三個集中測試先紅後綠，source typecheck 同獨立審查通過。

修理已推送並保留，但冇重新建立或發佈安裝程式，舊版本保持不變。完整桌面
目標仍未完成；工作額度已過 95% 實作界線，後續需要新額度同真正重新建立嘅證據。

[ChongLeung]

🚀 In progress: release-bound Pages repair

Progress record started: 2026-09-06T23:33:26-04:00, verified from the server timestamp. Inspection began earlier; its exact start time was not recorded.

The scoped repair starts from af3698b901bae0dd737165e99ea0c898242f3f47 on codex/pages-release-repair. Release run 34064801419 was intentionally cancelled for the earlier manual publication; Pages run 34064801441 then rejected the missing successful release. The newer source commit intentionally skipped automatic workflows.

The current work repairs provenance validation and exact HTML attribute replacement in the Pages workflow, updates the focused shell fixture, and records the deployment behavior. It preserves release-to-commit binding and unsigned Squirrel packaging. No desktop feature completion or unrelated issue is included.

Validation is pending. The independent fixture will exercise the actual workflow helpers and cover valid/invalid provenance, escaping, existing attribute values, and malformed/missing/duplicate markers. This is a publication-script defect; no rendered-interface result or screenshot is claimed.

粵語

今次只修正 Pages 發佈腳本嘅來源驗證同 HTML 屬性替換，更新真實 helper 測試同部署文件。舊 hosted release 因為手動發佈而取消，唔代表新版本已經驗證。測試同新發佈仍然未完成，唔會當成已經成功。

[ChongLeung]

🔎 Confirmed publication-contract mismatches

Read-only producer/consumer review established additional direct causes that must be repaired before a fresh deployment:

• The release producer writes build-provenance.json.updatedAt; Pages reads builtAt.
• The HTML intentionally has two installer links and two version chips. The publisher must update exactly those two, not reject the second or silently accept extra copies.
• Release notes do not emit the machine-readable release and catalog markers that Pages requires. The minimal release-workflow edit will add those markers from the existing validated values; build and packaging behavior is unchanged.

The focused shell fixture is being updated to execute the real helpers and cover their producer/consumer contract. No test result or new release is claimed yet. A separate header provenance strip is recorded as an excluded UI follow-up; this task does not claim full interface completion.

粵語

已核對 producer 同 consumer：時間欄位名唔同、兩個下載連結係刻意保留，而發佈說明欠缺 Pages 要求嘅 machine-readable markers。今次補返呢幾個直接阻住部署嘅合約問題，唔改 build 同 packaging 路線。測試同新版本仍然未完成。

[ChongLeung]

🔎 Delivery root cause: malformed catalog-selector merge

The current scripts/release-codename.sh fails Bash syntax parsing at line 205 with an unmatched fi (exit 2). The paired historical selector at 872ab6ff3^2 parses successfully (exit 0). Read-only review also established undefined response handling and incompatible selector/output/staging schemas in the current workflow.

The implementation scope now includes restoring only the intact selector and its matching catalog-selection, staging, and publication handoff. This is necessary for the requested fresh release; unrelated build and packaging behavior remains unchanged. The Pages marker and provenance fixes will consume that coherent contract. A syntax result alone is not a runtime or publication result; focused fixtures and hosted delivery are still pending.

粵語

目前 selector 喺第205行有 unmatched fi，Bash syntax check exit 2；已找到配對完整版本，syntax check exit 0。今次只修復呢條直接阻住發佈嘅 selector 同資料交接，唔擴展到其他功能。真正 fixture 同 hosted release 仍然未完成，唔會將 syntax check 當成功發佈。

[ChongLeung]

🔧 Implementation continues on the coherent delivery contract

The Pages helper fixture now exercises the real temporary HTML and covers deliberate rejection paths. The release-side work is not yet a coherent candidate: the catalog selector, photo staging, release-note markers, and Pages attachment validation must agree before commit.

The selected contract preserves the validated codename-<dish-id>.png release attachment and the original catalog filename in its source URL. Both identities are bound to the same dish and digest. Only the necessary historical selector and named workflow sections will be restored; later duplicate-release reconciliation will remain intact.

An independent reviewer supplied the exact historical section map. Implementation continues, with no new commit, push, release, or deployment claimed. A task-local scratch file is excluded from staging and will remain untouched because its deletion command was rejected before execution.

粵語

Pages helper fixture 已經改為測試真實 HTML，同埋覆蓋應該拒絕嘅情況。發佈端仍要將 selector、圖片 staging、release markers 同 Pages 驗證接返一致，先可以提交。原本 catalog URL 同發佈附件名分開驗證，再綁返同一個 dish 同 digest。現時未有新 commit、push、release 或部署。

[ChongLeung]

✅ Local source milestones, hosted delivery pending

The main delivery repair is committed as e92591913301b5fd49f1b9f4583fb4ba7c6b238c. An independent run of both focused shell fixtures completed with exit 0. The Pages fixture covers 38 negative cases and valid HTML/producer/consumer flow; the offline selector fixture covers 20 negative cases and three positive groups. Both workflow YAML documents and seven explicit Bash blocks passed syntax checks in the implementation lane.

