fix(desktop-windows): use --frozen-lockfile in README install step

.github/actions/deploy-backend-stack/action.yml

@@ -4,6 +4,13 @@ description: >-
   surfaces, and shared release-vector evidence for manual and auto-dev deploys.
 
 inputs:
+  firebase_probe_signer_service_account:
+    description: >-
+      Optional service account for signing release-probe custom tokens when the
+      Firebase auth project differs from project_id. Requires
+      roles/iam.serviceAccountTokenCreator for the deploy identity on it.
+    required: false
+    default: ''
   deploy_profile:
     description: 'manual or auto-dev orchestration profile'
     required: true
@@ -274,18 +281,6 @@ runs:
         fi
         python3 "$DEPLOY_CONTROL_SCRIPTS/preflight-cloud-run-deploy.py" "${PREFLIGHT_ARGS[@]}"
 
-    - name: Validate backend runtime env before deploy
-      shell: bash
-      env:
-        SYNC_LEDGER_FENCE_MODE: ${{ env.SYNC_LEDGER_FENCE_MODE }}
-      run: |
-        python3 "$DEPLOY_CONTROL_SCRIPTS/validate-backend-runtime-env.py" \
-          --env ${{ inputs.runtime_env }} \
-          --manifest "$GITHUB_WORKSPACE/backend/deploy/runtime_env.yaml" \
-          --check-workflows \
-          --workflow-root "$DEPLOY_WORKFLOW_ROOT" \
-          --check-rendered-cloud-run
-
     - name: Build runtime image
       uses: docker/build-push-action@v7
       with:
@@ -428,7 +423,20 @@ runs:
       run: |
         python3 "$DEPLOY_CONTROL_SCRIPTS/render_backend_runtime_env.py" \
           --env ${{ inputs.runtime_env }} \
-          --manifest "$GITHUB_WORKSPACE/backend/deploy/runtime_env.yaml" >> "$GITHUB_OUTPUT"
+          --manifest "$GITHUB_WORKSPACE/backend/deploy/runtime_env.yaml" \
+          --state-output "$RUNNER_TEMP/backend-runtime-env-state.json" >> "$GITHUB_OUTPUT"
+
+    - name: Validate backend runtime env before deploy
+      shell: bash
+      env:
+        SYNC_LEDGER_FENCE_MODE: ${{ env.SYNC_LEDGER_FENCE_MODE }}
+      run: |
+        python3 "$DEPLOY_CONTROL_SCRIPTS/validate-backend-runtime-env.py" \
+          --env ${{ inputs.runtime_env }} \
+          --manifest "$GITHUB_WORKSPACE/backend/deploy/runtime_env.yaml" \
+          --check-workflows \
+          --workflow-root "$DEPLOY_WORKFLOW_ROOT" \
+          --cloud-run-state "$RUNNER_TEMP/backend-runtime-env-state.json"
 
     - name: Migrate legacy public Cloud Run bindings
       shell: bash
@@ -487,6 +495,7 @@ runs:
           --final-revision="backend-${{ steps.image-tag.outputs.revision_suffix }}"
           --ingress-container=backend-1
           --config="$DEPLOY_CONTROL_SCRIPTS/../deploy/cloud_run_gmp_sidecar.yaml"
+          --expected-env-state="$RUNNER_TEMP/backend-runtime-env-state.json"
         )
         if [[ -n "$GMP_CANDIDATE_TAG" ]]; then
           args+=(--tag="$GMP_CANDIDATE_TAG")
@@ -744,6 +753,12 @@ runs:
         candidate_api_url: ${{ steps.transcription-candidate.outputs.url }}
         project_id: ${{ inputs.project_id }}
         firebase_auth_project_id: based-hardware
+        # A development deploy identity cannot sign a custom token for the
+        # production Firebase project this gate authenticates against, so it
+        # failed at custom_token_signing and blocked every manual development
+        # deploy. Left empty the behaviour is unchanged; set the variable to
+        # the Firebase project's signer to make this lane usable.
+        firebase_signer_service_account: ${{ inputs.firebase_probe_signer_service_account }}
 
     - name: Accept no-traffic Cloud Run candidate
       id: verify-cloud-run-candidate

