docs: record final PI release proof evidence

.project-docs/30-worklog/tasks/20260824-pi-release-proof-3e725ac7.md

@@ -8,7 +8,7 @@
 - Worktree: D:\Datas\OthersProjects\makelore-pi-release-proof-3e725ac7
 - Base commit: 977445ba450f4ad32b6e6db2caf048517513ab39
 - Owner: codex-root
-- Status: In Progress (planner Spec review fixes required)
+- Status: Ready for Planner Re-review (platform release blockers remain)
 
 ## Scope
 
@@ -67,97 +67,111 @@
 
 ## Outcome
 
-- Candidate `a795e0c970e6c9fac5609bea5ceda2517bf3ca48` contains the
-  final-product Pi artifact verifier, packaged Pi/provider-shaped smoke, Spec
-  17.3 performance runner, expanded Electron E2E, release runbook, synchronized
-  README, Linux package metadata fix, and Linux compatibility-executable fix.
-- Windows x64 and Linux x64 final unpacked products passed Pi `0.84.2`
-  production-closure, resource, lifecycle, controlled provider-shaped,
-  extension/subagent, concurrency/isolation, and performance qualification.
-  Windows NSIS and Linux x64 AppImage/deb distributables were produced.
-- Product-owned OpenCode resource paths and development-machine path residue are
-  empty. OpenCode-named files retained under the exact pinned upstream
-  `@earendil-works/pi-ai/dist/providers` closure are reported separately because
-  Pi statically imports them; deleting them would corrupt the pinned runtime.
-- The implementation is ready for PI-160 integration, but PI-150 remains blocked
-  from `Done` and the product is not cross-platform release-ready because macOS
-  x64/arm64 validation was explicitly skipped. QG-004/QG-005 also remain
-  `Explicitly Waived / Accepted Risk`, with `realTurnVerified=false`.
+- Code candidate `df1151b5eb8588f126ccbee98cb7bf0b46285659` fixes every
+  implementation defect from the planner's first Spec review. The packaged
+  extension/subagent proof now executes Main and runtime code from final
+  `app.asar`/`resources/pi-runtime`; cold and warm prompt samples are distinct
+  and include resources-ready, worker-spawn, RPC-ready, session-open,
+  prompt-accepted, and agent-settled milestones; one packaged run holds four
+  parent workers plus four child workers while exercising the real UI and then
+  proves process/permit/dispatch/lease cleanup; the verifier enumerates ASAR
+  internals; and a Linux x64 RPM is generated and inspected.
+- Windows x64 and WSL2 Linux x64 final products passed Pi `0.84.2`
+  production-closure, packaged composition, lifecycle, controlled
+  provider-shaped, extension/subagent, 4+4 pressure/isolation, cleanup, and
+  performance qualification. Windows NSIS and Linux AppImage/deb/RPM
+  distributables were produced.
+- Full ASAR enumeration found zero product-owned OpenCode paths. Exact matches
+  under the pinned upstream `@earendil-works/pi-ai/dist/providers/opencode*`
+  closure remain classified separately because Pi imports them; they are not
+  Makelore-owned runtime residue.
+- The five requested fixes are ready for planner re-review, but PI-150 remains
+  blocked from `Done`, PI-160 must not start, and the product is not
+  cross-platform release-ready: macOS x64/arm64 was explicitly skipped and no
+  independent native non-WSL Linux desktop/compositor acceptance run exists.
+  QG-004/QG-005 remain `Explicitly Waived / Accepted Risk`, with
+  `realTurnVerified=false`.
 
