sync: upstream v2.47.0 with verified CI repairs

.github/policies/ci-paths.yml

@@ -10,6 +10,10 @@ ci:
   - 'scripts/**'
   - 'gui/**'
   - 'integrations/replit-gateway/**'
+  - 'docker/**'
+  - 'Dockerfile'
+  - 'compose.yaml'
+  - '.dockerignore'
   - 'assets/**'
   - '.gitattributes'
   - '.npmignore'

.github/workflows/ci.yml

@@ -482,6 +482,7 @@ jobs:
         run: |
           bun x tsc --noEmit
           bun x tsc --noEmit -p tests/tsconfig.doctor-service-memory-contract.json
+          bun x tsc --ignoreConfig --noEmit --strict --target ESNext --module ESNext --moduleResolution bundler --types bun-types --skipLibCheck scripts/ci/docker-smoke.ts
 
       - name: Install replit-gateway companion
         run: cd integrations/replit-gateway && bun install --frozen-lockfile
@@ -943,6 +944,28 @@ jobs:
             bun run scripts/keyring-smoke.ts
           '
 
+  # Exercise the source-build Compose contract, including real volume reuse.
+  # Host fixtures cannot prove image construction or container recreation.
+  docker-smoke:
+    name: docker smoke
+    needs: changes
+    if: >-
+      (github.event_name != 'pull_request' && github.event_name != 'merge_group') ||
+      needs.changes.outputs.ci == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup project Bun
+        uses: ./.github/actions/setup-project-bun
+
+      - name: Build, start, and recreate the container
+        run: bun scripts/ci/docker-smoke.ts
+
   npm-global-smoke:
     name: npm-global ${{ matrix.os }}
     needs: changes
@@ -1009,7 +1032,7 @@ jobs:
     name: ci
     if: always()
     # Every producer, including the ones that only feed other jobs.
-    needs: [changes, test, storage-policy, api-usage, serial-load-sensitive, publish-test-timings, gates, platform-macos, platform-macos-full, platform-windows, keyring-smoke, npm-global-smoke]
+    needs: [changes, test, storage-policy, api-usage, serial-load-sensitive, publish-test-timings, gates, platform-macos, platform-macos-full, platform-windows, keyring-smoke, docker-smoke, npm-global-smoke]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:

.github/workflows/release.yml

@@ -443,6 +443,7 @@ jobs:
           }
 
       - name: Publish (or dry-run)
+        id: publication
         env:
           DRY_RUN: ${{ env.DISPATCH_DRY_RUN }}
           NPM_DIST_TAG: ${{ env.DISPATCH_TAG }}
@@ -461,39 +462,55 @@ jobs:
             npm pack --dry-run
           elif [ "$PUBLISH_NEEDED" != "true" ]; then
             echo "::notice::Exact npm version is already published from ${GITHUB_SHA}; resuming post-publish metadata only"
+            echo "published=true" >> "$GITHUB_OUTPUT"
           elif [ -z "$DISPATCH_CANDIDATE_RUN_ID" ]; then
             echo "::warning::transitional manual release is building locally; migrate this caller to candidate IDs"
             npm publish --tag "$NPM_DIST_TAG" --access public
+            echo "published=true" >> "$GITHUB_OUTPUT"
           elif [ "$DRY_RUN" = "true" ]; then
             echo "::notice::DRY RUN — validating exact candidate tarball, not publishing"
             npm publish "$package_file" --tag "$NPM_DIST_TAG" --access public --ignore-scripts --dry-run
           else
             npm publish "$package_file" --tag "$NPM_DIST_TAG" --access public --ignore-scripts
+            echo "published=true" >> "$GITHUB_OUTPUT"
           fi
 
-      # Confirm the registry actually has the new version (real publishes only).
+      # Publication is acknowledged before registry reads, which can lag or fail.
+      # Recover only observation failures in this run; never retry npm publish.
       - name: Post-publish registry smoke
-        if: ${{ env.DISPATCH_DRY_RUN != 'true' }}
+        id: registry-smoke
+        if: ${{ env.DISPATCH_DRY_RUN != 'true' && steps.publication.outputs.published == 'true' }}
         env:
           RELEASE_VERSION: ${{ env.DISPATCH_VERSION }}
+          PUBLISHED: ${{ steps.publication.outputs.published }}
         run: |
+          set -euo pipefail
+          test "$PUBLISHED" = "true" || {
+            echo "::error::No successful publication receipt; refusing registry recovery"
+            exit 1
+          }
           pkg_name="$(node -p "require('./package.json').name")"
-          for attempt in $(seq 1 30); do
-            if VERSION=$(npm view "${pkg_name}@${RELEASE_VERSION}" version 2>/dev/null); then
+          for attempt in $(seq 1 6); do
+            if VERSION=$(timeout --kill-after=2s 10s npm view "${pkg_name}@${RELEASE_VERSION}" version --fetch-retries=0 --fetch-timeout=8000 2>/dev/null); then
+              if [ "$VERSION" != "$RELEASE_VERSION" ]; then
+                echo "::error::Registry returned an unexpected version; refusing to create a release"
+                exit 1
+              fi
               echo "registry version=$VERSION"
-              test "$VERSION" = "$RELEASE_VERSION"
-              npm dist-tag ls "$pkg_name"
+              echo "verification=verified" >> "$GITHUB_OUTPUT"
+              echo "Registry verified ${pkg_name}@${RELEASE_VERSION}." >> "$GITHUB_STEP_SUMMARY"
+              timeout --kill-after=2s 10s npm dist-tag ls "$pkg_name" --fetch-retries=0 --fetch-timeout=8000 || echo "::warning::Could not read npm dist-tags; exact version was verified"
               exit 0
             fi
-            echo "::notice::${pkg_name}@${RELEASE_VERSION} not visible in npm registry yet (attempt $attempt/30)"
-            sleep 10
+            echo "::notice::Registry lookup not confirmed (attempt $attempt/6)"
+            if [ "$attempt" -lt 6 ]; then sleep 5; fi
           done
-          echo "::error::npm registry smoke failed after 30 attempts"
-          npm view "$pkg_name" versions dist-tags --json || true
-          exit 1
+          echo "verification=pending" >> "$GITHUB_OUTPUT"
+          echo "::warning::npm publish succeeded, but registry verification remains pending; continuing GitHub release creation without republishing"
+          echo "Publication acknowledged for ${pkg_name}@${RELEASE_VERSION}; registry verification pending after bounded reads. Inspect the registry before announcing availability. Do not republish this version." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Create GitHub release
-        if: ${{ env.DISPATCH_DRY_RUN != 'true' }}
+        if: ${{ env.DISPATCH_DRY_RUN != 'true' && steps.publication.outputs.published == 'true' }}
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_VERSION: ${{ env.DISPATCH_VERSION }}