From eb7ebb534c9ec45f7043cf1893e5fc1d5b1ad7d0 Mon Sep 17 00:00:00 2001
From: Aditya Vikram Singh <247195684+avs-io@users.noreply.github.com>
Date: Thu, 13 Aug 2026 19:33:26 +0530
Subject: [PATCH 1/7] ci(desktop): guard Windows installer artifacts

---
 .github/workflows/build-windows-installer.yml | 60 ++++++++++++
 app/DISTRIBUTION.md                           | 46 ++++++----
 app/scripts/verify-windows-installer.mjs      | 64 +++++++++++++
 app/scripts/verify-windows-installer.test.ts  | 92 +++++++++++++++++++
 4 files changed, 243 insertions(+), 19 deletions(-)
 create mode 100644 .github/workflows/build-windows-installer.yml
 create mode 100644 app/scripts/verify-windows-installer.mjs
 create mode 100644 app/scripts/verify-windows-installer.test.ts

diff --git a/.github/workflows/build-windows-installer.yml b/.github/workflows/build-windows-installer.yml
new file mode 100644
index 00000000..7638a707
--- /dev/null
+++ b/.github/workflows/build-windows-installer.yml
@@ -0,0 +1,60 @@
+name: Build Windows installer
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - .github/workflows/build-windows-installer.yml
+      - app/**
+      - src/**
+      - scripts/**
+      - package.json
+      - package-lock.json
+  push:
+    tags:
+      - 'desktop-v*'
+
+permissions:
+  contents: read
+
+jobs:
+  nsis:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22.13.0
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            app/package-lock.json
+
+      - name: Install CLI dependencies
+        run: npm ci
+
+      - name: Install desktop dependencies
+        run: npm ci --prefix app
+
+      - name: Build NSIS installer
+        run: npm --prefix app run package:win
+
+      - name: Verify installer manifest
+        shell: pwsh
+        run: |
+          if ($env:GITHUB_REF_TYPE -eq 'tag') {
+            node app/scripts/verify-windows-installer.mjs --tag $env:GITHUB_REF_NAME
+          } else {
+            node app/scripts/verify-windows-installer.mjs
+          }
+
+      - name: Upload installer artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: CodeBurn-Windows-Installer
+          path: |
+            app/release/CodeBurn-Setup-*.exe
+            app/release/CodeBurn-Setup-*.exe.blockmap
+          if-no-files-found: error
+          retention-days: 14
diff --git a/app/DISTRIBUTION.md b/app/DISTRIBUTION.md
index 69165022..94255dac 100644
--- a/app/DISTRIBUTION.md
+++ b/app/DISTRIBUTION.md
@@ -3,10 +3,10 @@
 This document describes how to produce distributable macOS, Windows, and Linux
 builds of the Electron desktop app. The macOS build is ad-hoc-signed and
 **not notarized** (no paid Apple Developer account); the Windows and Linux
-builds are **unsigned**. There is no CI automation for any of this yet (unlike
-the CLI and menubar release processes in `../RELEASING.md`) — packaging is run
-by hand on a maintainer's machine. All three targets are produced by
-`electron-builder` and can be cross-built from a single macOS host.
+builds are **unsigned**. Windows NSIS packages are built and checked by the
+`Build Windows installer` GitHub Actions workflow; the other desktop packages
+are still produced by hand. All three targets are produced by
+`electron-builder`.
 
 ## The bundled CLI (no install prerequisite)
 
@@ -161,12 +161,11 @@ the NSIS and AppImage tooling on first run.
 
 ### Windows (`package:win`)
 
-`electron-builder --win` produces a single artifact in `app/release/`:
+`electron-builder --win` produces a single installer in `app/release/`:
 
-- **`CodeBurn Setup 0.9.15.exe`** — the NSIS installer (the version number
-  tracks `package.json`; note the spaces in the filename). A `.exe.blockmap`
-  is written alongside it (differential-update metadata, unused — no
-  auto-updater yet).
+- **`CodeBurn-Setup-0.9.15.exe`** — the NSIS installer (the version number
+  tracks `package.json`). A `.exe.blockmap` is written alongside it
+  (differential-update metadata, unused — no auto-updater yet).
 
 Config (`build.win` + `build.nsis`):
 
@@ -236,8 +235,7 @@ taskbar/dock; it does not affect packaging or launch.
 
