Sync upstream 1.4.214

.gitattributes

@@ -7,6 +7,12 @@
 /skill-stubs/_shared/*.md text eol=lf
 /skills/*/SKILL.md text eol=lf
 /src/cli/bundled-skill-guides.ts text eol=lf
+# SVG bytes feed embedded data URLs and asset hashes on every build host.
+*.svg text eol=lf
+# Compiler input line breaks must not depend on the checkout OS.
+*.ts text eol=lf
+*.tsx text eol=lf
+*.html text eol=lf
 # Bundled plugin trees are byte-hashed; CRLF checkout would break the pinned hash.
 /resources/plugins/** text eol=lf
 # Relay assets are copied verbatim into the bundle and hashed byte-for-byte into
@@ -88,3 +94,6 @@
 /mobile/web-entry/**/*.otf -text
 /mobile/web-entry/**/*.woff -text
 /mobile/web-entry/**/*.woff2 -text
+
+# Generated ACP schemas are checked byte-for-byte against formatted output.
+/src/main/acp/generated/*.generated.ts linguist-generated=true text eol=lf

.github/CONTRIBUTING.md

@@ -16,6 +16,11 @@ Thanks for contributing to Orca.
 
 ## Local Setup
 
+Install Node 24, pnpm, and the Bun version in [`config/bun-version`](../config/bun-version).
+`pnpm test` runs Vitest on Bun, with Node workers for runtime contracts such as SQLite,
+native PTYs, socket liveness, and V8 memory behavior. `pnpm test:node` runs the same suites
+entirely on Node. Builds and dependency installation still use Node and pnpm.
+
 ```bash
 pnpm install
 pnpm dev

.github/workflows/ci-closed-pr-caches.yml

@@ -1,19 +1,86 @@
-name: Clean closed PR caches
+name: Clean closed PR work
 
 on:
   pull_request_target:
     types: [closed]
 
 permissions:
   actions: write
+  pull-requests: read
 
 jobs:
   clean:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
+      - name: Cancel checks for an unmerged closed PR
+        if: github.event.pull_request.merged == false
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const closed = context.payload.pull_request
+            const targets = [
+              ['pr-checks', 'pr.yml'],
+              ['node-server', 'node-server-tests.yml'],
+              ['ssh-windows-hosts', 'ssh-windows-hosts.yml'],
+              ['ssh-hostile-hosts', 'ssh-hostile-hosts.yml'],
+              ['mobile', 'mobile.yml'],
+              ['computer-e2e', 'computer-e2e.yml']
+            ]
+            const stillClosed = async () => {
+              const { data: current } = await github.rest.pulls.get({
+                ...context.repo, pull_number: closed.number
+              })
+              return current.state === 'closed' && current.merged_at === null &&
+                current.closed_at === closed.closed_at
+            }
+            if (!Number.isSafeInteger(closed.number) || closed.number <= 0 ||
+                !Number.isFinite(Date.parse(closed.closed_at))) {
+              throw new Error('Missing closed PR identity')
+            }
+            if (!await stillClosed()) return
+            for (const [prefix, workflow] of targets) {
+              const group = `${prefix}-${closed.number}`
+              let data
+              try {
+                const response = await github.request(
+                  'GET /repos/{owner}/{repo}/actions/concurrency_groups/{concurrency_group_name}', {
+                    ...context.repo, concurrency_group_name: group,
+                    headers: { 'X-GitHub-Api-Version': '2026-03-10' }
+                  }
+                )
+                data = response.data
+              } catch (error) {
+                if (error.status === 404) continue
+                throw error
+              }
+              if (data.group_name !== group || !Array.isArray(data.group_members)) {
+                throw new Error(`Unexpected concurrency group: ${group}`)
+              }
+              for (const member of data.group_members) {
+                // Only whole PR runs; release/manual jobs never share this identity.
