fix: harden restart recovery and release smoke

.github/workflows/ci.yml

@@ -646,12 +646,15 @@ jobs:
         run: pnpm run electron:prepare-deps
 
       - name: Build unsigned desktop package
+        id: build_desktop_package
         run: pnpm exec electron-builder --config electron-builder.config.cjs ${{ matrix.electron-target }} --publish never
 
       - name: Install and start release candidate
+        id: smoke_installed_candidate
         run: pnpm run electron:smoke-installed
 
       - name: Upload release candidate artifacts
+        if: ${{ always() && steps.build_desktop_package.outcome == 'success' }}
         uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.artifact-name }}

docs-web/content/docs/developer-building-from-source.mdx

@@ -168,14 +168,15 @@ Electron and npm package builds must include the `docs-web` runtime catalog. The
 
 Electron runtime dependency preparation runs a production-only pnpm 11 install with `--config.node-linker=hoisted` passed on the command line. A nested runtime `.npmrc` is not enough once pnpm discovers the enclosing workspace. Preparation rejects symbolic links, missing direct production packages, and failed MCP SDK/`zod` imports so Electron Builder cannot silently copy a broken peer-dependency layout. The workspace `allowBuilds` policy approves only `onnxruntime-node`; preparation sets `ONNXRUNTIME_NODE_INSTALL=skip` because the CPU bindings used by Code UX are bundled and the upstream Linux default fetches optional CUDA/TensorRT binaries from NuGet. This keeps desktop packaging deterministic without suppressing the dependency postinstall or pnpm's build-policy check. Keep that allowlist narrow and review any addition as release-executed code.
 
-The installed-Electron smoke uses each platform's native package and exits its readiness probe
-through the Node process boundary immediately with code zero after the packaged backend and
-renderer are ready and the readiness marker is durably written. This bypasses Electron/AppKit
-termination paths that newer macOS runners can defer even after `app.exit()`. On Windows it passes
-the NSIS silent-install arguments verbatim so the required final `/D=` destination remains unquoted
-even when that destination contains spaces. On macOS it accepts the DMG's embedded MIT license
-through `hdiutil` stdin before mounting. Production Electron shutdowns still drain the embedded
-runtime before exiting with the resulting process code.
+The installed-Electron smoke uses each platform's native package and waits until the packaged
+backend and renderer are ready and the readiness marker is durably written. Linux and Windows then
+require the isolated app probe to exit with code zero. On Windows the harness passes the NSIS
+silent-install arguments verbatim so the required final `/D=` destination remains unquoted even
+when that destination contains spaces, and retries only the known transient `0xC0000005` installer
+access violation once in a fresh directory. On macOS the harness accepts the DMG's embedded MIT
+license through `hdiutil` stdin, validates readiness, then owns probe teardown with `SIGTERM` and a
+bounded `SIGKILL` fallback because Electron/AppKit can defer both Electron and Node exit paths.
+Production Electron shutdowns still drain the embedded runtime normally.
 
 They must also include `assets/models-dev/catalog.json`. The automatic token-pricing path reads this snapshot beside the compiled runtime; without it, known models can appear unpriced only in the desktop build. Electron packaging tests pin both runtime assets and a representative GPT-5.5 catalogue rate.
 