 ## Releases
 
-There is no release CI for the desktop app yet (see the note at the top). When
-a maintainer cuts a desktop release by hand, the GitHub tag convention is:
+When a maintainer cuts a desktop release, the GitHub tag convention is:
 
 ```
 desktop-v<version>      # e.g. desktop-v0.9.15
@@ -245,14 +243,24 @@ desktop-v<version>      # e.g. desktop-v0.9.15
 
 This mirrors the menubar's `mac-v<version>` convention (see `../RELEASING.md`)
 and keeps the desktop app's tags in their own namespace, separate from the CLI
-(`v<version>`) and the menubar (`mac-v<version>`). Upload all of the artifacts
-above — the four macOS `.dmg`/`.zip` files, `CodeBurn-Setup-<version>.exe`,
-and `CodeBurn-<version>.AppImage` — to the GitHub Release created at that
-tag. The website's download links **pin that tag** in their URLs, so the
-release name and the artifact filenames must match exactly. (The Windows
-installer uses an explicit `nsis.artifactName` of
-`CodeBurn-Setup-${version}.${ext}` — electron-builder's default contains
-spaces, which make ugly percent-encoded URLs.)
+(`v<version>`) and the menubar (`mac-v<version>`).
+
+Pushing a `desktop-v<version>` tag runs the `Build Windows installer` workflow
+on `windows-latest`. The workflow requires the tag version, root package
+version, and app package version to agree, and it fails unless the build emits
+exactly one `CodeBurn-Setup-<version>.exe` and one matching
+`.exe.blockmap`. It uploads both files as the `CodeBurn-Windows-Installer`
+Actions artifact. The workflow has read-only repository permissions and does
+**not** publish release assets automatically.
+
+Before publishing the GitHub Release, the release owner must download that
+workflow artifact and manually upload both Windows files along with the four
+macOS `.dmg`/`.zip` files and `CodeBurn-<version>.AppImage`. Confirm the live
+release contains every required platform asset before announcing it. The
+website's download links **pin that tag** in their URLs, so a release with a
+missing installer is broken even when another Windows distribution channel is
+available. The Windows installer uses an explicit `nsis.artifactName` of
+`CodeBurn-Setup-${version}.${ext}`.
 
 ## Verifying a build
 
diff --git a/app/scripts/verify-windows-installer.mjs b/app/scripts/verify-windows-installer.mjs
new file mode 100644
index 00000000..a135eb61
--- /dev/null
+++ b/app/scripts/verify-windows-installer.mjs
@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+
+import { readFileSync, readdirSync } from 'node:fs'
+import { basename, join, resolve } from 'node:path'
+
+function fail(message) {
+  console.error(`Windows installer manifest invalid: ${message}`)
+  process.exitCode = 1
+}
+
+function option(name, fallback) {
+  const index = process.argv.indexOf(name)
+  if (index === -1) return fallback
+  if (!process.argv[index + 1]) throw new Error(`${name} requires a value`)
+  return process.argv[index + 1]
+}
+
+function packageVersion(path) {
+  return JSON.parse(readFileSync(path, 'utf8')).version
+}
+
+function filesBelow(directory) {
+  return readdirSync(directory, { recursive: true, withFileTypes: true })
+    .filter(entry => entry.isFile())
+    .map(entry => basename(entry.name))
+}
+
+try {
+  const root = resolve(option('--root', new URL('../..', import.meta.url).pathname))
+  const artifacts = resolve(option('--artifacts', join(root, 'app', 'release')))
+  const tag = option('--tag', '')
+  const rootVersion = packageVersion(join(root, 'package.json'))
+  const appVersion = packageVersion(join(root, 'app', 'package.json'))
+
+  if (rootVersion !== appVersion) {
+    fail(`root version ${rootVersion} does not match app version ${appVersion}`)
+  }
+
+  if (tag && tag !== `desktop-v${appVersion}`) {
+    fail(`${tag} does not match app version ${appVersion}`)
+  }
+
+  const files = filesBelow(artifacts)
+  const expectedArtifacts = [
+    `CodeBurn-Setup-${appVersion}.exe`,
+    `CodeBurn-Setup-${appVersion}.exe.blockmap`,
+  ]
+  for (const expected of expectedArtifacts) {
+    const count = files.filter(file => file === expected).length
+    if (count !== 1) fail(`expected exactly one ${expected}, found ${count}`)
+  }
+
+  const installerArtifacts = files.filter(file => /^CodeBurn-Setup-.*\.exe(?:\.blockmap)?$/.test(file))
+  const unexpected = installerArtifacts.filter(file => !expectedArtifacts.includes(file))
+  if (unexpected.length > 0) {
+    fail(`unexpected Windows installer artifacts: ${unexpected.join(', ')}`)
+  }
+
+  if (!process.exitCode) {
+    console.log(`Windows installer manifest verified for ${appVersion}`)
+  }
+} catch (error) {
+  fail(error instanceof Error ? error.message : String(error))
+}
diff --git a/app/scripts/verify-windows-installer.test.ts b/app/scripts/verify-windows-installer.test.ts
new file mode 100644
index 00000000..b8f488fc
--- /dev/null
+++ b/app/scripts/verify-windows-installer.test.ts
@@ -0,0 +1,92 @@
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { describe, expect, it } from 'vitest'
+
+const verifier = new URL('./verify-windows-installer.mjs', import.meta.url)
+
+function fixture(options: {
+  appVersion?: string
+  rootVersion?: string
+  files?: string[]
+  tag?: string
+} = {}) {
+  const root = mkdtempSync(join(tmpdir(), 'codeburn-windows-manifest-'))
+  const appDir = join(root, 'app')
+  const releaseDir = join(appDir, 'release')
+  mkdirSync(releaseDir, { recursive: true })
+
+  const appVersion = options.appVersion ?? '1.2.3'
+  writeFileSync(join(root, 'package.json'), JSON.stringify({ version: options.rootVersion ?? appVersion }))
+  writeFileSync(join(appDir, 'package.json'), JSON.stringify({ version: appVersion }))
+  for (const file of options.files ?? [
+    `CodeBurn-Setup-${appVersion}.exe`,
+    `CodeBurn-Setup-${appVersion}.exe.blockmap`,
+  ]) {
+    const path = join(releaseDir, file)
+    mkdirSync(join(path, '..'), { recursive: true })
+    writeFileSync(path, 'fixture')
+  }
+
+  const args = [verifier.pathname, '--root', root, '--artifacts', releaseDir]
+  if (options.tag) args.push('--tag', options.tag)
+  return spawnSync(process.execPath, args, { encoding: 'utf8' })
+}
+
+describe('Windows installer release manifest verifier', () => {
+  it('accepts one exact installer and blockmap for matching package versions and tag', () => {
+    const result = fixture({ tag: 'desktop-v1.2.3' })
+
+    expect(result.status).toBe(0)
+    expect(result.stdout).toContain('Windows installer manifest verified for 1.2.3')
+  })
+
+  it('rejects a desktop tag that does not match the app version', () => {
+    const result = fixture({ tag: 'desktop-v1.2.4' })
+
+    expect(result.status).toBe(1)
+    expect(result.stderr).toContain('desktop-v1.2.4 does not match app version 1.2.3')
+  })
+
+  it('rejects divergent root and app versions', () => {
+    const result = fixture({ rootVersion: '1.2.2' })
+
+    expect(result.status).toBe(1)
+    expect(result.stderr).toContain('root version 1.2.2 does not match app version 1.2.3')
+  })
+
+  it('rejects a missing installer blockmap', () => {
+    const result = fixture({ files: ['CodeBurn-Setup-1.2.3.exe'] })