.github/actions/transcription-release-candidate-probe/action.yml

@@ -11,6 +11,14 @@ inputs:
   firebase_auth_project_id:
     description: Firebase project whose ID-token audience the candidate verifies.
     required: true
+  firebase_signer_service_account:
+    description: >-
+      Service account to sign the probe's custom token as. Required when the
+      Firebase auth project differs from project_id, because Identity Toolkit
+      only accepts a signer authorized for that Firebase project. The caller's
+      deploy identity needs roles/iam.serviceAccountTokenCreator on it.
+    required: false
+    default: ''
   evidence_path:
     description: Optional absolute path for the redacted probe report.
     required: false
@@ -26,15 +34,21 @@ runs:
         EVIDENCE_PATH: ${{ inputs.evidence_path }}
         PROBE_SECRET_PROJECT: ${{ inputs.project_id }}
         FIREBASE_AUTH_PROJECT_ID: ${{ inputs.firebase_auth_project_id }}
+        FIREBASE_SIGNER_SERVICE_ACCOUNT: ${{ inputs.firebase_signer_service_account }}
       run: |
         set -euo pipefail
         DEPLOY_CONTROL_SCRIPT_DIR="${DEPLOY_CONTROL_SCRIPTS:-backend/scripts}"
         token_file="$(mktemp "$RUNNER_TEMP/omi-transcription-probe.XXXXXX")"
         trap 'rm -f "$token_file"' EXIT
-        python3 "$DEPLOY_CONTROL_SCRIPT_DIR/firebase_release_probe_token.py" \
-          --secret-project "$PROBE_SECRET_PROJECT" \
-          --firebase-project "$FIREBASE_AUTH_PROJECT_ID" \
+        token_args=(
+          --secret-project "$PROBE_SECRET_PROJECT"
+          --firebase-project "$FIREBASE_AUTH_PROJECT_ID"
           --token-output "$token_file"
+        )
+        if [[ -n "$FIREBASE_SIGNER_SERVICE_ACCOUNT" ]]; then
+          token_args+=(--signer-service-account "$FIREBASE_SIGNER_SERVICE_ACCOUNT")
+        fi
+        python3 "$DEPLOY_CONTROL_SCRIPT_DIR/firebase_release_probe_token.py" "${token_args[@]}"
         probe_args=(
           --candidate-api-url "$CANDIDATE_API_URL"
           --bearer-token-file "$token_file"