docs-web/content/docs/settings-restart-behavior.mdx

@@ -36,7 +36,7 @@ When `restartSprintPolicy = continue` and `restartInvocationPolicy = continue`,
 - preserves task-level and sprint-completion `changes_requested` verdicts before starting their coding handoffs; if restart occurs between the verdict and the follow-up invocation, the next cycle resumes that pending handoff instead of leaving QA indefinitely blocked
 - returns an abruptly failed QA coding handoff to `CODING_COMPLETED`/`QA_PENDING` and retries it from the recorded coding session and workspace. A successful or reconciled handoff remains in that verification-ready state until the next QA review starts, preventing the restart window from launching unrelated coding work. Provider failures are bounded to three continuation attempts, while resuming a `running` checkpoint after a runtime restart does not consume another failure allowance; exhaustion then follows the configured QA exhaustion policy instead of redispatching the task as unrelated coding or heartbeating forever.
 - resolves QA coding follow-ups from the durable `cli_workspace_bound` record, because a retry can have a newer logical task session while intentionally reusing an older preserved workspace. Provider and worker-branch compatibility are verified, the workspace session is passed separately from the logical provider session, and a missing workspace is recreated as an explicit continuation instead of force-resetting a branch checked out elsewhere.
-- records the original worker-branch baseline before invoking a QA coding follow-up and reuses it after restart, so provider commits made before host-branch publication are still exported and published instead of being mistaken for an empty follow-up
+- records the original worker-branch baseline before invoking a QA coding follow-up, checkpoints the completed provider turn before memory capture and host publication, and reuses both records after restart. A completed same-task provider turn newer than the baseline is never invoked again; its existing workspace changes continue through patch export and branch publication.
 - treats coding-provider completion as an intermediate checkpoint until Git finalization records a pushed branch or a verified no-change result. Task QA waits for that evidence. If restart interrupts this window, startup uses recovered-session membership (including hard kills with no shutdown event), preserves the workspace, requeues the premature terminal projection, and continues at Git finalization without calling the coding provider again.
 - reconciles the recovered coding task-run and dispatch after a successful handoff, preventing an earlier transient failure marker from incorrectly failing the sprint during terminal evaluation
 - requeues interrupted worker-owned CI-fix and merge-conflict attention, clearing ownership left by the stopped virtual worker

docs-web/developer/building-from-source.md

@@ -168,14 +168,15 @@ Electron and npm package builds must include the `docs-web` runtime catalog. The
 
 Electron runtime dependency preparation runs a production-only pnpm 11 install with `--config.node-linker=hoisted` passed on the command line. A nested runtime `.npmrc` is not enough once pnpm discovers the enclosing workspace. Preparation rejects symbolic links, missing direct production packages, and failed MCP SDK/`zod` imports so Electron Builder cannot silently copy a broken peer-dependency layout. The workspace `allowBuilds` policy approves only `onnxruntime-node`; preparation sets `ONNXRUNTIME_NODE_INSTALL=skip` because the CPU bindings used by Code UX are bundled and the upstream Linux default fetches optional CUDA/TensorRT binaries from NuGet. This keeps desktop packaging deterministic without suppressing the dependency postinstall or pnpm's build-policy check. Keep that allowlist narrow and review any addition as release-executed code.
 
-The installed-Electron smoke uses each platform's native package and exits its readiness probe
-through the Node process boundary immediately with code zero after the packaged backend and
-renderer are ready and the readiness marker is durably written. This bypasses Electron/AppKit
-termination paths that newer macOS runners can defer even after `app.exit()`. On Windows it passes
-the NSIS silent-install arguments verbatim so the required final `/D=` destination remains unquoted
-even when that destination contains spaces. On macOS it accepts the DMG's embedded MIT license
-through `hdiutil` stdin before mounting. Production Electron shutdowns still drain the embedded
-runtime before exiting with the resulting process code.
+The installed-Electron smoke uses each platform's native package and waits until the packaged
+backend and renderer are ready and the readiness marker is durably written. Linux and Windows then
+require the isolated app probe to exit with code zero. On Windows the harness passes the NSIS
+silent-install arguments verbatim so the required final `/D=` destination remains unquoted even
+when that destination contains spaces, and retries only the known transient `0xC0000005` installer
+access violation once in a fresh directory. On macOS the harness accepts the DMG's embedded MIT
+license through `hdiutil` stdin, validates readiness, then owns probe teardown with `SIGTERM` and a
+bounded `SIGKILL` fallback because Electron/AppKit can defer both Electron and Node exit paths.
+Production Electron shutdowns still drain the embedded runtime normally.
 
