chore: sync main into phase35 (sync 1)

.github/CONTRIBUTING.md

@@ -29,7 +29,6 @@ pnpm dev
 Ordinary installs include native optional dependencies for the current OS and CPU only.
 Before a cross-architecture build (including `pnpm build:mac`, which produces both x64 and
 arm64 artifacts by default), run `pnpm install:release` to add the other CPU's variants.
-See [the install policy](../docs/reference/pnpm-install-policy.md).
 
 ## Branch Naming
 

.github/pull_request_template.md

@@ -11,6 +11,7 @@
 <!-- What problem does this solve, and why is this approach better than the alternatives you considered? -->
 
 ## Linked Issue
+
 _If you do not have one and are an outside contributors, your PR **wiil** be ignored. Refs is not sufficient. Link an actual issue_
 <!-- Link the issue this PR addresses, there should ALWAYS be one (for outside contributors) -->
 <!-- SPECIAL CASE: If you are a maintainer (member of stablyai org) AVOID opening needless issues. Only attach pre-existing ones -->
@@ -39,7 +40,7 @@ Fixes #
 
 ## Agent skill upstream boundary
 
-- [ ] Not applicable, or this change follows `docs/reference/agent-skill-sharing-upstream-boundary.md` and copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.
+- [ ] Not applicable, or this change copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.
 
 ## Notes
 

.github/workflows/ci-cache-warmup.yml

@@ -14,7 +14,7 @@ on:
       - '.github/actions/prepare-native-runtime/**'
       - '.github/actions/prepare-git-compatibility/**'
       - '.github/actions/prepare-headless-compiler/**'
-      - 'config/scripts/headless-detector-compiler-cache*'
+      - 'config/scripts/headless-detector-compiler-cache.mjs'
       - '.github/actions/prepare-linux-package-fixture/**'
       - 'config/docker/headless-serve-shutdown/**'
       - 'config/docker/cli-launch-contract/**'
@@ -44,12 +44,11 @@ on:
       - '.github/workflows/ci-cache-warmup.yml'
       - '.github/actions/prepare-git-compatibility/**'
       - '.github/actions/prepare-headless-compiler/**'
-      - 'config/scripts/headless-detector-compiler-cache*'
+      - 'config/scripts/headless-detector-compiler-cache.mjs'
       - '.github/actions/prepare-linux-package-fixture/**'
       - 'config/docker/headless-serve-shutdown/**'
       - 'config/docker/cli-launch-contract/**'
       - 'config/docker/daemon-shutdown-descendants/**'
-      - 'config/scripts/ci-cache-warmup-workflow.test.mjs'
 
 permissions:
   contents: read

.github/workflows/cloud-deploy-relay-production-same-cap-job.yml

@@ -30,7 +30,8 @@ jobs:
     if: ${{ github.ref == 'refs/heads/main' }}
     runs-on: blacksmith-2vcpu-ubuntu-2204
     # The pre-drain sample adds 3-8 min (20 at most); a timeout cancels the job and skips the failsafe.
-    timeout-minutes: 90
+    # A 1200000 drain step alone may take 50 min.
+    timeout-minutes: 120
     environment: production
     env:
       GCP_PROJECT_ID: onorca-cloud
@@ -53,8 +54,9 @@ jobs:
       # /v1/assign at hosts / window and is re-placed through the director's drain-return
       # lane. The wave validator admits only its closed set, and anything below the 300000
       # default only on US general cells: Asia drains are bound by their targets' accept
-      # rate. The transition wait below is the 15-min migration lease plus this window. A
-      # cell on an older image drains at once.
+      # rate. The transition wait below is the 15-min migration lease plus this window, plus
+      # its excess over 300000, since restart-safe waits a window of quiet after the drain. A
+      # cell on an older image drains at once, or refuses a window above 300000.
       DRAIN_PACE_WINDOW_MS: ${{ inputs.drain-pace-window-ms }}
     steps:
       - name: Require exact reusable-workflow configuration
@@ -499,8 +501,8 @@ jobs:
         if: ${{ inputs.mode == 'verify' }}
         run: echo 'Exact same-cap rollback point verified.'
 