+
+    expect(result.status).toBe(1)
+    expect(result.stderr).toContain('expected exactly one CodeBurn-Setup-1.2.3.exe.blockmap, found 0')
+  })
+
+  it('rejects duplicate expected artifacts in nested output directories', () => {
+    const result = fixture({
+      files: [
+        'CodeBurn-Setup-1.2.3.exe',
+        'CodeBurn-Setup-1.2.3.exe.blockmap',
+        'duplicate/CodeBurn-Setup-1.2.3.exe',
+      ],
+    })
+
+    expect(result.status).toBe(1)
+    expect(result.stderr).toContain('expected exactly one CodeBurn-Setup-1.2.3.exe, found 2')
+  })
+
+  it('rejects stale installer artifacts from another version', () => {
+    const result = fixture({
+      files: [
+        'CodeBurn-Setup-1.2.3.exe',
+        'CodeBurn-Setup-1.2.3.exe.blockmap',
+        'CodeBurn-Setup-1.2.2.exe',
+        'CodeBurn-Setup-1.2.2.exe.blockmap',
+      ],
+    })
+
+    expect(result.status).toBe(1)
+    expect(result.stderr).toContain('unexpected Windows installer artifacts')
+  })
+})

From fe6d18357374a7f35d7d1789fa9e8bc4fe4c20d1 Mon Sep 17 00:00:00 2001
From: Aditya Vikram Singh <247195684+avs-io@users.noreply.github.com>
Date: Thu, 13 Aug 2026 19:47:31 +0530
Subject: [PATCH 2/7] fix(release): harden Windows installer verification

---
 .github/workflows/build-windows-installer.yml | 30 +++++-
 RELEASING.md                                  |  4 +-
 app/DISTRIBUTION.md                           |  9 +-
 app/scripts/verify-windows-installer.mjs      | 91 +++++++++++++------
 app/scripts/verify-windows-installer.test.ts  | 55 ++++++++++-
 app/scripts/windows-installer-paths.d.mts     |  1 +
 app/scripts/windows-installer-paths.mjs       |  8 ++
 7 files changed, 163 insertions(+), 35 deletions(-)
 create mode 100644 app/scripts/windows-installer-paths.d.mts
 create mode 100644 app/scripts/windows-installer-paths.mjs

diff --git a/.github/workflows/build-windows-installer.yml b/.github/workflows/build-windows-installer.yml
index 7638a707..8373e4a2 100644
--- a/.github/workflows/build-windows-installer.yml
+++ b/.github/workflows/build-windows-installer.yml
@@ -2,6 +2,11 @@ name: Build Windows installer
 
 on:
   workflow_dispatch:
+    inputs:
+      release_tag:
+        description: Existing desktop-v* release to verify after manual asset upload
+        required: false
+        type: string
   pull_request:
     paths:
       - .github/workflows/build-windows-installer.yml
@@ -13,12 +18,15 @@ on:
   push:
     tags:
       - 'desktop-v*'
+  release:
+    types: [published]
 
 permissions:
   contents: read
 
 jobs:
   nsis:
+    if: ${{ github.event_name != 'release' && !(github.event_name == 'workflow_dispatch' && inputs.release_tag != '') }}
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v6
@@ -37,6 +45,9 @@ jobs:
       - name: Install desktop dependencies
         run: npm ci --prefix app
 
+      - name: Test installer verifier
+        run: npm --prefix app test -- scripts/verify-windows-installer.test.ts
+
       - name: Build NSIS installer
         run: npm --prefix app run package:win
 
@@ -57,4 +68,21 @@ jobs:
             app/release/CodeBurn-Setup-*.exe
             app/release/CodeBurn-Setup-*.exe.blockmap
           if-no-files-found: error
-          retention-days: 14
+          retention-days: 30
+
+  verify-release-assets:
+    if: ${{ (github.event_name == 'release' && startsWith(github.event.release.tag_name, 'desktop-v')) || (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Verify live desktop release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.event.release.tag_name || inputs.release_tag }}
+        run: |
+          gh api "repos/${{ github.repository }}/releases/tags/$RELEASE_TAG" \
+            --jq '[.assets[].name]' > "$RUNNER_TEMP/release-assets.json"
+          node app/scripts/verify-windows-installer.mjs \
+            --tag "$RELEASE_TAG" \
+            --release-assets "$RUNNER_TEMP/release-assets.json"
diff --git a/RELEASING.md b/RELEASING.md
index df1c6754..ab14983c 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -2,7 +2,9 @@
 
 This document describes the actual steps a maintainer takes to cut a CLI or macOS menubar release. CLI releases are run by hand with `npm publish`; macOS menubar releases are automated by `.github/workflows/release-menubar.yml` when a `mac-v*` tag is pushed.
 
-The Electron desktop app (`app/`) has no CI automation yet, but it is released manually under `desktop-v<version>` tags: build the artifacts on a macOS host (see `app/DISTRIBUTION.md`) and `gh release upload desktop-v<version> … --clobber` them onto the release. See `app/DISTRIBUTION.md` for how to build and distribute it as an ad-hoc-signed, non-notarized macOS build (plus unsigned Windows and Linux builds).
+The Electron desktop app (`app/`) is released manually under `desktop-v<version>` tags. Build macOS and Linux artifacts as described in `app/DISTRIBUTION.md`; the tag also runs the read-only `Build Windows installer` workflow on `windows-latest`. Download its `CodeBurn-Windows-Installer` artifact and upload both the `.exe` and `.exe.blockmap` with the other platform assets. The workflow never publishes release assets.
+
+Before announcing a desktop release, the release owner must confirm the live GitHub Release contains all four macOS `.dmg`/`.zip` files, the Linux `.AppImage`, and both Windows installer files. Publishing the Release runs the workflow's read-only live-asset verification job. If assets are uploaded after publication, rerun `Build Windows installer` with the `release_tag` input and require that verification job to pass. A failed or missing verification is a release blocker.
 
 ## Versioning
 
diff --git a/app/DISTRIBUTION.md b/app/DISTRIBUTION.md
index 94255dac..5fedd46d 100644
--- a/app/DISTRIBUTION.md
+++ b/app/DISTRIBUTION.md
@@ -249,9 +249,10 @@ Pushing a `desktop-v<version>` tag runs the `Build Windows installer` workflow
 on `windows-latest`. The workflow requires the tag version, root package
 version, and app package version to agree, and it fails unless the build emits
 exactly one `CodeBurn-Setup-<version>.exe` and one matching
-`.exe.blockmap`. It uploads both files as the `CodeBurn-Windows-Installer`
+`.exe.blockmap` at the top level of `app/release/`. It uploads those exact
+top-level filenames as the `CodeBurn-Windows-Installer`
 Actions artifact. The workflow has read-only repository permissions and does
-**not** publish release assets automatically.
+**not** publish release assets automatically. Artifacts are retained for 30 days.
 
 Before publishing the GitHub Release, the release owner must download that
 workflow artifact and manually upload both Windows files along with the four
@@ -262,6 +263,10 @@ missing installer is broken even when another Windows distribution channel is
 available. The Windows installer uses an explicit `nsis.artifactName` of
 `CodeBurn-Setup-${version}.${ext}`.
 
+Publishing the Release triggers a read-only live-asset check. If the files are
+uploaded afterward, rerun the workflow manually with `release_tag` set to the
+existing `desktop-v<version>` tag and require the verification job to pass.
+
 ## Verifying a build
 
