fix(release): preserve Windows source immutability

[slashdevcorpse]

Why

Windows-only prerelease run 29788640616 successfully built the unsigned installer, passed packaged startup, and passed native Windows qualification (Authenticode inspection, fresh install/launch, exact stable-upstream selection, side-by-side overlap, and uninstall). Publication then stopped at the final source-cleanliness gate because TanStack regenerated apps/web/src/routeTree.gen.ts in Windows-specific ordering.

What

• Redirect exact-provenance route-tree generation into a stable ignored repo-local cache path.
• Alias the staged generated tree into the Vite bundle, preserving automatic route code splitting even when the committed tree is stale.
• Remove the staged tree on every source-build exit.
• Keep the stable redirect in Turbo's hashed environment so retries reuse cache keys without allowing source-map bytes to drift.
• Add a final fail-closed preflight source check after all smoke execution and require that it remain the last preflight step.
• Report exact tracked paths when release source bytes change.

Verification

• Web route-generation tests: 2/2 passed.
• Release helper/cleanliness/workflow tests: 21/21 passed.
• Workflow contracts: 4 allowed and 4 disabled paths passed.
• Exact-file Oxfmt and Oxlint checks passed.
• Redirected Vite build retained 509 JavaScript chunks and a ~269 KB main bundle.
• Synthetic stale-tree proof bundled a newly added route chunk while leaving the committed route-tree bytes unchanged; the generated cache directory was removed.
• Independent final review found no actionable defects.

The branch is based on current downstream main at 720075a834b40461f11e4e24127f2c8d4f21de34, including the merged desktop provider-session persistence and secure local file-preview work. Release scope remains Windows x64 only; macOS is kept as a non-regression CI lane and is not part of the release.

Summary by CodeRabbit

• Build Improvements

  • Enhanced web build to support controlled route-tree generation via SYNARA_GENERATED_ROUTE_TREE (build-time routing aliasing).
  • Added desktop provenance-scoped generated route-tree staging with targeted post-build cleanup.

• Release Reliability

  • Improved release worktree cleanliness checks to report the exact changed paths.
  • Strengthened publication preflight with stricter ordering and additional fail-closed cleanliness verification after smoke.

• Tests

  • Added/updated coverage for route-tree resolution, desktop provenance build environment behavior, worktree cleanliness validation, and workflow preflight ordering.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The changes redirect exact-provenance route-tree generation to a cache path, wire that path through web and desktop builds, report tracked worktree paths during cleanliness checks, and enforce ordered preflight cleanliness verification in the prerelease workflow.

Changes

Route tree provenance and release cleanliness

Layer / File(s)	Summary
Generated route-tree build wiring apps/web/viteRouteGeneration.ts, apps/web/vite.config.ts, apps/web/viteRouteGeneration.test.ts, apps/web/tsconfig.json, turbo.json	Web Vite configuration validates and aliases an absolute SYNARA_GENERATED_ROUTE_TREE path, with tests covering empty, trimmed, absolute, and relative values. Turbo and TypeScript include the supporting environment and module.
Desktop exact-provenance build environment scripts/lib/desktop-source-build-environment.ts, scripts/lib/desktop-source-build-environment.test.ts, scripts/build-desktop-artifact.ts	Exact-provenance desktop builds use a cached route-tree redirect path, remove inherited redirects outside exact-provenance mode, fail closed when the redirect is missing, and clean up the generated directory after building.
Release worktree cleanliness enforcement scripts/lib/release-worktree-cleanliness.ts, scripts/lib/release-worktree-cleanliness.test.ts, scripts/lib/super-synara-workflow-contract.ts, scripts/lib/super-synara-workflow-contract.test.ts, .github/workflows/super-synara-prerelease.yml	Cleanliness validation reports changed tracked paths, and workflow contracts require two ordered, fail-closed preflight checks plus the corresponding workflow step.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant DesktopBuild as build-desktop-artifact.ts
  participant Environment as desktop-source-build-environment
  participant WebBuild as apps/web/vite.config.ts
  participant RouteTree as generated route-tree cache
  DesktopBuild->>Environment: create exact-provenance build environment
  Environment->>RouteTree: provide SYNARA_GENERATED_ROUTE_TREE
  WebBuild->>RouteTree: resolve and alias routeTree.gen
  DesktopBuild->>RouteTree: remove generated route-tree root

Loading

Possibly related PRs

• slashdevcorpse/synara#1: Modifies the same workflow contract and release worktree cleanliness logic.
• slashdevcorpse/synara#23: Changes the shared release worktree cleanliness validation API used by this build flow.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately captures the main change: preserving Windows source immutability during release.
Description check	✅ Passed	The description covers What Changed, Why, and Verification, with only optional template sections like UI Changes and Checklist omitted.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/build-desktop-artifact.ts`:
- Around line 975-981: Update the environment passed by the desktop build flow
around createDesktopSourceBuildEnvironment so non-exact builds cannot inherit
SYNARA_GENERATED_ROUTE_TREE from process.env. Remove or override that key before
passing baseEnvironment, while preserving its use when exactProvenanceRequested
is true.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9e4b9d4c-5df0-4a0e-864b-f4da0dab0015

📥 Commits

Reviewing files that changed from the base of the PR and between 7d8eb1c and d32509b.

📒 Files selected for processing (12)

• .github/workflows/super-synara-prerelease.yml
• apps/web/vite.config.ts
• apps/web/viteRouteGeneration.test.ts
• apps/web/viteRouteGeneration.ts
• scripts/build-desktop-artifact.ts
• scripts/lib/desktop-source-build-environment.test.ts
• scripts/lib/desktop-source-build-environment.ts
• scripts/lib/release-worktree-cleanliness.test.ts
• scripts/lib/release-worktree-cleanliness.ts
• scripts/lib/super-synara-workflow-contract.test.ts
• scripts/lib/super-synara-workflow-contract.ts
• turbo.json

🚧 Files skipped from review as they are similar to previous changes (10)

• scripts/lib/desktop-source-build-environment.ts
• apps/web/viteRouteGeneration.test.ts
• turbo.json
• scripts/lib/desktop-source-build-environment.test.ts
• apps/web/viteRouteGeneration.ts
• .github/workflows/super-synara-prerelease.yml
• scripts/lib/super-synara-workflow-contract.test.ts
• apps/web/vite.config.ts
• scripts/lib/super-synara-workflow-contract.ts
• scripts/lib/release-worktree-cleanliness.ts

[cubic-dev-ai]

All reported issues were addressed

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 4 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request