fix(status): serve menubar-json status from a disk-persisted snapshot to eliminate per-poll re-parse latency

.github/workflows/build-windows-installer.yml

@@ -0,0 +1,88 @@
+name: Build Windows installer
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: Existing desktop-v* release to verify after manual asset upload
+        required: false
+        type: string
+  pull_request:
+    paths:
+      - .github/workflows/build-windows-installer.yml
+      - app/**
+      - src/**
+      - scripts/**
+      - package.json
+      - package-lock.json
+  push:
+    tags:
+      - 'desktop-v*'
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  nsis:
+    if: ${{ github.event_name != 'release' && !(github.event_name == 'workflow_dispatch' && inputs.release_tag != '') }}
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22.13.0
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            app/package-lock.json
+
+      - name: Install CLI dependencies
+        run: npm ci
+
+      - name: Install desktop dependencies
+        run: npm ci --prefix app
+
+      - name: Test installer verifier
+        run: npm --prefix app test -- scripts/verify-windows-installer.test.ts
+
+      - name: Build NSIS installer
+        run: npm --prefix app run package:win
+
+      - name: Verify installer manifest
+        shell: pwsh
+        run: |
+          if ($env:GITHUB_REF_TYPE -eq 'tag') {
+            node app/scripts/verify-windows-installer.mjs --tag $env:GITHUB_REF_NAME
+          } else {
+            node app/scripts/verify-windows-installer.mjs
+          }
+
+      - name: Upload installer artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: CodeBurn-Windows-Installer
+          path: |
+            app/release/CodeBurn-Setup-*.exe
+            app/release/CodeBurn-Setup-*.exe.blockmap
+          if-no-files-found: error
+          retention-days: 30
+
+  verify-release-assets:
+    if: ${{ (github.event_name == 'release' && startsWith(github.event.release.tag_name, 'desktop-v')) || (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Verify live desktop release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.event.release.tag_name || inputs.release_tag }}
+        run: |
+          gh api "repos/${{ github.repository }}/releases/tags/$RELEASE_TAG" \
+            --jq '[.assets[].name]' > "$RUNNER_TEMP/release-assets.json"
+          node app/scripts/verify-windows-installer.mjs \
+            --tag "$RELEASE_TAG" \
+            --release-assets "$RUNNER_TEMP/release-assets.json"

.github/workflows/mac-menubar-ci.yml

@@ -0,0 +1,34 @@
+name: macOS Menubar CI
+
+# The macOS menubar (mac/) ships from release-menubar.yml, which only packages the app.
+# Its Swift test suite (170+ tests covering the credential stores, Keychain cache,
+# serve connection, quota parsing) gated nothing until this workflow. Runs on every
+# PR touching mac/** so a red test fails the PR, the same way tests.yml does for the CLI.
+on:
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/mac-menubar-ci.yml
+      - mac/**
+  pull_request:
+    paths:
+      - .github/workflows/mac-menubar-ci.yml
+      - mac/**
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: macos-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+      - name: Swift toolchain
+        run: swift --version
+      - name: Build
+        run: swift build --package-path mac
+      - name: Test
+        run: swift test --package-path mac
+      - name: Package (same script the release uses)
+        run: mac/Scripts/package-app.sh ci-smoke

