- desktop:dist cleans dist/ + .next/standalone before next build: the
trace sweep was shipping the PREVIOUS build's DMG inside every new one
(standalone/dist = 8.0GB inside the app; measured 7.4GB DMG → 144MB).
- the same sweep shipped the repo-root auth.json (dev BYOK keys,
byte-identical) in every DMG ever built — excluded in the trace and
REFUSED by a new build-server.mjs guard (.env* belt-and-braces).
- WARNING (next.config.ts): dir-style trace excludes (dist/** etc.,
"./"-anchored or not) strip server-external packages to bare
package.jsons — pi-ai/pi-agent-core lost their dist/, the packaged
server 500'd on ERR_MODULE_NOT_FOUND. Only the three verified-safe
entries stay.
- new scripts/smoke-server.mjs gates desktop:dist between payload
curation and packaging: boots the standalone exactly as the Electron
shell does (temp LH_DATA_DIR, empty auth) and requires 200s on / +
graph/models/settings. Caught both defects above on its first day.
- entitlements: allow-unsigned-executable-memory dropped (2019-era
relic per current electron-builder docs; weakens hardened runtime).
- pi-ai + pi-agent-core pinned exact 1.0.2 — persisted chat records
carry their wire shapes; post-release a bump is a migration event.
Gates: typecheck, lint, 1459/1459 tests, full desktop:dist + smoke PASS.
amosblomqvist