ci: exercise the rebased es-419 branch against main-v2 (fork-internal) - #1
Closed
GuidoMaxier wants to merge 546 commits into
Closed
GuidoMaxier wants to merge 546 commits into
GuidoMaxier wants to merge 546 commits into
Conversation
Problem: Task stop commands could fail to persist their state when a short-lived Windows reader held snapshot.json without delete sharing. Root cause: The store bypassed the shared atomic rename boundary and returned the first transient sharing violation. Fix: Retain the per-task CAS lock while ClaimRename retries the same staged snapshot. No copy fallback or visible-file truncation is allowed. Cover the native reader contract in Windows PR CI. Verification: A real Windows read handle reproduced access denied before the fix. The regression passed 50 repetitions after it; the full taskmonitor race suite, Go lint and repository lint passed.
Problem: The authorization-restoration test could leave a replacement controller publishing inbox state while TempDir cleanup ran. Root cause: The fixture did not close the server that owns the replacement. The same omission existed in sibling model-switch recovery tests. Fix: Register server cleanup throughout that fixture family so the existing controller shutdown fence and owned background work finish before temporary directories are removed. Verification: All affected model-switch tests passed 100 repetitions under the race detector.
Problem: mainline Ubuntu CI could hang for ten minutes in the parallel-file fixture. Root cause: random temporary paths occasionally mapped a.go and b.go to the same bounded lock stripe, where production correctly serializes writes. Fix: use the existing distinct-stripe path helper, bound acquisition with a context deadline, and register both owner cleanups before acquisition. Verification: 1,000 focused race repetitions, full workspacelease race suite, and repository lint passed.
Integrate the reviewed read-evidence runtime and presentation changes while preserving immutable model-setting snapshots and application receipts. Resolve bundle limits from fresh production output: Chinese locale chunks measure 64734 and 65499 bytes, while initial raw assets measure 2492541 bytes, 3688 bytes (0.148%) above main-v2. Preserve narrowly rounded ceilings and all independent gzip and chunk limits. Verification: production build and bundle checks, full control/boot/serve/provider/agent race suites, Desktop Go suite, repository lint, and diff checks passed.
Integrate PR esengine#9974 so final model-settings qualification includes canonical Windows runtime identity, delete-sharing update reads, bounded atomic task snapshot publication, and deterministic workspace-lease fixtures. Verification: complete Serve, repair, taskmonitor and workspacelease race suites passed on the combined tree; repository lint and diff checks passed. The Windows product fixes previously passed native regression repetitions and the full Windows Desktop Go suite alongside model settings.
Problem: the managed-settings endpoint accepted unlisted model names through the generic resolver, and static analysis followed request selectors into session paths and controller diagnostics. Root cause: generic resolution permits temporary model names; filename replacement was implicit, aggregate capacity arithmetic could overflow, and a controller object was used only to format its type. Fix: resolve exact snapshot catalog entries before publication, preserve namespaced model IDs, explicitly keep generated session filenames to one path component, use overflow-safe append growth, and report unsupported snapshot controllers without formatting the object. Verification: invalid-selector and namespaced-model regressions, full Serve/config/agent race suites, focused Desktop model-settings/rebuild/probe race tests, both Go linters, repository lint, and diff checks passed.
Problem: Ubuntu CI observed inbox publication after a transition fixture had returned and begun deleting its temporary session directory. Root cause: real controllers and replacement owners lacked teardown, while cleanup callbacks registered before builder-created TempDirs ran too late. Fix: close the final Server owner in defers before any TempDir cleanup, retain explicit closure for manually fabricated detached entries, and release blocked transition gates before teardown. Group the related real-runtime fixtures into a focused test file without widening repository budgets. Verification: the failing transition passed 100 race repetitions; the sibling lifecycle suite, Go lint, repository lint and diff checks passed.
Problem: the CI gofmt gate rejected empty-line spacing left where lifecycle tests were extracted. Root cause: only the new destination test file was formatted before the preceding push. Fix: run gofmt on each changed source test file. Verification: gofmt, diff checks and repository lint passed; this changes whitespace only.
fix(release): restore runtime and atomic update CI gates / 修复运行时及原子更新发布门禁
Record the verified main-v2 merge of PR esengine#9974 as the model-settings baseline. The same release-gate code was already integrated and tested in this branch; this ancestry-only merge removes ambiguous parallel merge bases from final review and CI comparison.
Problem: model labels are untrusted filename hints, and replacement of separators did not explicitly reject NUL or control characters across platforms. Root cause: filename construction mixed sanitization and path joining inside the large persistence module, leaving its component invariant implicit to callers and static analysis. Fix: move the path helpers to their owning file, validate the final portable filename component and use a timestamped session fallback for invalid labels. Normal filenames and provider-visible model IDs remain unchanged. Verification: traversal, Windows separator, namespaced, NUL, newline and Unicode model cases passed; full Agent, Control and Serve race suites, Go lint, gofmt, repository lint and diff checks passed.
Problem: Native Windows qualification intermittently failed to reconnect a single-instance MCP helper, leaving its listening port and temporary files occupied after forced termination. Root cause: SDK teardown cancelled the process context before the transport could offer stdin EOF. The graceful path also retained its Windows Job handle and released bounded instance slots before process retirement. Fix: Retire the current session and endpoint before cancelling their contexts, finish the Windows Job after a graceful exit, and return instance capacity only after cleanup. Cover shutdown and invalidation ordering plus Windows Job and slot retirement. Verification: The ordering regression failed on both old paths and passes 20 race repetitions. Native Windows reconnect failed 3 of 100 repetitions before the fix and passed 100 afterward; native Job and shutdown regressions pass 20 repetitions. Full root Go, plugin/proc race, Desktop MCP tests, root lint and repository lint pass. Final full Desktop qualification is still in progress.
Problem: Native full-suite qualification found saved credentials being pinned into the process environment during a display-only refresh, and distinct prompt-history directories occasionally sharing a cache nonce. Root cause: Tab image-capability metadata used the mutating configuration loader. Prompt-history tape identity relied on wall-clock ticks, which can repeat across consecutive reads on Windows. Fix: Read metadata configuration without credential resolution or migrations, and use an opaque random nonce for each new history tape. Preserve capability projection and existing cache-hit behavior. Verification: Both direct metadata refresh and frozen-clock identity tests fail before the fix. The related history, metadata and credential tests pass 10 race repetitions locally and 50 native Windows repetitions. Desktop lint and repository lint pass; the full native Desktop suite is running on the final binary sources.