The recovery-only follow-up is 47b3176be8cf4f82cb8c360187df68d03de19a74: exact catalog-v1 receipt recovery first failed as ambiguous, then all 53 reconciliation cases passed, including nine added cases. A final narrow Pages validation update is in progress to reject impossible calendar dates instead of accepting a regex-shaped timestamp alone.

No push, hosted release, or deployment has occurred yet. These are source-verification results, not installer execution or rendered-interface evidence. The existing independent review will be bound to the final candidate before publication.

粵語

主要修復已提交，兩組 focused shell fixtures 由主流程獨立重跑，exit 0。復原邏輯先證明 exact catalog-v1 會錯誤變成 ambiguous，修正後53個案例全部通過。最後正加返真實日曆日期驗證，唔只睇 timestamp 字串外形。現時未 push、未有新 hosted release 或部署，唔會將 source tests 當成安裝或者介面證據。

[ChongLeung]

🚀 Candidate integrated and pushed

main now contains 31177f35d96a7c8f029ce9243365ed8f75198716, verified with git ls-remote. The source repair chain is e92591913 → 47b3176be → 31177f35d; independent source review accepted the final candidate.

Independent local checks completed successfully:

• Pages and offline selector fixtures at e92591913: exit 0.
• Reconciliation fixture at 47b3176be: 53 cases passed.
• Final focused Pages provenance fixture at 31177f35d: HTML population and seven negative identity/timestamp cases passed.
• Diff whitespace validation: passed.

Hosted state

• Release 34082212243: running.
• Pages 34082212208: waiting for a successful release.
• Verify 34082212225: completed successfully.

No new installer, release, or deployment is verified yet. Existing releases and unrelated branches remain preserved. Tests and lint were not added to hosted workflows.

粵語

修復已合併同推送到 main，已直接核對遠端 SHA。獨立 source review 同 focused 本地測試完成。Release 正在跑，Pages 等緊成功發佈，Verify 已成功。新 installer、release 同部署仍未驗證，唔會預先當成功。

[ChongLeung]

🏗️ Hosted build milestone

For candidate 31177f35d96a7c8f029ce9243365ed8f75198716, Release run 34082212243 has completed toolchain setup and the root build successfully. Its Squirrel packaging step is the current observed stage. Publication and release-download verification remain pending.

Verify run 34082212225 completed successfully. Pages run 34082212208 waits for the successful release and will deploy the release-bound source. No installer-execution or complete interface verdict is implied.

粵語

同一個 candidate 嘅 toolchain setup 同 root build 已成功，現時觀察到 Squirrel packaging 正在跑。發佈同下載驗證仍然未完成。Verify 成功唔等於完整介面或者安裝驗證，Pages 仍然等緊成功 release。

[ChongLeung]

🔧 Publication configuration repaired; attempt 2 running

Release run 34082212243, attempt 1 failed in Publish the release with workflow actor is outside the exact publisher allowlist. The build, unsigned Squirrel packaging, artifact validation, line count, catalog selection and photo staging had succeeded. No release was created.

The supported RELEASE_PUBLISHER_ALLOWLIST repository variable was absent. The triggering account was independently confirmed to be the authenticated GitHub account and to hold repository administrator permission. The variable now names that exact administrator; its value was read back after configuration. Exact publisher validation and ownership/recovery checks remain enabled.

Attempt 2 of the same run was queued and started at 2026-09-07T04:32:09Z, still targeting 31177f35d96a7c8f029ce9243365ed8f75198716. It is running. No source change or duplicate release was introduced by this recovery. Pages attempt 1 failed because its release failed; the failure-triggered Pages follow-up was correctly skipped.

粵語

第一次發佈因為觸發帳戶未列入 exact publisher allowlist 而停止，之前 build、unsigned Squirrel packaging 同相片驗證已成功，未建立 release。已核實該帳戶有管理員權限，再設定現有專用變數，並讀回確認。原本身份同復原驗證保留。第二次執行仍用同一個 source SHA，現正運行，未有新發佈成功聲明。

[ChongLeung]

🔧 Hosted proof identified two remaining format defects

Release v0.21.534-r533.2 was published successfully for 31177f35d96a7c8f029ce9243365ed8f75198716. Independent download verification confirmed all twelve asset sizes and GitHub digests.

Pages run 34084969634 failed with current release has no line-count evidence. Its resolver searches for Lines of code, while the committed counter emits the complete ### Line count section already present in the notes. The consumer will be aligned to that exact producer heading, with real counter-output coverage.

Independent receipt verification also found that requiredAssets[*].sha256 includes a leading backslash before each otherwise correct digest. GNU sha256sum adds this escape indicator when its filename operand contains Windows backslashes. The publisher will hash through standard input and validate exactly 64 lowercase hexadecimal characters before recording each digest. A regression will exercise the real escaped-filename case.

