[singkia]

Merged — 1a5118fc

• Merged on 2026-10-19 after the exact PR head 854f111e passed check, cargo, windows-cargo and the public-manual build. The macOS check passed on its second attempt; the first one-shot VM watcher timeout is retained, not reported as a product fix.
• Real certificate signing is now explicit local acceptance: one Bun case and four Rust cases. All five executed successfully locally. Default automation retains the remaining regressions; moving these cases does not resolve the hosted Keychain/codesign discrepancy.
• Previously completed RC21 real-host acceptance remains the app evidence. No repeat host install, permission reset, Runtime hot-publish or restart was performed for this merge.
• No check/protection bypass, temporary certificate trust change, tag or CLI release was used. Release preparation follows separately. The public manual may deploy automatically from the merge; this is not CLI publication.

Earlier checkpoints below remain historical. The RC21/current-head evidence distinction is intentional.

---

Summary

Integrate the macOS auto-restore experiment as one aggregate change:

• Preserve the per-device signing identity across official updates and reuse the Coordinator/helper recovery path, including queued normal exits and pre-transaction busy continuation.
• Reuse the native dual-permission guide and host-bound probe for install preflight, incodex perm, post-update checks, and resumable permission handoffs.
• Keep Runtime generation/ACK ownership, native migration boundaries, committed artifacts, tests, architecture contracts, and bilingual manual aligned.

Real-app evidence — frozen RC21, not the current PR head

RC21 (332fbee3) completed one observed official build 20586 → 20770 update: recovery committed, the new host started with the same local signing certificate, and the product post-update chain reported both permissions granted. The earlier RC20 failure remains recorded privately.

External Doctor checks timed out and remain unknown. Complete UI/private-window acceptance, actual AX operations, and the live-target busy path were not established by this sample. The source fixes below have not been installed into the user's running App.

Review fixes in this PR

• Atomic permission-marker handoff: coalesce directory notifications regardless of temporary filename, perform one bounded reread after missing/unsafe reads, and reread after the native flight completes even when no notification arrived. Deterministic failing cases were run before fixes; the existing 1500 ms observation bound was not increased.
• Failed uninstall: retire automatic-recovery registration only after successful original-bundle restoration.
• Shared restore entry: preserve typed pre-transaction busy exit 75; transaction/rollback errors still use failure 1.
• Windows CI: pin the frozen verifier fixture to LF, route UID/POSIX permission fixtures to macOS, and use POSIX paths inside the Darwin VM fixture. No production boundary or raw-hash guard was relaxed.

Verification — current scope

• Original main was an ancestor and merge-tree had no conflicts; this is not a merge authorization.
• Prior local Rust baseline: 907 passed / 0 failed / 3 ignored, formatting and Clippy passed. This is reused evidence, not a fresh full Rust run on the latest head.
• Permission responder deterministic RED→GREEN cases: temporary-only filename, publication after the first missing read, and disposal. Final affected suites plus migration check: 111 passed. Committed Runtime rebuilt from a35ae5b7 in 6b61540a; no host deployment.
• Latest diagnostic-only head bdabda09: permission-probe file 15 passed. It adds failure-only watcher callback/error/close evidence, not a production change or longer deadline.
• Remote Windows and public manual build passed on 6b61540a. Latest-head CI is running.
• Latest full local Bun on 6b61540a: shared 715 passed; macOS 448 passed / 9 skipped / 1 real responder-watcher timeout at the existing 1500 ms bound. Targeted passes do not waive this failure; root cause remains unknown.
• Remote macOS signing remains failed: codesign: no identity found in one Bun and two Rust tests. Corrected complete-target probes also fail. The same CI fixture's direct/array, SIGN/any read-only Security queries each find and match the single certificate; the random-SHA preference is absent. This rules out those tested input differences, not all environment or product compatibility failures. Public historical source is not proof of the current CI codesign implementation.
• Current full CI and same-head review before merge.

Investigation correction

The original signing command had the correct target and really failed. The six added diagnostic variants initially omitted the target and were not valid full-signing evidence. That probe bug was fixed in f35f30fd, with an actually failing argument regression before the fix. Later corrected CI still fails. Failure-only native queries run only after the original failure, so they cannot prewarm that operation into a false pass. No tests were skipped and no trust/search-list/branch-protection changes were made.

Private correction and evidence supersedes the earlier invalid matrix claim and preserves original failures.

This PR does not authorize merging, a public release, host reinstallation, Runtime publication, or permission changes. The installed RC21 and the user's current App remain untouched.

