Prove packaged macOS and Windows startup before release

.github/workflows/release.yml

@@ -380,6 +380,16 @@ jobs:
             fi
           fi
 
+      - name: Smoke exact packaged desktop startup
+        if: ${{ matrix.platform != 'linux' }}
+        shell: bash
+        run: |
+          node scripts/verify-packaged-desktop-startup.ts \
+            --assets-dir release-publish \
+            --platform "${{ matrix.platform }}" \
+            --arch "${{ matrix.arch }}" \
+            --version "${{ needs.preflight.outputs.version }}"
+
       - name: Upload build artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:

apps/desktop/src/main.ts

@@ -3514,9 +3514,19 @@ function createWindow(): BrowserWindow {
     window.setTitle(APP_DISPLAY_NAME);
   });
   window.webContents.on("did-finish-load", () => {
+    writeDesktopLogHeader("renderer main frame loaded");
     window.setTitle(APP_DISPLAY_NAME);
     emitUpdateState();
   });
+  window.webContents.on(
+    "did-fail-load",
+    (_event, errorCode, errorDescription, _validatedUrl, isMainFrame) => {
+      if (!isMainFrame) return;
+      writeDesktopLogHeader(
+        `renderer main frame load failed code=${errorCode} message=${errorDescription}`,
+      );
+    },
+  );
   window.once("ready-to-show", () => {
     // Preserve the original first-launch behavior, then respect the state saved
     // by subsequent closes. Normal bounds are restored before maximizing so the

docs/release.md

@@ -15,6 +15,9 @@ This document covers build-only native validation, promotion through the protect
   - macOS `x64` DMG
   - Linux `x64` AppImage
   - Windows `x64` NSIS installer
+- Before upload, launches the exact collected macOS and Windows payloads from
+  isolated Scient state and requires stable app readiness, backend readiness,
+  and successful renderer main-frame loading.
 - Publishes one versioned GitHub Release with all produced files.
   - Versions with a suffix after `X.Y.Z` (for example `1.2.3-alpha.1`) are published as GitHub prereleases.
   - Stable 0.5.x releases are GitHub Latest; the 0.4.x compatibility release remains historical.

scripts/release-smoke.ts

@@ -288,6 +288,50 @@ function verifyReleaseWorkflowSafety(): void {
   ) {
     throw new Error("Expected the release-note gate to verify the exact resolved version.");
   }
+  const collectAssetsIndex = buildSteps.findIndex((step) => step.name === "Collect release assets");
+  const packagedStartupIndex = buildSteps.findIndex(
+    (step) => step.name === "Smoke exact packaged desktop startup",
+  );
+  const uploadArtifactsIndex = buildSteps.findIndex(
+    (step) => step.name === "Upload build artifacts",
+  );
+  const packagedStartupStep = buildSteps[packagedStartupIndex];
+  if (
+    collectAssetsIndex < 0 ||
+    packagedStartupIndex <= collectAssetsIndex ||
+    uploadArtifactsIndex <= packagedStartupIndex ||
+    packagedStartupStep?.if !== "${{ matrix.platform != 'linux' }}" ||
+    !packagedStartupStep.run?.includes("node scripts/verify-packaged-desktop-startup.ts") ||
+    !packagedStartupStep.run.includes("--assets-dir release-publish")
+  ) {
+    throw new Error(
+      "Expected exact macOS and Windows packaged-startup proof after collection and before upload.",
+    );
+  }
+  const packagedStartupVerifier = readFileSync(
+    resolve(repoRoot, "scripts/verify-packaged-desktop-startup.ts"),
+    "utf8",
+  ).replaceAll("\r\n", "\n");
+  assertContains(
+    packagedStartupVerifier,
+    "SCIENT_HOME: scientHome",
+    "Expected packaged startup verification to isolate Scient state.",
+  );
+  assertContains(
+    packagedStartupVerifier,
+    "PACKAGED_SMOKE_INHERITED_ENVIRONMENT_ALLOWLIST",
+    "Expected packaged startup verification to inherit only explicit host variables.",
+  );
+  assertContains(
+    packagedStartupVerifier,
+    'log.includes("renderer main frame loaded")',
+    "Expected packaged startup proof to require successful renderer loading.",
+  );
+  assertNotContains(
+    packagedStartupVerifier,
+    '"linux" | "mac" | "win"',
+    "The extracted startup verifier must not absorb deferred Linux packaging policy.",
+  );
   const appleSigningNames = [
     "CSC_LINK",
     "CSC_KEY_PASSWORD",