-      # The sample can age the first one-hour token by up to 20 min; the drain's 20-min
-      # restart-safe wait gets a fresh one.
+      # The sample can age the first one-hour token by up to 20 min; the drain's restart-safe
+      # wait (20 min at the default pace, 50 at the slowest) gets a fresh one.
       - id: drain-auth
         if: ${{ inputs.mode != 'verify' && env.ROLLBACK_RESUME != 'true' }}
         uses: google-github-actions/auth@v2
@@ -517,6 +519,11 @@ jobs:
         env:
           ORCA_RELAY_ADMIN_ID_TOKEN: ${{ steps.drain-auth.outputs.id_token }}
         run: |
+          # Before any mutation: a cell whose image caps the pace below this one stops untouched.
+          node dev/scripts/prepare-relay-production-capacity-canary.mjs \
+            --director-origin "${DIRECTOR_ORIGIN}" --cell-origin "${CELL_ORIGIN}" \
+            --cell-id "${TARGET_CELL_ID}" --approved-cells same-cap --mode pace-check \
+            --pace-window-ms "${DRAIN_PACE_WINDOW_MS}"
           # Opens the window the report-only shadow health gate below judges this cell over.
           echo "drain-started-at=$(date -u +%FT%TZ)" >> "${GITHUB_OUTPUT}"
           echo "MUTATION_STARTED=true" >> "${GITHUB_ENV}"
@@ -555,7 +562,7 @@ jobs:
             --heartbeat either --admission migration-only --draining required \
             --activity restart-safe --expected-image-digests "${PREDECESSOR_IMAGE_DIGEST}" \
             --pace-window-ms "${DRAIN_PACE_WINDOW_MS}" \
-            --timeout-ms "$((900000 + DRAIN_PACE_WINDOW_MS))"
+            --timeout-ms "$((900000 + DRAIN_PACE_WINDOW_MS + (DRAIN_PACE_WINDOW_MS > 300000 ? DRAIN_PACE_WINDOW_MS - 300000 : 0)))"
           echo "drain-settled-at=$(date -u +%FT%TZ)" >> "${GITHUB_OUTPUT}"
 
       - id: capacity-auth
@@ -709,19 +716,31 @@ jobs:
         env:
           ORCA_RELAY_ADMIN_ID_TOKEN: ${{ steps.post-auth.outputs.id_token }}
         run: |
-          # A single transient 5xx (LB warm-up behind a fresh instance) must not
-          # fail a canary; 4xx (auth, generation mismatch) still fails fast.
+          # Rides out one DB stall: 5-7 s, then readiness grace and two 10 s LB
+          # health checks (c18, 10-07 18:49Z: 503 "no healthy upstream", healthy
+          # 16 s later). A cell still down after 60 s fails; other 4xx fail fast.
+          # Retried in this loop: the runner's 7.81 client (Ubuntu 22.04) never
+          # retries under --fail-with-body, so its --retry flags were inert.
           admin_post() {
-            local out="${RUNNER_TEMP}/$1.json"
-            if ! curl --fail-with-body --max-time 30 \
-              --retry 3 --retry-delay 2 --retry-connrefused --output "${out}" \
-              --request POST "$2" \
-              --header "Authorization: Bearer ${ORCA_RELAY_ADMIN_ID_TOKEN}" \
-              --header 'Content-Type: application/json' --data "$3"; then
-              cat "${out}" >&2
-              return 1
-            fi
-            cat "${out}"
+            local out="${RUNNER_TEMP}/$1.json" window=60 delay=5 status
+            local deadline=$((SECONDS + window))
+            while true; do
+              # A refused or timed-out attempt writes no body; never report the last one's.
+              rm -f "${out}"
+              status="$(curl --silent --show-error --max-time 30 --output "${out}" \
+                --write-out '%{http_code}' --request POST "$2" \
+                --header "Authorization: Bearer ${ORCA_RELAY_ADMIN_ID_TOKEN}" \
+                --header 'Content-Type: application/json' --data "$3")" || status=000
+              case "${status}" in
+                2??) cat "${out}"; return 0 ;;
+                000|408|429|5??) ((SECONDS + delay < deadline)) || break ;;
+                *) break ;;
+              esac
+              sleep "${delay}"
+            done
+            echo "admin_post $1: HTTP ${status}" >&2
+            cat "${out}" >&2 2>/dev/null || true
+            return 1
           }
           node dev/scripts/verify-relay-capacity-transition.mjs \
             --director-origin "${DIRECTOR_ORIGIN}" --cell-origin "${CELL_ORIGIN}" \
@@ -824,8 +843,8 @@ jobs:
         # read cost its full retry budget and can push the job past timeout-minutes, and a
         # cancelled job takes the whole wave with it. A healthy gate is already minutes of
         # serial reads, so both bounds sit above that: the script settles at seven minutes and
-        # reaching this eight is the pathological case. Eight on top of a ~14-minute cell still
-        # leaves the job's 90 minutes intact.
+        # reaching this eight is the pathological case. Eight on top of a cell of ~14 minutes
+        # (~45 at the slowest pace) still leaves the job's 120 minutes intact.
         timeout-minutes: 8
         env:
           DRAIN_STARTED_AT: ${{ steps.drain.outputs.drain-started-at }}