 ```sh
diff --git a/app/scripts/verify-windows-installer.mjs b/app/scripts/verify-windows-installer.mjs
index a135eb61..dfd4b18a 100644
--- a/app/scripts/verify-windows-installer.mjs
+++ b/app/scripts/verify-windows-installer.mjs
@@ -2,6 +2,7 @@
 
 import { readFileSync, readdirSync } from 'node:fs'
 import { basename, join, resolve } from 'node:path'
+import { rootFromModuleUrl } from './windows-installer-paths.mjs'
 
 function fail(message) {
   console.error(`Windows installer manifest invalid: ${message}`)
@@ -20,44 +21,78 @@ function packageVersion(path) {
 }
 
 function filesBelow(directory) {
-  return readdirSync(directory, { recursive: true, withFileTypes: true })
+  return readdirSync(directory, { withFileTypes: true })
     .filter(entry => entry.isFile())
     .map(entry => basename(entry.name))
 }
 
-try {
-  const root = resolve(option('--root', new URL('../..', import.meta.url).pathname))
-  const artifacts = resolve(option('--artifacts', join(root, 'app', 'release')))
-  const tag = option('--tag', '')
-  const rootVersion = packageVersion(join(root, 'package.json'))
-  const appVersion = packageVersion(join(root, 'app', 'package.json'))
+function releaseVersion(tag) {
+  const match = /^desktop-v(.+)$/.exec(tag)
+  if (!match) throw new Error(`${tag || '(missing tag)'} is not a desktop release tag`)
+  return match[1]
+}
 
-  if (rootVersion !== appVersion) {
-    fail(`root version ${rootVersion} does not match app version ${appVersion}`)
+function verifyLiveRelease(tag, assetPath) {
+  const version = releaseVersion(tag)
+  const assets = JSON.parse(readFileSync(assetPath, 'utf8'))
+  if (!Array.isArray(assets) || assets.some(asset => typeof asset !== 'string')) {
+    throw new Error('release asset manifest must be a JSON array of names')
   }
-
-  if (tag && tag !== `desktop-v${appVersion}`) {
-    fail(`${tag} does not match app version ${appVersion}`)
-  }
-
-  const files = filesBelow(artifacts)
-  const expectedArtifacts = [
-    `CodeBurn-Setup-${appVersion}.exe`,
-    `CodeBurn-Setup-${appVersion}.exe.blockmap`,
+  const required = [
+    `CodeBurn-${version}-arm64.dmg`,
+    `CodeBurn-${version}.dmg`,
+    `CodeBurn-${version}-arm64-mac.zip`,
+    `CodeBurn-${version}-mac.zip`,
+    `CodeBurn-${version}.AppImage`,
+    `CodeBurn-Setup-${version}.exe`,
+    `CodeBurn-Setup-${version}.exe.blockmap`,
   ]
-  for (const expected of expectedArtifacts) {
-    const count = files.filter(file => file === expected).length
-    if (count !== 1) fail(`expected exactly one ${expected}, found ${count}`)
+  for (const expected of required) {
+    const count = assets.filter(asset => asset === expected).length
+    if (count === 0) fail(`live release is missing ${expected}`)
+    if (count > 1) fail(`live release contains ${count} copies of ${expected}`)
   }
+  if (!process.exitCode) console.log(`Live desktop release assets verified for ${version}`)
+}
 
-  const installerArtifacts = files.filter(file => /^CodeBurn-Setup-.*\.exe(?:\.blockmap)?$/.test(file))
-  const unexpected = installerArtifacts.filter(file => !expectedArtifacts.includes(file))
-  if (unexpected.length > 0) {
-    fail(`unexpected Windows installer artifacts: ${unexpected.join(', ')}`)
-  }
+try {
+  const tag = option('--tag', '')
+  const releaseAssets = option('--release-assets', '')
+  if (releaseAssets) {
+    verifyLiveRelease(tag, resolve(releaseAssets))
+  } else {
+    const root = resolve(option('--root', rootFromModuleUrl(import.meta.url)))
+    const artifacts = resolve(option('--artifacts', join(root, 'app', 'release')))
+    const rootVersion = packageVersion(join(root, 'package.json'))
+    const appVersion = packageVersion(join(root, 'app', 'package.json'))
 
-  if (!process.exitCode) {
-    console.log(`Windows installer manifest verified for ${appVersion}`)
+    if (rootVersion !== appVersion) {
+      fail(`root version ${rootVersion} does not match app version ${appVersion}`)
+    }
+
+    if (tag && tag !== `desktop-v${appVersion}`) {
+      fail(`${tag} does not match app version ${appVersion}`)
+    }
+
+    const files = filesBelow(artifacts)
+    const expectedArtifacts = [
+      `CodeBurn-Setup-${appVersion}.exe`,
+      `CodeBurn-Setup-${appVersion}.exe.blockmap`,
+    ]
+    for (const expected of expectedArtifacts) {
+      const count = files.filter(file => file === expected).length
+      if (count !== 1) fail(`expected exactly one ${expected}, found ${count}`)
+    }
+
+    const installerArtifacts = files.filter(file => /^CodeBurn-Setup-.*\.exe(?:\.blockmap)?$/.test(file))
+    const unexpected = installerArtifacts.filter(file => !expectedArtifacts.includes(file))
+    if (unexpected.length > 0) {
+      fail(`unexpected Windows installer artifacts: ${unexpected.join(', ')}`)
+    }
+
+    if (!process.exitCode) {
+      console.log(`Windows installer manifest verified for ${appVersion}`)
+    }
   }
 } catch (error) {
   fail(error instanceof Error ? error.message : String(error))
diff --git a/app/scripts/verify-windows-installer.test.ts b/app/scripts/verify-windows-installer.test.ts
index b8f488fc..0c63c4f0 100644
--- a/app/scripts/verify-windows-installer.test.ts
+++ b/app/scripts/verify-windows-installer.test.ts
@@ -3,6 +3,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { describe, expect, it } from 'vitest'
+import { rootFromModuleUrl } from './windows-installer-paths.mjs'
 
 const verifier = new URL('./verify-windows-installer.mjs', import.meta.url)
 
@@ -34,7 +35,27 @@ function fixture(options: {
   return spawnSync(process.execPath, args, { encoding: 'utf8' })
 }
 
+function releaseFixture(files: string[]) {
+  const root = mkdtempSync(join(tmpdir(), 'codeburn-windows-release-'))
+  const assets = join(root, 'assets.json')
+  writeFileSync(assets, JSON.stringify(files))
+  return spawnSync(process.execPath, [
+    verifier.pathname,
+    '--tag',
+    'desktop-v1.2.3',
+    '--release-assets',
+    assets,
+  ], { encoding: 'utf8' })
+}
+
 describe('Windows installer release manifest verifier', () => {
+  it('converts a Windows module URL into a valid drive-letter repository root', () => {
+    expect(rootFromModuleUrl(
+      'file:///D:/a/codeburn/codeburn/app/scripts/verify-windows-installer.mjs',
+      true,
+    )).toBe('D:\\a\\codeburn\\codeburn')
+  })
+
   it('accepts one exact installer and blockmap for matching package versions and tag', () => {
     const result = fixture({ tag: 'desktop-v1.2.3' })
 
@@ -63,17 +84,16 @@ describe('Windows installer release manifest verifier', () => {
     expect(result.stderr).toContain('expected exactly one CodeBurn-Setup-1.2.3.exe.blockmap, found 0')
   })
 