+                if (member.job_id !== undefined || !Number.isSafeInteger(member.run_id)) continue
+                const { data: run } = await github.rest.actions.getWorkflowRun({
+                  ...context.repo, run_id: member.run_id
+                })
+                if (run.event !== 'pull_request' || run.path !== `.github/workflows/${workflow}` ||
+                    run.status === 'completed' ||
+                    !Number.isFinite(Date.parse(run.created_at)) ||
+                    Date.parse(run.created_at) > Date.parse(closed.closed_at)) continue
+                if (!await stillClosed()) return
+                try {
+                  await github.rest.actions.cancelWorkflowRun({
+                    ...context.repo, run_id: member.run_id
+                  })
+                  core.info(`Requested cancellation of ${group}: ${member.run_id}`)
+                } catch (error) {
+                  if (error.status !== 409) throw error
+                }
+              }
+            }
       # No checkout: this runs trusted default-branch code, including for fork PRs.
       - uses: actions/github-script@v8
+        if: '!cancelled()'
         with:
           script: |
             const ref = `refs/pull/${context.payload.pull_request.number}/merge`

.github/workflows/cloud-deploy-relay-production-same-cap-job.yml

@@ -15,6 +15,7 @@ on:
       expected-general-cells: { required: true, type: string }
       expected-rehome-generation: { required: true, type: string }
       wave-index: { required: true, type: string }
+      drain-pace-window-ms: { required: true, type: string }
 
 permissions:
   contents: read
@@ -48,14 +49,13 @@ jobs:
       EXPECTED_GENERAL_CELLS: ${{ inputs.expected-general-cells }}
       EXPECTED_REHOME_GENERATION: ${{ inputs.expected-rehome-generation }}
       WAVE_INDEX: ${{ inputs.wave-index }}
-      # Each drained host re-dials /v1/assign and is re-placed through the director's
-      # single-slot sticky lane, which clears roughly 8 hosts/s fleet-wide. A 2,100-host
-      # cell over 2 min (~18/s) overran it on 2026-09-23 and browned out assign for every
-      # region for ~5 min. 5 min is the cell's maximum window (DRAIN_PACE_WINDOW_MAX_MS); a
-      # ~2,700-host cell still arrives at ~9/s, so expect a short tail, not zero rejects.
-      # The transition wait below is the 15-min migration lease plus this window. A cell on
-      # an older image drains at once.
-      DRAIN_PACE_WINDOW_MS: '300000'
+      # The cell spreads its drain sends over this window, so each drained host re-dials
+      # /v1/assign at hosts / window and is re-placed through the director's drain-return
+      # lane. The wave validator admits only its closed set, and anything below the 300000
+      # default only on US general cells: Asia drains are bound by their targets' accept
+      # rate. The transition wait below is the 15-min migration lease plus this window. A
+      # cell on an older image drains at once.
+      DRAIN_PACE_WINDOW_MS: ${{ inputs.drain-pace-window-ms }}
     steps:
       - name: Require exact reusable-workflow configuration
         working-directory: .
@@ -104,10 +104,11 @@ jobs:
 
       # One approved-cell table, in the wave validator the dispatch gate already uses, so
       # a cell's class and its wave's selector delta cannot drift apart between the two.
+      # Also re-checks the drain pace against this cell, before anything reads production.
       - name: Resolve this cell's admission class and wave selector delta
         run: |
           CELL_CLASS="$(node dev/scripts/relay-production-same-cap-wave.mjs cell-class \
-            --cell-id "${TARGET_CELL_ID}")"
+            --cell-id "${TARGET_CELL_ID}" --drain-pace-window-ms "${DRAIN_PACE_WINDOW_MS}")"
           ENTRY_ADMISSION="$(jq -er '.entryAdmission' <<< "${CELL_CLASS}")"
           SELECTOR_WAVE_DELTA="$(jq -er '.selectorWaveDelta' <<< "${CELL_CLASS}")"
           if test "${DEPLOY_MODE}" = verify; then
@@ -537,10 +538,14 @@ jobs:
           jq -e '.rollIsolated == true' <<< "${ISOLATE_RESULT}" >/dev/null
           ISOLATE_GENERATION="$(jq -er '.generation' <<< "${ISOLATE_RESULT}")"
           echo "SELECTOR_GENERATION_AFTER_ISOLATE=${ISOLATE_GENERATION}" >> "${GITHUB_ENV}"
-          node dev/scripts/prepare-relay-production-capacity-canary.mjs \
+          DRAIN_RESULT="$(node dev/scripts/prepare-relay-production-capacity-canary.mjs \
             --director-origin "${DIRECTOR_ORIGIN}" --cell-origin "${CELL_ORIGIN}" \
             --cell-id "${TARGET_CELL_ID}" --approved-cells same-cap --mode drain \
-            --pace-window-ms "${DRAIN_PACE_WINDOW_MS}"
+            --pace-window-ms "${DRAIN_PACE_WINDOW_MS}")"
+          echo "${DRAIN_RESULT}"
+          # What the cell accepted, which is 0 when an older image fell back to an unpaced drain.