.github/workflows/cloud-deploy-relay-production-same-cap.yml

@@ -54,11 +54,11 @@ on:
         required: true
         type: string
       drain-pace-window-ms:
-        description: Window the cell spreads its drain over; below 300000 only for US general cells, named in the confirmation
+        description: Window the cell spreads its drain over; below 300000 only for US general cells; any other value named in the confirmation
         required: true
         default: '300000'
         type: choice
-        options: ['300000', '60000', '30000']
+        options: ['300000', '60000', '30000', '900000', '1200000']
       canary-run-id:
         description: Successful same-code canary in this rehome control generation; reusable across batches
         required: false

.github/workflows/e2e.yml

@@ -329,10 +329,12 @@ jobs:
               . != "tests/e2e/ssh-lost-kill-tab-resurrection.spec.ts" and
               . != "tests/e2e/ssh-pi-compatible-agent-title.spec.ts" and
               . != "tests/e2e/ssh-port-forward-lifecycle.spec.ts" and
+              . != "tests/e2e/ssh-reattach-home-partition.spec.ts" and
               . != "tests/e2e/ssh-reconnect-tab-destruction.spec.ts" and
               . != "tests/e2e/ssh-restart-tab-accumulation.spec.ts" and
               . != "tests/e2e/ssh-skill-installation.spec.ts" and
               . != "tests/e2e/ssh-stale-resume-execution-host-scope.spec.ts" and
+              . != "tests/e2e/ssh-startup-local-shadow.spec.ts" and
               . != "tests/e2e/ssh-terminal-window-wake-stale-grid-repro.spec.ts" and
               . != "tests/e2e/terminal-inline-images-ssh.spec.ts" and
               . != "tests/e2e/ssh-docker-watcher-isolation.spec.ts" and

.github/workflows/pr.yml

@@ -432,6 +432,8 @@ jobs:
           PREFLIGHT_PHASE_SELECTED: ${{ needs.code_paths.outputs.typecheck == 'true' }}
           PREFLIGHT_PRIOR_SUCCESS: ${{ job.status == 'success' }}
           ORCA_UNIT_SELECTION_MODE: ${{ vars.ORCA_UNIT_SELECTION_MODE || 'shadow' }}
+          # Set the repository variable to '5' to roll back full PR shards.
+          ORCA_UNIT_FULL_SHARD_COUNT: ${{ vars.ORCA_UNIT_FULL_SHARD_COUNT || '10' }}
         run: |
           if [ "$PREFLIGHT_PHASE_SELECTED" != true ] || [ "$PREFLIGHT_PRIOR_SUCCESS" != true ]; then exit 0; fi
           node config/scripts/ci-unit-plan.mjs
@@ -1085,7 +1087,15 @@ jobs:
       - name: Install Linux package tooling
         id: linux-package-tools
         background: true
-        run: sudo apt-get update && sudo apt-get install -y cpio rpm
+        run: |
+          # Use the shell lane's bounded refresh; required tooling installation stays fatal.
+          sudo tee /etc/apt/apt.conf.d/99-orca-package-tools >/dev/null <<'APTCONF'
+          Acquire::http::Timeout "15";
+          Acquire::https::Timeout "15";
+          Acquire::Retries "1";
+          APTCONF
+          timeout 120 sudo apt-get update || true
+          timeout 300 sudo apt-get install -y cpio rpm
 
