fix(desktop-windows): wire AutoCreatedTasksStep as step 14 of onboarding

.github/actions/deploy-backend-stack/action.yml

@@ -972,7 +972,10 @@ runs:
         ADMIN_KEY="$(gcloud secrets versions access latest --secret=ADMIN_KEY --project="$PROJECT_ID")"
         export ADMIN_KEY
         trap 'unset ADMIN_KEY' EXIT
-        python3 "$DEPLOY_CONTROL_SCRIPTS/smoke_what_matters_now.py" --base-url https://api.omi.dev
+        # api.omi.dev has never resolved (NXDOMAIN), so this smoke could not reach
+        # anything; api.omiapi.com is development's real public API host, matching
+        # the rest of the dev domain family (parakeet/nllb/pusher.omiapi.com).
+        python3 "$DEPLOY_CONTROL_SCRIPTS/smoke_what_matters_now.py" --base-url https://api.omiapi.com
 
     - name: Restore Cloud Run traffic snapshot after failed promotion
       if: >-

.github/checks-manifest.yaml

@@ -399,6 +399,11 @@ checks:
     triggers: ["backend/**/*.py", "backend/scripts/scan_async_blockers.py"]
     lanes: ["local", "ci"]
     reason: "backend Python changed"
+  - id: legacy-memory-surface-ratchet
+    command: ["python3", "backend/scripts/legacy_memory_surface_inventory.py", "--check-ratchet", "--base-ref", "{base}"]
+    triggers: ["backend/scripts/legacy_memory_surface_inventory.py", "backend/scripts/legacy_memory_surface_baseline.json", "backend/tests/unit/test_legacy_memory_surface_inventory.py", "backend/utils/conversations/process_conversation.py", "backend/utils/conversations/merge_conversations.py", "backend/utils/sync/pipeline.py", "backend/utils/memory/*.py", "backend/jobs/short_term_lifecycle_worker.py", "backend/modal/memory_maintenance_job.py", "backend/routers/conversations.py", "backend/routers/developer.py", "backend/routers/listen/conversations.py", "backend/routers/mcp.py", "backend/routers/mcp_sse.py", "backend/routers/memory_admin.py", "backend/routers/users.py", "backend/database/product_memory_items.py", "backend/database/users.py", "backend/runtime_images.json", "backend/utils/llm/ai_user_profile.py", "backend/deploy/runtime_env/*.yaml", "backend/scripts/memory-continuity-gauntlet.py", "backend/scripts/validate_memory_maintenance_scheduler.py", "desktop/macos/Desktop/Sources/ProactiveAssistants/**/*.swift", "desktop/macos/Desktop/Sources/Providers/ChatProvider.swift", "desktop/macos/Desktop/Sources/Rewind/Core/RewindDatabase.swift", "desktop/windows/src/main/assistants/**/*.ts", "desktop/windows/src/main/agentKernel/desktopChatPrompt.ts", "desktop/windows/src/main/ipc/mainChatPersonalization.ts", "desktop/windows/src/main/ipc/db.ts", ".github/workflows/gcp_memory_maintenance_job*.yml"]
+    lanes: ["local", "ci"]
+    reason: "Gate F legacy memory surfaces may shrink during the JIT-processing migration but must not gain new source or deployment references"
   - id: backend-datetime-sort-sentinel-ratchet
     command: ["python3", "backend/scripts/check_datetime_sort_sentinel_ratchet.py"]
     triggers: ["backend/**/*.py", "backend/scripts/check_datetime_sort_sentinel_ratchet.py"]

.github/failure-classes/FC-daily-memory-sweep-fence.json

@@ -0,0 +1,19 @@
+{
+  "schema_version": 1,
+  "id": "FC-daily-memory-sweep-fence",
+  "violated_contract": "A completed-day memory sweep must never advance or recreate canonical state across an account-deletion, owner, generation, source-completeness, or concurrent-runner boundary.",
+  "canonical_prevention": "Read deletion and live generation markers inside the canonical apply, receipt, and cursor transactions; require immutable complete-day packets; use generation-scoped leased receipts and prove crash, wipe, rollover, and overlapping-runner recovery against the Firestore emulator.",
+  "canonical_prevention_artifact": [
+    "backend/database/memory_apply_store.py",
+    "backend/utils/memory/daily_memory_sweep.py",
+    "backend/scripts/daily_memory_sweep_emulator_test.py"
+  ],
+  "evidence_prs": [
+    12084
+  ],
+  "scope_hints": [
+    "backend/utils/memory/daily_memory_sweep.py",
+    "backend/database/memory_apply_store.py"
+  ],
+  "status": "open"
+}

