feat(action-items): task cleanup — backend endpoints + Windows UI

.github/checks-manifest.yaml

@@ -324,6 +324,11 @@ checks:
     triggers: [".github/scripts/check_runner_cost_policy.py", ".github/scripts/test_check_runner_cost_policy.py"]
     lanes: ["local", "ci"]
     reason: "runner cost-policy fixtures must keep rejecting the paid larger-runner label"
+  - id: windows-sync-pr-retirement-contract
+    command: ["python3", ".github/scripts/test_retire_superseded_sync_prs.py"]
+    triggers: [".github/workflows/desktop_windows_release.yml", ".github/scripts/retire_superseded_sync_prs.py", ".github/scripts/test_retire_superseded_sync_prs.py"]
+    lanes: ["local", "ci"]
+    reason: "#10727: the Windows release sync-PR cleanup must retain the current PR, only close same-repo release/windows-v* heads, and never block the release"
   - id: telegram-deployment-notifier
     command: ["bash", ".github/actions/deployment-notifier/test-check-configuration.sh"]
     triggers: [".github/actions/deployment-notifier/**", ".github/checks-manifest.yaml"]

.github/failure-classes/FC-client-rederives-authority-verdict.json

@@ -0,0 +1,18 @@
+{
+  "schema_version": 1,
+  "id": "FC-client-rederives-authority-verdict",
+  "violated_contract": "A client that consumes an authority's decision response must act on the authority's own verdict field, never re-derive a stricter verdict from the raw inputs the authority also returns. The re-derivation diverges silently the day the authority's computation changes: the client keeps issuing the decision read, receives a 200, and gates off anyway — no decode error, no failing test, and the server log looks healthy. #12369 collapsed backend JIT admission onto one exposure flag plus a two-UID allowlist and returns effective=enabled for admitted owners; the macOS client kept requiring rollout == enabled && kill_switch == .disabled, so Omi Beta 12237 repeatedly read /v1/jit/rollout-decision with a 200, never issued GET /v1/jit/trigger-snapshot, and persisted zero jit_trigger_snapshot_receipts rows. The Windows client parses and uses effective and was not affected.",
+  "canonical_prevention": "Point the admission predicate at the same value the authority computes: JITProactivityFlags.permitsNewLane admits on effective == .enabled and fails closed on .disabled, keeping the raw rollout + kill-switch pair only as an older-server fallback that distinguishes an absent kill_switch (wire compatibility) from a present unknown (fail closed). Exercise the full truth table through URLProtocol-level wire tests against the response shape the router actually emits, plus a runtime test that an effective-enabled authority reads the trigger snapshot and persists its receipt even for a complete empty watchlist. A downstream projection failure (ledger mirror sync) must fail that projection closed, not the authoritative receipt the client already holds.",
+  "canonical_prevention_artifact": [
+    "desktop/macos/Desktop/Sources/ProactiveAssistants/Core/JITProactivityPolicy.swift",
+    "desktop/macos/Desktop/Sources/ProactiveAssistants/Core/ProactiveLaneClient.swift",
+    "desktop/macos/Desktop/Tests/ProactiveLaneClientTests.swift",
+    "desktop/macos/Desktop/Tests/JITProactivityRuntimeTests.swift"
+  ],
+  "evidence_prs": [],
+  "scope_hints": [
+    "desktop/macos/Desktop/Sources/ProactiveAssistants/**",
+    "desktop/windows/src/main/jit/**"
+  ],
+  "status": "open"
+}

.github/failure-classes/FC-naive-utc-timestamp-in-llm-surface.json

@@ -0,0 +1,9 @@
+{
+  "schema_version": 1,
+  "id": "FC-naive-utc-timestamp-in-llm-surface",
+  "violated_contract": "A timestamp value handed to the chat model as tool output or prompt context must carry an explicit time zone; a naive datetime string must never be presented as if it were already local time.",
+  "canonical_prevention": "Convert database-stored UTC datetime values to TimeZone.current with an explicit zone abbreviation/offset in the formatter that renders them for the model, rather than relying on prompt instructions asking the model to apply the offset itself.",
+  "evidence_prs": [],
+  "scope_hints": ["desktop/macos/Desktop/Sources/Chat/**", "desktop/macos/Desktop/Sources/Providers/ChatToolExecutor.swift"],
+  "status": "open"
+}

