merge: sync verified updater with v1.5.14

Author: cixiangtao

TASK_PROGRESS.md

@@ -22,7 +22,7 @@
   App bundle ID, App/engine version, and code-signature integrity. Only the
   verified DMG is moved into a private cache and opened; the running App is
   never replaced automatically. Background checks still do not download.
-- [verified] Live v1.5.12 metadata check, shell syntax, `git diff --check`, Swift
+- [verified historical] Live v1.5.12 metadata check, shell syntax, `git diff --check`, Swift
   frontend parse, shared-runtime sync check, 93 portable Node tests, and the
   macOS suite all pass. The macOS suite covers the valid handoff plus checksum,
   identity, URL, duplicate asset, draft Release, cache symlink, oversized
@@ -34,13 +34,144 @@
   `cixiangtao:codex/verified-auto-update`; Draft PR #355 targets
   `Fei-Away/Codex-Dream-Skin:main`:
   https://github.com/Fei-Away/Codex-Dream-Skin/pull/355
-- [current] Waiting for the Draft PR's macOS CI to provide the full
-  SwiftPM/XCTest and packaged-DMG evidence unavailable on this machine.
-- [pending] A real newer public Release does not exist yet, so clicking the
-  menu through a production download/open flow remains a post-release smoke
-  test; automated tests never launch an installer. Keep this PR scoped to the
-  macOS guided handoff and do not fold #276 or #237 into it.
+- [sync 2026-08-14] Upstream advanced by five commits to public v1.5.14 and
+  Draft PR #355 became conflicting. The published PR branch is being repaired
+  with a non-rewriting merge from `upstream/main@95423d8`; no rebase or force
+  push is allowed. The verified download flow is being adapted to the new
+  bilingual macOS catalog while preserving bundled-updater preference and the
+  fail-closed validation contract.
+- [verified 2026-08-14] Both content conflicts are resolved semantically. Live
+  metadata reports current/latest v1.5.14; portable Node passes 104/104, macOS
+  localization passes 6/6, runtime asset sync and both payload checks pass, all
+  six version sources equal 1.5.14, Bash/Swift parse and direct Swift typecheck
+  pass, and the complete macOS wrapper exits 0. The wrapper intentionally skips
+  full-Xcode SwiftPM/XCTest, signed-runtime integration, and Doctor on this host;
+  the guided-DMG positive and fail-closed negative cases still execute.
+- [handoff 2026-08-14] The full merge delta against `upstream/main` is the
+  reviewed result for one focused merge commit and normal push to the existing
+  Draft PR; exact-head upstream CI remains the next external gate.
+- [pending] Require exact-head upstream CI after push. A real newer public
+  Release does not exist yet, so the production menu-to-newer-release download
+  remains a post-release smoke test; automated tests never launch an installer.
+  Keep this PR scoped to the macOS guided handoff and do not fold #276 or #237
+  into it.
 