-  it('rejects duplicate expected artifacts in nested output directories', () => {
+  it('requires installer artifacts at the documented top-level output', () => {
     const result = fixture({
       files: [
-        'CodeBurn-Setup-1.2.3.exe',
         'CodeBurn-Setup-1.2.3.exe.blockmap',
         'duplicate/CodeBurn-Setup-1.2.3.exe',
       ],
     })
 
     expect(result.status).toBe(1)
-    expect(result.stderr).toContain('expected exactly one CodeBurn-Setup-1.2.3.exe, found 2')
+    expect(result.stderr).toContain('expected exactly one CodeBurn-Setup-1.2.3.exe, found 0')
   })
 
   it('rejects stale installer artifacts from another version', () => {
@@ -89,4 +109,33 @@ describe('Windows installer release manifest verifier', () => {
     expect(result.status).toBe(1)
     expect(result.stderr).toContain('unexpected Windows installer artifacts')
   })
+
+  it('accepts a complete live desktop release asset manifest', () => {
+    const result = releaseFixture([
+      'CodeBurn-1.2.3-arm64.dmg',
+      'CodeBurn-1.2.3.dmg',
+      'CodeBurn-1.2.3-arm64-mac.zip',
+      'CodeBurn-1.2.3-mac.zip',
+      'CodeBurn-1.2.3.AppImage',
+      'CodeBurn-Setup-1.2.3.exe',
+      'CodeBurn-Setup-1.2.3.exe.blockmap',
+    ])
+
+    expect(result.status).toBe(0)
+    expect(result.stdout).toContain('Live desktop release assets verified for 1.2.3')
+  })
+
+  it('rejects a live desktop release missing the Windows installer', () => {
+    const result = releaseFixture([
+      'CodeBurn-1.2.3-arm64.dmg',
+      'CodeBurn-1.2.3.dmg',
+      'CodeBurn-1.2.3-arm64-mac.zip',
+      'CodeBurn-1.2.3-mac.zip',
+      'CodeBurn-1.2.3.AppImage',
+      'CodeBurn-Setup-1.2.3.exe.blockmap',
+    ])
+
+    expect(result.status).toBe(1)
+    expect(result.stderr).toContain('live release is missing CodeBurn-Setup-1.2.3.exe')
+  })
 })
diff --git a/app/scripts/windows-installer-paths.d.mts b/app/scripts/windows-installer-paths.d.mts
new file mode 100644
index 00000000..7074fa43
--- /dev/null
+++ b/app/scripts/windows-installer-paths.d.mts
@@ -0,0 +1 @@
+export function rootFromModuleUrl(moduleUrl: string | URL, windows?: boolean): string
diff --git a/app/scripts/windows-installer-paths.mjs b/app/scripts/windows-installer-paths.mjs
new file mode 100644
index 00000000..b2b0eb45
--- /dev/null
+++ b/app/scripts/windows-installer-paths.mjs
@@ -0,0 +1,8 @@
+import { posix, win32 } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+export function rootFromModuleUrl(moduleUrl, windows = process.platform === 'win32') {
+  const path = windows ? win32 : posix
+  const scriptPath = fileURLToPath(moduleUrl, { windows })
+  return path.resolve(path.dirname(scriptPath), '..', '..')
+}

From 864991fe3fdca280c9dd695d95a3eef478a50c5c Mon Sep 17 00:00:00 2001
From: Aditya Vikram Singh <247195684+avs-io@users.noreply.github.com>
Date: Thu, 13 Aug 2026 20:01:00 +0530
Subject: [PATCH 3/7] fix(release): verify all desktop assets

---
 RELEASING.md                                 |  2 +-
 app/DISTRIBUTION.md                          |  6 ++--
 app/scripts/verify-windows-installer.mjs     |  2 ++
 app/scripts/verify-windows-installer.test.ts | 31 ++++++++++++++++++--
 4 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/RELEASING.md b/RELEASING.md
index ab14983c..83f739a2 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -4,7 +4,7 @@ This document describes the actual steps a maintainer takes to cut a CLI or macO
 
 The Electron desktop app (`app/`) is released manually under `desktop-v<version>` tags. Build macOS and Linux artifacts as described in `app/DISTRIBUTION.md`; the tag also runs the read-only `Build Windows installer` workflow on `windows-latest`. Download its `CodeBurn-Windows-Installer` artifact and upload both the `.exe` and `.exe.blockmap` with the other platform assets. The workflow never publishes release assets.
 
-Before announcing a desktop release, the release owner must confirm the live GitHub Release contains all four macOS `.dmg`/`.zip` files, the Linux `.AppImage`, and both Windows installer files. Publishing the Release runs the workflow's read-only live-asset verification job. If assets are uploaded after publication, rerun `Build Windows installer` with the `release_tag` input and require that verification job to pass. A failed or missing verification is a release blocker.
+Before announcing a desktop release, the release owner must confirm the live GitHub Release contains all four macOS `.dmg`/`.zip` files, the Linux `.AppImage`, `.deb`, and `.rpm`, and both Windows installer files. Publishing the Release runs the workflow's read-only live-asset verification job. If assets are uploaded after publication, rerun `Build Windows installer` with the `release_tag` input and require that verification job to pass. A failed or missing verification is a release blocker.
 
 ## Versioning
 
diff --git a/app/DISTRIBUTION.md b/app/DISTRIBUTION.md
index 5fedd46d..431c1900 100644
--- a/app/DISTRIBUTION.md
+++ b/app/DISTRIBUTION.md
@@ -256,8 +256,10 @@ Actions artifact. The workflow has read-only repository permissions and does
 
 Before publishing the GitHub Release, the release owner must download that
 workflow artifact and manually upload both Windows files along with the four
-macOS `.dmg`/`.zip` files and `CodeBurn-<version>.AppImage`. Confirm the live
-release contains every required platform asset before announcing it. The
+macOS `.dmg`/`.zip` files, `CodeBurn-<version>.AppImage`,
+`codeburn-desktop_<version>_amd64.deb`, and
+`codeburn-desktop-<version>.x86_64.rpm`. Confirm the live release contains
+every required platform asset before announcing it. The
 website's download links **pin that tag** in their URLs, so a release with a
 missing installer is broken even when another Windows distribution channel is
 available. The Windows installer uses an explicit `nsis.artifactName` of
diff --git a/app/scripts/verify-windows-installer.mjs b/app/scripts/verify-windows-installer.mjs
index dfd4b18a..84d499e6 100644
--- a/app/scripts/verify-windows-installer.mjs
+++ b/app/scripts/verify-windows-installer.mjs
@@ -44,6 +44,8 @@ function verifyLiveRelease(tag, assetPath) {
     `CodeBurn-${version}-arm64-mac.zip`,
     `CodeBurn-${version}-mac.zip`,
     `CodeBurn-${version}.AppImage`,
+    `codeburn-desktop_${version}_amd64.deb`,
+    `codeburn-desktop-${version}.x86_64.rpm`,
     `CodeBurn-Setup-${version}.exe`,
     `CodeBurn-Setup-${version}.exe.blockmap`,
   ]
diff --git a/app/scripts/verify-windows-installer.test.ts b/app/scripts/verify-windows-installer.test.ts
index 0c63c4f0..2dd252f8 100644
--- a/app/scripts/verify-windows-installer.test.ts
+++ b/app/scripts/verify-windows-installer.test.ts
@@ -2,10 +2,12 @@ import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
 import { describe, expect, it } from 'vitest'
 import { rootFromModuleUrl } from './windows-installer-paths.mjs'
 
 const verifier = new URL('./verify-windows-installer.mjs', import.meta.url)
+const verifierPath = fileURLToPath(verifier)
 
 function fixture(options: {
   appVersion?: string
@@ -30,7 +32,7 @@ function fixture(options: {
     writeFileSync(path, 'fixture')
   }
 