.github/failure-classes/FC-path-filter-masks-default-branch-health.json

@@ -0,0 +1,16 @@
+{
+  "schema_version": 1,
+  "id": "FC-path-filter-masks-default-branch-health",
+  "violated_contract": "A path-filtered workflow answers whether one diff requires a component check; it does not establish that the component still compiles at the current default-branch SHA. Treating a later unrelated commit's skipped component jobs or overall green workflow as refreshed health evidence lets an older compiler failure remain on main behind a newer green run (#12275).",
+  "canonical_prevention": "Keep ordinary push and pull-request path filtering for cost control, but give the component an authoritative recurring health event and an operator recovery event that force its real compile/test phases against the current SHA regardless of changed paths. Guard both sides: authoritative events must select the full phases, while unrelated ordinary pushes must remain filtered.",
+  "canonical_prevention_artifact": [
+    ".github/scripts/test_pre_push_ci_prediction.py",
+    ".github/scripts/test_desktop_swift_ci_contract.py"
+  ],
+  "evidence_prs": [],
+  "scope_hints": [
+    ".github/workflows/",
+    "scripts/pre_push_ci_prediction.py"
+  ],
+  "status": "open"
+}

.github/failure-classes/FC-sync-gated-on-consumer-trigger.json

@@ -0,0 +1,18 @@
+{
+  "schema_version": 1,
+  "id": "FC-sync-gated-on-consumer-trigger",
+  "violated_contract": "A durable state sync whose authority is cheap to read (a snapshot plus its receipt) must be driven by the lifecycle event of the scope that owns it — signed-in admitted startup, owner change — never only by the opportunistic consumer path that happens to need it next. Binding the sync to the consumer's trigger silently couples availability to an unrelated subsystem: the JIT trigger snapshot download only ran inside JITProactivityRuntime.admission, reached solely after a notify-worthy screen-capture context visit, so an allowlisted owner whose TCC Screen Recording grant dropped (Sparkle replaced the signed binary) held a valid authority, kept the routes it did hit green, and stayed at zero jit_trigger_snapshot_receipts forever — the client fix in #12381 shipped in Beta 12240 but could never execute. No decode error, no failing test, and the server log looks healthy because the gating read simply never happens.",
+  "canonical_prevention": "Hook the same flag → fetch → reconcile chain the consumer uses onto the owner-ready startup path: DesktopHomeSignedInStartup.runProductServicesIfAdmitted fires JITProactivityRuntime.syncTriggerSnapshot once after isProductShellAdmitted, and the .task(id: productShellAdmissionToken) restart supplies the owner-change retry. Fire-and-forget so a slow authority route never gates startup; keep the consumer's fail-closed gate (permitsNewLane) and the complete-empty-snapshot receipt contract. Behavioral coverage: a runtime test that fetches and persists a receipt with zero context visits, fail-closed tests that every non-permitting authority performs no snapshot read, and URLProtocol-level wire tests asserting the GET sequence rollout-decision → trigger-snapshot.",
+  "canonical_prevention_artifact": [
+    "desktop/macos/Desktop/Sources/AccountCutover/DesktopHomeSignedInStartup.swift",
+    "desktop/macos/Desktop/Sources/ProactiveAssistants/Core/JITProactivityRuntime.swift",
+    "desktop/macos/Desktop/Tests/JITProactivityRuntimeTests.swift",
+    "desktop/macos/Desktop/Tests/ProactiveLaneClientTests.swift"
+  ],
+  "evidence_prs": [],
+  "scope_hints": [
+    "desktop/macos/Desktop/Sources/ProactiveAssistants/**",
+    "desktop/windows/src/main/jit/**"
+  ],
+  "status": "open"
+}

.github/failure-classes/FC-unattended-warm-resource-loop.json

@@ -0,0 +1,14 @@
+{
+  "schema_version": 1,
+  "id": "FC-unattended-warm-resource-loop",
+  "violated_contract": "A warm resource kept open purely to hide first-use latency (a pre-warmed provider session, connection, or cache) exists for the user's presence; its refresh loop must be gated on evidence the user can still benefit. Rebuilding it unconditionally after every provider-side idle teardown turns a latency optimization into an unbounded background spend loop — per running app, around the clock — whose cost (metered tokens re-billed on every rebuild) accrues while the user is asleep or away, and whose fleet-wide aggregate can exhaust a shared project quota and degrade every user at once.",
+  "canonical_prevention": "Gate idle-teardown re-warms behind RealtimeHubWarmPresencePolicy: defer the rebuild once HID input idle exceeds the threshold, resume on the first returned input event, and fail open (always warm) when the presence sample is unavailable. Any explicit warm intent (PTT-down, settings change) clears the deferral so a present user never waits on the gate.",
+  "canonical_prevention_artifact": [
+    "desktop/macos/Desktop/Tests/RealtimeHubWarmPresencePolicyTests.swift"
+  ],
+  "evidence_prs": [],
+  "scope_hints": [
+    "desktop/macos/Desktop/Sources/FloatingControlBar/RealtimeHub*"
+  ],
+  "status": "open"
+}

