chore: sync main into phase3 (sync 4)

.github/CONTRIBUTING.md

@@ -16,7 +16,7 @@ Thanks for contributing to Orca.
 
 ## Local Setup
 
-Install Node 24, pnpm, and the Bun version in [`config/bun-version`](../config/bun-version).
+Install Node 24, pnpm, and the Bun version in [`config/.bun-version`](../config/.bun-version).
 `pnpm test` runs Vitest on Bun, with Node workers for runtime contracts such as SQLite,
 native PTYs, socket liveness, and V8 memory behavior. `pnpm test:node` runs the same suites
 entirely on Node. Builds and dependency installation still use Node and pnpm.

.github/workflows/pr.yml

@@ -201,7 +201,7 @@ jobs:
         if: needs.code_paths.outputs.static_analysis == 'true'
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version-file: config/bun-version
+          bun-version-file: config/.bun-version
 
       # Keep each check in its own log while sharing this runner.
       - name: Lint

.github/workflows/unit-tests.yml

@@ -50,7 +50,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version-file: config/bun-version
+          bun-version-file: config/.bun-version
 
       - uses: actions/download-artifact@v8
         continue-on-error: true

cloud/dev/scripts/prepare-relay-production-capacity-canary.test.mjs

@@ -97,13 +97,11 @@ describe('production Relay capacity cell admission', () => {
   it('admits the same-cap Asia and migration-only cells only under the same-cap allowlist', () => {
     for (const cellId of [
       'production-gce-c27', 'production-gce-c28', 'production-gce-c29', 'production-gce-c30',
-      'production-gce-c31',
+      'production-gce-c31', 'production-gce-c34',
       // Migration-only canaries: the US-only capacity rollout never touches them either.
       'production-gce-c17', 'production-gce-c18',
       // US cells at the Asia shape: the 1,000-cap capacity rollout never touches them.
-      'production-gce-c32', 'production-gce-c33',
-      // The migration-only Asia spare.
-      'production-gce-c34'
+      'production-gce-c32', 'production-gce-c33'
     ]) {
       const hostname = cellId.slice('production-gce-'.length)
       assert.deepEqual(parseProductionCapacityCellArguments([

cloud/dev/scripts/relay-production-same-cap-wave.mjs

@@ -4,18 +4,15 @@ import { requireSameEvidenceCode } from './relay-evidence-code-provenance.mjs'
 
 // Migration-only by policy: zero hosts and no reservation, so a wave rolls one without
 // displacing anybody. It enters and must leave migration-only, never general.
-// C34 is an Asia spare that stays migration-only by policy.
-export const SAME_CAP_MIGRATION_ONLY_CELLS = [
-  'production-gce-c17', 'production-gce-c18', 'production-gce-c34'
-]
+export const SAME_CAP_MIGRATION_ONLY_CELLS = ['production-gce-c17', 'production-gce-c18']
 
 export const SAME_CAP_CELLS = [
   'production-gce-c7', 'production-gce-c8', 'production-gce-c9', 'production-gce-c10',
   'production-gce-c13', 'production-gce-c14', 'production-gce-c15', 'production-gce-c16',
   'production-gce-c19', 'production-gce-c20', 'production-gce-c21', 'production-gce-c22',
   'production-gce-c23', 'production-gce-c24', 'production-gce-c25', 'production-gce-c26',
   'production-gce-c27', 'production-gce-c28', 'production-gce-c29', 'production-gce-c30',
-  'production-gce-c31', 'production-gce-c32', 'production-gce-c33',
+  'production-gce-c31', 'production-gce-c32', 'production-gce-c33', 'production-gce-c34',
   ...SAME_CAP_MIGRATION_ONLY_CELLS
 ]
 

cloud/dev/scripts/relay-production-same-cap-wave.test.mjs

@@ -136,13 +136,11 @@ test('the wave workflow chains exactly ten serial cell jobs', () => {
   assert.doesNotMatch(dispatch, /\n  cell_11:/)
 })
 