-  const args = [verifier.pathname, '--root', root, '--artifacts', releaseDir]
+  const args = [verifierPath, '--root', root, '--artifacts', releaseDir]
   if (options.tag) args.push('--tag', options.tag)
   return spawnSync(process.execPath, args, { encoding: 'utf8' })
 }
@@ -40,7 +42,7 @@ function releaseFixture(files: string[]) {
   const assets = join(root, 'assets.json')
   writeFileSync(assets, JSON.stringify(files))
   return spawnSync(process.execPath, [
-    verifier.pathname,
+    verifierPath,
     '--tag',
     'desktop-v1.2.3',
     '--release-assets',
@@ -117,6 +119,8 @@ describe('Windows installer release manifest verifier', () => {
       'CodeBurn-1.2.3-arm64-mac.zip',
       'CodeBurn-1.2.3-mac.zip',
       'CodeBurn-1.2.3.AppImage',
+      'codeburn-desktop_1.2.3_amd64.deb',
+      'codeburn-desktop-1.2.3.x86_64.rpm',
       'CodeBurn-Setup-1.2.3.exe',
       'CodeBurn-Setup-1.2.3.exe.blockmap',
     ])
@@ -132,10 +136,33 @@ describe('Windows installer release manifest verifier', () => {
       'CodeBurn-1.2.3-arm64-mac.zip',
       'CodeBurn-1.2.3-mac.zip',
       'CodeBurn-1.2.3.AppImage',
+      'codeburn-desktop_1.2.3_amd64.deb',
+      'codeburn-desktop-1.2.3.x86_64.rpm',
       'CodeBurn-Setup-1.2.3.exe.blockmap',
     ])
 
     expect(result.status).toBe(1)
     expect(result.stderr).toContain('live release is missing CodeBurn-Setup-1.2.3.exe')
   })
+
+  it.each([
+    'codeburn-desktop_1.2.3_amd64.deb',
+    'codeburn-desktop-1.2.3.x86_64.rpm',
+  ])('rejects a live desktop release missing %s', missing => {
+    const required = [
+      'CodeBurn-1.2.3-arm64.dmg',
+      'CodeBurn-1.2.3.dmg',
+      'CodeBurn-1.2.3-arm64-mac.zip',
+      'CodeBurn-1.2.3-mac.zip',
+      'CodeBurn-1.2.3.AppImage',
+      'codeburn-desktop_1.2.3_amd64.deb',
+      'codeburn-desktop-1.2.3.x86_64.rpm',
+      'CodeBurn-Setup-1.2.3.exe',
+      'CodeBurn-Setup-1.2.3.exe.blockmap',
+    ]
+    const result = releaseFixture(required.filter(asset => asset !== missing))
+
+    expect(result.status).toBe(1)
+    expect(result.stderr).toContain(`live release is missing ${missing}`)
+  })
 })

From 8883ec44122b7f9fbbd7f205e13c684973b69a8b Mon Sep 17 00:00:00 2001
From: Aditya Vikram Singh <247195684+avs-io@users.noreply.github.com>
Date: Thu, 13 Aug 2026 20:17:28 +0530
Subject: [PATCH 4/7] docs: clarify authoritative Windows installer build

---
 RELEASING.md        |  4 ++--
 app/DISTRIBUTION.md | 15 +++++++++------
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/RELEASING.md b/RELEASING.md
index 83f739a2..be443b3d 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -1,6 +1,6 @@
 # Releasing CodeBurn
 
-This document describes the actual steps a maintainer takes to cut a CLI or macOS menubar release. CLI releases are run by hand with `npm publish`; macOS menubar releases are automated by `.github/workflows/release-menubar.yml` when a `mac-v*` tag is pushed.
+This document describes the actual steps a maintainer takes to cut CLI, macOS menubar, and Electron desktop releases. CLI releases are run by hand with `npm publish`; macOS menubar releases are automated by `.github/workflows/release-menubar.yml` when a `mac-v*` tag is pushed.
 
 The Electron desktop app (`app/`) is released manually under `desktop-v<version>` tags. Build macOS and Linux artifacts as described in `app/DISTRIBUTION.md`; the tag also runs the read-only `Build Windows installer` workflow on `windows-latest`. Download its `CodeBurn-Windows-Installer` artifact and upload both the `.exe` and `.exe.blockmap` with the other platform assets. The workflow never publishes release assets.
 
@@ -199,4 +199,4 @@ For the menubar, tag a new mac-v0.9.9 and let the workflow build and upload it.
 
 ## Summary
 
-The CLI release is manual: bump the version, update `CHANGELOG.md`, commit, run `npm publish`, then tag and create a GitHub Release. The macOS menubar release is automated: pushing a `mac-v*` tag fires `.github/workflows/release-menubar.yml`, which builds, signs, zips, and publishes the bundle. The homebrew-core formula is updated automatically or via `brew bump-formula-pr`.
+The CLI release is manual: bump the version, update `CHANGELOG.md`, commit, run `npm publish`, then tag and create a GitHub Release. The macOS menubar release is automated: pushing a `mac-v*` tag fires `.github/workflows/release-menubar.yml`, which builds, signs, zips, and publishes the bundle. The Electron desktop release is assembled manually under a `desktop-v*` tag, with the release-authoritative Windows NSIS installer built by the read-only `windows-latest` workflow. The homebrew-core formula is updated automatically or via `brew bump-formula-pr`.
diff --git a/app/DISTRIBUTION.md b/app/DISTRIBUTION.md
index 431c1900..56609fae 100644
--- a/app/DISTRIBUTION.md
+++ b/app/DISTRIBUTION.md
@@ -93,8 +93,9 @@ self-contained bundle into `app/build/cli`; see "The bundled CLI" above), then
 `vite`), then `electron-builder --mac` (whose `afterPack` hook copies the
 staged CLI into the app). `package:win` and `package:linux` mirror it exactly,
 swapping the final flag for `electron-builder --win` and `electron-builder
---linux`. All three can run on the same macOS host — electron-builder downloads
-the NSIS and AppImage tooling on first use.
+--linux`. Developers can run all three locally on the same macOS host —
+electron-builder downloads the NSIS and AppImage tooling on first use. Release
+Windows installers are built by the `windows-latest` workflow described below.
 