 They must also include `assets/models-dev/catalog.json`. The automatic token-pricing path reads this snapshot beside the compiled runtime; without it, known models can appear unpriced only in the desktop build. Electron packaging tests pin both runtime assets and a representative GPT-5.5 catalogue rate.
 

docs-web/settings/restart-behavior.md

@@ -36,7 +36,7 @@ When `restartSprintPolicy = continue` and `restartInvocationPolicy = continue`,
 - preserves task-level and sprint-completion `changes_requested` verdicts before starting their coding handoffs; if restart occurs between the verdict and the follow-up invocation, the next cycle resumes that pending handoff instead of leaving QA indefinitely blocked
 - returns an abruptly failed QA coding handoff to `CODING_COMPLETED`/`QA_PENDING` and retries it from the recorded coding session and workspace. A successful or reconciled handoff remains in that verification-ready state until the next QA review starts, preventing the restart window from launching unrelated coding work. Provider failures are bounded to three continuation attempts, while resuming a `running` checkpoint after a runtime restart does not consume another failure allowance; exhaustion then follows the configured QA exhaustion policy instead of redispatching the task as unrelated coding or heartbeating forever.
 - resolves QA coding follow-ups from the durable `cli_workspace_bound` record, because a retry can have a newer logical task session while intentionally reusing an older preserved workspace. Provider and worker-branch compatibility are verified, the workspace session is passed separately from the logical provider session, and a missing workspace is recreated as an explicit continuation instead of force-resetting a branch checked out elsewhere.
-- records the original worker-branch baseline before invoking a QA coding follow-up and reuses it after restart, so provider commits made before host-branch publication are still exported and published instead of being mistaken for an empty follow-up
+- records the original worker-branch baseline before invoking a QA coding follow-up, checkpoints the completed provider turn before memory capture and host publication, and reuses both records after restart. A completed same-task provider turn newer than the baseline is never invoked again; its existing workspace changes continue through patch export and branch publication.
 - treats coding-provider completion as an intermediate checkpoint until Git finalization records a pushed branch or a verified no-change result. Task QA waits for that evidence. If restart interrupts this window, startup uses recovered-session membership (including hard kills with no shutdown event), preserves the workspace, requeues the premature terminal projection, and continues at Git finalization without calling the coding provider again.
 - reconciles the recovered coding task-run and dispatch after a successful handoff, preventing an earlier transient failure marker from incorrectly failing the sprint during terminal evaluation
 - requeues interrupted worker-owned CI-fix and merge-conflict attention, clearing ownership left by the stopped virtual worker

docs/deployment/electron-desktop.md

@@ -67,7 +67,7 @@ macOS DMG builds include the MIT license resource through `build/license_en.txt`
 - `pnpm run electron:dist:win`: build Windows targets.
 - `pnpm run electron:benchmark:runtime`: launch Electron with an isolated temporary user profile, navigate dashboard routes, probe backend endpoints, and write route/API/renderer/runtime metrics under `.cache/electron-runtime-benchmark/`.
 - `pnpm run electron:benchmark:win`: build Windows installers with `normal` and `store` compression and write timing/size data to `release/electron-benchmark/summary.json`.
-- `pnpm run electron:smoke-installed`: select the native package in `release/electron/` whose artifact name matches the current `package.json` version, install it, start that installed app with an isolated profile, wait until its backend and renderer are ready, and require a deterministic zero-code probe exit. After the atomic readiness marker is durably written, the isolated probe exits through the Node process boundary instead of Electron/AppKit shutdown, which newer macOS runners can defer even after `app.exit()`. Linux requires passwordless `sudo` and `xvfb-run`, as provided by the release runners. Windows launches the silent NSIS installer with verbatim arguments because NSIS requires its final `/D=` destination segment to remain unquoted even when the path contains spaces. macOS supplies affirmative input to `hdiutil` so the CI-owned smoke can mount a DMG containing the embedded MIT license without an interactive terminal.
+- `pnpm run electron:smoke-installed`: select the native package in `release/electron/` whose artifact name matches the current `package.json` version, install it, start that installed app with an isolated profile, and wait until its backend and renderer are ready. Linux and Windows require the isolated app probe to exit with code zero. macOS validates the durably written readiness marker, then the parent smoke harness terminates only that validated probe with `SIGTERM` and a bounded `SIGKILL` fallback because Electron/AppKit can defer both `app.exit()` and `process.exit()` after readiness. Linux requires passwordless `sudo` and `xvfb-run`, as provided by the release runners. Windows launches the silent NSIS installer with verbatim arguments because NSIS requires its final `/D=` destination segment to remain unquoted even when the path contains spaces; only the known transient `0xC0000005` installer access violation is retried once in a fresh directory. macOS supplies affirmative input to `hdiutil` so the CI-owned smoke can mount a DMG containing the embedded MIT license without an interactive terminal.
 - `pnpm run electron:install-deps`: rebuild native app dependencies for Electron.
 