Parallelism tests must choose distinct stripes after canonical path normalization, including macOS temporary-directory symlinks and Windows case folding. Bound hierarchy/path acquisitions and register owner cleanup so assertion failures cannot strand a lease.
Pin the final product source and executable digest after full native Desktop tests and held-request, no-runtime, restart and predecessor-read acceptance. Record the shutdown, display-read and nonce regressions discovered during qualification, and distinguish the later test-only stripe fixture repair from product changes.
Problem: The final CI lint gate rejected the new zero-based stripe selection loop. Root cause: the helper used a classic counted loop despite the repository integer-range rule. Fix: retain the same search bounds using Go integer range. Verification: full root golangci-lint and workspacelease race tests pass; no product code changes.
…ntime-snapshots fix: save model settings independently and preserve accepted runtime snapshots
Summary: Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available. Verification: Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Review the full nine-PR first-parent range and current product behavior. Remove duplicated implementation summaries, correct settings-overlap wording and delivery targets, include MCP and history fixes, and document old Serve and status-bar upgrade behavior. Credit the verified adopted contributors. Both rendered languages, catalog validation and all 10 release-note tests pass; prior release records remain unchanged.
docs(release): review v1.38.3 notes / 审核 v1.38.3 双语更新日志
Problem: Controller shutdown could return while an autonomous inbox scan still touched its sidecar, racing directory removal and controller replacement. Root cause: The shutdown boundary joined sidecar opening, but NextQueued refreshed disk state after leaving that boundary. Fix: Serialize sidecar opening and queue scans with shutdown. Release this gate before host admission so a dispatcher can retire its own controller without waiting on itself. Verification: The shutdown barrier regression fails against the previous implementation and passes for Close and ReleaseResources. Focused race tests passed 20 repetitions; stale foreground recovery passed 1000 race repetitions. Full root and Desktop suites, owning control/serve/sessioninbox race suites, golangci-lint, and repository lint passed.
Problem: The model-settings bot integration test left SQLite handles open when its isolated home was removed on Windows. Root cause: Controller shutdown does not own process-wide history and usage catalogs, but the fixture only closed its session controller. Fix: Fence both catalog lifetimes around the isolated test home and report any shutdown failure before temporary-directory cleanup. Verification: The unchanged fixture reproduced history and usage database sharing failures on native Windows ARM64. After cleanup ownership was corrected, the full bot suite passed 20 native Windows repetitions and 10 race-enabled repetitions; focused lint passed.
…utdown fix(control): join inbox scans during shutdown / 关闭控制器时等待收件箱扫描结束
Summary: Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available. Verification: Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Summary: Review all ten merged product PRs, retain curated bilingual release guidance and contributor credit, and include the inbox shutdown correction. Record the new Windows binary and native runtime-replacement reassessment alongside the process-catalog fixture cleanup. Verification: Catalog validation, all ten release-note tests, bilingual rendering, complete merged-PR references, prior-record comparison, and public-text privacy review passed. Product qualification and exact-head CI passed before this documentation update.
docs(release): review refreshed 1.38.3 notes / 审阅更新后的 1.38.3 发布说明
…nery Problem: phase F of docs/DESKTOP_SHELL_MIGRATION.md retires the in-process Wails shell. The Wails entry point, its generated bindings, the WebView2 and WebKitGTK recovery coordinators, the remote-window child processes and the REASONIX_DESKTOP_SHELL=wails fallback all became dead weight once the Electron shell drove the service over --host-rpc. Fix: delete wails.Run from desktop/main.go (a plain launch now bootstraps the installed Electron shell or exits with an install hint), the Wails nativeHost adapter, logger, menu and single-instance lock, the webview2_*/webkit_*/ linux_renderer_recovery/nvidia_wayland/web_runtime_*/window_restore_*/ hang_watchdog/window_icon/system_quit old-shell files, the transcript native smoke harnesses, the vendored go-webview2 fork, and the wails dependency from desktop/go.mod. Remote Serve windows are shell BrowserWindows only; the ticket handoff and child-process registry are gone and openRemoteWindowForHost validates loopback URLs before delegating. The frontend heartbeat watchdog now presents the window with a diagnostics trail instead of driving a WebKit compatibility restart. Kept for compatibility: the legacy webRuntime/webview2 crash-report decode fields, the com.wails.reasonix-desktop bundle identity and the update helper's wails-app- single-instance lookup (upgrade detection). Verification: go build/vet/test ./... green in both modules, go test -race on the desktop package and touched internal packages green, GOOS=windows/linux (CGO_ENABLED=0) and darwin/arm64 cross-builds pass with no WebKitGTK headers, go list -m all in desktop shows no wails module.
… stub Problem: the desktop frontend still carried the Wails half of the host adapter — window.go/window.runtime fallbacks, the wailsjs type import behind @ts-ignore, the Wails drag-error suppression, the frameless resize workaround and the --wails-draggable CSS marker. Fix: desktopHost.ts now only knows the Electron preload host (window.reasonixDesktop) and the plain browser; the boundary check rejects wailsjs imports even type-only. bridge.ts checks AppBindings against the generated desktop host contract (DesktopCommandName) instead of the Wails bindings. The Wails drag-error suppression, useWailsResizeFix and the dev spinner anchor are deleted; --wails-draggable is renamed --reasonix-draggable and scripts/shell-css.mjs only rewrites it for the Electron bundle. The generated contract loses the app:open-settings event (the Electron menu emits it shell-side). ~60 test files move from injecting window.go/window.runtime to a shared __tests__/desktopHostStub.ts that fakes the preload host (live command table, event capture/emit, clipboard and drop channels); native file drop tests dispatch real DOM drop events through the production document handlers. The initial raw bundle budget drops to 2404.6 KiB with the Wails half gone. Verification: pnpm --dir desktop/frontend build (all gates, budgets green), pnpm test (332 suites) green, check-desktop-host-boundary and its self-test green, desktop contract drift check clean after regen.
Problem: prototypes/electron-browser proved the crash fault matrix against the prototype shell, but the production shell had no equivalent cases pinned. Fix: promote the valuable fault injections into desktop/electron's real tests: a render-process-gone while the ref resolves cancels the act with BROWSER_ERR_TAKEN_OVER and dispatches no input; a crash after dispatch settles the act as executed (no token rotation) so the Go ledger can never replay it; and the crash recovery test now asserts the persistent login partition survives the reload. The prototype's fixed test pages and mock provider stay out of the production entry points. Verification: node --import tsx --test src/main/browser/actions.test.ts and surfaceManager.test.ts pass (desktop/electron suite: 83/83).