-test('lists the C34 spare as migration-only beside C17 and C18, and C30-C33 as general', () => {
-  assert.deepEqual(
-    SAME_CAP_MIGRATION_ONLY_CELLS,
-    ['production-gce-c17', 'production-gce-c18', 'production-gce-c34']
-  )
+test('lists only C17 and C18 as migration-only now that C34 is promoted, and C30-C34 as general', () => {
+  assert.deepEqual(SAME_CAP_MIGRATION_ONLY_CELLS, ['production-gce-c17', 'production-gce-c18'])
   for (const cellId of [
-    'production-gce-c30', 'production-gce-c31', 'production-gce-c32', 'production-gce-c33'
+    'production-gce-c30', 'production-gce-c31', 'production-gce-c32', 'production-gce-c33',
+    'production-gce-c34'
   ]) {
     assert.equal(SAME_CAP_CELLS.includes(cellId), true, cellId)
   }
@@ -207,6 +205,19 @@ test('rolls the migration-only cells but never mixes the two classes in one wave
     confirmation: `ROLL_RELAY_SAME_CAP ${targetDigest} ${asiaPromoted}`,
     canaryRunId: '42'
   }).cells, ['production-gce-c30', 'production-gce-c31'])
+  // C34 is general once its Asia canary promotes it, so a rollback restores it general.
+  assert.equal(entryAdmission('production-gce-c34'), 'general')
+  assert.equal(selectorWaveDelta('production-gce-c34'), 2)
+  const c34Mixed = 'production-gce-c34,production-gce-c17'
+  assert.throws(() => validateSameCapWave({
+    mode: 'batch-apply',
+    cellIds: c34Mixed,
+    targetDigest,
+    rollbackDigest,
+    drainPaceWindowMs: '300000',
+    confirmation: `ROLL_RELAY_SAME_CAP ${targetDigest} ${c34Mixed}`,
+    canaryRunId: '42'
+  }), /all general or all migration-only/)
   const c31Mixed = 'production-gce-c31,production-gce-c18'
   assert.throws(() => validateSameCapWave({
     mode: 'batch-apply',

cloud/dev/scripts/relay-same-cap-script-census.test.mjs

@@ -279,10 +279,9 @@ describe('same-cap roll scripts accept every same-cap cell', () => {
     const trusted = SAME_CAP_CELLS.filter((cell) => REHOME_SOURCE_CELLS.has(cell))
     // Only a declared rehome source may roll at a trusted protocol at all; the job refuses
     // the rest before it plans, and the next test covers them at protocol 0.
-    // The C34 spare is a rehome source that stays migration-only.
     assert.deepEqual(
       SAME_CAP_CELLS.filter((cell) => !REHOME_SOURCE_CELLS.has(cell)),
-      SAME_CAP_MIGRATION_ONLY_CELLS.filter((cell) => cell !== 'production-gce-c34')
+      SAME_CAP_MIGRATION_ONLY_CELLS
     )
     for (const [cellId, protocol] of trusted.flatMap((cell) => [[cell, 1], [cell, 3]])) {
       const { cap, pool } = cellShape(cellId)

cloud/dev/scripts/relay-same-cap-shadow-gate-verdict.mjs

@@ -28,7 +28,8 @@ export const FLEET_POOL_CELL_IDS = [
   'production-gce-c28',
   'production-gce-c29',
   'production-gce-c30',
-  'production-gce-c31'
+  'production-gce-c31',
+  'production-gce-c34'
 ]
 