+          echo "drain-applied-pace-window-ms=$(jq -er '.paceWindowMs' <<< "${DRAIN_RESULT}")" \
+            >> "${GITHUB_OUTPUT}"
           # Restart-safe means an empty runtime for a whole pace window after the drain; leases
           # held by unplaceable hosts are reported, not waited on (c28, 2026-10-01).
           node dev/scripts/verify-relay-capacity-transition.mjs \
@@ -549,7 +554,9 @@ jobs:
             --unobserved-bound "${EXPECTED_UNOBSERVED_BOUND}" \
             --heartbeat either --admission migration-only --draining required \
             --activity restart-safe --expected-image-digests "${PREDECESSOR_IMAGE_DIGEST}" \
-            --pace-window-ms "${DRAIN_PACE_WINDOW_MS}" --timeout-ms 1200000
+            --pace-window-ms "${DRAIN_PACE_WINDOW_MS}" \
+            --timeout-ms "$((900000 + DRAIN_PACE_WINDOW_MS))"
+          echo "drain-settled-at=$(date -u +%FT%TZ)" >> "${GITHUB_OUTPUT}"
 
       - id: capacity-auth
         if: ${{ inputs.mode != 'verify' }}
@@ -822,6 +829,8 @@ jobs:
         timeout-minutes: 8
         env:
           DRAIN_STARTED_AT: ${{ steps.drain.outputs.drain-started-at }}
+          DRAIN_SETTLED_AT: ${{ steps.drain.outputs.drain-settled-at }}
+          DRAIN_APPLIED_PACE_WINDOW_MS: ${{ steps.drain.outputs.drain-applied-pace-window-ms }}
           APPLY_STARTED_AT: ${{ steps.apply.outputs.apply-started-at }}
           APPLY_COMPLETED_AT: ${{ steps.apply.outputs.apply-completed-at }}
           VERIFY_ENDED_AT: ${{ steps.verify-target.outputs.verify-ended-at }}
@@ -838,6 +847,10 @@ jobs:
             --apply-started-at "${APPLY_STARTED_AT}" \
             --apply-completed-at "${APPLY_COMPLETED_AT}" \
             --verify-ended-at "${VERIFY_ENDED_AT}" \
+            --drain-pace-window-ms "${DRAIN_PACE_WINDOW_MS}" \
+            --drain-applied-pace-window-ms "${DRAIN_APPLIED_PACE_WINDOW_MS}" \
+            --drain-settled-at "${DRAIN_SETTLED_AT}" \
+            --target-hosts "${TARGET_HOSTS:-}" \
             --summary-file "${GITHUB_STEP_SUMMARY}" \
             --output-file "${SHADOW_GATE_DIRECTORY}/${SHADOW_GATE_NAME}"
 

.github/workflows/cloud-deploy-relay-production-same-cap.yml

@@ -53,6 +53,12 @@ on:
         description: Exact durable regional-rehome control generation; it must be disabled
         required: true
         type: string
+      drain-pace-window-ms:
+        description: Window the cell spreads its drain over; below 300000 only for US general cells, named in the confirmation
+        required: true
+        default: '300000'
+        type: choice
+        options: ['300000', '60000', '30000']
       canary-run-id:
         description: Successful same-code canary in this rehome control generation; reusable across batches
         required: false
@@ -103,11 +109,13 @@ jobs:
           ROLLBACK_DIGEST: ${{ inputs.rollback-image-digest }}
           CONFIRMATION: ${{ inputs.confirmation }}
           CANARY_RUN_ID: ${{ inputs.canary-run-id }}
+          DRAIN_PACE_WINDOW_MS: ${{ inputs.drain-pace-window-ms }}
         run: |
           CELLS="$(node dev/scripts/relay-production-same-cap-wave.mjs validate \
             --mode "${MODE}" --cell-ids "${CELL_IDS}" \
             --target-digest "${TARGET_DIGEST}" --rollback-digest "${ROLLBACK_DIGEST}" \
-            --confirmation "${CONFIRMATION}" --canary-run-id "${CANARY_RUN_ID}")"
+            --confirmation "${CONFIRMATION}" --canary-run-id "${CANARY_RUN_ID}" \
+            --drain-pace-window-ms "${DRAIN_PACE_WINDOW_MS}")"
           echo "cells=${CELLS}" >> "${GITHUB_OUTPUT}"
           if [[ "${MODE}" =~ ^(canary-apply|batch-apply)$ ]]; then
             echo 'job-mode=apply' >> "${GITHUB_OUTPUT}"
@@ -133,13 +141,15 @@ jobs:
           ROLLBACK_DIGEST: ${{ inputs.rollback-image-digest }}
           SELECTOR_GENERATION: ${{ inputs.expected-selector-generation }}
           REHOME_GENERATION: ${{ inputs.expected-rehome-generation }}
+          DRAIN_PACE_WINDOW_MS: ${{ inputs.drain-pace-window-ms }}
         run: |
           node dev/scripts/relay-production-same-cap-wave.mjs verify-canary \
             --file "${RUNNER_TEMP}/relay-same-cap-canary/authority.json" \
             --commit-sha "${GITHUB_SHA}" --run-id "${CANARY_RUN_ID}" \
             --cell-ids "${CELL_IDS}" \