…arnesses Problem: CI and the packaging pipeline still installed the Wails-era native toolchain (libwebkit2gtk headers, the webkit2_41 build tag, the wails CLI pin) and ran the WebView2/WebKitGTK native smoke harnesses whose binaries no longer exist. Fix: delete the transcript-native-smoke workflow, the WebKitGTK install steps in desktop-prepare/desktop-go, the WKWebView/WebView2 native transcript steps, the WebView2 smoke scripts and the vendored-edge test step, and the wails pin check (scripts, .wails-version, make wails-install). desktop-build.sh builds the service without -tags webkit2_41, so Linux needs no WebKitGTK headers. desktop/packaging reads the frozen product identity from a constant instead of wails.json. The contract tests now pin the packaged-Electron startup smoke and reject references to the retired harnesses. The root ./dev script drives the Electron shell against a freshly built service plus the Vite dev server; prod_test/prod_fast_test lose the Wails CLI pinning. The issue labeler describes the desktop app as Electron. Browser-compatibility Playwright tests (chromium/webkit) for the Web/Serve product are unchanged. Verification: bash scripts/release-workflows.test.sh, node scripts/check-desktop-build-contract.mjs, node scripts/check-single-release-public-contract.mjs, node --test scripts/desktop-release-artifacts.test.mjs scripts/ci-workflow.test.mjs, desktop/frontend/scripts/check-motion-ci-contract.mjs and actionlint on the release workflows all pass.
…ne#10194) * fix(desktop): locate macOS bundles from service paths Problem: Desktop 1.38.7 rejects in-app updates when the running Go service lives under Contents/Resources/service. Root cause: The updater searched for one fixed .app/Contents/MacOS substring and ignored symlink resolution errors. Fix: Resolve supported bundle layouts by directory components, validate Info.plist and the frozen bundle identifier, and share the layout resolver with shell bootstrap and icon repair callers. Verification: cd desktop && go test ./... * build(desktop): deduplicate macOS service payloads Problem: macOS bundles carry two complete service binaries and package production source maps and unused icon copies without a comparable size inventory. Root cause: The package script copied the service into two bundle locations and packaging validation treated both paths as independent files. Fix: Keep one service entity with an internal compatibility symlink, reject unsafe links and packaging junk, minify Electron entrypoints while archiving maps, trim copied icons, and emit JSON and Markdown size reports. Verification: node --test desktop/packaging/size-report.test.mjs desktop/packaging/lib.test.mjs desktop/packaging/sign-macos.test.mjs Built, mounted, verified, and smoke-tested the darwin-arm64 candidate DMG. * build(desktop): publish native macOS artifacts Problem: The release workflow copied one Universal application under native updater names and exposed only a Universal DMG to manual installers. Root cause: Artifact discovery used substring matching and the build matrix had no native Intel or Apple Silicon package jobs. Fix: Build native updater ZIPs and architecture DMGs, retain a manual Universal DMG, extend manifest and website compatibility, and gate publication on the exact Universal artifact passing both Apple Silicon and Intel smoke tests. Verification: node --test site/src/scripts/release-channels.test.mjs scripts/desktop-release-artifacts.test.mjs scripts/ci-workflow.test.mjs scripts/notarize-desktop.test.mjs bash scripts/release-workflows.test.sh pnpm --dir workers/crash-report test --run src/desktop_release.test.ts * build(windows): add a lightweight CLI entry Problem: New Windows installs and portable archives duplicate the complete Reasonix CLI at the install root and in the active version directory. Root cause: The stable root command was populated directly from the full versioned CLI because no console forwarding executable existed. Fix: Add a minimal current.json-aware CLI launcher, keep the complete CLI only in the version directory, preserve old payload compatibility, fail closed on invalid entries, and include the new PE in SignPath verification. Verification: go test ./cmd/reasonix-cli-launcher ./cmd/reasonix-legacy-migrator ./internal/installlayout GOOS=windows GOARCH=amd64 go test -c ./desktop/cmd/update-helper GOOS=windows GOARCH=amd64 go build ./cmd/reasonix-cli-launcher * build(desktop): tighten release compression gates Problem: Desktop release formats use default compression and size diagnostics are not retained with native build evidence. Root cause: NSIS, gzip, and nFPM compression were implicit, and release CI discarded package size and source-map outputs. Fix: Use solid LZMA with a 32 MiB dictionary, gzip level 9, and XZ DEBs; verify final Linux archives and upload package reports and source maps while refreshing Windows reports from signed payloads. Verification: bash -n scripts/desktop-build.sh scripts/package-windows-desktop.sh ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release-desktop.yml")' git diff --check * refactor(desktop): split updater support files Problem: The updater and updater tests exceeded the repository line-count budgets after the packaging compatibility work. Root cause: New bundle resolution, manifest asset definitions, and architecture-download tests were added to already oversized source files. Fix: Move the new responsibilities into focused support files and regenerate the desktop inventory without raising the lint baseline. Verification: go run ./tools/repolint go test ./tools/desktopinventory cd desktop && go test ./... * fix(desktop): keep Linux icons out of Electron staging Problem: The Windows Electron packaging smoke failed before the native app could be assembled. Root cause: The resource-pruning path treated every non-macOS target as Linux and required untracked reasonix.png icon names on Windows. Fix: Stage only the cross-platform appicon used by Electron. Linux system icon sizes remain owned by the DEB integration manifest and the Go tray embed. Verification: node --test desktop/packaging/lib.test.mjs desktop/packaging/size-report.test.mjs go run ./tools/repolint git diff --check
…ine#10196) * Improve the desktop model switcher Problem: The desktop model picker was narrow, provider-scoped during search, and offered no way to keep frequently used models visible. Root cause: The picker rendered one flat grouped list and stored no user-level model preference. Fix: Add a provider rail, catalog-wide search, persisted favorites, provider metadata, responsive sizing, and localized labels. Verification: Run the focused model switcher and favorites tests, desktop typecheck, frontend production build, and browser interaction checks. * Open Overview for empty workspace docks Problem: Opening a session with an expanded but empty workspace dock showed a tab picker instead of useful context. Root cause: Workspace restoration deliberately left an empty dock unseeded and did not distinguish first session display from a user's later tab close. Fix: Seed the Overview tab once for each visible session while preserving deliberate tab closure until the session changes. Verification: Run the workspace panel command regression test, browser dock mode test, desktop typecheck, and frontend production build. * Add one-command desktop development Problem: Local contributors needed multiple manual commands to start the browser UI or complete Electron application. Root cause: The desktop workspace had build commands but no coordinated development entry points. Fix: Add pnpm dev for the browser frontend and pnpm dev:desktop to build the Go service, start or reuse Vite, launch Electron, and clean up child processes. Document both commands. Verification: Run the launcher syntax and help checks, desktop typecheck, Electron tests, and frontend production build. * Update browser gates for default Overview Problem: The desktop browser gate expected a fresh expanded dock to show the empty tab picker, which no longer matches the new default Overview behavior. Root cause: The end-to-end fixtures selected Files only through the empty-state picker and treated every recently closed tab as interchangeable. Fix: Assert the default Overview tab, open Files through the add-tab menu, and target the closed Files entry explicitly after Overview also enters tab history. Verification: Run the complete frontend app browser gate, including app lifecycle, dock view state, and runtime state scenarios.
