ci: scope the packaged Windows gate to its own inputs

This lane packages, installs and updates Maka on Windows. It takes about
25 minutes on a runner class that is scarce on shared infrastructure, and
it was being allocated for two reasons that its own steps cannot justify.

`apps/desktop/src/main/runtime-host-boot.ts` was in the path filter
because the packaged updater is driven through `MAKA_UPDATE_TEST_FEED`,
which that file hands to the update service. The wiring is a handful of
lines; the module is 1900 of them, and over the last 200 commits on main
it was the sole reason this lane ran 13 times. It is now asserted by
`scripts/update-test-feed-wiring.test.mjs`, which runs on every change in
the required job before any toolchain is installed and costs
milliseconds. The filter matches 41 of those 200 commits, down from 55.

The pinned-baseline steps qualify a transition out of an already-released
installer, so a pull request's diff is not their input and cannot change
their outcome. Downloading that baseline is also this lane's most common
failure: 14 of 36 failures across the last 300 runs, every one of them on
a branch that could not have caused it, each costing another 25-minute
Windows allocation. Those three steps move to a nightly schedule, which
is still far ahead of release day, the moment they exist to precede.

Packaging, release verification and the end-to-end autoupdate check still
run on every matching pull request.

Generated-by: Claude Code

Author: Astro-Han

.github/workflows/ci.yml

@@ -102,6 +102,12 @@ jobs:
       - name: Test script entrypoint contracts
         run: node --test scripts/script-entrypoints.test.mjs
 
+      # The packaged Windows lane drives the updater through this wiring. It
+      # is a few lines, so it is asserted here on every change rather than by
+      # naming its module in that lane's 25-minute path filter.
+      - name: Test the packaged update feed wiring
+        run: node --test --test-concurrency=1 scripts/update-test-feed-wiring.test.mjs
+
       # Install-free like its neighbours: the gate reads one source file and
       # compares it to a hand-edited inventory, so a hook that silently widens
       # its scope to the whole tree fails here rather than in a profile (#4109).

.github/workflows/release-windows-check.yml

@@ -46,11 +46,13 @@ on:
       - 'scripts/package-windows-autoupdate-next.mjs'
       # The Abort-path rollback hook ships inside the installer itself.
       - 'apps/desktop/build/installer.nsh'
-      # The packaged updater's feed behavior — and the boot wiring that hands
-      # MAKA_UPDATE_TEST_FEED to it — is only observable on this path.
+      # The packaged updater's feed behavior is only observable on this path.
+      # The boot wiring that hands MAKA_UPDATE_TEST_FEED to it is not here:
+      # that is a few lines, `scripts/update-test-feed-wiring.test.mjs` asserts
+      # them on every change for free, and naming the file made a 1900-line
+      # module the single largest source of runs on this 25-minute lane.
       - 'apps/desktop/src/main/app-update-service.ts'
       - 'apps/desktop/src/main/main-window.ts'
-      - 'apps/desktop/src/main/runtime-host-boot.ts'
       - 'packages/runtime-host/src/client/connect-or-spawn.ts'
       - 'packages/runtime-host/src/client/launcher.ts'
       - 'apps/desktop/src/main/windows-maximize-renderer-sync.ts'
@@ -94,6 +96,11 @@ on:
       - 'apps/desktop/resources/licenses/cargo/THIRD_PARTY_NOTICES.txt'
       - '.github/workflows/release.yml'
       - '.github/workflows/release-windows-check.yml'
+  # The installer upgrade and rollback steps below qualify a transition from a
+  # pinned historical release, so their input is that release rather than the
+  # diff. They run here instead, which is still far ahead of release day.
+  schedule:
+    - cron: '17 5 * * *'
   workflow_dispatch:
 
 permissions:
@@ -135,8 +142,13 @@ jobs:
           version="$(node -p "require('./apps/desktop/package.json').version")"
           npm run verify:windows-x64 -- "apps/desktop/release/Maka-${version}-win-x64.exe"
 
+      # Qualifies a transition out of a pinned historical release, so a pull
+      # request cannot change the outcome. Downloading that release is also
+      # this lane's most frequent failure, on branches that cannot have caused
+      # it, and each false red costs another 25-minute Windows runner.
       - name: Download and verify the pinned Windows upgrade baseline
         id: previous
+        if: github.event_name != 'pull_request'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
@@ -146,6 +158,7 @@ jobs:
           echo "exe=$previous_exe" >> "$GITHUB_OUTPUT"
 
       - name: Exercise pinned-version upgrade and uninstall
+        if: github.event_name != 'pull_request'
         run: |
           version="$(node -p "require('./apps/desktop/package.json').version")"
           npm run verify:windows-installer -- \
@@ -163,6 +176,7 @@ jobs:
             apps/desktop/release-autoupdate-next
 
       - name: Prove deterministic mid-install failure rollback
+        if: github.event_name != 'pull_request'
         run: |
           version="$(node -p "require('./apps/desktop/package.json').version")"
           npm run verify:windows-installer-rollback -- \

scripts/update-test-feed-wiring.test.mjs

@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * `verify-windows-autoupdate.mjs` drives the packaged updater by handing it
+ * `MAKA_UPDATE_TEST_FEED`, and the boot path is what carries that value to the
+ * update service. Break the wiring and the packaged run stops reaching the
+ * harness feed, so the verifier proves nothing while still passing.
+ *
+ * The wiring is a handful of lines. Asserting them costs milliseconds on every
+ * change, which is why naming their 1900-line module in the packaged Windows
+ * lane's path filter — a 25-minute Windows job — was the wrong instrument.
+ */
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+
+const FEED = 'MAKA_UPDATE_TEST_FEED';
+
+function read(path) {
+  return readFileSync(new URL(`../${path}`, import.meta.url), 'utf8');
+}
+
+test('the packaged boot path hands the harness feed to the update service', () => {
+  const boot = read('apps/desktop/src/main/runtime-host-boot.ts');
+
+  assert.match(boot, /const updateTestFeed = process\.env\.MAKA_UPDATE_TEST_FEED;/u);
+  assert.match(boot, /createAppUpdateService\(\{[\s\S]*?testFeedUrl: updateTestFeed,/u);
+});
+
+test('the harness feed still redirects packaged user data away from the real root', () => {
+  // Without this the update test would write into the developer's own profile.
+  const main = read('apps/desktop/src/main/main.ts');
+
+  assert.match(
+    main,
+    /resolveUpdateTestUserDataDirectory\(\{\n\s+feedUrl: process\.env\.MAKA_UPDATE_TEST_FEED,/u,
+  );
+});
+
+test('the Windows autoupdate verifier is what supplies the feed', () => {
+  const verifier = read('scripts/verify-windows-autoupdate.mjs');
+
+  assert.match(verifier, new RegExp(`${FEED}: feed\\.url`, 'u'));
+});