 The release output is written to `release/electron/`.
@@ -129,7 +129,7 @@ Use `.github/workflows/release.yml` for published desktop releases. It is the la
 
 The no-secret release-candidate package lane is part of `.github/workflows/ci.yml`, named `Code UX CI Pipeline`. It runs for `main` validation and manual dispatches after package smoke, keeping the full desktop package proof out of the routine `dev` lane.
 
-The `10 Release Candidate / desktop package` matrix starts as soon as the package smoke job passes, so desktop packaging can run beside the E2E and orchestration matrices instead of waiting for them to finish. It downloads the shared `codeux-build-linux` artifact, installs the cached Electron binary, rebuilds Electron native dependencies, prepares runtime assets, and runs Electron Builder directly with `--linux`, `--mac`, or `--win` plus `--publish never`. After compilation, every native runner installs its candidate—the Linux `.deb`, Windows NSIS `.exe`, or macOS app copied from the `.dmg`—and starts that installed copy with an isolated home and dashboard port. The Windows smoke preserves NSIS's required unquoted, final `/D=` destination segment when spawning the installer, and the macOS smoke accepts the DMG's embedded MIT license through `hdiutil` stdin before mounting. Success requires the packaged backend to start, the dashboard renderer to finish loading, an atomic readiness marker to be written, and the smoke process to exit immediately with code zero. The dedicated probe exits through the Node process boundary only after the marker rename completes, bypassing Electron/AppKit termination paths that newer macOS runners can defer even after `app.exit()`. Production shutdowns still cancel the initial quit request while the embedded server drains, then exit directly with the resulting process code instead of starting a second macOS quit cycle. The package smoke job that precedes it runs `node scripts/verify-release-install.mjs` with `CODE_UX_SKIP_RELEASE_INSTALL_BUILD=1`, so the npm tarball install check uses the same compiled artifact instead of rebuilding.
+The `10 Release Candidate / desktop package` matrix starts as soon as the package smoke job passes, so desktop packaging can run beside the E2E and orchestration matrices instead of waiting for them to finish. It downloads the shared `codeux-build-linux` artifact, installs the cached Electron binary, rebuilds Electron native dependencies, prepares runtime assets, and runs Electron Builder directly with `--linux`, `--mac`, or `--win` plus `--publish never`. After compilation, every native runner installs its candidate—the Linux `.deb`, Windows NSIS `.exe`, or macOS app copied from the `.dmg`—and starts that installed copy with an isolated home and dashboard port. The Windows smoke preserves NSIS's required unquoted, final `/D=` destination segment when spawning the installer and retries only a first-attempt `0xC0000005` access violation in a clean destination. The macOS smoke accepts the DMG's embedded MIT license through `hdiutil` stdin before mounting. Success requires the packaged backend to start, the dashboard renderer to finish loading, and an atomic readiness marker to be written. Linux and Windows then require a zero-code probe exit; on macOS the parent harness owns teardown after validation, using `SIGTERM` with a short `SIGKILL` fallback so upstream AppKit exit deferral cannot turn a healthy installed app into a false failure. Built native artifacts are uploaded whenever packaging succeeded, even if the installed-app smoke fails, preserving evidence for release debugging. Production shutdowns remain unchanged and still drain the embedded server. The package smoke job that precedes it runs `node scripts/verify-release-install.mjs` with `CODE_UX_SKIP_RELEASE_INSTALL_BUILD=1`, so the npm tarball install check uses the same compiled artifact instead of rebuilding.
 
 Release-candidate packaging sets `CSC_IDENTITY_AUTO_DISCOVERY=false` for unsigned Electron packaging and passes `--publish never` to Electron Builder. It does not require provider API keys, npm publishing credentials, Docker credentials, GitHub Release events, or real project state. When Electron output exists, the workflow uploads files from `release/electron/` as workflow artifacts only; it does not publish to npm or attach files to a GitHub Release.