* ci: centralize frontend path decisions Problem: independent path filters treated desktop documentation as an unknown frontend input and triggered the full memory soak. Root cause: shell regexes and the memory workflow maintained separate, incomplete classifications. Fix: use one tested classifier for CI and memory workflows, publish per-surface reasons, preserve full main CI, and fail closed for unknown or invalid diffs. Verification: node --test scripts/ci-paths.test.mjs desktop/frontend/bench/app-memory-paths.test.mjs; actionlint for ci.yml and app-memory.yml. * ci: deduplicate frontend motion validation Problem: test:motion ran once in the frontend plan and again in the protected lint job. Root cause: the required lint check owned both code lint and a duplicate frontend command. Fix: move code lint into lint-code and keep lint as a fail-closed aggregate over code lint, frontend preparation, and the deduplicated frontend suite. Verification: ci-workflow and ci-test-plan node tests; motion CI contract; actionlint. * ci: validate and reuse frontend artifacts * ci: parallelize browser contract groups * ci: report workflow and runner timings * docs: explain layered frontend CI
* Simplify execution and completion semantics Problem: Host-derived quality contracts, readiness gates, ordinary todo continuation, and a separate Goal evaluator could prolong or block turns after the model had finished, while mixing model claims with observed execution facts. Root cause: Execution safety, model completion judgment, and result presentation shared a single quality-policy pipeline. Legacy delivery mode also propagated through session, CLI, ACP, worktree, and recovery paths. Fix: Retire delivery mode and host quality obligations, keep Plan preapproval and execution safety boundaries, drive Goal continuation from structured model reports without an evaluator, and render facts separately from declarations. Preserve legacy reads, explicit check recovery, historical evidence, and old remote state without reactivating retired policy. Verification: - root and desktop Go suites - focused root and desktop race suites - frontend test:all and production build - lint, generated contracts, cache guard, browser and native Electron checks Cache impact: One-time provider prefix change from retired tool discovery and updated tool descriptions. Serialization and ordering remain stable within the version. * Fix transcript history formatting Problem: The pull request's Linux and macOS test jobs stopped at the repository-wide gofmt gate for internal/transcript/history.go. Root cause: A composite literal added during historical-check projection was not aligned by gofmt before the initial push. Fix: Apply gofmt to the affected transcript history source. Verification: - gofmt -l . returns no files - go test ./internal/transcript passes - git diff --check passes * Normalize subagent receipt paths for display Problem: The Windows isolated agent job rendered changed paths with backslashes while the stable host-receipt contract and tests require slash-separated paths. Root cause: The simplified subagent completion path now exposes native receipt paths directly, so Windows filepath normalization leaked into provider-visible attestation text. Fix: Normalize only the rendered receipt and claim-violation path copies to forward slashes. Keep native paths intact for write-scope enforcement and audit state. Verification: - focused host receipt and subagent completion tests pass - deterministic backslash input test covers the platform-independent output - repository gofmt and git diff checks pass * Refresh desktop migration inventory Problem: The upstream CI refactor added one classified desktop CI job while this branch removes retired delivery surfaces, leaving the merged inventory count stale. Fix: Regenerate the desktop migration inventory with the current generator after merging main-v2. Verification: - go test -p 2 ./... -timeout 300s - go test -p 2 ./... -timeout 300s (desktop) - pnpm test:all && pnpm build - make lint * Wait for dock fixture hydration Problem: The dock browser benchmark could close Overview before the delayed bench session hydration completed. The authoritative hydrate then replaced the empty-state picker while Playwright was clicking Files. Root cause: The benchmark waited for the composer but not for the selected session snapshot, even though the fixture intentionally expands asynchronously. Fix: Wait for the fixture completion marker before mutating dock state. Verification: - node bench/dock-view-state.mjs (three consecutive runs) - pnpm test:app-browser - REASONIX_SETTINGS_BROWSERS=chromium pnpm test:settings-browser
* ci: batch frontend artifact hashing Problem: each artifact verification spawned one git process per tracked frontend input, adding about 20 seconds locally and more on Windows. Root cause: the version-one identity algorithm read every committed blob through a separate git show invocation. Fix: stream all HEAD blobs through one git cat-file batch process while preserving the exact ordered digest and manifest schema. Verification: node --test desktop/frontend/scripts/artifact-identity.test.mjs; the regression test compares the batched digest with the original per-file algorithm. * ci: merge the motion browser runner Problem: the seven-second motion browser command occupied a separate runner for roughly a minute because it repeated checkout, toolchain, dependency, browser, and artifact setup. Root cause: browser validation used three matrix groups even though motion can share the app-and-settings environment without changing command order or fixtures. Fix: run app, settings, and motion sequentially in one group while keeping transcript isolated, max-parallel at two, fail-fast disabled, and all five entrypoints unique. Verification: node --test scripts/ci-workflow.test.mjs; actionlint .github/workflows/ci.yml. * ci: expose Windows Go test phases Problem: the Windows desktop Go step took about fifteen minutes while package-reported test time explained only part of the wall time. Root cause: CI recorded only the whole step, so compile and package-launch delay could not be separated from package execution without inspecting raw logs. Fix: consume the existing test pass as Go JSON, preserve its human-readable output and exit status, and report first/last package launch, package elapsed totals, failures, and slow packages. Document the two browser groups and batched artifact verification. Verification: node tests for timing, workflow, artifact identity, and CI timing; desktop build contract; actionlint; repolint; a live local go test JSON pass through the reporter. * docs: refresh the desktop CI inventory Problem: the generated Desktop inventory became stale after adding the Windows Go timing reporter. Root cause: the inventory counts repository CI utilities and therefore requires regeneration when a new tracked