             --target-digest "${TARGET_DIGEST}" \
             --rollback-digest "${ROLLBACK_DIGEST}" \
+            --drain-pace-window-ms "${DRAIN_PACE_WINDOW_MS}" \
             --selector-generation "${SELECTOR_GENERATION}" \
             --rehome-generation "${REHOME_GENERATION}"
 
@@ -158,6 +168,7 @@ jobs:
       expected-migration-only-cells: ${{ inputs.expected-migration-only-cells }}
       expected-general-cells: ${{ inputs.expected-general-cells }}
       expected-rehome-generation: ${{ inputs.expected-rehome-generation }}
+      drain-pace-window-ms: ${{ inputs.drain-pace-window-ms }}
       wave-index: '0'
     secrets: inherit
 
@@ -177,6 +188,7 @@ jobs:
       expected-migration-only-cells: ${{ inputs.expected-migration-only-cells }}
       expected-general-cells: ${{ inputs.expected-general-cells }}
       expected-rehome-generation: ${{ inputs.expected-rehome-generation }}
+      drain-pace-window-ms: ${{ inputs.drain-pace-window-ms }}
       wave-index: '1'
     secrets: inherit
 
@@ -196,6 +208,7 @@ jobs:
       expected-migration-only-cells: ${{ inputs.expected-migration-only-cells }}
       expected-general-cells: ${{ inputs.expected-general-cells }}
       expected-rehome-generation: ${{ inputs.expected-rehome-generation }}
+      drain-pace-window-ms: ${{ inputs.drain-pace-window-ms }}
       wave-index: '2'
     secrets: inherit
 
@@ -215,6 +228,7 @@ jobs:
       expected-migration-only-cells: ${{ inputs.expected-migration-only-cells }}
       expected-general-cells: ${{ inputs.expected-general-cells }}
       expected-rehome-generation: ${{ inputs.expected-rehome-generation }}
+      drain-pace-window-ms: ${{ inputs.drain-pace-window-ms }}
       wave-index: '3'
     secrets: inherit
 
@@ -234,6 +248,7 @@ jobs:
       expected-migration-only-cells: ${{ inputs.expected-migration-only-cells }}
       expected-general-cells: ${{ inputs.expected-general-cells }}
       expected-rehome-generation: ${{ inputs.expected-rehome-generation }}
+      drain-pace-window-ms: ${{ inputs.drain-pace-window-ms }}
       wave-index: '4'
     secrets: inherit
 
@@ -253,6 +268,7 @@ jobs:
       expected-migration-only-cells: ${{ inputs.expected-migration-only-cells }}
       expected-general-cells: ${{ inputs.expected-general-cells }}
       expected-rehome-generation: ${{ inputs.expected-rehome-generation }}
+      drain-pace-window-ms: ${{ inputs.drain-pace-window-ms }}
       wave-index: '5'
     secrets: inherit
 
@@ -272,6 +288,7 @@ jobs:
       expected-migration-only-cells: ${{ inputs.expected-migration-only-cells }}
       expected-general-cells: ${{ inputs.expected-general-cells }}
       expected-rehome-generation: ${{ inputs.expected-rehome-generation }}
+      drain-pace-window-ms: ${{ inputs.drain-pace-window-ms }}
       wave-index: '6'
     secrets: inherit
 
@@ -291,6 +308,7 @@ jobs:
       expected-migration-only-cells: ${{ inputs.expected-migration-only-cells }}
       expected-general-cells: ${{ inputs.expected-general-cells }}
       expected-rehome-generation: ${{ inputs.expected-rehome-generation }}
+      drain-pace-window-ms: ${{ inputs.drain-pace-window-ms }}
       wave-index: '7'
     secrets: inherit
 
@@ -310,6 +328,7 @@ jobs:
       expected-migration-only-cells: ${{ inputs.expected-migration-only-cells }}
       expected-general-cells: ${{ inputs.expected-general-cells }}
       expected-rehome-generation: ${{ inputs.expected-rehome-generation }}
+      drain-pace-window-ms: ${{ inputs.drain-pace-window-ms }}
       wave-index: '8'
     secrets: inherit
 
@@ -329,6 +348,7 @@ jobs:
       expected-migration-only-cells: ${{ inputs.expected-migration-only-cells }}
       expected-general-cells: ${{ inputs.expected-general-cells }}
       expected-rehome-generation: ${{ inputs.expected-rehome-generation }}
+      drain-pace-window-ms: ${{ inputs.drain-pace-window-ms }}
       wave-index: '9'
     secrets: inherit
 
@@ -343,14 +363,26 @@ jobs:
       - uses: actions/setup-node@v4
         with: { node-version: 24 }
 
+      # Its pace checks are what let a batch drain faster than the default; a missing artifact
+      # seals UNVERIFIED, which only the default accepts. Named from the gate's normalized cell,
+      # as cell_1 uploaded it, so a padded cell-ids input cannot miss it.
