[ufna]

This brings integrate/design-polish into main through the frozen snapshot integrate/to-main-8, now design-polish at 56a6b4f. The first cut, at eed65fd, failed only macOS CI. It follows to-main-7 (#706); main 240fab8 is already merged into the branch (#707, #708).

What lands

• Projects:
  • the default-project choice (Connect the local default-project choice #709);
  • folder link actions (Connect Projects folder link actions #713) and repository cloning (Connect Projects repository cloning #717);
  • the folder and worktrees pane (Connect the Projects folder and worktrees pane #719);
  • the bounded Worktrees overview: source and page models, native reads, manual cleanup, and the connected overview with cleanup review (Add bounded Worktrees overview source and page models #723, Add bounded native Worktrees overview reads #726, Add native manual cleanup for overview selections #728, Connect the bounded Worktrees overview and cleanup review #737);
  • Project Swarm: controller reservation (Reserve the organization controller for catalog recovery #739), native Preview/Join/Sync (Connect Project Swarm Preview and Join through the native worker #742) and the lazy Computers / Connect computer dialog (Add the lazy Project Swarm Computers and connection dialog #744);
  • the read-only Windows folder model (feat(client): read-only Windows Projects folder model (.66.2.31) #745).
• Mobile connection:
  • phone pairing and revoke (fix(client): phone pairing and revoke actions (.24.4) #720);
  • computer invitation codes (fix(client): enable computer invitation codes (.24.6) #724), with their Cancel kept across navigation (fix(client): keep invitation Cancel across navigation (.24.9) #741);
  • guarded workspace create/join/change (Enable guarded Mobile workspace create, join and change (.24.7) #733), Stop preflight (Guard mobile Stop before workspace changes (.24.10) #730), and connector Start/Stop/Refresh (Enable guarded Mobile connector Start, Stop and Refresh (.24.5) #738);
  • legacy connector configuration (feat(client): legacy connector configuration (.24.8) #740).
• Session view:
  • the question card back in the reading column, styled as needing attention (Question card follows the reading column and reads as needing attention #711);
  • opening a session paints its settled end with no visible jumps (Opening a session paints its settled end, with no visible jumps #731).
• Appearance: user skin import (feat(client): import user skins in Appearance (.11.1) #712).
• Linux notifications and badges (G4):
  • notifier work partition and retirement (Partition agent and GUI update notifier work before native drain #710, Retire notifier inputs while admitted callbacks settle #715);
  • badge resource completion, readers and raw streams (G4: qualify Linux badge resource completion #714, G4: keep badge readers live during tray registration #716, G4: activate raw badge streams after match preparation #718);
  • Attention observer retention (Retain Attention observer captures until actual destruction #721);
  • the owned-identity codec, inspection, provenance and envelopes (G4: add the passive bounded Linux owned-identity codec #722, Inspect owner-separated Linux notification data without authority #729, Validate passive Linux notification provenance rows #732, Decode explicitly owned notification envelopes from raw spans #735);
  • isolated store specification (Specify isolated Linux native stores and invalidation proof #727);
  • post admission and barrier acknowledgements, a pure model (Model bounded notification post admission and barrier acknowledgements #747).
• Desktop producer (G1, dormant internal helpers):
  • native reservation inspection (Inspect bounded native reservations without granting another send #725);
  • background-v1 profile data (Define canonical background-v1 role and permission profile data #734);
  • timing bounds (Enforce non-renewable local producer timing bounds #736), identity probe (Bind one-use producer probes to retained frontend identity #743) and control-line I/O (Bound producer control lines by one absolute deadline #746).
• Test fix (Resolve the legacy relay test fixtures' temp folder #748): the legacy relay fixtures canonicalize their temp folder. Without it, macOS's /var symlink would fail them in the macos-15 core job.

Pre-merge pinned reviews ran for the updater, installer, security, credential and destructive changes: #710, #714, #715, #720, #721, #724, #725, #727, #728, #730, #733–#747. All other merges were reviewed post-merge against the mockup and Qt.

Local gate

The full pre-cut gate ran at 33d32f6 (logs hashed).

• Passed:
  • all 18 lockfiles --locked;
  • check-source, separators and privacy;
  • the client-scripts, publication and ci-security suites;
  • gitleaks history and tree;
  • root clippy and tests;
  • core fmt and clippy;
  • Tauri clippy and tests with media;
  • Windows cross-clippy for root, core and Tauri;
  • npm check, tests, build and bundle budget;
  • the worktree lifecycle suite (private PID namespace);
  • licences.
• Fixed by Resolve the legacy relay test fixtures' temp folder #748: core tests failed only in the seven mobile::legacy fixtures, under the gate's symlinked TMPDIR. At eed65fd the full client/core suite passes, and mobile::legacy passes under a symlinked TMPDIR too.
• Known non-CI artefacts: root and Tauri rustfmt drift, and the terminal_launch descriptor test under a symlinked TMPDIR.

Re-cut at 56a6b4f (#749–#755 added)

The first cut's gate failed on macOS only, in desktop::producer_io::tests::sockets::clean_eof_and_partial_frame_are_not_confused (#746). XNU's setsockopt returns EINVAL once both directions of a socket are shut. #755 (zerus-5wmh.23.1, pinned review) maps exactly that Apple EINVAL to "receive side shut", keeps both deadline checks, and the macOS test now asserts the real EINVAL. This run is the macOS evidence for it.

The snapshot also gains these, each pinned-reviewed at its exact head:

• Project Swarm conflicts: Add bounded Swarm conflict review data #750 (conflict review data) and Connect native Swarm conflict review and Resolve #753 (native Resolve and retained review).
• Desktop producer helpers (dormant): Seal original fresh native reservation response data #751 (original fresh reservation response) and Fence producer channel reuse after terminal I/O failure #752 (producer Channel).
• Linux notifications: Model exact noncolliding notification results and saved-result retirement #754 (pure post-result continuation).

Local pre-cut gate at 56a6b4f: every step passes apart from the known non-CI artefacts (root and Tauri rustfmt drift, and terminal_launch under a symlinked TMPDIR).

🤖 Generated with Claude Code

[ufna]

CI gate red at eed65fd, on macOS only: desktop::producer_io::tests::sockets::clean_eof_and_partial_frame_are_not_confused (from #746) gets EINVAL from set_read_timeout after the peer closes, because XNU refuses setsockopt once a socket is shut. The CLI (macos-15) aggregator failed with it, and the macOS core/native jobs were skipped. The fix is assigned as zerus-5wmh.23.1. Once it merges into integrate/design-polish I'll move this snapshot to the new head and run the gate again.

🤖 Generated with Claude Code

[ufna]

Re-cut at 5b6f03d. Run 41210256828 at 56a6b4f confirmed #755's macOS EOF fix, and surfaced two more problems:

• macOS: a Linux-only assertion in Fence producer channel reuse after terminal I/O failure #752's Channel test. After the Channel's full shutdown, XNU accepts the peer's late write. The assertion is fixed test-only in Accept XNU's late peer write in the fenced Channel test #758, and the fence itself stays asserted on every platform.
• Windows: the known search_index resume test flaked (2 vs 3). Neither snapshot touches that code, and it passed at eed65fd. I filed a bead for a deterministic fixture fix.

The snapshot also gains #756 (audited one-time automatic approvals, .54). It had a pinned pre-merge security review, the full client/core suite passes at its head (1648 passed), and check-source, privacy and gitleaks history/tree pass at 5b6f03d.

🤖 Generated with Claude Code