helper is introduced. Fix: regenerate the inventory so the ci-job and total counts include the new timing utility. Verification: go test ./tools/desktopinventory; go run ./tools/repolint. * ci: trace stalled Windows test output Problem: The Windows desktop suite prints its final package result and then holds the CI pipe open for roughly ten minutes, but the surviving process is unknown. Root cause: The existing timing report records package boundaries only and cannot identify a descendant that retains an inherited output handle after the Go test process exits. Fix: When the Windows JSON stream is idle for 30 seconds, record the names and parent identities of processes created during the test step. Command lines and environments remain excluded from public logs. Verification: node --test scripts/go-test-timing.test.mjs scripts/ci-workflow.test.mjs go run ./tools/repolint git diff --check * ci: avoid synchronous Windows test cleanup Problem: the Windows desktop test process remained alive for several minutes after printing PASS, adding about ten minutes to the runner step in the observed run. Root cause: TestMain synchronously removed the package's large isolated user directory after m.Run completed, even though GitHub Actions already owns and cleans the job temp directory. Fix: defer cleanup only for Windows GitHub Actions directories proven to be inside RUNNER_TEMP, retain synchronous cleanup everywhere else, and remove the temporary idle diagnostic. Verification: targeted desktop tests; Node timing and workflow contract tests; repolint; git diff --check. * ci: place Windows test state under runner temp Problem: deferring cleanup is safe only when the isolated desktop test home is provably owned by the GitHub job. Root cause: the platform default temp path is not required to equal RUNNER_TEMP on every Windows runner. Fix: create the Windows Actions test home directly beneath RUNNER_TEMP before applying the guarded deferred cleanup. Verification: targeted desktop tests; repolint; git diff --check. * ci: remove Windows JSON test overhead Problem: the Windows desktop test step stayed busy for 8-10 minutes after the package printed its final ok line. Root cause: go test -json enables verbose test2json streaming and retains that output for Go's test cache; finalizing the large Windows package output dominated the tail. The prior cleanup hypothesis was disproved by a hosted run and is reverted. Fix: restore native go test output, delete the JSON reporter, record the step duration from the Actions API, and update the workflow contracts and bilingual CI guide. Verification: hosted diagnostic run; full local Desktop Go suite; Node workflow, timing, and artifact tests; actionlint; repolint; git diff --check. * test: absorb slow Windows catalog scheduling Problem: removing verbose JSON output exposed two asynchronous catalog tests whose one- and five-second observation windows intermittently expired on loaded Windows runners. Root cause: both tests wait for background catalog work with wall-clock polling; the assertions remained correct, but their observation budgets were shorter than hosted scheduling delays. Fix: raise only the test observation windows to five and fifteen seconds. Successful runs still return immediately, and production catalog deadlines are unchanged. Verification: both affected tests passed ten consecutive local runs; repolint; git diff --check.
…s / 修复 Linux 包内 app/ 目录为 0700 (esengine#10213) Problem: The .deb installs /usr/lib/reasonix/app/ as drwx------ root:root, so the launcher reports "no Electron desktop shell (app/) is installed" for every non-root user (esengine#10091, esengine#10139, esengine#10168). The portable tar.gz carries the same mode but is unaffected because the extracting user owns it. Root cause: @electron/packager stages the app tree in a mkdtemp directory (0700) and renames it into place. package.mjs, desktop-build.sh (cp -R) and nfpm (type: tree) all preserve that mode, and verify.mjs discarded the mode column of dpkg-deb -c. Fix: chmod the packaged app directory to 0755 right after the packager rename, parse the verbose listing of .deb and .tar.gz artifacts in verify.mjs, and fail the build when any directory is not drwxr-xr-x, any file is not world-readable, or a .deb member is not owned by root/root. Verification: node --test desktop/packaging/lib.test.mjs
… flat CLI (esengine#10214) Problem: Every Linux portable tar.gz fails on first launch with "migrate: flat CLI binary reasonix-cli is required" and never writes current.json (esengine#10146). Root cause: The legacy migrator looked the flat CLI up by installlayout.CLIBinaryName, which is the member name inside a version directory. Unix archives have always shipped the CLI as "reasonix" beside the desktop binary; only the Windows payload uses "reasonix-cli.exe" in both places. The migrator tests built their flat fixtures from AllowedVersionMembers, so they mirrored the same mistake. Fix: Add installlayout.FlatCLIBinaryName for the flat-root name, source the versioned reasonix-cli member from it, clean the flat entry up under that name after activation, build the test fixtures from the real flat layout, and add a first-launch test over the exact Linux tarball member set. Verification: go test ./cmd/reasonix-legacy-migrator/ ./internal/installlayout/ ./internal/desktoplauncher/ golangci-lint run ./cmd/reasonix-legacy-migrator/... ./internal/installlayout/... go run ./tools/repolint
…pp/ / 修复直接启动 Reasonix.exe 时找不到 service (esengine#10215) Problem: Starting versions\v<ver>\app\Reasonix.exe directly (a pinned taskbar icon or a double-click in Explorer) opens a window that reports "desktop service is not running": the service spawn fails with ENOENT (esengine#10118). Root cause: The Go service hands its own path to the shell through REASONIX_DESKTOP_SERVICE. Without that variable the shell fell back to resources/service/reasonix-desktop.exe, which only exists in the macOS bundle; Windows and Linux keep the service beside the app/ directory. Fix: Resolve the service the same way the Go bootstrap resolves the shell, in reverse: the configured path, then reasonix-desktop beside app/ (Windows and Linux, versioned or flat), then /usr/bin for the .deb, then the bundled macOS location. Probed paths are logged with the startup line. The release workflow gains a Linux smoke without --service so the sibling lookup is exercised on the packaged tree. Verification: cd desktop/electron && pnpm test && pnpm typecheck bash scripts/release-workflows.test.sh
…venance 证明 (esengine#10216) Problem: reasonix@1.38.x carries no dist.attestations, so trust-policy installers such as mise/aube refuse it as a downgrade from 0.44.0, which had SLSA provenance (esengine#10052). Root cause: --provenance only ever lived in the retired release-render.yml; the current publisher in npm/publish.mjs never carried it, and neither release-npm.yml nor its caller in release-stable.yml grants id-token: write. Fix: Pass --provenance to every npm publish, grant id-token: write on the publishing job and on the reusable-workflow call that feeds it, and assert the flag in the publish tests. All seven packages already declare the matching repository URL. Verification: node --test npm/publish.test.mjs bash scripts/release-workflows.test.sh