+## Issue #352 fix and v1.5.14 release (2026-08-12)
+
+- [fix merged] PR #360 (`e3787857953998a1916c39b10942ac6c15978a25`) passed exact-head CI run `31558654733`: Static, macOS repository regressions plus universal DMG, Windows PowerShell 7, and Windows PowerShell 5.1 plus Setup.exe. It was squash-merged with the authorized same-owner review bypass at `2026-08-12T03:06:37Z` as `main@69a5a2e4b68174b1c0c70a2fa62adf1aca1eff2a`.
+- [release branch] This isolated worktree is `codex/release-v1.5.14` from that exact merge commit. Only the six version sources, two version-bound macOS assertions, both platform changelogs, and this durable progress record are in scope. All six version sources equal `1.5.14`.
+- [local gate] Portable Node regressions pass 103/103; runtime asset sync, macOS/Windows payload checks, Node/Bash syntax, version consistency, and `git diff --check` pass. `CODEX_DREAM_SKIN_SKIP_DOCTOR=1 bash macos/tests/run-tests.sh` passes with only the documented full-Xcode XCTest and installed signed Codex Doctor branches skipped.
+- [next] Commit and push the version branch, open a Ready PR, require exact-head CI, merge it, then verify the sole Release workflow creates `v1.5.14` from the exact main merge and publishes non-empty DMG, Setup.exe, and `SHA256SUMS.txt`. Only after public asset/checksum verification will #352 receive the customer reply; keep it open pending field confirmation.
+
+## Issue #352 Windows one-click cold-session baseline (2026-08-12)
+
+- [root cause] The reporter's exact `One-click apply requires an existing
+  verified Dream Skin session.` failure is the cold-session guard introduced
+  by PR #245 (`c44b434`, merged as `71f30f0`), not PR #357. The guard conflicts
+  with the documented one-click start/restart path by rejecting before that
+  path can run. Upstream Issue #235 remains a separate limitation: current
+  Store Codex may still fail to expose a verified CDP endpoint after startup.
+- [local implementation] Isolated worktree
+  `/private/tmp/dreamskin-issue352-baseline`, branch
+  `codex/fix-352-one-click-baseline`, starts from exact public v1.5.13
+  `main@6ae42e645c15f6ac91f5fa54a9c37dbc57af646c`. The Windows community apply
+  path now classifies only a missing session as bootstrap-eligible, releases
+  the operation lock while invoking the existing start-and-verify child, then
+  reacquires the lock and revalidates the complete old-theme baseline and its
+  fingerprint. All other baseline failures remain fail-closed.
+- [safety/order] User confirmation still precedes startup. Old-theme baseline
+  establishment and visible verification precede temporary work-root creation,
+  ZIP download, import, snapshot, or active-theme write. The transaction keeps
+  its second baseline check to reject a concurrent pause/theme/session change.
+  A baseline failure therefore performs zero candidate download/import/write,
+  and no longer claims that nonexistent download files were cleaned up.
+- [tests] Before the final orchestration assertion, focused PowerShell suites passed for community apply, both appearance
+  recovery paths, renderer readiness, verified-skin preservation, config
+  rollback, and the structured start-result contract. All 11 Windows scripts
+  parse; Windows Node tests pass 27/27, tools Node tests 2/2, and the focused
+  macOS ZIP validator passes. The final portable Node set passes 103/103,
+  runtime asset sync, dual payload checks, Node syntax, and `git diff --check`
+  pass. The portable macOS set previously passed 73/74 in one
+  parallel run with only a host subprocess exit 141, and that exact ZIP case
+  passed alone. Full Windows wrapper and one ZIP guard remain native-Windows CI
+  gates because macOS lacks `Get-AuthenticodeSignature` and resolves `/var`
+  through a symlink. This shell no longer has `pwsh` installed, so the final
+  test-only orchestration ordering assertion has not been executed locally and
+  remains an explicit exact-head Windows CI gate.
+- [independent review] Final read-only review found no P0/P1. It confirmed
+  lock release before child startup, bounded lock reacquisition, exact
+  fingerprint revalidation, download-before-baseline prevention, accurate
+  cleanup messaging, and PowerShell 5.1-compatible syntax. Residual evidence
+  required before merge is exact-head Windows PowerShell 5.1/7 CI plus Setup.
+- [current truth] Six implementation/test/documentation/progress files are modified and
+  uncommitted. No push, PR, merge, version bump, tag, Release, or Issue reply
+  exists for this fix yet. Next: rerun the corrected focused/static gates,
+  review the final diff, commit/push, open a Ready PR, and require all four