 ## Verification
 
-- Exact pnpm `10.33.4` frozen install passed on Windows (997 packages) and WSL2
-  Ubuntu 24.04 x64 (999 packages); lockfile remained unchanged.
+- Exact pnpm `10.33.4` frozen install passed on Windows and WSL2 Ubuntu 24.04
+  x64; the candidate stayed clean at `df1151b` and the lockfile change is limited
+  to the direct `@electron/asar@3.4.1` verifier dependency.
 - Candidate-final Windows checks passed: `pnpm run typecheck`; `pnpm run
   lint:check` with 0 errors and five pre-existing warnings; `pnpm test` with 178
-  files, 1504 passed and two skipped; `pnpm run test:e2e` with 24/24; production
-  Vite/Electron build passed as part of packaging and E2E.
-- `pnpm run package:win` passed. NSIS
-  `Makelore-2.0.0-win-x64.exe` is 211,835,138 bytes with SHA-256
-  `0DB9D811058595E91BED9FFE4FFF1E94D170FDAC411D1D54CD9F6856FCA60521`.
-  The existing packaged-runtime verifier passed for Electron `43.4.0`, Node
-  `24.18.1`, bundled Python/uv/npm, native modules, and Unicode copy behavior.
-- Windows final-product Pi artifact verifier passed with five samples: 130
-  applicable production packages, six assets, four packaged Skills, no missing
-  or relocated packages, no product-owned OpenCode paths, no development path
-  residue, cold/warm ready p95 `653/628 ms`, and exit p95 `20 ms`.
-- Windows packaged smoke passed all coverage flags for session, prompt, tool,
-  abort, settle, reopen, two-worker overlap/isolation, provider abort isolation,
-  subagent, and shutdown. Each of the four controlled protocol shapes issued
-  four image requests; real Provider verification remained false by waiver.
-- Windows Spec 17.3 performance report passed all ten scenarios and all budgets
-  at clean commit `a795e0c`: cold/warm RPC p95 `626/627 ms`, Composer p95 `6
-  ms`, Renderer first-commit p95 `33.8181 ms` (max `54.6524 ms`), exit p95 `20
-  ms`, RSS p95 `126536 KiB`, and 100 runtime patch items transported in 20
-  batches/21 SSE frames/20 Renderer transactions.
-- Linux x64 final product was built under WSL2 kernel
-  `6.6.87.2-microsoft-standard-WSL2`. AppImage SHA-256 is
-  `8b5a23de48670bd6edfac93ef74c5ebd58645c609ccd2a504d0d94ce04a18b06`;
-  deb SHA-256 is
-  `d6f5b08dec3ffc39c1944aeb38b1e8fa6fb7e1c6fcb72092c66d7c918a5590c5`.
-  The Linux compatibility executable is intentionally `niancode`, preserving
-  the project identifier contract; the verifier default and unit test now match
-  the actual electron-builder output.
-- Linux final-product artifact verification and packaged smoke passed with five
-  samples and the same coverage/waiver contract. The 131-package/six-asset
-  closure had no missing/relocated package, no product-owned OpenCode path, and
-  no development path residue. Cold/warm ready p95 was `447/445 ms` in artifact
-  verification and `467/463 ms` in smoke.
-- Linux Spec 17.3 performance report passed all ten scenarios and all budgets at
-  clean commit `a795e0c`: cold/warm RPC p95 `452/474 ms`, Composer p95 `5 ms`,
-  Renderer first-commit p95 `27.5318 ms`, exit p95 `8 ms`, and RSS p95 `169668
-  KiB`. This is WSL2 final-product/CLI/Electron-probe evidence, not an
-  independent Linux desktop-compositor GUI acceptance run.
-- The aggregate `package:linux` command initially hit transient GitHub EOFs;
-  retry produced x64 AppImage/deb. Its rpm sub-target did not complete because
-  the isolated Ubuntu environment lacked `rpmbuild`; an attempt to install the
-  standard `rpm` package was stopped after the Ubuntu mirror stalled. No x64 rpm
-  artifact is claimed. This does not invalidate the qualified unpacked product,
-  AppImage, or deb, but a later RPM release must run on a prepared Linux builder.
+  files, 1505 passed and two skipped; `pnpm run test:e2e` with 24/24; `pnpm run
+  build:vite`; and the focused final-proof suite with 6 files/32 tests.
+- Final Windows NSIS `release/Makelore-2.0.0-win-x64.exe` is 208,297,927 bytes
+  with SHA-256
+  `3DDCF48D28ABA914F427DC828428E4248A9751F8A449324F48060BA981E7B3D8`.
+  The rebuilt `win-unpacked` artifact verifier enumerated 10,278 ASAR entries,
+  found zero product-owned OpenCode path or development path residue, and passed
+  packaged Electron/Node/runtime/resource qualification. Structured evidence is
+  in ignored release reports `pi-artifact-win-followup.json`,
+  `pi-product-proof-win-followup.json`, and `pi-smoke-win-followup.json`.
+- The Windows packaged product proof loaded Main through final `app.asar`, ran
+  cold/warm managed workers and the materialized extension/subagent bridge, held
+  4 parent + 4 child workers as 8 live OS processes while the UI remained
+  interactive, and then reported zero active/waiting process-budget entries,
+  child permits, dispatches, parents, PIDs, and write leases.
+- Windows formal five-sample performance evidence
+  `pi-performance-win-followup.json` passed every budget. Managed cold p95 was
+  resources `25 ms`, spawn `13 ms`, RPC `669 ms`, session `3 ms`, accepted `1
+  ms`, settled `309 ms`; warm p95 was `8/13/674/8/0/270 ms`. Pressure UI p95
+  was `176 ms`; Renderer first-commit p95 was `33.6402 ms` (max `48.8593 ms`).
+- WSL2 Linux final product was rebuilt at the exact same clean commit. Final RPM
+  `release/Makelore-2.0.0-linux-x86_64.rpm` has SHA-256
+  `c7d7eac673abed61d83af2fbd2cc33d81ffa3b2c1e449ad89ee8f118f7400c64`.
+  RPM inspection reports Name `niancode`, Version `2.0.0`, Release `1`, Arch
+  `x86_64`, and contains `/opt/Makelore/niancode`,
+  `/opt/Makelore/resources/app.asar`, and
+  `/opt/Makelore/resources/pi-runtime/dist/cli.js`.
+- Linux artifact verification enumerated 10,280 ASAR entries and found zero
+  product-owned OpenCode path. WSLg launched the final packaged product from
+  `app.asar`; extension/subagent, live 4+4/8-PID pressure, UI interaction, and
+  zero-resource cleanup all passed. Evidence is in
+  `pi-artifact-linux-rpm-followup.json`,
+  `pi-product-proof-linux-rpm-followup.json`, and
+  `pi-smoke-linux-rpm-followup.json` in the Linux checkout's ignored
+  `release/evidence` directory.
+- Linux formal five-sample report `pi-performance-linux-rpm-followup.json`
+  passed every budget. Managed cold p95 was resources `14 ms`, spawn `6 ms`,
+  RPC `456 ms`, session `2 ms`, accepted `1 ms`, settled `284 ms`; warm p95 was
+  `4/4/465/1/1/256 ms`. Pressure UI p95 was `99 ms`; Renderer first-commit p95
+  was `27.897758 ms` (max `42.186106 ms`); exit p95 was `7 ms`.
+- Linux results are WSL2/WSLg final-product evidence, not an independent native
+  non-WSL Linux desktop/compositor/distribution acceptance run. Controlled
+  provider-shaped smoke issued six requests per protocol (distinct cold, warm,
+  and abort-isolation paths); real Provider verification remains false by the
+  explicit waiver.
 