.github/failure-classes/FC-drain-stall-completes-silently.json

@@ -0,0 +1,16 @@
+{
+  "schema_version": 1,
+  "id": "FC-drain-stall-completes-silently",
+  "violated_contract": "When a device-storage drain protocol enters a state where it is structurally unable to serve stored data — e.g. a mode that makes drain and recording mutually exclusive, or full storage that stays armed for recording and yields no pages — a stall caused by that state must be classified and surfaced to the user as an actionable error, never allowed to fall through to a generic \"completed, nothing new\" success state. Silent completion after a classifiable stall hides that the transfer never happened and that the user must act (e.g. stop recording) to unblock it.",
+  "canonical_prevention": "FlashPageWalSyncImpl re-queries device status on a stall while still in batch mode and classifies it via FlashSyncStallReason (recordingSuspected, deviceFull), exposed through WalSyncs.flashStallReason. SyncProvider._performSync checks the classified reason before its fallback branch and maps a classified stall with no new conversations to a user-facing, localized error state instead of toCompleted(). Regression tests replay each classified-stall path and assert the state is error, not completed.",
+  "canonical_prevention_artifact": [
+    "app/test/unit/flash_page_stall_classification_test.dart",
+    "app/test/providers/sync_provider_flash_stall_test.dart"
+  ],
+  "evidence_prs": [],
+  "scope_hints": [
+    "app/lib/services/wals/**",
+    "app/lib/providers/sync_provider.dart"
+  ],
+  "status": "open"
+}

.github/failure-classes/FC-malformed-doc-read.json

@@ -3,6 +3,10 @@
   "id": "FC-malformed-doc-read",
   "violated_contract": "A malformed persisted document must not turn a read path into a 500 response.",
   "canonical_prevention": "Validate persisted documents at the shared read boundary and treat invalid records according to that boundary's explicit absent-or-skipped policy.",
+  "canonical_prevention_artifact": [
+    "backend/database/read_boundary.py",
+    ".github/scripts/check_firestore_model_read_boundary.py"
+  ],
   "evidence_prs": [9494, 9696],
   "scope_hints": ["backend/**"],
   "status": "open"

.github/scripts/check-deployment-concurrency.py

@@ -78,11 +78,20 @@ class LockContract:
     "gcp_frontend.yml": LockContract(
         "deploy-cloud-run-frontend-${{ github.event_name == 'workflow_dispatch' && github.event.inputs.environment || github.ref == 'refs/heads/development' && 'development' || github.ref == 'refs/heads/main' && 'prod' || format('nondeploy-{0}', github.run_id) }}"
     ),
+    "gcp_frame_request_retention_job.yml": LockContract(
+        "deploy-frame-request-retention-${{ github.event.inputs.environment }}"
+    ),
     "gcp_llm_gateway.yml": LockContract("deploy-backend-stack-${{ github.event.inputs.environment }}"),
     "gcp_memory_maintenance_job.yml": LockContract(
         "deploy-cloud-run-memory-maintenance-job-${{ github.event.inputs.environment }}"
     ),
     "gcp_memory_maintenance_job_auto_dev.yml": LockContract("deploy-cloud-run-memory-maintenance-job-development"),
+    "gcp_daily_memory_sweep_job.yml": LockContract(
+        "deploy-cloud-run-daily-memory-sweep-job-${{ github.event.inputs.environment }}"
+    ),
+    "gcp_daily_memory_sweep_job_auto_dev.yml": LockContract(
+        "deploy-cloud-run-daily-memory-sweep-job-development"
+    ),
     "gcp_models.yml": LockContract("deploy-gke-vad-${{ github.event.inputs.environment }}"),
     "gcp_nllb_translation.yml": LockContract("deploy-gke-nllb-translation-${{ github.event.inputs.environment }}"),
     "gcp_notifications_job.yml": LockContract(
@@ -667,6 +676,7 @@ def validate_shared_families(groups: dict[str, str]) -> list[str]:
         ("gcp_backend_listen_helm.yml", "gcp_backend_auto_dev.yml"),
         ("gcp_llm_gateway.yml", "gcp_backend_auto_dev.yml"),
         ("gcp_memory_maintenance_job.yml", "gcp_memory_maintenance_job_auto_dev.yml"),
+        ("gcp_daily_memory_sweep_job.yml", "gcp_daily_memory_sweep_job_auto_dev.yml"),
         ("gcp_backend_pusher.yml", "gcp_backend_pusher_auto_deploy.yml"),
     )
     for manual, automatic in family_pairs:
@@ -681,8 +691,10 @@ def validate_shared_families(groups: dict[str, str]) -> list[str]:
         "gcp_firestore_indexes.yml",
         "gcp_backend_listen_helm.yml",
         "gcp_diarizer.yml",
+        "gcp_frame_request_retention_job.yml",
         "gcp_llm_gateway.yml",
         "gcp_memory_maintenance_job.yml",
+        "gcp_daily_memory_sweep_job.yml",
         "gcp_models.yml",
         "gcp_nllb_translation.yml",
         "gcp_notifications_job.yml",

