[Astro-Han]

Summary

Nightly 101 completed all five Desktop targets and the publisher without this fix, and 0.2.2-dev.101.20261026 is published. This PR is release reliability hardening: it addresses the diagnostic and recovery gaps observed in earlier failures, plus the runner maintainers' workaround for intermittent ticket connection loss. It is no longer blocking publication. I am keeping it open for review; no additional exploratory runs are planned.

Nightly 98 failed at stapler validate on the app copied from its notarized ARM64 DMG (failure). The check bypassed the existing recovery gate, and runCommand omitted stdout and exit metadata. Reuse the gate in validation-only mode and retain command status and both output streams. App validation remains read-only; only exit 68 with NSURLErrorDomain Code=-1005 gets three attempts and 10/20-second delays.

Nightly 99 exhausted those existing attempts earlier, while stapling its accepted ARM64 DMG. GitHub runner maintainers reproduced the same CloudKit connection loss over HTTP/3 and verified TCP fallback. Apply their temporary UDP 443 block before notarization in the hosted macOS Desktop Nightly, Desktop release and CLI release jobs. This covers app, DMG and validation lookups without adding a new recovery path or weakening ticket checks. Remove the workaround when the runner issue is fixed. Local packaging is unchanged; the disposable CI jobs use HTTPS over TCP.

Verification

• 48 related stapling, packaged-app and workflow tests passed; format, lint and git diff --check passed.
• Real child-process regressions protect output/status capture and validation-only recovery. Removing the network setup makes the new workflow ordering check fail.
• A targeted macOS ARM runner probe used the public, signed Nightly 92 DMG: signature verification passed, then native staple and validate passed with TCP fallback; PF counted 10 blocked UDP 443 packets and the packet trace showed Apple HTTPS traffic over TCP. The baseline also passed on that runner, so this proves workaround compatibility, not a reproduction of Nightly 99 or proof of its exact wire-level cause.
• CI test, Linux packaging and Windows packaging/automatic-update checks all passed at the current head, 527103d5b.
• Apple failures in local regressions are simulated. No TypeScript sources changed; typecheck was not run.

Release qualification

The first post-merge attempt, npm run 40625327778, used source ed3f91707cfe96c240b92e4911255ef47a64b403 and version 0.2.2-dev.103.20261028. All installed CLI validation jobs passed. Publication stopped at the shipped-dependency audit because qs@6.16.0 matches GHSA-6pq8-jhm2-2vcw (moderate; fixed in 6.16.1). The downstream Desktop run 40626707958 was skipped, so the macOS changes remain unqualified by a post-merge release. The existing dependency update is tracked in #6408.

Nightly 101 establishes that publication recovered without this PR. It does not qualify the changes below; after merge, I will verify one Nightly containing the fix through the existing release process.

• A fresh Nightly containing this fix completes all five targets and publishes matching npm, installers and update feeds.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex investigated the release failures, implemented the fixes and regression tests, and ran local checks and the hosted network probe.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[sunrioa]

Reviewed at 527103d5b2e90998f64a3ab06560cfaaf049d82b.

I found no blocking issues in the changed paths. The retry remains limited to exit code 68 with NSURLErrorDomain Code=-1005, with a bounded attempt count. Permanent failures still fail, validation-only mode does not staple the artifact again, and the existing signature and Gatekeeper checks remain in place.

Independent verification:

• All 48 focused tests passed.
• With the implementation changes removed and the PR tests retained, the three targeted regressions failed as expected: command error metadata, transient validation recovery, and workflow setup ordering.
• On native macOS ARM64, the PR's validation-only helper succeeded against the existing signed Nightly 92 application. Native codesign checks passed before and after validation, and the signature manifest remained unchanged.
• Lint, formatting, and diff checks passed.

The hosted TCP workaround matches the runner maintainers' recommendation. I inspected the existing hosted probe logs but did not rerun that job. The full workspace tests/typecheck and a newly signed build of this PR were outside this verification.

Please retain the tracked post-merge qualification: run one Nightly containing this fix through all five Desktop targets and publication. The existing Nightly 101 success does not qualify this patch.

Source review and local test execution were assisted by OpenAI Codex.

中文全文

本次审核对应提交 527103d5b2e90998f64a3ab06560cfaaf049d82b。

在本次修改涉及的路径中，未发现阻止合并的问题。重试仍限定为退出码 68 且包含 NSURLErrorDomain Code=-1005，并有明确的次数上限。永久错误仍会失败；只读验证模式不会重新挂载票据；原有签名和 Gatekeeper 检查均保留。

独立验证结果：

• 相关的 48 项测试全部通过。
• 移除实现改动、保留 PR 测试后，三项针对性回归测试均按预期失败，分别对应命令错误信息、临时验证失败后的恢复，以及工作流准备步骤的顺序。
• 在原生 macOS ARM64 上，使用已有签名的 Nightly 92 应用，通过了 PR 的只读验证入口。验证前后的原生 codesign 检查均通过，签名清单保持一致。
• Lint、格式和 diff 检查均通过。

CI 中的 TCP 绕过措施与 Runner 维护者的建议一致。我检查了已有的 Runner 探测日志，但没有重新运行该作业。本次验证未覆盖整个仓库的测试和类型检查，也没有为该 PR 重新生成签名安装包。

请保留已记录的合并后验收项：运行一次包含此修复的 Nightly，完成全部五个 Desktop 目标及发布流程。已有 Nightly 101 的成功不能作为本补丁的验收结果。

源码审查和本地测试执行由 OpenAI Codex 辅助完成。

[sunrioa]

Approved for 527103d5b2e90998f64a3ab06560cfaaf049d82b. Detailed verification and the remaining post-merge Nightly qualification are recorded in the review notes.

Submitted through OpenAI Codex at the explicit direction of human reviewer @sunrioa.