 export const SHADOW_GATE_THRESHOLDS = {

cloud/dev/scripts/relay-same-cap-shadow-gate.test.mjs

@@ -278,6 +278,7 @@ function productionLikeEntries() {
     ...metricSamples({ cellId: 'production-gce-c29', from: '2026-09-20T20:20:00Z', count: 20 }),
     ...metricSamples({ cellId: 'production-gce-c30', from: '2026-09-20T20:20:00Z', count: 20 }),
     ...metricSamples({ cellId: 'production-gce-c31', from: '2026-09-20T20:20:00Z', count: 20 }),
+    ...metricSamples({ cellId: 'production-gce-c34', from: '2026-09-20T20:20:00Z', count: 20 }),
     // One director instance's samples from ten minutes before the drain to the window's end.
     ...directorSamples({ from: '2026-09-20T19:50:00Z', count: 80, payload: {} })
   ]
@@ -339,10 +340,10 @@ function gcloudSeam(entries = productionLikeEntries()) {
   }
 }
 
-test('reads every promoted asia-east2 cell as fleet pool, C31 included', () => {
+test('reads every promoted asia-east2 cell as fleet pool, C34 included', () => {
   assert.deepEqual(FLEET_POOL_CELL_IDS, [
     'production-gce-c27', 'production-gce-c28', 'production-gce-c29', 'production-gce-c30',
-    'production-gce-c31'
+    'production-gce-c31', 'production-gce-c34'
   ])
 })
 
@@ -363,6 +364,7 @@ test('a healthy roll reads as PASS and names the instance it proved serving', as
     'fleetPool:production-gce-c29',
     'fleetPool:production-gce-c30',
     'fleetPool:production-gce-c31',
+    'fleetPool:production-gce-c34',
     'nonDrain503Budget'
   ])
   assert.deepEqual(report.drain, {

cloud/docs/relay-workflows.md

@@ -221,18 +221,12 @@ list because their pool is the US default of 10.
 
 C34 is a sixth Asia cell at the C31 shape in `asia-east2-c`, so the six Asia cells spread 2/2/2. It
 was its own topology wave, registered alone as migration-only, and the director was configured with
-`cell-ids` set to C34, all on 2026-10-05. It launched as a migration-only spare and now has a
-promotion wave of its own, with the same five-minute canary C30 and C31 ran. The canary lands on
-C34 because it is the emptiest general Asia cell once promoted. Promotion compares the director's
-serving digest and C34's runtime digest with the one `image-digest` input, so C34 must first be
-rolled to the director's image. That roll is a same-cap wave that enters and leaves
-migration-only, so it moves nobody. C34 stays in the same-cap migration-only list until its promotion
-succeeds, because a same-cap job reads a cell's class from that list, not from the selector. It
-then moves to the general list and the fleet pool list together, as its own reviewed change,
-before any same-cap wave names C34 again. Between promotion and that change, do not run a same-cap
-wave on C34; a rollback there would demote it. Do not name it in the multi-target
-`promote-general-cell` or `retire-migration-cell` modes, which accept any migration-only cell. It
-is a declared rehome source.
+`cell-ids` set to C34, all on 2026-10-05. It launched as a migration-only spare and has a promotion
+wave of its own, with the same five-minute canary C30 and C31 ran. Promotion compares the
+director's serving digest and C34's runtime digest with the one `image-digest` input, so C34 was
+first rolled to the director's image as a migration-only same-cap wave. Once its canary promoted
+it, it moved to the same-cap general list and the fleet pool list together, so the same-cap job now
+rolls it as a general cell and a rollback restores it general. It is a declared rehome source.
 Rollback returns
 Asia cells to migration-only; it does not destroy the network or use
 existing-only. The production topology dispatch remains unavailable until the

cloud/infra/terraform/environments/production.tfvars

@@ -450,7 +450,7 @@ relay_gce_cells = {
     connection_hard_cap         = 3000
     connection_unobserved_bound = 60
   }
-  # Asia spare: registered migration-only as a drain landing zone; c completes the 2/2/2 zone spread.
+  # Sixth Asia cell: launched as a migration-only spare, now general; c completes the 2/2/2 zone spread.
   "production-gce-c34" = {
     hostname                    = "c34"
     region                      = "asia-east2"