.github/scripts/check-desktop-backend-release-policy.py

@@ -48,6 +48,7 @@ def _validate_production_python_runtime(text: str, *, workflow: str) -> list[str
         "GOOGLE_CLOUD_PROJECT=${{ vars.GCP_PROJECT_ID }}",
         "GCP_LOCATION=us-central1",
         "/secrets/firebase/service-account.json=SERVICE_ACCOUNT_JSON:latest",
+        "POSTHOG_PROJECT_API_KEY=POSTHOG_PROJECT_API_KEY:latest",
         "GEMINI_API_KEY=DESKTOP_GEMINI_API_KEY:latest",
         "FIREBASE_API_KEY=DESKTOP_FIREBASE_API_KEY:latest",
         "REDIS_DB_PASSWORD=DESKTOP_REDIS_DB_PASSWORD:latest",
@@ -154,6 +155,7 @@ def validate_deploy_workflow(text: str, *, production: bool) -> list[str]:
         "cloud_run_gmp_sidecar.yaml",
         "PROMETHEUS_SIDECAR_PORT=9090",
         "METRICS_SECRET=METRICS_SECRET:latest",
+        "POSTHOG_PROJECT_API_KEY=POSTHOG_PROJECT_API_KEY:latest",
         "Attach Managed Prometheus sidecar",
         "Verify candidate image lineage",
         "@${{ steps.build-image.outputs.digest }}",

.github/workflows/backend-unit-tests.yml

@@ -47,6 +47,7 @@ on:
       - 'scripts/install-git-hooks.sh'
       - 'scripts/pre-push'
       - 'scripts/pre-push-singleflight'
+      - 'scripts/dev-harness/dev_harness/jit_vertex_gateway.py'
       - 'scripts/voice-provider-probe.sh'
   pull_request:
     paths:
@@ -92,6 +93,7 @@ on:
       - 'scripts/install-git-hooks.sh'
       - 'scripts/pre-push'
       - 'scripts/pre-push-singleflight'
+      - 'scripts/dev-harness/dev_harness/jit_vertex_gateway.py'
       - 'scripts/voice-provider-probe.sh'
   workflow_dispatch:
 

.github/workflows/desktop_backend_auto_dev.yml

@@ -256,6 +256,7 @@ jobs:
             GOOGLE_CALENDAR_API_KEY=DESKTOP_GOOGLE_CALENDAR_API_KEY:latest
             OMI_LLM_GATEWAY_SERVICE_TOKEN=OMI_LLM_GATEWAY_SERVICE_TOKEN:latest
             METRICS_SECRET=METRICS_SECRET:latest
+            POSTHOG_PROJECT_API_KEY=POSTHOG_PROJECT_API_KEY:latest
 
       # See desktop_backend_prod.yml: the expectation is rendered from the
       # manifest so it cannot drift from the values actually deployed.

.github/workflows/desktop_backend_prod.yml

@@ -224,7 +224,8 @@ jobs:
             DESKTOP_REDIS_DB_PASSWORD \
             DESKTOP_REDIS_DB_HOST \
             DESKTOP_REDIS_DB_PORT \
-            METRICS_SECRET; do
+            METRICS_SECRET \
+            POSTHOG_PROJECT_API_KEY; do
             gcloud secrets describe "$secret" \
               --project="$PROJECT_ID" \
               --format='none'
@@ -342,6 +343,7 @@ jobs:
             GOOGLE_CALENDAR_API_KEY=DESKTOP_GOOGLE_CALENDAR_API_KEY:latest
             OMI_LLM_GATEWAY_SERVICE_TOKEN=OMI_LLM_GATEWAY_SERVICE_TOKEN:latest
             METRICS_SECRET=METRICS_SECRET:latest
+            POSTHOG_PROJECT_API_KEY=POSTHOG_PROJECT_API_KEY:latest
 
       # The sidecar attach re-serialises the live Cloud Run export, so it verifies
       # the ingress env it is about to rewrite against what the manifest says it