The published release has been annotated with these verified limitations; its tag and assets remain unchanged. The durable source fix will receive its own unique release. No successful Pages deployment or valid strict receipt is claimed for the existing release.

粵語

已發佈版本嘅12個附件大小同 GitHub digest 全部核對成功，但 Pages 用錯行數標題，publication receipt 亦將 sha256sum 嘅檔名 escaping 反斜線寫咗入 digest。兩個都係資料格式合約問題，正加返真實 producer 同檔名測試。舊版本已註明限制，tag 同附件保留；修正原始碼會有自己嘅新版本，唔會當舊 receipt 同部署已經成功。

[ChongLeung]

🚀 Corrected evidence candidate integrated

f21f6802fa2e2265bdfe506c50e08696a50498e0 is now on main, verified against the remote ref. Independent review accepted the exact counter-heading and filename-independent SHA-256 repairs. The new focused fixture passed three positive producer/consumer checks and five negative cases; both original defects were reproduced against the previous commit before the fix.

• Release run 34085666977: root build succeeded, Squirrel packaging is running.
• Verify run 34085666979: succeeded.
• Pages run 34085666960: waits for a successful release.

The previously published v0.21.534-r533.2 and its assets remain preserved with the metadata limitation explained in its notes. The new candidate is not yet claimed published or deployed.

粵語

新修復已合併同推送，並核對遠端 SHA。真實 counter 標題同不受檔名 escaping 影響嘅 SHA-256 路線，已經通過獨立 review 同 focused 測試。新 run 嘅 root build 成功，Squirrel packaging 正在跑；舊 release 同附件保留，新候選版本未當成已發佈或部署。

[ChongLeung]

🚀 Full Pages resolver verified and integrated

The final consumer repair is on main at cc77cc5c7f83175e6af35c51e2964d070d4834eb, confirmed against the remote ref.

The published updater schema deliberately uses logical name Setup.exe; its branded asset basename is independently carried by the URL. Pages now checks that actual schema together with schema version, installer type, enabled Windows x64 target, provider byte count, release version, unsigned state, exact download/checksum URLs and checksum.

The new fixture executes the entire exact release-facts Bash step. Its synthetic suite passed twelve cases (one complete positive path and eleven independent metadata rejections). A separate independent replay using the actual downloaded v0.21.535-r534.1 release response, metadata, checksum, photograph and provenance also passed through all six final outputs, both installer links, both chips, release fields, front provenance and PNG decode. The old step reproduced its metadata rejection before the fix. No live API or photo download occurred during those replays.

Release run 34088085074 is running for the new commit. Verify and Pages belong to the same candidate. A new hosted deployment is still pending; prior releases and assets remain preserved.

粵語

Pages 而家會分清 logical Setup.exe 同 URL 入面嘅 branded 檔名，並一併核對整個 updater metadata 合約。完整真實 Bash step 已經通過12個 synthetic 案例，亦用已下載嘅真實 release 資料獨立重播到最後所有 output 同 HTML 更新，冇網絡替身當成真正部署。新 commit 已推送，hosted run 正在執行，舊 release 同附件保留。

[ChongLeung]

✅ Release and deployment recovery verified

The repair is verified at cc77cc5c7f83175e6af35c51e2964d070d4834eb with release v0.21.536-r535.1.

Workflow	Result
Release 34088085074	Success
Verify 34088085092	Success
Push Pages 34088085043	Success
Automatic Pages 34089548193	Success

Independent verification downloaded all twelve release assets (1,013,639,576 bytes) and confirmed API digests, sizes, publication-receipt hashes, Squirrel feed/package integrity, updater metadata, and exact tag/source/run/actor bindings. The installer is 502,825,472 bytes, Authenticode NotSigned, SHA-256 542cad6946de23a27a11075ec389bb1dbab4345b8296e08f41900b1e6a75d9ef.

The live site returned HTTP 200 and matched version 0.21.536, timestamp 2026-09-07T05:46:25Z, source cc77cc5c7f83175e6af35c51e2964d070d4834eb, both installer URLs, and the front-screen text fields. This is deployed-HTML evidence, not installed-application execution or a full visual matrix.

The final roadmap/handoff record is being committed after this observed success. That documentation commit will receive its own required automatic release. No further product or workflow changes are planned. Historical releases, unrelated work and the separate header-provenance follow-up remain preserved.

粵語

以上四個 workflow 全部成功。十二個附件已獨立下載並核對大小、hash、receipt、Squirrel feed 同 updater metadata。線上頁面 HTTP 200，版本、時間、source SHA 同兩個下載 URL 都吻合。呢個係部署 HTML 證據，唔係已安裝應用程式或者完整視覺驗證。現時正提交最後 roadmap 同 handoff 記錄，之後只跟進該文件 commit 嘅自動發佈同安全收尾。