 ### Artifacts
 
@@ -154,10 +155,12 @@ separate `electron-builder.yml`):
 
 ## Windows and Linux builds
 
-Both are cross-built from the same macOS host used for the mac build — no
-Windows or Linux machine, and no `wine`, is required. electron-builder 26
-embeds the Windows executable's icon/version resources natively and downloads
-the NSIS and AppImage tooling on first run.
+Developers can cross-build both locally from the same macOS host used for the
+mac build — no Windows or Linux machine, and no `wine`, is required.
+Release-authoritative Windows NSIS installers are instead built by the `Build
+Windows installer` workflow on `windows-latest`. electron-builder 26 embeds the
+Windows executable's icon/version resources natively and downloads the NSIS and
+AppImage tooling on first run.
 
 ### Windows (`package:win`)
 

From d841ea59d7a61a7a2180766ccae5b716b1516d61 Mon Sep 17 00:00:00 2001
From: Aditya Vikram Singh <247195684+avs-io@users.noreply.github.com>
Date: Thu, 13 Aug 2026 20:44:11 +0530
Subject: [PATCH 5/7] fix: retain discovered durable history

---
 CHANGELOG.md              |  2 ++
 docs/providers/copilot.md |  3 ++-
 src/parser.ts             |  7 ++++---
 tests/parser.test.ts      | 37 +++++++++++++++++++++++++++++++------
 4 files changed, 39 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 477c7f4f..fc0b5e5f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- **Old durable sources remain visible while they still exist.** The 90-day session-cache age-out now applies only after a durable source disappears from discovery, so an unchanged older Copilot source keeps reporting usage and reuses its persisted fingerprint instead of being reparsed and immediately discarded. (#987)
+
 ## 0.9.20 - 2026-08-10
 
 ### Added
diff --git a/docs/providers/copilot.md b/docs/providers/copilot.md
index 478687e2..30e97421 100644
--- a/docs/providers/copilot.md
+++ b/docs/providers/copilot.md
@@ -39,7 +39,8 @@ instead of trying to dedupe across stores.
   wrong-schema, OTel is skipped and the JSONL/transcript sources are used as a fallback.
 - **Durable cache (monotonic totals).** Copilot is marked `durableSources`: OTel-derived
   cache entries are never evicted when VS Code prunes old spans from the DB, so
-  month-to-date totals do not drop as the DB rotates. Entries age out after 90 days.
+  month-to-date totals do not drop as the DB rotates. Orphaned entries age out after
+  90 days; sources still present in discovery remain cached regardless of call age.
 - **Upgrade note.** The first run after upgrading to the OTel version bumps the copilot
   parse version, which discards the prior copilot cache. Spans already pruned from the DB
   before the upgrade cannot be recovered, so monotonicity starts from the upgrade point,
diff --git a/src/parser.ts b/src/parser.ts
index 712295b0..bdeae348 100644
--- a/src/parser.ts
+++ b/src/parser.ts
@@ -3039,8 +3039,9 @@ async function parseProviderSources(
     }
   }
 
-  // 90-day age-out for durable providers: remove entries whose newest call is
-  // older than 90 days so the cache doesn't grow unboundedly over time.
+  // 90-day age-out for durable providers: prune only orphaned entries whose
+  // newest call is older than 90 days. Still-discovered sources remain live
+  // regardless of age and keep their persisted fingerprint for reuse.
   if (!readOnly && provider.durableSources) {
     const cutoffMs = Date.now() - 90 * 24 * 60 * 60 * 1000
     for (const [cachedPath, cachedFile] of Object.entries(section.files)) {
@@ -3049,7 +3050,7 @@ async function parseProviderSources(
         .map(c => new Date(c.timestamp).getTime())
         .filter(ts => !isNaN(ts))
         .reduce((max, ts) => Math.max(max, ts), 0)
-      if (newestTs > 0 && newestTs < cutoffMs) {
+      if (!allDiscoveredFiles.has(cachedPath) && newestTs > 0 && newestTs < cutoffMs) {
         delete section.files[cachedPath]
         ;(diskCache as { _dirty?: boolean })._dirty = true
       }
diff --git a/tests/parser.test.ts b/tests/parser.test.ts
index 4bd0c5c2..a7e08ebe 100644
--- a/tests/parser.test.ts
+++ b/tests/parser.test.ts
@@ -23,6 +23,7 @@ import type { SessionSource, SessionParser, ParsedProviderCall } from '../src/pr
 let _synthSources: SessionSource[] = []
 let _synthDurable = false
 let _synthYields: ParsedProviderCall[] = []
+let _synthParseCalls = 0
 
 vi.mock('../src/providers/index.js', async (importOriginal) => {
   type Mod = typeof import('../src/providers/index.js')
@@ -52,6 +53,7 @@ vi.mock('../src/providers/index.js', async (importOriginal) => {
           createSessionParser(_s: SessionSource, _k: Set<string>): SessionParser {
             return {
               async *parse(): AsyncGenerator<ParsedProviderCall> {
+                _synthParseCalls++
                 for (const call of _synthYields) {
                   // Respect seenKeys so that when multiple sources share the same
                   // dedup key, only the first source yields it (mirrors real parsers).
@@ -190,6 +192,7 @@ beforeEach(async () => {
   _synthSources = []
   _synthDurable = false
   _synthYields  = []
+  _synthParseCalls = 0
 })
 
 afterEach(async () => {
@@ -354,7 +357,7 @@ describe('(d) non-durable provider evicts deleted sources', () => {
 // (e) 90-day age-out: orphan ≥ 91d old is pruned; ≤ 89d is retained
 // ═══════════════════════════════════════════════════════════════════════════
 describe('(e) 90-day age-out for durable providers', () => {
-  it('prunes an orphaned cache entry whose newest call is 91 days old', async () => {
+  it('keeps a discovered 91-day source persisted until discovery removes it', async () => {
     const synthFile = join(tmpHome, 'synth-age.txt')
     await writeFile(synthFile, 'placeholder')
 
@@ -374,15 +377,37 @@ describe('(e) 90-day age-out for durable providers', () => {
       userMessage: 'old', sessionId: 'synth-old',
     }]
 
-    // First parse: cached with 91d-old timestamp → immediately pruned by 90-day check
+    // First refresh: a still-discovered durable source is live and persisted,
+    // regardless of the age of its newest call.
     const proj1 = await parseAllSessions(undefined, 'test-synthetic')
-    expect(totalOutput(proj1)).toBe(0)  // pruned right away
+    expect.soft(totalOutput(proj1)).toBe(8)
+    expect.soft(_synthParseCalls).toBe(1)
 