…r Retry / 激活阶段重试瞬态文件锁并提供重试 (esengine#10219) Problem: The Windows installer aborts with "Reasonix could not activate the verified release. The previous version was left unchanged." while antivirus is scanning the freshly extracted files, and the only workaround is to disable the scanner (esengine#10126, esengine#10136). Nothing persists the reason, and the staged files are deleted before the dialog, so the user cannot simply try again. Root cause: installlayout.ActivateVersion performs every rename, delete, and exclusive create exactly once; a single ERROR_SHARING_VIOLATION, ERROR_LOCK_VIOLATION or ERROR_ACCESS_DENIED from a scanner fails the whole activation with exit 1. The NSIS script then removes the staging directory and aborts without a Retry, and the activator's error text only reaches the in-memory details view. Fix: - installlayout retries those transient Windows errors with a linear backoff bounded to about eleven seconds, including the reused staging/replaced names, the rollback paths, and the exclusive create in copyFileRegular. CleanupStaleStaging now also sweeps *.replaced-* trees. - The migrator records the activation outcome in <home>\desktop-shell\logs\recovery.log through the exported desktopinstance.AttemptLog. - The installer keeps the staging directory and offers Retry/Cancel with a code-specific bilingual message (still running vs. locked files); the exit code is set only once the attempt is abandoned, and silent installs keep aborting as before. Verification: go test ./internal/installlayout/ ./internal/desktopinstance/ ./cmd/reasonix-legacy-migrator/ GOOS=windows go vet ./internal/installlayout/ ./internal/desktopinstance/ ./cmd/reasonix-legacy-migrator/ golangci-lint run (host and GOOS=windows) on the same packages go run ./tools/repolint cd desktop && go test ./ -run 'TestWindowsInstallerScript|Guard|Installer' node --test desktop/packaging/lib.test.mjs
…/ 为 1.38.3 及更早客户端补充手动升级提示 (esengine#10218) Problem: Desktops on v1.38.3 or older fail in-app update with "unsupported install_layout \"electron-v1\" (keeping current version)" and nothing tells them what to do (esengine#10093, esengine#10112, esengine#10097, esengine#10129, esengine#10184, esengine#10185). The boundary is deliberate and cannot be bridged from the release side: old clients validate the whole platform table, all manifest endpoints are byte-identical by construction, and a legacy-shaped manifest would let the old Windows and Linux updaters install a broken tree. Fix: - reasonix.io #start (the page the old client's download link opens) gains a bilingual "Updating from 1.38.3 or earlier?" note beside the existing macOS quarantine help. - The v1.38.7 release notes carry the same warning in upgrade[], so the GitHub release body and the changelog page show it; v1.38.6 already did. - docs/RELEASING.md adds the expected old-client behaviour to the first-release-after-cutover checklist. - classifyUpdateError treats "unsupported install_layout" as manual, so any future layout boundary shows the official download link in the banner instead of an endless Retry. Verification: node scripts/release-notes.mjs render --version v1.38.7 --output /tmp/rn.md node --test scripts/release-notes.test.mjs cd desktop/frontend && npx tsx src/__tests__/updater-shared-state.test.tsx npm ci --prefix site && npm run build --prefix site
… cask 改用 postflight_steps (esengine#10217) Problem: brew install/upgrade reasonix prints "Calling `postflight` is deprecated! Use `postflight_steps` instead." for the generated cask (esengine#9884). Root cause: GoReleaser renders homebrew_casks[].hooks.post.install as the deprecated `postflight do` stanza. The hook itself is still needed: the CLI archive is not signed or notarized, so the cask strips com.apple.quarantine after staging. Fix: Write the same command through custom_block as a `postflight_steps do` stanza, and assert in the release workflow contract tests that the cask block carries postflight_steps with the quarantine command and no hooks field, so the deprecated form cannot return. Verification: bash scripts/release-workflows.test.sh
…rness 重构聊天、权限与 Windows 沙箱 (esengine#10209) * feat: align chat and permissions with Harness Replace the virtualized transcript and split approval/sandbox policy with a natural-flow chat surface, stable node subscriptions, unified permission presets, precise session grants, and platform sandbox enforcement. Port the Harness-style process rows, turn footer, navigator, file presentation, and full-access confirmation while preserving Reasonix history and provider contracts. Add the Windows restricted-token sandbox and fail-closed capability reporting, together with migration, remote compatibility, documentation, and acceptance evidence. * chore: refresh repolint baseline for one-shot refactor Record the deliberate carry-forward from the transcript, remote presentation, permission, and Windows sandbox changes. The refreshed baseline also captures size and complexity reductions produced by the same extraction work. * fix: align permission refactor with CI contracts * fix: stabilize cross-platform permission CI Problem: The permission refactor left headless Windows tests on the workspace sandbox, exposed Windows-only lint findings, and let the transcript browser resolve Playwright assets from the wrong directory. Root cause: Tests used the interactive mode setter for a headless controller, direct Bash fixtures did not stamp their intended unrestricted preset, the transcript benchmark imported Playwright before normalizing its browser path, and Windows-tagged files had not been linted locally. Fix: Use the headless permission entry point, make Bash fixture intent explicit, normalize the transcript benchmark root before importing Playwright, and apply the Windows lint corrections without changing sandbox behavior. Verification: - go test ./... - cross-platform golangci-lint for linux, darwin, and windows - Windows amd64 cross-compilation for boot, builtin, and winsandbox tests - transcript Chromium browser replay for 240 and 1,000 turns - go run ./tools/repolint * test: harden native transcript and shell contracts Problem: The Linux native-scrollbar regression clicked the bottom arrow instead of the scrollbar thumb, and direct shell-contract tests inherited the new workspace-write default on Windows hosts without a sandbox backend. Root cause: The browser test used a fixed bottom-edge coordinate, while shell fixtures invoked Bash outside the controller path and therefore had no host-stamped permission