.github/checks-manifest.yaml

@@ -642,6 +642,16 @@ checks:
     triggers: ["desktop/macos/Desktop/Sources/FloatingControlBar/RealtimeHubController.swift", "desktop/macos/scripts/check-hub-controller-ratchet.py"]
     lanes: ["local", "ci"]
     reason: "realtime hub extracted-type ownership anti-regrowth ratchet"
+  - id: task-capture-authority
+    command: ["python3", ".github/scripts/check_task_capture_authority.py"]
+    triggers: ["backend/utils/task_intelligence/**", "backend/utils/conversations/process_conversation.py", "backend/config/task_intelligence_sources_v1.json", "desktop/macos/Desktop/Sources/ProactiveAssistants/Assistants/TaskExtraction/**", ".github/scripts/check_task_capture_authority.py"]
+    lanes: ["local", "ci"]
+    reason: "INV-TASK-2: automatic capture proposes; four shipped paths wrote tasks the user never asked for"
+  - id: task-capture-authority-tests
+    command: ["python3", ".github/scripts/test_check_task_capture_authority.py"]
+    triggers: [".github/scripts/check_task_capture_authority.py", ".github/scripts/test_check_task_capture_authority.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "the guard must still fail on each shape it was written for"
   - id: desktop-auth-session-ratchet
     command: ["python3", ".github/scripts/check_desktop_auth_session.py"]
     triggers: ["desktop/macos/Desktop/Sources/APIClient.swift", "desktop/macos/Desktop/Sources/AuthService.swift", "desktop/macos/Desktop/Sources/AuthSessionCoordinator.swift", "desktop/macos/Desktop/Sources/DesktopKeychainStore.swift", "desktop/macos/Desktop/Sources/OmiApp.swift", "desktop/macos/Desktop/Sources/Auth/**/*.swift", ".github/scripts/check_desktop_auth_session.py"]
@@ -689,14 +699,19 @@ checks:
     reason: "#9989 exercises non-main, ambiguous SHA, mismatched checkout, and workflow-contract rejection cases"
   - id: backend-deploy-source-admission
     command: ["python3", ".github/scripts/check_backend_deploy_source_admission.py"]
-    triggers: [".github/workflows/gcp_backend.yml", ".github/workflows/gcp_backend_auto_dev.yml", ".github/actions/deploy-backend-stack/**", ".github/scripts/verify_backend_release_admission.py", ".github/scripts/verify_auto_backend_release_admission.py", ".github/scripts/check_backend_deploy_source_admission.py", ".github/scripts/test_check_backend_deploy_source_admission.py", ".github/scripts/workflow_composite_contract.py", ".github/checks-manifest.yaml"]
+    triggers: [".github/workflows/gcp_backend.yml", ".github/workflows/gcp_backend_auto_dev.yml", ".github/actions/deploy-backend-stack/**", ".github/scripts/verify_backend_release_admission.py", ".github/scripts/verify_auto_backend_release_admission.py", ".github/scripts/check_backend_deploy_source_admission.py", ".github/scripts/test_check_backend_deploy_source_admission.py", ".github/scripts/test_verify_auto_backend_release_admission.py", ".github/scripts/workflow_composite_contract.py", ".github/checks-manifest.yaml"]
     lanes: ["local", "ci"]
     reason: "#9991 keeps backend deploy source selection bound to one successful main Release Eligibility proof"
   - id: backend-deploy-source-admission-fixtures
     command: ["python3", ".github/scripts/test_check_backend_deploy_source_admission.py"]
-    triggers: [".github/workflows/gcp_backend.yml", ".github/workflows/gcp_backend_auto_dev.yml", ".github/actions/deploy-backend-stack/**", ".github/scripts/verify_backend_release_admission.py", ".github/scripts/verify_auto_backend_release_admission.py", ".github/scripts/check_backend_deploy_source_admission.py", ".github/scripts/test_check_backend_deploy_source_admission.py", ".github/scripts/workflow_composite_contract.py", ".github/checks-manifest.yaml"]
+    triggers: [".github/workflows/gcp_backend.yml", ".github/workflows/gcp_backend_auto_dev.yml", ".github/actions/deploy-backend-stack/**", ".github/scripts/verify_backend_release_admission.py", ".github/scripts/verify_auto_backend_release_admission.py", ".github/scripts/check_backend_deploy_source_admission.py", ".github/scripts/test_check_backend_deploy_source_admission.py", ".github/scripts/test_verify_auto_backend_release_admission.py", ".github/scripts/workflow_composite_contract.py", ".github/checks-manifest.yaml"]
     lanes: ["local", "ci"]
     reason: "#9991 mutation-tests workflow-run event, result, branch, SHA, repository, and manual proof drift"
+  - id: automatic-backend-release-admission
+    command: ["python3", ".github/scripts/test_verify_auto_backend_release_admission.py"]
+    triggers: [".github/workflows/gcp_backend.yml", ".github/workflows/gcp_backend_auto_dev.yml", ".github/actions/deploy-backend-stack/**", ".github/scripts/verify_backend_release_admission.py", ".github/scripts/verify_auto_backend_release_admission.py", ".github/scripts/check_backend_deploy_source_admission.py", ".github/scripts/test_check_backend_deploy_source_admission.py", ".github/scripts/test_verify_auto_backend_release_admission.py", ".github/scripts/workflow_composite_contract.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#11979 keeps automatic development admission on merged-into-main ancestry, not main-tip equality"
   - id: gcp-backend-production-boundary
     command: ["python3", ".github/scripts/check-gcp-backend-production-boundary.py"]
     triggers: [".github/workflows/gcp_backend.yml", ".github/actions/deploy-backend-stack/**", "backend/scripts/firebase_release_probe_token.py", "backend/scripts/transcription_capability_probe.py", ".github/scripts/check-gcp-backend-production-boundary.py", ".github/scripts/test_check_gcp_backend_production_boundary.py", ".github/scripts/workflow_composite_contract.py", ".github/checks-manifest.yaml"]