.github/workflows/release-menubar-windows.yml

@@ -0,0 +1,99 @@
+name: Release Windows Menubar
+
+# Triggers on a `windows-v*` tag push (e.g. `git tag windows-v0.9.20 && git push origin
+# windows-v0.9.20`), or manually via the Actions tab. Mirrors release-menubar.yml, which
+# does the same job for the macOS menubar under the `mac-v*` tags. The produced `.msi` is
+# unsigned; users see a SmartScreen prompt on first run until we add signing.
+on:
+  push:
+    tags:
+      - 'windows-v*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version label for the bundle (e.g. v0.9.20 or dev-preview)'
+        required: true
+        default: 'dev-preview'
+
+permissions:
+  contents: write  # Needed to create the release + upload assets.
+
+jobs:
+  build:
+    runs-on: windows-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Resolve version label
+        id: version
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/windows-v* ]]; then
+            echo "value=${GITHUB_REF#refs/tags/windows-}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=${{ github.event.inputs.version }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22.13.0
+          cache: npm
+          cache-dependency-path: windows/package-lock.json
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-pc-windows-msvc
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: windows/src-tauri
+
+      - name: Install dependencies
+        working-directory: windows
+        run: npm ci
+
+      - name: Build MSI bundle
+        working-directory: windows
+        run: npm run tauri build
+
+      - name: Collect artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p release-artifacts
+          find windows/src-tauri/target/release/bundle -type f -name '*.msi' \
+            -exec cp -v {} release-artifacts/ \;
+          (cd release-artifacts && for f in *.msi; do sha256sum "$f" > "$f.sha256"; done)
+          ls -la release-artifacts
+
+      - name: Upload artifact (for manual runs)
+        if: github.event_name == 'workflow_dispatch'
+        uses: actions/upload-artifact@v6
+        with:
+          name: CodeBurnMenubar-Windows-${{ steps.version.outputs.value }}
+          path: release-artifacts/*
+          if-no-files-found: error
+
+      - name: Create / update GitHub Release
+        if: startsWith(github.ref, 'refs/tags/windows-v')
+        uses: softprops/action-gh-release@v3
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: Windows Menubar ${{ steps.version.outputs.value }}
+          body: |
+            Download the `.msi` below and run it. The tray app reads everything through the
+            CodeBurn CLI, so install that first:
+
+            ```
+            npm install -g codeburn
+            ```
+
+            Requires codeburn 0.9.9 or newer and the WebView2 Runtime (preinstalled on
+            Windows 11 and recent Windows 10 updates; installed on demand otherwise).
+
+            The bundle is unsigned, so Windows SmartScreen warns on first run: click
+            "More info", then "Run anyway". Signing is planned.
+          files: release-artifacts/*
+          fail_on_unmatched_files: true

.github/workflows/tests.yml

@@ -9,12 +9,18 @@ jobs:
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        # Package floor, and the newest 22.x so paths gated on later node:zlib
+        # features (zstd, 22.15+) get exercised.
+        node-version: [22.13.0, 22]
 
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-node@v4
         with:
-          node-version: 22.13.0
+          node-version: ${{ matrix.node-version }}
           cache: npm
       - run: npm ci
       - name: Typecheck
@@ -27,10 +33,13 @@ jobs:
       # script since #948, so CI and a contributor's `npm test` can never drift.
       - name: Test suite (parallel)
         run: npm test
-      # Single forked worker, so lock contention comes only from the child processes the
-      # tests spawn deliberately. Quarantined (reports, never gates): the process
-      # suite still races its own takeover window even serially on slow runners -
-      # tracked in #904; drop continue-on-error once that race is settled.
-      - name: Cache-lock suite (serial, quarantined)
-        continue-on-error: true
+      # Single forked worker, so lock contention comes only from the child
+      # processes the tests spawn deliberately. Serial because the suite is
+      # parallelism-sensitive (fails under full worker pressure, passes
+      # serially). After #904 the loser of a stale-lock contest may be
+      # timed-out or completed-by-other; this step gates CI.
+      # Step-level timeout so a stalled lock suite fails this job instead of
+      # eating the 15-minute budget and cancelling a green parallel suite.
+      - name: Cache-lock suite (serial)
+        timeout-minutes: 5
         run: npm run test:locks

.github/workflows/upgrade-path.yml

@@ -0,0 +1,53 @@
+name: Upgrade path
+
+# Every existing user upgrading from the last published CLI (0.9.20) crosses the
+# session-cache v7 -> v9 re-layout and the daily-cache v17 -> v19 re-derivation on
+# their first run. Unit tests cover the migration in isolation on one platform; this
+# job proves it against a cache that the REAL 0.9.20 binary wrote, on all three
+# platforms, at both the package floor and the newest 22.x.
+on:
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'scripts/upgrade-path/**'
+      - '.github/workflows/upgrade-path.yml'
+  workflow_dispatch:
+
+jobs:
+  upgrade-path:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        # Package floor, and the newest 22.x. The floor matters here: node:zlib
+        # gained zstd in 22.15, so dsh degrades below it (the corpus writes the
+        # uncompressed dsh variant so both legs still count the same numbers).
+        node-version: [22.13.0, 22]
+
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+      - run: npm ci
+      # dist/cli.js + dist/parse-worker.js. The dash bundle is not exercised by
+      # any command this job runs, so the full `npm run build` is not paid for.
+      - run: npm run build:cli
+
+      - name: Upgrade path from codeburn@0.9.20
+        run: npm run verify:upgrade
+        env:
+          # Under runner.temp so the artifact step below can find it. The space
+          # is deliberate: a real Windows HOME almost always has one.
+          UPGRADE_PATH_WORK: ${{ runner.temp }}/codeburn upgrade path
+
+      - name: Upload payloads on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: upgrade-path-${{ matrix.os }}-node${{ matrix.node-version }}
+          path: ${{ runner.temp }}/codeburn upgrade path/payloads
+          if-no-files-found: ignore