config/build-plugins/plain-node-entry-guard.ts

@@ -61,6 +61,7 @@ const WORKER_THREAD_ENTRY_NAMES = [
   'main-thread-hang-watchdog-entry',
   'port-scan-command-worker-entry',
   'usage-scan-worker-entry',
+  'claude-profile-setup-worker-entry',
   'profile-state-backup-worker-entry',
   'profile-state-writer-worker-entry'
 ] as const

config/scripts/build-relay.mjs

@@ -25,6 +25,7 @@ import {
   RELAY_BUILD_PLATFORMS,
   RELAY_VERSION_FILENAME,
   RELAY_OPENCODE_SQLITE_READER_FILENAME,
+  WSL_CLAUDE_PROFILE_HELPER_FILENAME,
   relayOptionalArtifactFilenames,
   isWindowsRelayPlatform,
   relayArtifactFilenames
@@ -331,6 +332,18 @@ for (const platform of RELAY_BUILD_PLATFORMS) {
     .slice(0, 12)
   writeFileSync(join(outDir, '.browser-network-version'), `${RELAY_VERSION}+${browserNetworkHash}`)
   console.log(`Built WSL browser network relay → ${outDir}/wsl-browser-network-relay.js`)
+
+  // Why here, not the relay dirs: only the desktop runs it, inside WSL; SSH hosts never upload it.
+  await build({
+    entryPoints: [join(ROOT, 'src/main/claude-accounts/claude-profile-wsl-entry.ts')],
+    bundle: true,
+    platform: 'node',
+    target: 'node18',
+    format: 'cjs',
+    outfile: join(outDir, WSL_CLAUDE_PROFILE_HELPER_FILENAME),
+    minify: true,
+    define: { 'process.env.NODE_ENV': '"production"' }
+  })
 }
 
 console.log('Relay build complete.')