.github/failure-classes/FC-bridge-liveness-without-data-path-proof.json

@@ -0,0 +1,17 @@
+{
+  "schema_version": 1,
+  "id": "FC-bridge-liveness-without-data-path-proof",
+  "violated_contract": "A component whose only purpose is to move data between two systems is healthy only when a datum has recently crossed the whole path. Process availability, HTTP readiness, and a downstream scrape's `up` describe the relay's own endpoint, not its cargo, so they must never be allowed to classify it as healthy while every upstream query is rejected or every selector matches nothing. A relay that answers its own liveness probe while importing zero rows is indistinguishable, at the destination, from a source that is simply idle -- and idle is the reading an operator will take.",
+  "canonical_prevention": "Alert on the relay's own upstream outcome and on arrival, never on its liveness: the count of failed upstream queries, and the presence of at least one imported series under the name the destination actually queries. Execute the composed upstream expression against the real vendor endpoint before shipping the config that produces it -- a filter or query assembled in values is a program whose only compiler is the vendor API, and it is never exercised by rendering, unit tests, or deployment success.",
+  "canonical_prevention_artifact": [
+    "backend/charts/monitoring/alert-rules.json",
+    "backend/docs/runbooks/cloud-run-metrics-ingestion.md"
+  ],
+  "evidence_prs": [11998],
+  "scope_hints": [
+    "backend/charts/monitoring/prometheus-stackdriver-exporter/**",
+    "backend/charts/monitoring/kube-prometheus-stack/**",
+    ".github/workflows/gcp_cloud_run_metrics_egress.yml"
+  ],
+  "status": "open"
+}

.github/failure-classes/FC-config-target-identified-by-count-not-identity.json

@@ -0,0 +1,17 @@
+{
+  "schema_version": 1,
+  "id": "FC-config-target-identified-by-count-not-identity",
+  "violated_contract": "A check that reads or rewrites one component's configuration must select that component by identity, never by asserting it is the only one present. Counting is a proxy for identity that holds only until something legitimately adds a second component, and when it breaks it rejects a correctly configured service rather than reporting real drift.",
+  "canonical_prevention": "Select the target by name or role and exclude known companions explicitly, sharing one definition of those companions with whatever attaches them. Reserve a cardinality assertion for the set that remains after companions are excluded, so the check still fails a genuinely ambiguous shape.",
+  "canonical_prevention_artifact": [
+    "backend/scripts/preflight-cloud-run-deploy.py",
+    "backend/tests/unit/test_preflight_cloud_run_deploy.py"
+  ],
+  "evidence_prs": [11998],
+  "scope_hints": [
+    "backend/scripts/preflight-cloud-run-deploy.py",
+    "backend/scripts/attach_cloud_run_gmp_sidecar.py",
+    ".github/actions/deploy-backend-stack/action.yml"
+  ],
+  "status": "open"
+}

.github/failure-classes/FC-metadata-format-validated-only-on-next-read.json

@@ -0,0 +1,17 @@
+{
+  "schema_version": 1,
+  "id": "FC-metadata-format-validated-only-on-next-read",
+  "violated_contract": "A value written into shared platform metadata must satisfy the parser of every tool that later reads that metadata, not merely the API that accepts the write. When the writing API is permissive and a different consumer is strict, the write succeeds and the failure surfaces on the next unrelated operation against the same resource, pointing away from the change that caused it.",
+  "canonical_prevention": "Write the strictest form every known consumer accepts, and assert that form in the writer's own test against the consumer's actual validation rule rather than a hand-copied expectation. Where the consumer is a vendored tool, copy its rule verbatim into the test so a vendor upgrade that tightens it fails locally instead of on the next deploy.",
+  "canonical_prevention_artifact": [
+    "backend/scripts/attach_cloud_run_gmp_sidecar.py",
+    "backend/tests/unit/test_attach_cloud_run_gmp_sidecar.py"
+  ],
+  "evidence_prs": [11998],
+  "scope_hints": [
+    "backend/scripts/attach_cloud_run_gmp_sidecar.py",
+    "backend/deploy/cloud_run_gmp_sidecar.yaml",
+    ".github/actions/deploy-backend-stack/action.yml"
+  ],
+  "status": "open"
+}

