* 🐛 fix(desktop): pin bundled npm deps through the Desktop lockfile
The main hash accepted any npm module that happened to resolve inside apps/desktop/node_modules, so a module linked from outside the frozen install (or from a stale store entry) could enter the renderer OTA hash without the lockfile ever pinning it.
Resolve each bundled module to its package name@version and require apps/desktop/pnpm-lock.yaml to pin it, keeping the file:/link:/git/tarball escape hatch for specifiers that pin by resolution instead of version.
partial-json is imported by packages/utils and packages/context-engine but was never declared, so the Desktop lockfile could not pin it: declare it in both packages and record it in apps/desktop/pnpm-lock.yaml.
* 🔊 chore(desktop): name the changed bundles before a dev restart
The dev orchestrator logged only that a main/preload bundle changed, which cannot distinguish the debounced restart from an unrelated vite rebuild. Collect every file reported by the watcher during the debounce window and print it with its event type, size and mtime.
* 📝 docs(acceptance): publish the round from the session's own observations
A delivery verified on the real product earlier in the session still had to re-run the plan and checker stage to obtain a published round. Document that those observations and artifacts are the evidence: write plan[] and cases[] from them, disclose anything never captured, and ingest.
* 🐛 fix(desktop): derive renderer OTA compatibility from source inputs
* 🐛 fix(desktop): set up Node before validating S3 releases
* 🐛 fix(desktop): report OTA decisions and preserve diagnostics
- server: emit X-Auth-Failure (jwt_expired / jwt_signature / user_inactive / no_token ...) next to X-Auth-Required on session UNAUTHORIZED responses
- desktop: log every 401/403 through the backend proxy at info level with hadToken, authRequired, authFailure and locally decoded JWT claims (sub / exp / expiredBy)
- desktop: add scripts/analyzeAuthLog.mjs (bun run log:auth) that turns a user's main.log into verdict codes with next steps
Claude-Session: https://claude.ai/code/session_01XjdtgxABquDMKeLZxu8q64
* 🐛 fix(desktop): hash renderer OTA main bundles
* 🐛 fix(desktop): hash externalized runtime modules in mainHash
Externalized main-process modules (electron-log, font-list, native addons
and their dependency trees) never reach the emitted bundles, so a renderer
OTA patch could be gated against an installed binary whose external runtime
module had changed.
Each platform now contributes an `externals` digest: name@version for
registry packages, plus full source content for workspace packages whose
version never bumps.
Claude-Session: https://claude.ai/code/session_01HNtnp2V5PrHc6tgrjwLRwN
* ♻️ refactor(desktop): unify update notification info
* test: avoid building main hash bundles in unit test
* ✨ feat(desktop): gzip renderer OTA CAS and keep r0 plus last-2 deltas
Tree-diff with zstd --patch-from instead of re-downloading the full renderer,
gzip the original CAS objects, and generate deltas from the packaged r0 tree
plus the two most recent patch versions.
* ♻️ refactor(desktop): simplify renderer OTA lineage
* 🐛 fix(ci): publish renderer base after r0
* ✨ feat(desktop): renderer OTA hot update without app restart
* 🐛 fix(desktop): address renderer OTA review findings
- compute mainHash only from committed files and include src/common
- inject UPDATE_SERVER_URL into beta builds so OTA is enabled
- validate all MPA entry htmls at staging, not just index.html
- use async fs for renderer tree hashing/staging off the main event loop
* ♻️ refactor(desktop): validate renderer OTA manifest with zod + zod-compiler
* 🐛 fix(desktop): pin renderer OTA build lineage
* 🐛 fix(desktop): isolate renderer OTA lineages
Innei