+      - name: Download the canary cell's shadow health verdict
+        continue-on-error: true
+        uses: actions/download-artifact@v4
+        with:
+          name: relay-same-cap-shadow-gate-${{ fromJSON(needs.gate.outputs.cells)[0] }}-${{ github.run_id }}.json
+          path: ${{ runner.temp }}/relay-same-cap-shadow-gate
+
       - name: Seal exact successful canary authority
         run: |
           mkdir -p "${RUNNER_TEMP}/relay-same-cap-canary"
           node dev/scripts/relay-production-same-cap-wave.mjs create-canary \
-            --cell-id "${{ inputs.cell-ids }}" \
+            --cell-id "${{ fromJSON(needs.gate.outputs.cells)[0] }}" \
             --target-digest "${{ inputs.target-image-digest }}" \
             --rollback-digest "${{ inputs.rollback-image-digest }}" \
             --confirmation "${{ inputs.confirmation }}" \
+            --drain-pace-window-ms "${{ inputs.drain-pace-window-ms }}" \
+            --shadow-report "${RUNNER_TEMP}/relay-same-cap-shadow-gate/relay-same-cap-shadow-gate-${{ fromJSON(needs.gate.outputs.cells)[0] }}-${GITHUB_RUN_ID}.json" \
             --commit-sha "${GITHUB_SHA}" --run-id "${GITHUB_RUN_ID}" \
             --selector-generation "${{ inputs.expected-selector-generation }}" \
             --rehome-generation "${{ inputs.expected-rehome-generation }}" \

.github/workflows/cloud-operate-relay-asia-admission.yml

@@ -39,7 +39,7 @@ on:
         required: false
         type: string
       evidence-run-id:
-        description: Staging evidence run ID for C27, C27 canary run ID for C28/C29; C30-C33 take none and each proves itself by its own canary
+        description: Staging evidence run ID for C27, C27 canary run ID for C28/C29; C30-C34 take none and each proves itself by its own canary
         required: false
         type: string
       evidence-run-attempt:
@@ -156,7 +156,7 @@ jobs:
                 evidence_kind=c27
                 artifact_name="relay-asia-c27-canary-${EVIDENCE_RUN_ID}-${EVIDENCE_RUN_ATTEMPT}"
                 ;;
-              production-gce-c30|production-gce-c31)
+              production-gce-c30|production-gce-c31|production-gce-c34)
                 # No earlier proof binds a later cell's generation; its own canary below rolls it back on failure.
                 canary_cell="${TARGET_CELL_IDS}"
                 ;;
@@ -330,7 +330,7 @@ jobs:
               verify_cells=production-gce-c27,production-gce-c28,production-gce-c29
               expected_states='{"production-gce-c27":"general","production-gce-c28":"migration-only","production-gce-c29":"migration-only"}'
               ;;
-            production-gce-c30|production-gce-c31|production-gce-c32|production-gce-c33)
+            production-gce-c30|production-gce-c31|production-gce-c32|production-gce-c33|production-gce-c34)
               verify_cells="${CANARY_CELL}"
               expected_states="{\"${CANARY_CELL}\":\"general\"}"
               ;;