Fix review findings and harden Studio 2.2.10

[gaochangw]

Worker launch failures could leave runs retrying forever, package uploads blocked the event loop, and repeated catalog reads wasted hosted compute. This release fixes those paths, removes personal-code imports and process-argument mutation, consolidates validated storage and request helpers, atomically reserves generated dataset names, and protects malformed navigation and artifact links.

The hosted runtime gains checked source ownership, a tested capability-bounded GPU service, loopback restrictions for the tunnel identity, credential files and hash-locked dependencies. Publishing is release-only, external actions are commit-pinned, and protected changes require review of the current head. Version 2.2.10 also updates contracts, documentation and GUI screenshots.

Validation:

• 1,008 Python tests and 254 frontend tests passed; focused final regressions also passed.
• Type checking, lint, strict documentation build, wheel/sdist checks and Twine passed; source archive is 37 MiB.
• Shared sandboxed Chromium verified generation, real/IQ/complex CSV analysis, downloads, accessibility, mobile layout and malformed run links.
• Candidate image and hardened systemd CUDA probe passed. Production deployment and installed PyPI verification follow the merged revision.

The review disposition in docs/releases/review-2.2.10.md records each finding group and explicitly retains compatibility-sensitive namespace, data-contract and large-component refactors. The GPU agent still uses root-owned OCI storage; rootless migration is a documented follow-up. Default desktop dependencies and offline datasets remain as requested.

[gaochangw]

Reviewed head: 9f2ab97

Reviewed the final diff against the report, including upload cancellation/file lifetime, terminal spawn failures, catalog cache invalidation, paired-array provenance, strict request contracts, tenant retirement/GPU delivery locking, artifact navigation and release boundaries. Corrected the changed-file versus missing-file hardware error distinction, both malformed-path callers, output initialization in two backbones, and the cleanup regression's background-thread race during review.

Validation: 1,007 Python tests and 254 frontend tests passed; final focused regressions, type/lint checks, strict documentation build, packaging checks and browser workflows passed. The exact GPU runtime restrictions were exercised with a real CUDA operation. No remaining release-blocking finding in this diff was identified. Rootless hosting, namespace relocation and broader compatibility-sensitive refactors remain explicitly tracked in the release disposition.

This is an automated review recorded through the repository administrator account; it is not an independent human approval. Deployment and actual published-wheel checks remain release verification steps.

[gaochangw]

Reviewed head: 0c4dd0d

Reviewed the final diff against the report, including upload cancellation/file lifetime, terminal spawn failures, catalog cache invalidation, paired-array provenance, strict request contracts, tenant retirement/GPU delivery locking, artifact navigation and release boundaries. Corrected the changed-file versus missing-file hardware error distinction, both malformed-path callers, output initialization in two backbones, and the cleanup regression's background-thread race during review.

Validation: 1,007 Python tests and 254 frontend tests passed; final focused regressions, type/lint checks, strict documentation build, packaging checks and browser workflows passed. The exact GPU runtime restrictions were exercised with a real CUDA operation. No remaining release-blocking finding in this diff was identified. Rootless hosting, namespace relocation and broader compatibility-sensitive refactors remain explicitly tracked in the release disposition.

This is an automated review recorded through the repository administrator account; it is not an independent human approval. Deployment and actual published-wheel checks remain release verification steps.

Follow-up review: production now eliminates the developer gallery module entirely. Browser and touch test configurations build fixtures only in an explicit test mode. Verified the production artifact has no GalleryPage chunk and rendered both spectrum and IQ fixtures through the shared sandboxed browser.

[gaochangw]

Reviewed head: 9f75b74

Reviewed the final diff against the report, including upload cancellation/file lifetime, terminal spawn failures, catalog cache invalidation, paired-array provenance, strict request contracts, tenant retirement/GPU delivery locking, artifact navigation and release boundaries. Corrected the changed-file versus missing-file hardware error distinction, both malformed-path callers, output initialization in two backbones, and the cleanup regression's background-thread race during review.

Validation: 1,007 Python tests and 254 frontend tests passed; final focused regressions, type/lint checks, strict documentation build, packaging checks and browser workflows passed. The exact GPU runtime restrictions were exercised with a real CUDA operation. No remaining release-blocking finding in this diff was identified. Rootless hosting, namespace relocation and broader compatibility-sensitive refactors remain explicitly tracked in the release disposition.

This is an automated review recorded through the repository administrator account; it is not an independent human approval. Deployment and actual published-wheel checks remain release verification steps.

Follow-up review: production now eliminates the developer gallery module entirely. Browser and touch test configurations build fixtures only in an explicit test mode. Verified the production artifact has no GalleryPage chunk and rendered both spectrum and IQ fixtures through the shared sandboxed browser.

The final CI adjustment checks the actual packaged asset directory and bounds BLAS/OpenMP threads consistently with the local regression run. No runtime behavior changed in this adjustment.

[gaochangw]

Reviewed head: a4ff155

Reviewed the final diff against the report, including upload cancellation/file lifetime, terminal spawn failures, catalog cache invalidation, paired-array provenance, strict request contracts, tenant retirement/GPU delivery locking, artifact navigation and release boundaries. Corrected the changed-file versus missing-file hardware error distinction, both malformed-path callers, output initialization in two backbones, and the cleanup regression's background-thread race during review.

Validation: 1,007 Python tests and 254 frontend tests passed; final focused regressions, type/lint checks, strict documentation build, packaging checks and browser workflows passed. The exact GPU runtime restrictions were exercised with a real CUDA operation. No remaining release-blocking finding in this diff was identified. Rootless hosting, namespace relocation and broader compatibility-sensitive refactors remain explicitly tracked in the release disposition.

This is an automated review recorded through the repository administrator account; it is not an independent human approval. Deployment and actual published-wheel checks remain release verification steps.

Follow-up review: production now eliminates the developer gallery module entirely. Browser and touch test configurations build fixtures only in an explicit test mode. Verified the production artifact has no GalleryPage chunk and rendered both spectrum and IQ fixtures through the shared sandboxed browser.

The final CI adjustment checks the actual packaged asset directory and bounds BLAS/OpenMP threads consistently with the local regression run. No runtime behavior changed in this adjustment.

Reviewed the array-import follow-up: name ownership is now claimed by atomic directory creation before writing any samples; a conflicting request exits before cleanup can touch the owning request. The new stale-existence regression and 46 public-boundary plus 14 generator/PA/import focused tests pass.