+  exact-head CI jobs before merge. Then prepare v1.5.14 through the sole Release
+  workflow, verify tag/assets/checksums/public status, and reply to #352 without
+  closing it until the reporter confirms the field fix.
+
+## Issue #354 Windows failed-start appearance recovery (2026-08-12)
+
+- [current local implementation] All prior independent-audit findings are
+  addressed. Startup appearance uses a strict, 64 KiB durable
+  `preparing -> committed` journal before marker/config writes. Recovery is
+  three-way per managed key and marker, preserves a newer post-crash user
+  `system -> light` edit, rejects a journal whose declared changes do not match
+  its snapshots without mutating config/marker/evidence, and normalizes CRLF
+  snapshot line endings before serialization. One-click child completion gets
+  lock timeout plus 300000 ms independent grace, never force-kills a live child,
+  and keeps candidate files coherent for timeout/invalid/blocked/
+  `preserved-rendered` states. A rendered-but-unverified result-token child
+  closes its exact new CDP session and restores appearance before returning
+  `restored`.
+- [focused verification 2026-08-12] Seven PowerShell 7.6.4 suites pass together:
+  `config-startup-rollback`, `start-result-contract`, CDP-failure recovery,
+  post-launch recovery, renderer readiness, verified-skin preservation, and
+  `community-theme-link`. Executable coverage includes marker/config hard-stop
+  windows, tampered journals, CRLF quoted keys and dollar-bearing values,
+  post-crash user edits, 480000 ms parent wait, no force-kill/result cleanup
+  while the child remains live, preserved-rendered file coherence, and the full
+  outer child catch/writer/reader category path.
+- [complete local gate 2026-08-12] Portable Node passes 103/103 (macOS 74,
+  Windows 27, tools 2). All 23 PowerShell files parse and satisfy the PS5.1
+  non-ASCII UTF-8 BOM policy; all Node and Bash syntax checks, both platform
+  payload checks, runtime asset sync, and `git diff --check` pass. The full
+  `CODEX_DREAM_SKIN_SKIP_DOCTOR=1 bash macos/tests/run-tests.sh` wrapper exits
+  0, including signed-runtime switch and runtime-state integration. Native
+  SwiftPM/XCTest is skipped because this host lacks a matching full Xcode
+  platform, and Doctor is explicitly skipped because no installed signed Codex
+  app is available. Native Windows PowerShell 5.1/7 and Setup remain CI gates.
+- [independent final audit] Read-only review of the complete local diff found no
+  remaining P0/P1. The prior parent hard-kill and `preserved-rendered` mixed-state
+  blockers are closed by executable production-helper/result-path coverage.
+  Non-blocking P2 residuals are documented: same-user coherent rewriting of the
+  entire local journal is outside corruption detection; the explicitly invoked
+  test/debug-only `-ForegroundInjector` mode has a narrow pre-injector committed
+  window and no production caller; and a concurrent manual action choosing
+  byte-identical theme content is indistinguishable from no superseding change.
+- [remote state] PR #351 is squash-merged as
+  `main@9e6798700c0e35be0713135ebd9b3a6f01583499`; exact-head run
+  `31522162828` and post-merge run `31523222468` passed all four client CI
+  jobs. Draft PR #357 targets that `main` from
+  `codex/fix-354-appearance-rollback@fa3e53822a4158d56dc1ae10efa8f288b2d73a88`.
+  Exact-head run `31531028135` passed Static, macOS/DMG, Windows PowerShell 7,
+  and Windows PowerShell 5.1/Setup.
+- [pushed checkpoint] The 15 implementation, test, and Windows documentation
+  files are committed as `54933c3678034333a4e00c0a93c9d4da5d2ded6d`; the
+  first verification checkpoint is `8ad35f2`. Both were pushed to
+  `codex/fix-354-appearance-rollback` for Draft PR #357. Run `31531028135`
+  remains historical evidence for older head `fa3e538`, not the new changes.
+- [scope] The PR fixes only caught Windows failed-start partial appearance,
+  rollback ownership/concurrency, and bounded one-click diagnostics. It does
+  not claim that official Store Codex `26.803.5235.0` restored a supported CDP
+  endpoint. User authorization covers scoped commit, push, PR merge, and issue
+  handling, but not a version, tag, Release, deployment, or external config.
+- [remaining] Push this progress-only checkpoint and update the PR body. Require
+  all four CI jobs green on the resulting exact head before marking #357 Ready
+  and squash-merging with head protection. Verify post-merge `main` CI, then
+  update only #235, #352, and #354. Native Windows 5.1/7 and Setup are CI-only
+  evidence on this macOS host.
 ## Client release v1.5.12 (2026-08-08)
 
 - [scope] Reviewed and merged 10 pending community/self PRs that had accumulated