.github/failure-classes/FC-serialiser-dialect-mismatch-retypes-values.json

@@ -0,0 +1,17 @@
+{
+  "schema_version": 1,
+  "id": "FC-serialiser-dialect-mismatch-retypes-values",
+  "violated_contract": "A tool that reads another tool's serialized output, edits it, and writes it back must parse under the same dialect the producer emitted. When the reader's dialect types a plain scalar differently from the writer's, the round trip silently rewrites values the edit never touched, and the corruption is attributed to whoever reads the record next rather than to the tool that rewrote it.",
+  "canonical_prevention": "Pin the reader to the producer's dialect rather than the library default, and prove the round trip is value-preserving with a fixture copied verbatim from the producer's real output -- not a hand-written approximation, which will be written in the dialect the author already assumes.",
+  "canonical_prevention_artifact": [
+    "backend/scripts/attach_cloud_run_gmp_sidecar.py",
+    "backend/tests/unit/test_attach_cloud_run_gmp_sidecar.py"
+  ],
+  "evidence_prs": [11998],
+  "scope_hints": [
+    "backend/scripts/attach_cloud_run_gmp_sidecar.py",
+    "backend/deploy/runtime_env.yaml",
+    ".github/actions/deploy-backend-stack/action.yml"
+  ],
+  "status": "open"
+}

.github/guardrail-pulse-history.jsonl

@@ -1 +1,2 @@
 {"date": "2026-07-23", "metrics": {"brand_ui_purple": {"baseline": 1776, "count": 1776}, "deferred_work_markers": {"baseline": 837, "count": 837}, "lifecycle_unlabeled_scripts": {"baseline": 17, "count": 17}, "mapless_packages": {"baseline": 6, "count": 3}, "union_return_isinstance": {"baseline": 0, "count": 0}, "version_prefixed_files": {"baseline": 42, "count": 42}}}
+{"date": "2026-08-17", "metrics": {"brand_ui_purple": {"baseline": 1763, "count": 1763}, "deferred_work_markers": {"baseline": 829, "count": 829}, "lifecycle_unlabeled_scripts": {"baseline": 10, "count": 10}, "mapless_packages": {"baseline": 6, "count": 2}, "union_return_isinstance": {"baseline": 0, "count": 0}, "version_prefixed_files": {"baseline": 38, "count": 38}}}

.github/scripts/check-desktop-prod-promotion-policy.py

@@ -24,7 +24,8 @@
     "EXPECTED_RELEASE_ID",
     "EXPECTED_GENERATION",
     "desktop_update_channels/macos-stable",
-    "desktop_release_manifests/$RELEASE_TAG",
+    'ENCODED_RELEASE_TAG="${RELEASE_TAG/+/%2B}"',
+    "desktop_release_manifests/$ENCODED_RELEASE_TAG",
     "Publish immutable stable repair installer",
     "Advance explicit stable pointer",
     "Bridge stable for legacy desktop clients",

.github/scripts/check-mobile-production-routing.py

@@ -28,9 +28,16 @@
 RETIRED_GKE_DESKTOP_BACKEND_MARKERS = ("desktop-api.omi.me", "desktop-backend")
 GKE_WORKFLOW_MARKERS = ("gcloud container clusters", "helm ", "kubectl ")
 CLOUD_RUN_OBSERVER_ROOT = Path("backend/charts/monitoring/prometheus-stackdriver-exporter")
+# What makes one of these files an observer of Cloud Run is the monitored
+# resource it selects, not how it spells the namespace set. `__run__` is Cloud
+# Run's reserved pseudo-cluster, so these two markers together are proof; keying
+# the exemption on an exact namespace comparison instead made it collapse the
+# moment that disjunction was rewritten as one_of(...) to satisfy Cloud
+# Monitoring's filter grammar, and flagged a read-only metrics reader as retired
+# GKE ownership.
 CLOUD_RUN_OBSERVER_MARKERS = (
     "prometheus.googleapis.com/",
-    'resource.labels.namespace="desktop-backend"',
+    'resource.labels.cluster="__run__"',
 )
 LEGACY_BETA_ROUTING_PATHS = (
     "codemagic.yaml",

.github/scripts/check-release-process-guards.py

@@ -592,7 +592,7 @@ def check_desktop_codemagic_release() -> list[str]:
 
     for required_fragment in (
         "publish-desktop-debug-symbols.sh generate",
-        "publish-desktop-debug-symbols.sh upload",
+        "publish-desktop-debug-symbols.sh upload-best-effort",
         '"$DSYM_ARCHIVE"',
         "- build/*.dSYM",
         "source scripts/launcher-bootstrap.sh",