[singkia]

Current head: e290d0c. The permission-handoff, uninstall-registration, typed-busy and Windows fixture fixes are committed and pushed to this PR; review-thread replies link the relevant commits.

• Local full Bun check: 1,160 pass / 0 fail / 9 skip, including typecheck, lint and committed-dist rebuild.
• Local Rust workspace: 907 pass / 0 fail / 3 ignored; formatting and Clippy passed.
• Latest-head remote Windows and public manual build passed.
• Latest-head macOS check and Cargo remain failed: one Bun and two Rust synthetic-signing tests report codesign: no identity found. Permission-handoff tests passed in the remote run.

The signing root cause is not established. Three hypothesis groups were checked: trust-inventory status alone does not explain the passing local baseline; the certificate really uses SHA256; and the controlled identity-selector/runtime/requirement matrix still fails on macOS 26.6.2. Local macOS 27.0.1 passes. Further speculative patches are stopped pending a dedicated macOS 26 lower-layer reproduction. No test skips, global trust/search-list changes, or production signing workaround were introduced.

Private review/CI report: 40 paths verified remotely, 30 source/archive dual-SHA records. The report's earlier Windows-pending snapshot is superseded by the final successful job above. RC21 and the user's running App were untouched; no merge or release.

[singkia]

Correction to the previous signing investigation: the original test command included its synthetic target and did fail, but the six added diagnostic variants accidentally omitted that target. Their failures must not be used to exclude complete signing alternatives. f35f30f fixes the probe argument; an executed VM regression first failed on the missing target and then passed, and the full local remote-key file passed 7 tests. No production signing or CI gate changed. Corrected remote evidence is pending; the original signing root cause remains unknown.

[singkia]

Follow-up: a35ae5b fixes a separate proven responder bug: a temporary-filename-only directory event could be ignored. The old implementation failed the async temp-only, early-publication and disposal cases; affected suites plus rebuilt migration check passed 111 tests. This does not explain every OS watcher timeout: full local 6b61540 still had one real 1500 ms responder timeout, although the latest remote 6b check passed all watcher cases and failed only signing. bdabda0 adds failure-only callback/error/close diagnostics without changing production or the deadline. The signing CI query also finds the expected identity in all four tested query shapes, while codesign still refuses it; the root cause remains unknown. Current evidence and the earlier probe correction are retained in the private correction report linked in the PR body. No CI bypass, merge, or host changes.

[singkia]

Latest merge gate — 7e68a324

• Fixed the test fixture's request-retirement instrumentation: only an actual guarded lstat ENOENT counts; watcher filenames and existsSync=false do not. Two deterministic failing repros precede the fix.
• Real filesystem watcher integration now executes the unchanged responder in Node, matching the Electron Runtime host. The original 1.5-second stage deadlines, nonce/retirement assertions, and deterministic event/timer tests remain. Withholding delivery is a negative control that must fail without a response. This does not claim to identify Bun's zero-callback root cause.
• Fresh local same-head verification: bun run check passed (715 shared + 452 macOS, 9 existing skips); fmt/Clippy and cargo test --workspace --release --locked passed (907 passed, 3 ignored); committed Runtime rebuild matches. Runtime source provenance is restored; production code and Runtime asset bytes are unchanged by this CI follow-up.
• CI run 39241214383: Windows and public-manual build pass. macOS check still has one real certificate-signing failure; cargo still has two. Even queries using codesign's actual policy constructor find the isolated identity, while the original /usr/bin/codesign reports no identity found. The signing discrepancy remains unresolved.
• Not merged. No skipped failure, branch-protection bypass, certificate-trust/search-list change, installed-App modification, release or deployment was used to force a green result.

[singkia]

Merged — 1a5118fc

• Merged on 2026-10-19 after the exact PR head 854f111e passed check, cargo, windows-cargo and the public-manual build. The macOS check passed on its second attempt; the first one-shot VM watcher timeout is retained, not reported as a product fix.
• Real certificate signing is now explicit local acceptance: one Bun case and four Rust cases. All five executed successfully locally. Default automation retains the remaining regressions; moving these cases does not resolve the hosted Keychain/codesign discrepancy.
• Previously completed RC21 real-host acceptance remains the app evidence. No repeat host install, permission reset, Runtime hot-publish or restart was performed for this merge.
• No check/protection bypass, temporary certificate trust change, tag or CLI release was used. Release preparation follows separately. The public manual may deploy automatically from the merge; this is not CLI publication.

Earlier checkpoints below remain historical. The RC21/current-head evidence distinction is intentional.

---