 ## Follow-ups
 
-- Planner review of `977445b..a795e0c` returned `Standards Pass / Spec Needs
-  Fix` and requires direct final-ASAR composition smoke, distinct cold/warm
-  prompt milestones, live 4-parent/4-child UI pressure plus cleanup proof, ASAR
-  path enumeration for OpenCode residue, and the declared Linux x64 RPM target.
-- PI-160 should integrate candidate `a795e0c` and this task record, then perform
-  canonical project-memory reconciliation in an integration-owned worktree.
+- Request planner re-review of `c7e7772..df1151b`. The five prior findings now
+  have direct final-product implementation and structured Windows/Linux
+  evidence; no source-only unit-test result is used as their release proof.
+- Do not start PI-160 or integrate `df1151b` while PI-150 remains blocked by the
+  accepted platform evidence boundary. If the planner accepts the five fixes,
+  keep PI-150 as the active frontier until the missing platform decision or
+  evidence is resolved.
 - Keep missing macOS x64/arm64 artifact/runtime/resource/performance evidence as
   a release blocker; do not promote a cross-platform release-ready or PI-150
   `Done` conclusion without independent macOS execution.
-- If RPM distribution is required, rerun the x64 rpm target on a Linux builder
-  with `rpmbuild` installed; do not infer rpm validity from AppImage/deb.
+- Keep the lack of an independent native non-WSL Linux
+  desktop/compositor/distribution run explicit. The WSL2/WSLg run qualifies the
+  generated Linux artifacts and final process seam but does not erase that
+  environment boundary.
 - Real Provider Account and real-provider concurrency/credential/protocol
   compatibility remain accepted risk unless the user explicitly revokes the
   waiver and supplies provider access.
 
 ## Promotion Candidates
 
-- PI-160 should promote the current Pi runtime/Conversation state from README
-  and `docs/pi-runtime-release-runbook.md` into canonical project memory after
+- After PI-150 is actually unblocked, PI-160 may promote the current Pi
+  runtime/Conversation state from README and
+  `docs/pi-runtime-release-runbook.md` into canonical project memory during
   integration review.
-- PI-160 should record QG-004/QG-005 as `Explicitly Waived / Accepted Risk`,
-  with `realTurnVerified=false`; this is not a Pass.
-- PI-160 must preserve the macOS x64/arm64 missing-evidence blocker unless a
-  later task supplies independent final-product evidence.
+- PI-160 must record QG-004/QG-005 as `Explicitly Waived / Accepted Risk`, with
+  `realTurnVerified=false`; this is not a Pass.
+- PI-160 must preserve any unresolved macOS x64/arm64 or native Linux
+  missing-evidence blocker; this candidate does not authorize overriding it.