preset. Fix: Compute the native thumb center from scrollbar geometry, retain CI screenshots as artifacts, and mark direct shell execution fixtures with an explicit full-access test context while preserving restricted-sandbox tests. Verification: - go test ./internal/tool/builtin -count=1 - Windows amd64 cross-compilation for internal/tool/builtin - GOOS=windows golangci-lint run --timeout=5m ./... - Chromium transcript replay for 240 and 1,000 turns - go run ./tools/repolint * perf: bound cumulative transcript mounting Problem: The 1,000-turn Linux browser replay exceeded the 500 ms long-task budget while cumulative history pages were mounted. Root cause: Transcript subtree mutations repeatedly rescanned all loaded rows, and each 60-turn history page committed its full natural-flow DOM in one frame. Fix: Observe direct chat-node additions only, retain per-row resize observation for internal content changes, enumerate direct row children, and reveal prepended history across bounded adjacent-frame commits without unmounting existing rows. Verification: frontend typecheck; chat natural-flow and scroll-controller tests; Chromium transcript replay (1,000 turns: 122.7 ms input P95, 161 ms longest task, 0 px anchor drift); repolint clean. * fix: keep transcript hydration synchronous Problem: The progressive history mount delayed initial and replacement transcript content by one frame, breaking remote hydration visibility contracts. Root cause: The bounded reveal path treated every order change like a history prepend, including an empty initial order and authoritative session replacement. Fix: Restrict progressive rendering to a contiguous non-empty suffix with newly added leading nodes; hydrate, replace, and grow the tail synchronously. Verification: remote-session-surface 101/101; frontend typecheck; chat natural-flow and scroll-controller tests; Chromium transcript replay within input and long-task budgets. * fix: stabilize transcript and Windows CI Problem: Linux transcript hydration remapped every mounted node on each history page and exceeded the 500ms long-task budget. The Windows project-session migration test also raced asynchronous catalog startup. Root cause: The order subscriber owned the full React child map even while progressive hydration intentionally retained the previous order reference. The catalog test requested reconciliation before the catalog had been published. Fix: Memoize the node-seat mapping by rendered-order identity so only committed history chunks reconcile. Wait for catalog publication before requesting the production reconcile path, and move shared catalog polling helpers out of the oversized test file. Verification: - 1,000-turn Chromium transcript benchmark: max long task about 249ms - frontend typecheck and hooks lint - project CLI migration tests, 10 repetitions - repolint and git diff checks * perf: bound cumulative transcript layout Problem: Linux 1000-turn transcript replay still exceeded 500ms after seat memoization because each history page reconciled existing seats and the turn rail forced layout of every loaded mark. Root cause: Progressive prepend kept one flat React child list, unchanged turns were reprojected, and the navigator read scroll geometry and rendered all marks after every page. Fix: Keep immutable 24-node seat chunks, cache unchanged turn projections, isolate row layout, window rail marks while retaining full loaded-turn geometry, and make benchmark waits target exact mounted anchors without weakening thresholds. Verification: - Chromium 1000-turn: max 196ms, input P95 119ms, 2407ms full mount - Full transcript test suite - Frontend build, typecheck, lint and bundle checks - Go migration tests 10x - Repository lint and diff checks * Serialize permission changes with approval commits Problem: permission revisions could change while an older approval was still recording and installing its session grant, exposing a mixed snapshot and allowing cross-version authorization. Root cause: mode changes, grant revocation, approval resolution, and permission snapshot reads used separate synchronization boundaries. Fix: establish permissionMu -> promptResolveMu -> permissionStateMu ordering, publish preset/revision/grants atomically, cancel the captured old turn outside the state mutation, and cover both legal concurrent orderings with a deterministic barrier test. Verification: go test -race ./internal/control (including five repeated targeted runs), Windows amd64 cross-compilation, and repository lint all pass. * Preserve chat nodes across history prepends Problem: loading older history repartitioned existing messages under different chunk parents, remounting their DOM and losing selection, focus, and local disclosure state. Root cause: the rendered order was grouped into position-derived SeatChunk components and regrouped whenever a prefix crossed a 24-node boundary. Fix: render every business node under one stable parent, progressively reveal only the new flat prefix, and publish the committed mounted order so navigation never advertises a missing target. Verification: transcript unit tests cover 1/5/23/24/25/48/49-node boundaries and 60 resident DOM identities; Chromium, WebKit, and Electron layout and 240/1000-turn production replays pass. * Clarify full-access host execution semantics Problem: product copy implied that Reasonix filesystem and network sandbox guarantees continued to apply after selecting full access. Root cause: permission labels were updated without consistently documenting Harness-style unsandboxed execution across the desktop, CLI, bot, Windows, and site surfaces. Fix: state that full access runs with the current OS account, retains explicit pre-launch host denies, and does not constrain behavior inside the launched process. Verification: desktop locale typecheck/build, documentation tests, site tests, and full-text consistency checks pass. * Stabilize virtual rail navigation coverage Problem: the Windows Electron layout check sometimes reached the test after the active turn had already scrolled the Harness-style virtual rail to its tail, leaving the early turn mark unmounted. Fix: explicitly scroll the rail to its loaded start before the early keyboard jump, then to its loaded tail before the final jump. Verification: Chromium reports 39 passing geometry scenarios and Electron reports 42. * Make permission ordering test platform-neutral Problem: the Windows control runner correctly reports restricted presets unavailable before its native sandbox is initialized, so the new concurrency test failed before reaching the transaction it was meant to exercise. Fix: drive the same serialized Controller mode-change path directly; platform capability rejection remains covered separately at the public preset boundary. Verification: the ordering suite passes ten times under the race detector and internal/control cross-compiles for Windows amd64.