-    // Confirm: entry is not in the persistent cache after first parse
+    const cache1 = await loadCache()
+    const persisted1 = cache1.providers['test-synthetic']?.files[synthFile]
+    expect.soft(persisted1).toBeDefined()
+
+    // Second refresh: force the public seam through the persisted cache. The
+    // unchanged fingerprint must serve the cached parse without invoking the
+    // provider parser again.
     clearSessionCache()
-    _synthSources = []  // no longer discovered
     const proj2 = await parseAllSessions(undefined, 'test-synthetic')
-    expect(totalOutput(proj2)).toBe(0)
+    expect.soft(totalOutput(proj2)).toBe(8)
+    expect.soft(_synthParseCalls).toBe(1)
+
+    const cache2 = await loadCache()
+    expect.soft(cache2.providers['test-synthetic']?.files[synthFile]?.fingerprint)
+      .toEqual(persisted1?.fingerprint)
+
+    // Third refresh: once discovery removes the old source, it becomes an
+    // orphan and the durable 90-day age-out prunes it from results and disk.
+    clearSessionCache()
+    _synthSources = []
+    const proj3 = await parseAllSessions(undefined, 'test-synthetic')
+    expect.soft(totalOutput(proj3)).toBe(0)
+
+    const cache3 = await loadCache()
+    expect.soft(cache3.providers['test-synthetic']?.files[synthFile]).toBeUndefined()
   })
 
   it('retains an orphaned cache entry whose newest call is 89 days old', async () => {

From 2d35c8fa242574a073a60f1ea4c8d48c8851ce3f Mon Sep 17 00:00:00 2001
From: iamtoruk <resham0209@gmail.com>
Date: Tue, 18 Aug 2026 08:52:43 -0700
Subject: [PATCH 6/7] test(parser): cover durable retention through a
 month-scoped refresh

---
 tests/parser.test.ts | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/tests/parser.test.ts b/tests/parser.test.ts
index 6582a97c..44f9db73 100644
--- a/tests/parser.test.ts
+++ b/tests/parser.test.ts
@@ -416,6 +416,45 @@ describe('(e) 90-day age-out for durable providers', () => {
     expect.soft(cache3.providers['test-synthetic']?.files[synthFile]).toBeUndefined()
   })
 
+  it('keeps a discovered 91-day source through a month-scoped refresh', async () => {
+    const synthFile = join(tmpHome, 'synth-scoped.txt')
+    await writeFile(synthFile, 'placeholder')
+
+    const ts91dAgo = new Date(Date.now() - 91 * 24 * 60 * 60 * 1000).toISOString()
+
+    _synthDurable = true
+    _synthSources = [{ path: synthFile, project: 'test', provider: 'test-synthetic' }]
+    _synthYields  = [{
+      provider: 'test-synthetic', model: 'gpt-4o',
+      inputTokens: 10, outputTokens: 8,
+      cacheCreationInputTokens: 0, cacheReadInputTokens: 0,
+      cachedInputTokens: 0, reasoningTokens: 0, webSearchRequests: 0,
+      costUSD: 0.002, tools: [], bashCommands: [],
+      timestamp: ts91dAgo,
+      speed: 'standard',
+      deduplicationKey: 'synth-age-out-91d-scoped',
+      userMessage: 'old', sessionId: 'synth-old-scoped',
+    }]
+
+    expect.soft(totalOutput(await parseAllSessions(undefined, 'test-synthetic'))).toBe(8)
+
+    // A today-ranged refresh loads under a month scope that excludes the entry's
+    // shard. Durable providers are never scoped, so the age-out still sees the
+    // entry as discovered and the save must carry its month across intact.
+    clearSessionCache()
+    const today = new Date()
+    const start = new Date(today); start.setHours(0, 0, 0, 0)
+    const end   = new Date(today); end.setHours(23, 59, 59, 999)
+    expect.soft(totalOutput(await parseAllSessions({ start, end }, 'test-synthetic'))).toBe(0)
+
+    clearSessionCache()
+    expect.soft(totalOutput(await parseAllSessions(undefined, 'test-synthetic'))).toBe(8)
+    expect.soft(_synthParseCalls).toBe(1)
+
+    const cache = await loadCache()
+    expect.soft(cache.providers['test-synthetic']?.files[synthFile]).toBeDefined()
+  })
+
   it('retains an orphaned cache entry whose newest call is 89 days old', async () => {
     const synthFile = join(tmpHome, 'synth-retain.txt')
     await writeFile(synthFile, 'placeholder')

From 595225da34229c71b94e0e4a9bfb1b1d71700b5b Mon Sep 17 00:00:00 2001
From: iamtoruk <hello@agentseal.org>
Date: Tue, 18 Aug 2026 09:27:21 -0700
Subject: [PATCH 7/7] changelog: note the one-time lifetime jump when retained
 history reappears (#987)

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5e3dfbad..7663da93 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,7 +28,7 @@
 - **The resident `codeburn serve` child.** The first real panel request is also the cache warm-up, so startup never runs an artificial warm-up query beside a duplicate one-shot child; each served command carries its own read-only option allowlist, and anything outside it falls back to a normal spawn; the child exits when its stdin closes, so it can never outlive the app. Requests whose response exceeds the 16 MiB frame limit still replace the child, but that deliberate kill no longer spends the resident's unexpected-death budget. (#972)
 
 ### Fixed
-- **Old durable sources remain visible while they still exist.** The 90-day session-cache age-out now applies only after a durable source disappears from discovery, so an unchanged older Copilot source keeps reporting usage and reuses its persisted fingerprint instead of being reparsed and immediately discarded. (#987)
+- **Old durable sources remain visible while they still exist.** The 90-day session-cache age-out now applies only after a durable source disappears from discovery, so an unchanged older Copilot source keeps reporting usage and reuses its persisted fingerprint instead of being reparsed and immediately discarded. (#987) On long-lived machines this makes previously dropped history reappear, so lifetime totals can jump once after upgrading.
 - **`optimize` no longer offers `claude mcp remove` for claude.ai connectors, and its MCP schema-cost estimate is per session.** A `claude_ai_*` namespace that no readable local MCP config claims is a claude.ai connector, managed through `/mcp` or claude.ai Settings rather than as a local MCP server (a local server that carries the prefix keeps its removal command and gains a same-name connector note); low-coverage findings now render them as a manual follow-up and build `--apply` plans only for exact local server names found in readable MCP config, so mixed findings remove only the local subset and the "apply-able" subtotal counts only that subset. The same change replaces the old global schema-cost cap with per-session, per-server proportional attribution — a more accurate model that lowers `mcp-low-coverage` estimates for everyone, connectors or not (on a large corpus roughly by half). (#975, #991)
 - **Bash command splitting was quadratic on long whitespace-heavy commands.** The separator regex retried its leading `\s*` from every offset; matching the separator alone and widening over whitespace by hand makes cold parse ~24% and warm ~40% faster on large corpora, output unchanged.
 - **Cold parse no longer retains full message bodies through cached previews.** `flatSlice` skipped its Buffer round-trip for strings already within the bound, but provider adapters pre-truncate user-message previews with `.slice(0, 500)` before the cache-site call — those pre-sliced views are still V8 SlicedStrings pinning their large parent, so the retention that OOM'd cold parses of large histories survived. The round-trip now always runs.