       - name: Build package inputs
         run: |
@@ -1262,6 +1272,7 @@ jobs:
           src/main/wsl/wsl-runner.test.ts
           src/main/wsl/wsl-guest-environment.test.ts
           src/main/wsl/wsl-executable-path.win32.test.ts
+          src/main/claude-accounts/claude-profile-history-windows.test.ts
           src/main/wsl/wsl-w1-w3-contract.test.ts
           src/shared/source-scan/source-tree-scan.test.ts
           src/main/cli/wsl-cli-powershell-boundary.test.ts

.gitignore

@@ -90,10 +90,9 @@ design-docs/
 # Machine-local agent hook endpoint files may contain auth tokens.
 /agent-hooks/
 
-# Local-only design/planning docs (not checked in), including most of docs/reference/.
+# Local-only design/planning docs (not checked in).
 # Durable docs that should be tracked must live in one of the allow-listed
-# locations below (assets, readme, STYLEGUIDE, mobile terminal shortcut bar,
-# and the tracked reference docs linked from AGENTS.md / README.md).
+# locations below (assets, readme, STYLEGUIDE, and mobile terminal shortcut bar).
 docs/**
 !docs/
 # The deployable docs app is source, not local engineering notes.
@@ -117,40 +116,6 @@ docs/**
 !docs/audits/crashpad-read-limit/source-hashes.json
 !docs/agent-skill-sharing-implementation-checklist.md
 !docs/mobile-terminal-shortcut-bar.md
-!docs/reference/
-!docs/reference/agent-pty-transcript-capture.md
-!docs/reference/agent-session-search-query-tuning.md
-!docs/reference/agent-session-search-contract.md
-!docs/reference/agent-status-store.md
-!docs/reference/antigravity-readiness-evidence.md
-!docs/reference/antivirus-prerelease-clearance.md
-!docs/reference/cline-and-prime-agent-readiness-evidence.md
-!docs/reference/git-compatibility.md
-!docs/reference/headless-linux-server.md
-!docs/reference/ime-regression-checklist.md
-!docs/reference/jcode-hook-events.md
-!docs/reference/linux-glibc-compatibility.md
-!docs/reference/macos-press-and-hold.md
-!docs/reference/orcad-operations.md
-!docs/reference/pnpm-install-policy.md
-!docs/reference/relay-grace-time-reconfiguration.md
-!docs/reference/windows-cmd-shim-resolution.md
-!docs/reference/windows-daemon-host-relocation.md
-!docs/reference/windows-edr-posture.md
-!docs/reference/windows-msys-job-breakaway.md
-!docs/reference/windows-process-enumeration.md
-!docs/reference/wsl-runner-verification.md
-!docs/reference/remote-wire-compatibility.md
-!docs/reference/renderer-agent-status-performance.md
-!docs/reference/ssh-execution-boundary.md
-!docs/reference/ssh-host-key-verification.md
-!docs/reference/ssh-reconnect-source-recovery.md
-!docs/reference/windows-setup-shell.md
-!docs/reference/windows-terminal-shell-selection.md
-!docs/reference/worktree-scan-fingerprint.md
-!docs/reference/wsl-command-execution.md
-!docs/reference/wsl-probe-failure-semantics.md
-!docs/reference/xterm-patch-regeneration.md
 
 # Stably CLI (only docs/ are tracked)
 .stably/*