config/scripts/check-runtime-electron-ratchet-graph.test.mjs

@@ -0,0 +1,114 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { collectElectronImporters } from './check-runtime-electron-ratchet.mjs'
+
+const roots = []
+afterEach(() => {
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function fixture(files) {
+  const root = mkdtempSync(path.join(tmpdir(), 'orca-electron-ratchet-graph-'))
+  roots.push(root)
+  for (const [file, source] of Object.entries(files)) {
+    const absolute = path.join(root, file)
+    mkdirSync(path.dirname(absolute), { recursive: true })
+    writeFileSync(absolute, source)
+  }
+  return root
+}
+
+async function inspectGraph(entries, { separateEntries = false, plugins = [] } = {}) {
+  let result
+  const inspect = {
+    name: 'inspect-electron-ratchet-graph',
+    setup(pluginBuild) {
+      if (separateEntries) {
+        delete pluginBuild.initialOptions.stdin
+        pluginBuild.initialOptions.entryPoints = entries
+      }
+      pluginBuild.onEnd((built) => {
+        result = built
+      })
+    }
+  }
+  const importers = await collectElectronImporters(entries, { plugins: [...plugins, inspect] })
+  return { importers, ...result }
+}
+
+function fixtureInputs(result, root) {
+  return Object.fromEntries(
+    Object.entries(result.metafile.inputs)
+      .filter(([file]) => file.includes(path.basename(root)))
+      .sort(([left], [right]) => left.localeCompare(right))
+  )
+}
+
+describe('the runtime Electron import graph', () => {
+  it('retains every original CommonJS input and Electron edge when sharing root dependencies', async () => {
+    const root = fixture({
+      'entry.mjs': `
+        export { value } from './shared.cjs'
+        export { value as imported } from 'conditional-package'
+        export const load = () => import('./dynamic.mjs')
+      `,
+      'future.cjs': `
+        module.exports = {
+          value: require('conditional-package').value,
+          bare: () => require.resolve('electron'),
+          subpath: () => require.resolve('electron/main'),
+          addon: () => require('./missing.node'),
+          desktop: () => require('desktop-package')
+        }
+      `,
+      'shared.cjs': 'exports.value = 42',
+      'dynamic.mjs': "import 'electron/renderer'; export const value = 1",
+      'node_modules/conditional-package/package.json': JSON.stringify({
+        exports: { '.': { import: './import.mjs', require: './require.cjs' } }
+      }),
+      'node_modules/conditional-package/import.mjs': "import 'electron'; export const value = 2",
+      'node_modules/conditional-package/require.cjs': "require('electron/main'); exports.value = 3",
+      'node_modules/desktop-package/package.json': '{"main":"index.cjs"}',
+      'node_modules/desktop-package/index.cjs': "require('electron'); exports.value = 4"
+    })
+    const injectElectron = {
+      name: 'inject-future-electron-import',
+      setup(pluginBuild) {
+        pluginBuild.onLoad({ filter: /future\.cjs$/ }, (args) => ({
+          contents: `require('electron/utility')\n${readFileSync(args.path, 'utf8')}`,
+          loader: 'js'
+        }))
+      }
+    }
+    const entries = ['entry.mjs', 'future.cjs', 'shared.cjs'].map((file) => path.join(root, file))
+    const original = await inspectGraph(entries, {
+      separateEntries: true,
+      plugins: [injectElectron]
+    })
+    const shared = await inspectGraph(entries, { plugins: [injectElectron] })
+
+    expect(fixtureInputs(shared, root)).toEqual(fixtureInputs(original, root))
+    expect(shared.importers).toEqual(original.importers)
+    expect(shared.importers.map((file) => file.slice(file.indexOf(path.basename(root))))).toEqual([
+      `${path.basename(root)}/dynamic.mjs`,
+      `${path.basename(root)}/future.cjs`,
+      `${path.basename(root)}/node_modules/conditional-package/import.mjs`,
+      `${path.basename(root)}/node_modules/conditional-package/require.cjs`,
+      `${path.basename(root)}/node_modules/desktop-package/index.cjs`
+    ])
+    const future = Object.entries(shared.metafile.inputs).find(([file]) =>
+      file.endsWith('/future.cjs')
+    )
+    expect(future[1].imports).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ path: 'electron', kind: 'require-resolve', external: true }),
+        expect.objectContaining({ path: 'electron/main', kind: 'require-resolve', external: true }),
+        expect.objectContaining({ path: './missing.node', external: true })
+      ])
+    )
+  })
+})

config/scripts/check-runtime-electron-ratchet.mjs

@@ -113,18 +113,24 @@ const externalNativeAddons = {
 // Why `plugins`: lets a test add an Electron import to a real file in memory, never on disk.
 export async function collectElectronImporters(entryPoints, { plugins = [] } = {}) {
   const result = await build({
-    entryPoints,
+    // Export every entry through one bundle so shared dependencies are emitted once.
+    stdin: {
+      contents: entryPoints
+        .map(
+          (entry, index) =>
+            `export * as entry_${index} from ${JSON.stringify(path.resolve(ROOT, entry))}`
+        )
+        .join('\n'),
+      resolveDir: ROOT,
+      loader: 'ts',
+      sourcefile: 'runtime-electron-ratchet-entry.ts'
+    },
     bundle: true,
     write: false,
-    // Why outdir with write:false: esbuild refuses multiple entry points without one,
-    // even though nothing is emitted — the metafile is all this reads.
     outdir: path.join(ROOT, 'runtime-electron-ratchet-metafile-only'),
     platform: 'node',
     target: 'node20',
-    // Why splitting: ~2.5k entry points each bundled whole held every copy of the graph in
-    // memory (2GB+), enough to take down a CI runner; shared chunks keep one copy.
-    format: 'esm',
-    splitting: true,
+    format: 'cjs',
     external: EXTERNAL,
     metafile: true,
     absWorkingDir: ROOT,