.github/scripts/analytics_reachability_baseline.json

@@ -36,7 +36,7 @@
       "memoriesPageCreateMemoryBtn": 2,
       "omiDoubleTap": 5,
       "onboardingStepCompleted": 11,
-      "pageOpened": 30,
+      "pageOpened": 31,
       "paywallOpened": 4,
       "permissionChanged": 5,
       "permissionsSettingsOpened": 2,
@@ -49,7 +49,7 @@
       "taskIntegrationAuthFailed": 8,
       "taskIntegrationEnabled": 5,
       "taskIntegrationSettingsOpened": 4,
-      "track": 27,
+      "track": 28,
       "transcriptionSourceSelected": 4,
       "uncheckedActionItem": 2,
       "upgradeSucceeded": 2,
@@ -59,36 +59,40 @@
     },
     "macos": {
       "appDetailViewed": 3,
-      "chatAppSelected": 2,
-      "chatFirst": 37,
+      "chatFirst": 41,
       "chatMessageSent": 8,
+      "conversationCreated": 2,
+      "desktopPromptAnswered": 2,
       "floatingBarAskOmiOpened": 2,
       "floatingBarPTTEnded": 7,
       "floatingBarPTTStarted": 2,
-      "floatingBarQuerySent": 2,
+      "floatingBarQuerySent": 3,
       "floatingBarToggled": 4,
       "identify": 3,
+      "insightAssistantDeliveryOutcome": 3,
+      "integrationNudgeActioned": 3,
       "knowledgeGraphBuildCompleted": 2,
+      "languageChanged": 2,
       "launchAtLoginChanged": 4,
       "memoryAssistantAnalysisRun": 2,
       "memoryListItemClicked": 2,
       "menuBarActionClicked": 8,
       "notificationClicked": 3,
-      "notificationDismissed": 2,
+      "notificationDismissed": 3,
       "notificationRepairTriggered": 2,
       "notificationSent": 2,
       "onboardingChatMessageDetailed": 3,
       "onboardingChatToolUsed": 11,
-      "onboardingCompleted": 3,
+      "onboardingCompleted": 2,
       "onboardingHowDidYouHear": 2,
       "onboardingStepCompleted": 32,
       "recordingError": 4,
       "rewindTimelineNavigated": 2,
-      "screenCaptureBrokenDetected": 3,
+      "screenCaptureBrokenDetected": 4,
       "screenCaptureResetClicked": 3,
       "screenCaptureResetCompleted": 2,
-      "settingToggled": 16,
-      "shareAction": 4,
+      "settingToggled": 14,
+      "shareAction": 5,
       "signInCompleted": 2,
       "signInFailed": 2,
       "signInStarted": 2,
@@ -172,8 +176,8 @@
       "wrappedBannerClicked"
     ],
     "macos": [
+      "chatAppSelected",
       "claudeOAuthCallbackTimeout",
-      "focusAlertDismissed",
       "memoryShareButtonClicked",
       "onboardingChatMessage",
       "optInTracking",

.github/scripts/desktop_backend_candidate_probe.py

@@ -36,7 +36,13 @@
 MAX_FIRST_EVENT_SECONDS = 20
 SHA_PATTERN = re.compile(r"^[0-9a-f]{40}$")
 CONTRACT_PATTERN = re.compile(r"^[1-9][0-9]{0,5}$")
-REAL_GEMINI_PROVIDER_ROUTES = frozenset({"vertex_ai", "ai_studio", "ai_studio_byok"})
+REAL_GEMINI_PROVIDER_ROUTES = frozenset({"vertex_ai", "ai_studio", "ai_studio_byok", "llm_gateway"})
+# `llm_gateway` is the route the desktop proxy stamps on X-Omi-Provider for
+# company-paid Gemini traffic since #12337 routed it through the LLM gateway
+# (backend/utils/llm/desktop_gemini_gateway.py proxy_company_paid_via_gateway).
+# The gateway's desktop-vertex lanes pin the Vertex provider with no fallbacks
+# (backend/llm_gateway/gateway/config_loader.py), so the hop is still real
+# Gemini-on-Vertex; stub and unknown routes stay rejected fail-closed.
 
 
 class ProbeError(RuntimeError):