…sengine#10223) * refactor(fileops): protect mutations with live observations Problem: File writes could deadlock behind range-based read evidence or overwrite a version that changed outside the structured file tools. Root cause: Authorization was reconstructed from model-visible read receipts above the actual I/O boundary instead of being bound to the target version used for mutation. Fix: Add host-owned file observations, native target versions, per-target mutation locks, atomic create/replace checks, and wire the structured file tools through the shared path. Add native Windows file identity support. Verification: Covered observation refresh, stale versions, aliases, concurrent writers and creates, encodings, buffers, and native Windows 11 identity behavior. * refactor(agent): simplify scheduling and execution state Problem: Batch-frozen evidence, full-read debt, repeated-call guards, and proof-oriented completion logic could block otherwise independent tools. Root cause: The scheduler treated read coverage and prior outcomes as cross-call authorization state rather than executing each call against current host state. Fix: Execute calls in actual dependency order, publish observations synchronously, keep ordinary failures local, remove read-completion gates, and replace hard repeat guards with reminders at calls 3, 5, and 8. Verification: Added deterministic harness scenarios for same-batch reads and writes, consecutive edits, bounded large-file reads, independent failures, and repeat reminders. * refactor(recovery): retire proof and recovery gates Problem: Unknown tool outcomes and unsettled proof records could permanently block later tools or require a recovery decision even when the user wanted to inspect external state. Root cause: Recovery, operation settlement, Auto Guard, and completion proof state machines controlled tool availability and turn finalization. Fix: Record interrupted and unknown outcomes as facts, retire recovery actions and proof tools, remove Auto Guard review paths, and keep legacy values decode-only for history compatibility. Verification: Covered crash-after-effect recovery, orphan ledger completion, fact-only interrupted turns, retired tool responses, Goal and Plan boundaries, and root control tests. * feat(desktop): retire recovery actions in host APIs Problem: Desktop host APIs still exposed recovery confirmation and replay actions after the runtime gates were removed. Fix: Keep recovery queries as compatibility reads and return a stable retired error for mutation actions, without confirming or replaying historical operations. Regenerate the Desktop contract. Verification: Desktop Go tests and generated contract drift checks pass. * feat(desktop): render legacy recovery as read-only history Problem: Existing Desktop recovery cards presented actionable confirmation controls that no longer matched the fact-only runtime. Fix: Render legacy recovery records as read-only history, preserve current interrupted and unknown tool facts, and remove recovery action controls from the active decision surface. Verification: Frontend decision-surface tests, the complete frontend suite, production build, shell tests, and Electron layout scenarios pass. * docs(execution): document harness migration semantics Document the live file-observation model, bounded-read behavior, fact-only recovery, retired proof tools, compatibility rules, cache impact, and explicit guarantee boundaries. Add bilingual migration and acceptance reports with issue-by-issue macOS, Desktop, and native Windows 11 validation evidence. * fix(fileops): preserve observed intent and publish without clobbering Problem: reads through the generic tool entry point did not observe files, and deletion, buffer routing, concurrent moves, or Linux metadata changes could bypass the intended freshness and no-overwrite contracts. Root cause: read entry points diverged, intent was inferred from current existence, publication checked only content, native lock identity changed on replacement, and Linux Ctim did not match the metadata field filter. Fix: share bounded reads, retain live observations across same-session rebuilds, keep source routes stable, and compare bytes and native versions captured from one handle. Stage complete creates, reject overwrite copy fallbacks, use native no-replace moves, and retain a stable path lock. Recognize both Linux Ctim and Darwin Ctimespec without a whole-file scan. This adapts the session ownership and staged publication mechanisms from DeepSeek Harness c291e7961a to the existing Go and encoding adapters. Verification: owning file-package tests, deterministic replacement/create regressions, targeted race tests, and native Windows identity/move tests pass. A real git command between consecutive edits remains usable after live runtime replacement. Linux Ctim has a portable nanosecond regression. * fix(agent): preserve model completion reports without host adjudication Problem: delegated tasks still received host-downgraded completion status even after the root proof gates were retired. Root cause: complete_subtask and parent report rendering retained the receipt-based adjudicator and a mandatory completion-tool prompt. Fix: remove adjudication and make the structured report optional. Label model-reported status separately from recorded execution facts. Preserve legacy audit fields for historical reads without producing new judgments. Verification: tests cover report preservation without receipts, separate model/fact presentation, malformed-report validation, and final prose without a completion-tool call. Serialized cache guards pass; the changed child tool description and contract cause one upgrade-time prefix change. * refactor(execution): remove retired guard remnants and correct acceptance Problem: retired proof and recovery policies left unused runtime helpers, and the initial acceptance report overstated publication guarantees. Root cause: removal of callers did not remove obsolete shell classifiers, completion salvage, batch rewrites, review dumps, or budget/governor state. Fix: delete unused enforcement code and obsolete fixtures, keep historical data types, and document each follow-up review finding in both languages. Separate original UI acceptance evidence from the new backend regressions. Verification: golangci-lint reports zero issues in both Go modules; the repository ratchet is clean without increasing budgets. Targeted execution and race regressions pass. Cache metadata now records the actual review instead of the invalid N/A declaration. * fix(boot): avoid role key capacity overflow
…ngine#10241) Problem: session state, cancellation, persistence, and client binding ownership overlapped, allowing hung turns, unsafe runtime disposal, divergent imported histories, and expensive cold listings. Root cause: execution state depended on legacy transcript mirrors and shared Controller lifecycles. Watcher teardown and test fixtures also retained resources across shutdown. Fix: use typed in-memory session events, separate write-behind persistence with fixed 200 ms batching and semantic checkpoints, host-owned runtime bindings, unified frozen import into v3.1, and bounded catalog metadata queries. Preserve permissions and file observations while removing todo completion gates. Correct watcher shutdown, immutable binding comparison, and Windows fixture ownership. Verification: all 39 successful checks and 5 explicit skips on af67e0a; required checks pass, all review threads resolved, and no newly introduced CodeQL alerts. The four remaining repository alerts also exist on the unchanged base. Packaging and signing remain release-stage work.
internal/i18n: new Spanish catalogue (messages_es.go, 556 fields), ArgLanguageEs in every locale, setLanguage/normalize mapping for es*, /language es completion in cli+control, config SetLanguage persistence (extracted to edit_language.go), and parity/placeholder/code-token/plan-choice test coverage.
locales/es.ts: full 3,527-key es-419 dictionary (1:1 with en.ts); startup wiring (Locale union, LANGUAGE_PREFS, SPINNER_WORDS.es, detect/preload); auxiliary dictionaries retyped Record<Exclude<Locale,"es">, ...> with existing ?? en fallbacks; SetTrayLocale accepts es; bundle-budget gates updated for the es startup wiring and the lazy es-*.js chunk.
The i18n section now describes the multi-catalogue flow (messages_es.go as the Spanish baseline) and the setLanguage/normalize, /language, and parity-test steps.
After rebasing onto main-v2: add ProviderErrWaitExhaustedFmt to messages_es.go; add the 100 new en.ts keys to es.ts, drop the 66 preset keys upstream removed (superseded by the catalog structure), and re-measure the es-*.js chunk budget (62.2 KiB -> 62.3 KiB ceiling).
Drop the two leftover conflict markers and re-align the Spanish catalogue with the permission-preset wording that main-v2 adopted (esengine#10209).
The es-419 dictionary is 3,332 keys on the current main-v2 and measures 59567 B (58.171 KiB) gzip, so the 56.8 KiB ceiling no longer holds. Keep the next one-decimal ceiling with bounded headroom, like the Chinese dialects.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fork-internal PR, opened only to run this repository's
ci.ymlagainst the rebasedfeat/es-spanishbranch.ci.ymltriggers onpull_requesttargetingmain-v2, and pull requests from a fork (esengine#9870) leave the upstream workflows inaction_requireduntil a maintainer approves them. This PR produces a green CI run on the same commit that can be linked from esengine#9870 as evidence.No merge is intended; it will be closed once the run is captured.