Prove packaged macOS and Windows startup before release

[yaacovcorcos]

Summary

• prove that the exact packaged macOS and Windows release payload reaches app, window, backend, and renderer readiness and remains stable
• bind verifier lifetime to the packaged process tree without broad signals or PID reuse
• isolate temporary Scient state and inherit only an allowlisted host environment
• fail closed on verifier channel loss and clean the entire packaged process tree

Why

The earlier release checks could succeed after Electron created a window even when renderer, preload, or packaged assets failed. The original containment design also had process-authority races during interruption. This final candidate uses explicit lifecycle ownership:

• POSIX: a sentinel process owns the packaged process group; the verifier holds an IPC channel to the sentinel and never calls broad process-group kill itself
• Windows: the verifier creates a fresh private inherited stdin pipe; the PowerShell Job owner validates FILE_TYPE_PIPE and checks that exact channel before payload creation, before resume, and every 20 ms while the payload runs

This removes both numeric verifier-PID reuse and ambiguous competing cleanup authority.

Scope

Limited to packaged macOS and Windows startup proof. It does not include the deferred Linux AppImage/.deb, AppArmor, updater-channel, or distribution-policy work from #58.

Exact candidate

• base/current main: 869d71d100c167b164e49df831feb16b6e4768ee
• head: 9a0d140a9de303c605f6b662054e3772c26e736c
• branch: agent/packaged-startup-proof
• update method: normal main merges only; no rebase or force push

Verification

Exact-head local verification:

• bun run scient:upstream-check --intake: passed
• identity, format, lint: passed; lint 0 errors
• typecheck: 9/9
• full bun run test: 12/12 tasks; web 3,097 passed; CLI/server 2,338 passed and 10 platform skips
• desktop/server builds and release smoke: passed
• focused packaged-startup verification: 69 passed; 4 Windows-native cases skipped on macOS
• git diff --check: clean
• worktree: clean

The required remaining platform gate is hosted exact-head Windows CI, especially Windows Process Regression executing all four Windows-only containment cases, including pre-resume verifier-pipe loss.

Independent review

Exactly three fresh read-only reviews inspected exact head 9a0d140a after verification:

1. correctness, lifecycle, concurrency, regression risk: CLEAR; no P0-P3
2. security, process authority, release safety: CLEAR; no P0-P3
3. architecture, maintainability, evidence completeness: CLEAR; no P0-P3

Rollback and limitations

Rollback is the ordinary PR revert. This proof validates packaged startup and cleanup, not Windows signing, publication, updater delivery, Linux packaging, or release promotion.

[yaacovcorcos]

Final integration refresh (2026-07-25): current main dab9b6d was merged normally into this branch; no rebase or force-push. Exact hosted head: 6a60c42. Packaged-startup proof 14/14 and release smoke passed. git diff --check passes and the task worktree is clean. Fresh hosted CI run https://github.com/ScientFactory/scient-desktop/actions/runs/30160244885 completed successfully, including format, lint, typecheck, full bun run test, stable browser, Linux geometry, desktop build/preload, release smoke, Linux and Windows HTML-preview smoke, and Windows process regression. No unresolved review threads remain. Existing documented manual limitations are unchanged and non-blocking. This candidate is integration-ready against main dab9b6d; this is not merge or release authorization.

[yaacovcorcos]

Published exact reviewed head 9a0d140. Local full intake certification and exactly three final reviews are clear. Awaiting exact-head hosted Windows Process Regression before merge.