feat(sync): bound idle daemon memory with FSEvents and worker passes

- fix(sync): distinguish reused virtual source paths
- fix(sync): preserve reconciled session ownership
- fix(sync): persist tombstone cache invalidation
- db: drop legacy source-baseline column migration
- sync,parser,db,cmd: cut dead code and test-only surface
- fix(sync): keep hermes archive identity stable across parses
- test(cmd): export USERPROFILE to the spawned sync worker
- fix(db): drain in-flight connections in CloseConnections
- fix(db): hold db.mu through the CloseConnections drain
- fix(db): drain the writer pool before CloseWriter returns
- fix(db): retain undrained writer pools across CloseWriter retries
- fix(cmd): restore serve console output around the startup worker
- fix(db): propagate CloseConnections drain timeout as an error
- fix(cmd): reload skip cache inside the worker pass exclusive section
- fix(sync): tombstone virtual members removed from live containers
- fix(sync): run archive-scale passes on an unthrottled retention budget
- perf(parser): build compact claude entries in one gjson pass
- fix(db): restrict virtual-member range to single-segment suffixes
- fix(server): route archive-scale daemon pushes through the worker resync runner
- fix(duckdb): make Store.Close wait for in-flight mirror swap retirement
- fix(parser): surface hermes profiles-container enumeration failures
- fix(db): drain undrained pools in Close and keep flock on failure

- test(db): pin single-segment virtual-member filtering in source path hints
- fix(sync-worker): keep write-owner flock when database close fails
- fix(duckdb): make Store.Close wait for in-flight replacement checks
- fix(sync): reopen writer after a failed close instead of stranding writes
- fix(db): diff source-baseline replacement instead of rewriting every row
- fix(sync): abort resync swap when the replacement database fails to close
- fix(serve): defer startup maintenance on the worker startup path
- fix(serve): keep fallback semantics when worker handoff fails pre-launch
- perf(sync): size per-pass batch structures by changed set
- fix(watch): scope full watcher recovery to available roots
- perf(sync): let hermes member hash establish freshness on container change
- fix(watch): defer present roots overlapping a deferred scope
- fix(watch): defer unavailable provider roots in rename promotion
- fix(pg-watch): own deferred scopes with an authoritative poller
- fix(sync): only promote container trust for discovered sources
- fix(worker): apply classifier config in the resync-build worker
- fix(watch): defer broken symlink root scopes from reconciliation
- fix(parser): stream RooCode discovery and propagate traversal errors
- perf(sync): build VS Copilot discovery path set only when consumed
- fix(watch): register symlink polling gates when watcher init fails
- fix(watch): register root-keyed polling gates when watcher init fails
- fix(watch): gate every root's scopes when watcher init fails
- fix(watch): register probe gates before the ungated fallback poll
- test(cmd): create symlink targets before links for Windows
- fix(parser): propagate symlink resolution failures in streaming discovery
- docs(db): document claude_linear_parse as deliberately unmirrored
- fix(parser): propagate symlink resolution failures in remaining streaming discoverers
- fix(serve): release startup maintenance from foreground resync fallbacks
- fix(parser): force full parse when a queued command masks the split check
- fix(worker): drain worker stdout after scanner errors before Wait
- fix(parser): follow symlinked OpenClaude project dirs in streaming discovery
- fix(serve): release startup maintenance when reconciliation already recorded
- fix(parser): gate queued-command full-parse fallback on the stored tail id
- docs(parser): record OpenClaude project-dir symlink reverification
- fix(sync): restore original archive state when a resync swap fails

Author: wesm

.github/workflows/ci-macos-main.yml

@@ -0,0 +1,37 @@
+name: CI (macOS)
+
+on:
+  # Persistent self-hosted runners must never be selectable from a workflow
+  # definition controlled by a pull request. The ci-runners group must allow
+  # this exact workflow path only from refs/heads/main.
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test-macos-fsevents:
+    name: Go Test (macOS FSEvents)
+    runs-on:
+      group: ci-runners
+      labels: [self-hosted, macOS, ARM64]
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
+        with:
+          go-version-file: go.mod
+
+      - name: Restore pricing snapshot
+        run: go run ./internal/pricing/cmd/litellm-snapshot -restore
+
+      - name: Run focused macOS FSEvents tests
+        run: CGO_ENABLED=1 go test -tags "fts5" ./internal/fsevents ./internal/sync ./internal/db ./cmd/agentsview -count=1 -timeout=20m

.github/workflows/desktop-macos-main.yml

@@ -1,8 +1,8 @@
 name: Desktop Artifacts (macOS)
 
 on:
-  # This workflow is the only workflow allowed to use the ci-runners group.
-  # The organization runner-group policy must pin access to this path on main.
+  # macOS self-hosted workflows are push-only for main. The organization
+  # runner-group policy must pin access to their exact workflow paths on main.
   push:
     branches: [main]
     paths: