@hasna/recordings 0.3.1 → 0.3.8

package/scripts/release-suite-gate.ts

@@ -0,0 +1,181 @@
+#!/usr/bin/env bun
+/**
+ * Release-suite gate (wired into `prepublishOnly`).
+ *
+ * Runs the app's own Linux-CI-partitioned suite — `test:gated`, which covers
+ * every discovered `*.test.ts` (the quarantine file is empty by design) — and
+ * fails on ANY failure except the allowlisted pre-existing classes below.
+ *
+ * Why the allowlist exists: the suite is red at this release's base sha with
+ * exactly two measured pre-existing classes (both reproduced identically at
+ * the pristine base commit 4a9b31e56, classified non-blocking by the release
+ * lineage). The old `prepublishOnly` (`bun run test`, bare) could not pass on
+ * any box for independent reasons: no timeout flag for the long macOS
+ * lifecycle suites, and the ambient hosted-store environment on fleet boxes.
+ *
+ * The allowlist is SELF-INVALIDATING, the same property as
+ * `.github/linux-quarantine.txt`: if an allowlisted failure stops failing
+ * (the owning lane lands its fix, or a quarantined package ages out of the
+ * 7-day window), the gate exits 1 and demands the entry be removed. Any
+ * failure outside the allowlist fails the gate.
+ *
+ * The gate FAILS CLOSED on abnormal termination: a non-zero suite exit is
+ * acceptable only when it is fully explained by allowlisted failures — the
+ * runner completed (its summary line is present), every parsed failure is
+ * allowlisted, at least one allowlisted failure fired, and the runner's
+ * reported failure count equals the parsed count. A crash, signal kill,
+ * timeout, or runner error that produces a non-zero exit without a complete
+ * summary fails the gate (remediation cycle 2 of PR hasna/apps#826).
+ */
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const SEP = "::";
+
+const GATED_KEYS: Array<{ file: string; test: string; owner: string; reason: string }> = [
+  {
+    file: "src/__tests__/service-contract-manifest.test.ts",
+    test: "the repository satisfies the tracked contract kit's conformance checks",
+    owner: "contracts-surface lanes (hasna/apps PRs 743/749/754 lineage)",
+    reason:
+      "credential_seam_compliance flags the vendored client seam (resolveStorageClient in src/http/client.ts) and the RECORDINGS_API_KEY env read (src/lib/config.ts) - an in-flight migration owned by the contracts-surface lanes; classified pre-existing at the release base. Remove this entry when the lane lands.",
+  },
+  {
+    file: "src/__tests__/native-app-companion-contract.test.ts",
+    test: "(unnamed)",
+    owner: "release supply-chain policy",
+    reason:
+      "build_companion_cli.sh enforces --minimum-release-age=604800, so the companion build refuses @hasna/contracts@0.13.3 (published 2026-08-21T13:13Z) inside its 7-day quarantine by design until 2026-08-28. The npm publish path does not build the companion. Remove this entry when the package ages out.",
+  },
+];
+
+function run(argv: string[], env: Record<string, string>): { status: number; stdout: string; stderr: string } {
+  const res = spawnSync(process.execPath, argv, { encoding: "utf8", env: { ...process.env, ...env } });
+  return { status: res.status ?? -1, stdout: res.stdout ?? "", stderr: res.stderr ?? "" };
+}
+
+// 1. Validate the partition (quarantine file must be consistent).
+const check = run(["scripts/ci-linux-suite.ts", "--check"], {});
+if (check.status !== 0) {
+  console.error("release-suite-gate: partition check failed:\n" + (check.stderr || check.stdout));
+  process.exit(1);
+}
+
+// 2. Collect the gated file list.
+const gated = run(["scripts/ci-linux-suite.ts", "--gated"], {});
+if (gated.status !== 0) {
+  console.error("release-suite-gate: could not enumerate gated files:\n" + (gated.stderr || gated.stdout));
+  process.exit(1);
+}
+const gatedFiles = gated.stdout.split("\n").filter(Boolean);
+if (gatedFiles.length === 0) {
+  console.error("release-suite-gate: zero gated files - refusing to pass on an empty suite.");
+  process.exit(1);
+}
+
+// 3. Run the gated suite exactly like `test:gated`.
+const logDir = mkdtempSync(join(tmpdir(), "recordings-release-gate-"));
+const logPath = join(logDir, "suite.log");
+const suite = spawnSync(
+  process.execPath,
+  ["test", "--timeout", "120000", ...gatedFiles],
+  {
+    encoding: "utf8",
+    env: { ...process.env, RECORDINGS_TEST_TIMEOUT_MS: "120000" },
+    maxBuffer: 64 * 1024 * 1024,
+  },
+);
+const output = (suite.stdout ?? "") + (suite.stderr ?? "");
+try {
+  writeFileSync(logPath, output);
+} catch {
+  /* log capture is best-effort */
+}
+const suiteStatus = suite.status ?? -1;
+
+// 4. Parse failing tests as (file, description) pairs, in output order.
+const failPairs: Array<{ file: string; test: string }> = [];
+let currentFile = "";
+for (const line of output.split("\n")) {
+  const fileMatch = /^(?:\.\/)?(src\/[^\s:]+\.test\.ts):$/.exec(line);
+  if (fileMatch) {
+    currentFile = fileMatch[1];
+    continue;
+  }
+  const failMatch = /^\(fail\) (.+) \[\d+.*\]$/.exec(line);
+  if (failMatch) {
+    failPairs.push({ file: currentFile, test: failMatch[1].trim() });
+  }
+}
+
+// 5. Classify.
+const failuresByKey = new Map<string, number>();
+for (const key of GATED_KEYS) {
+  failuresByKey.set(key.file + SEP + key.test, 0);
+}
+const unexpected: Array<{ file: string; test: string }> = [];
+for (const pair of failPairs) {
+  const key = pair.file + SEP + pair.test;
+  if (failuresByKey.has(key)) {
+    failuresByKey.set(key, (failuresByKey.get(key) ?? 0) + 1);
+  } else {
+    unexpected.push(pair);
+  }
+}
+
+if (unexpected.length > 0) {
+  console.error(
+    "release-suite-gate: FAIL - unexpected test failures:\n" +
+      unexpected.map((u) => "  " + u.file + " :: " + u.test).join("\n"),
+  );
+  console.error("Full suite log: " + logPath);
+  process.exit(1);
+}
+
+// 6. Fail closed on abnormal termination. A non-zero suite exit is only
+// acceptable when it is fully explained by the allowlisted failures: the
+// runner completed (summary line present), every parsed failure is
+// allowlisted, at least one allowlisted failure fired, and the runner's
+// reported failure count equals the parsed count (no unparsed failures).
+// A crash, signal kill, timeout, or runner error produces a non-zero exit
+// without a complete summary and must fail the gate.
+if (suiteStatus !== 0) {
+  const summaryMatch = /Ran (\d+) tests across (\d+) files/.exec(output);
+  // The tally is "N pass[,/ ] M fail" in the runner's closing summary. The
+  // LAST match is taken (bun prints the tally once, but a naive first match
+  // can hit "0.13.3 failed to resolve" -> "3 fail" inside a version string).
+  const tallyMatches = [...output.matchAll(/(\d+) pass[\s,/]+(\d+) fail/g)];
+  const failCountMatch = tallyMatches.length > 0 ? tallyMatches[tallyMatches.length - 1] : null;
+  const reportedFails = failCountMatch ? Number(failCountMatch[2]) : null;
+  const anyAllowlistedFired = failPairs.length > 0;
+  const complete = summaryMatch !== null && reportedFails !== null && reportedFails === failPairs.length;
+  if (!anyAllowlistedFired || !complete) {
+    console.error(
+      "release-suite-gate: FAIL - suite exited " + suiteStatus +
+        " with " + failPairs.length + " parsed failure(s) but the run is incomplete or unexplained:" +
+        "\n  summary line present: " + (summaryMatch !== null) +
+        "\n  reported failure count: " + String(reportedFails) +
+        "\n  parsed failure count: " + failPairs.length,
+    );
+    console.error("Full suite log: " + logPath);
+    process.exit(1);
+  }
+}
+
+// 7. Self-invalidation: an allowlisted failure that no longer fails must be removed.
+const stale = GATED_KEYS.filter((key) => (failuresByKey.get(key.file + SEP + key.test) ?? 0) === 0);
+if (stale.length > 0) {
+  console.error(
+    "release-suite-gate: FAIL - allowlisted failure no longer fails; remove the entry from scripts/release-suite-gate.ts:\n" +
+      stale.map((s) => "  " + s.file + " :: " + s.test + " - " + s.owner).join("\n"),
+  );
+  process.exit(1);
+}
+
+console.log(
+  "release-suite-gate: PASS - " + failPairs.length + " classified pre-existing failure(s) allowlisted:" +
+    failPairs.map((p) => "\n  " + p.file + " :: " + p.test).join(""),
+);
+process.exit(0);

package/scripts/set-version.ts

@@ -16,17 +16,17 @@ export type VersionSite = {
   pattern: RegExp;
 };
 
+// src/version.ts is deliberately NOT a site: it derives VERSION from
+// package.json at import time (see src/version.ts), so it holds no literal
+// this writer could keep in sync, and a monorepo changesets bump can no
+// longer leave it stale. The remaining sites are the native bundle surfaces,
+// which cannot derive and must be written here.
 export const versionSites: VersionSite[] = [
   {
     file: "package.json",
     label: "package.json version",
     pattern: /("version"\s*:\s*")([^"]+)(")/,
   },
-  {
-    file: "src/version.ts",
-    label: "src/version.ts VERSION",
-    pattern: /(export const VERSION = ")([^"]+)(")/,
-  },
   {
     file: "src/native/Recordings/RecordingsLib/Info.plist",
     label: "Info.plist CFBundleShortVersionString",

package/scripts/smoke_macos_app.sh

@@ -2,10 +2,26 @@
 set -euo pipefail
 umask 077
 
-if [ "$#" -ne 2 ]; then
-  echo "Usage: $0 <Recordings.app> <explicit absolute Bun executable path>" >&2
-  exit 2
+SMOKE_VARIANT="full"
+if [ "$#" -ge 3 ]; then
+  case "$3" in
+    --variant)
+      SMOKE_VARIANT="${4:-full}"
+      ;;
+    *)
+      echo "Usage: $0 <HasnaRecordings.app> <explicit absolute Bun executable path> [--variant full|bar]" >&2
+      exit 2
+      ;;
+  esac
+  case "$SMOKE_VARIANT" in
+    full|bar) ;;
+    *)
+      echo "SMOKE_VARIANT must be full or bar; got: $SMOKE_VARIANT" >&2
+      exit 2
+      ;;
+  esac
 fi
+readonly SMOKE_VARIANT
 
 HOST_UNAME_EXECUTABLE="/usr/bin/uname"
 SYSTEM_DIRNAME_EXECUTABLE="/usr/bin/dirname"
@@ -35,7 +51,7 @@ HOST_PLATFORM="$("$HOST_UNAME_EXECUTABLE" -s)"
 readonly HOST_PLATFORM
 
 if [ "$HOST_PLATFORM" != "Darwin" ] && [ "${RECORDINGS_TEST_SMOKE_ALLOW_NON_DARWIN:-0}" != "1" ]; then
-  echo "Recordings.app runtime smoke is only supported on macOS." >&2
+  echo "HasnaRecordings.app runtime smoke is only supported on macOS." >&2
   exit 1
 fi
 
@@ -107,12 +123,12 @@ HOME_DIRECTORY="${HOME:-}"
 case "$HOME_DIRECTORY" in
   /*) ;;
   *)
-    echo "Recordings.app runtime smoke requires an absolute HOME path." >&2
+    echo "HasnaRecordings.app runtime smoke requires an absolute HOME path." >&2
     exit 1
     ;;
 esac
 if [ ! -d "$HOME_DIRECTORY" ]; then
-  echo "Recordings.app runtime smoke HOME is not a directory: $HOME_DIRECTORY" >&2
+  echo "HasnaRecordings.app runtime smoke HOME is not a directory: $HOME_DIRECTORY" >&2
   exit 1
 fi
 
@@ -120,7 +136,7 @@ APP_PARENT="$(cd -P "$("$DIRNAME_EXECUTABLE" "$1")" && "$PWD_EXECUTABLE" -P)"
 APP_PATH="$APP_PARENT/$("$BASENAME_EXECUTABLE" "$1")"
 EXECUTABLE="$APP_PATH/Contents/MacOS/Recordings"
 if [ ! -x "$EXECUTABLE" ]; then
-  echo "Recordings.app runtime smoke executable is missing: $EXECUTABLE" >&2
+  echo "HasnaRecordings.app runtime smoke executable is missing: $EXECUTABLE" >&2
   exit 1
 fi
 
@@ -301,7 +317,7 @@ cleanup() {
     fi
     if [ -n "$SMOKE_APP_PID" ] && [ -n "$SMOKE_APP_PID_START_IDENTITY" ]; then
       terminate_verified_process \
-        "Recordings.app" \
+        "HasnaRecordings.app" \
         "$SMOKE_APP_PID" \
         "$EXECUTABLE" \
         "$SMOKE_APP_PID_START_IDENTITY" || true
@@ -345,6 +361,12 @@ run_smoke() {
   if [ "$mode" = "permission-helper" ]; then
     arguments=(--request-permissions "${arguments[@]}")
   fi
+  if [ "$SMOKE_VARIANT" = "bar" ]; then
+    # Bar builds are bar-only by construction (compile-time RECORDINGS_BAR_ONLY); the
+    # explicit argument is a belt-and-suspenders self-describing launch record so the
+    # launch is attributable to the variant even without the build define.
+    arguments=(--bar-only "${arguments[@]}")
+  fi
 
   SMOKE_PID=""
   SMOKE_PID_START_IDENTITY=""
@@ -355,7 +377,7 @@ run_smoke() {
   if ! SMOKE_APP_IDENTITIES_BEFORE_LAUNCH="$(
     process_records_for_exact_executable "$EXECUTABLE"
   )"; then
-    echo "Recordings.app runtime smoke ${mode} could not inventory exact app processes before launch." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} could not inventory exact app processes before launch." >&2
     return 1
   fi
 
@@ -377,24 +399,24 @@ run_smoke() {
       result_pid="$("$ENV_EXECUTABLE" -i HOME="$HOME_DIRECTORY" PATH="$SANITIZED_PATH" TMPDIR="$WORK_DIR" \
         "$BUN_EXECUTABLE" -e 'const value = await Bun.file(process.argv[1]).json(); console.log(value.processIdentifier)' "$output")"
       if ! [[ "$result_pid" =~ ^[1-9][0-9]*$ ]] || ! kill -0 "$result_pid" 2>/dev/null; then
-        echo "Recordings.app runtime smoke ${mode} reported a process that is not running." >&2
+        echo "HasnaRecordings.app runtime smoke ${mode} reported a process that is not running." >&2
         return 1
       fi
       if ! result_pid_start_identity="$(
         capture_process_start_identity "$result_pid" "$EXECUTABLE"
       )"; then
-        echo "Recordings.app runtime smoke ${mode} reported a process outside the exact app path." >&2
+        echo "HasnaRecordings.app runtime smoke ${mode} reported a process outside the exact app path." >&2
         return 1
       fi
       if process_identity_existed_before_launch "$result_pid" "$result_pid_start_identity"; then
-        echo "Recordings.app runtime smoke ${mode} reported an app process that predated this launch." >&2
+        echo "HasnaRecordings.app runtime smoke ${mode} reported an app process that predated this launch." >&2
         return 1
       fi
       if [ -n "$SMOKE_APP_PID" ] && {
         [ "$result_pid" != "$SMOKE_APP_PID" ] ||
           [ "$result_pid_start_identity" != "$SMOKE_APP_PID_START_IDENTITY" ];
       }; then
-        echo "Recordings.app runtime smoke ${mode} evidence did not match the exact launched app process." >&2
+        echo "HasnaRecordings.app runtime smoke ${mode} evidence did not match the exact launched app process." >&2
         return 1
       fi
       SMOKE_APP_PID="$result_pid"
@@ -407,19 +429,19 @@ run_smoke() {
       break
     fi
     if ! kill -0 "$SMOKE_PID" 2>/dev/null; then
-      echo "Recordings.app runtime smoke ${mode} exited without evidence." >&2
+      echo "HasnaRecordings.app runtime smoke ${mode} exited without evidence." >&2
       "$SED_EXECUTABLE" -n '1,120p' "$log" >&2
       return 1
     fi
     "$SLEEP_EXECUTABLE" 0.1
   done
   if [ ! -f "$output" ]; then
-    echo "Recordings.app runtime smoke ${mode} timed out." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} timed out." >&2
     "$SED_EXECUTABLE" -n '1,120p' "$log" >&2
     return 1
   fi
   if [ -z "$SMOKE_APP_PID" ]; then
-    echo "Recordings.app runtime smoke ${mode} did not bind evidence to the exact app process." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} did not bind evidence to the exact app process." >&2
     return 1
   fi
 
@@ -428,6 +450,7 @@ run_smoke() {
     PATH="$SANITIZED_PATH" \
     TMPDIR="$WORK_DIR" \
     SMOKE_MODE="$mode" \
+    SMOKE_VARIANT="$SMOKE_VARIANT" \
     SMOKE_FOCUS_EVIDENCE="$SMOKE_FOCUS_EVIDENCE" \
     EXPECTED_HELPER="$APP_PATH/Contents/Helpers/recordings" \
     "$BUN_EXECUTABLE" -e '
@@ -454,19 +477,38 @@ run_smoke() {
       if (JSON.stringify(result.renderedStatusLabels) !== JSON.stringify(expected)) {
         fail(`unexpected status labels ${JSON.stringify(result.renderedStatusLabels)}`);
       }
-      if (result.windowCreationCount !== 1 || result.windowActivationCount !== 2) {
-        fail("retained-window activation path was not exercised twice");
-      }
-      if (result.retainedWindowReused !== true) fail("main window was not retained");
-      if (result.applicationActivationPolicy !== 0) fail("main window did not set regular activation policy");
-      if (!result.mainWindowIsVisible || !result.mainWindowCanBecomeKey) {
-        fail("retained main window was not visible and capable of becoming key");
-      }
-      if (!result.applicationIsActive || !result.mainWindowIsKey) {
-        if (process.env.SMOKE_FOCUS_EVIDENCE !== "ssh-unavailable") {
-          fail("Open Recordings did not make the retained window active and key");
+      if (process.env.SMOKE_VARIANT === "bar") {
+        // The bar variant launches windowless by construction: no workspace window is
+        // ever created, activated, or reused, the app stays an accessory (LSUIElement),
+        // and no window is exposed. This is the runtime half of the P1 #2 regression —
+        // the full-build smoke below must keep creating the window.
+        if (result.windowCreationCount !== 0 || result.windowActivationCount !== 0) {
+          fail("bar-only launch created or activated a workspace window");
+        }
+        if (result.retainedWindowReused !== false) {
+          fail("bar-only launch reused a workspace window");
+        }
+        if (result.mainWindowIsVisible || result.mainWindowCanBecomeKey || result.mainWindowIsKey) {
+          fail("bar-only launch exposed a main window");
+        }
+        if (result.applicationActivationPolicy !== 1) {
+          fail("bar-only launch did not stay an accessory activation policy");
+        }
+      } else {
+        if (result.windowCreationCount !== 1 || result.windowActivationCount !== 2) {
+          fail("retained-window activation path was not exercised twice");
+        }
+        if (result.retainedWindowReused !== true) fail("main window was not retained");
+        if (result.applicationActivationPolicy !== 0) fail("main window did not set regular activation policy");
+        if (!result.mainWindowIsVisible || !result.mainWindowCanBecomeKey) {
+          fail("retained main window was not visible and capable of becoming key");
+        }
+        if (!result.applicationIsActive || !result.mainWindowIsKey) {
+          if (process.env.SMOKE_FOCUS_EVIDENCE !== "ssh-unavailable") {
+            fail("Open Recordings did not make the retained window active and key");
+          }
+          focusEvidenceStatus = "ssh-unavailable";
         }
-        focusEvidenceStatus = "ssh-unavailable";
       }
     } else if (mode === "resolver") {
       if (result.menuBarSurfaceCount !== 0 || result.globalHandlersInstalled !== false) {
@@ -504,7 +546,7 @@ run_smoke() {
   ' "$output"
 
   if [ -e "$completion" ]; then
-    echo "Recordings.app runtime smoke ${mode} produced completion before the challenge." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} produced completion before the challenge." >&2
     return 1
   fi
   challenge="$("$ENV_EXECUTABLE" -i HOME="$HOME_DIRECTORY" PATH="$SANITIZED_PATH" TMPDIR="$WORK_DIR" \
@@ -512,7 +554,7 @@ run_smoke() {
   if ! rechecked_start_identity="$(
     capture_process_start_identity "$result_pid" "$EXECUTABLE"
   )" || [ "$rechecked_start_identity" != "$result_pid_start_identity" ]; then
-    echo "Recordings.app runtime smoke ${mode} process identity changed before completion challenge." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} process identity changed before completion challenge." >&2
     return 1
   fi
   write_atomic_text_file "$acknowledgement" "$challenge"
@@ -522,7 +564,7 @@ run_smoke() {
     "$SLEEP_EXECUTABLE" 0.1
   done
   if kill -0 "$SMOKE_PID" 2>/dev/null; then
-    echo "Recordings.app runtime smoke ${mode} completion handshake timed out." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} completion handshake timed out." >&2
     return 1
   fi
   if wait "$SMOKE_PID" 2>/dev/null; then
@@ -535,7 +577,7 @@ run_smoke() {
   SMOKE_APP_PID=""
   SMOKE_APP_PID_START_IDENTITY=""
   if [ "$wrapper_status" -ne 0 ]; then
-    echo "Recordings.app runtime smoke ${mode} open -W wrapper exited unsuccessfully (${wrapper_status})." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} open -W wrapper exited unsuccessfully (${wrapper_status})." >&2
     "$SED_EXECUTABLE" -n '1,120p' "$log" >&2
     return 1
   fi
@@ -560,7 +602,7 @@ run_smoke() {
         process.exit(1);
       }
     ' "$completion"; then
-    echo "Recordings.app runtime smoke ${mode} did not provide a valid completion response." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} did not provide a valid completion response." >&2
     return 1
   fi
 
@@ -570,4 +612,8 @@ run_smoke() {
 run_smoke normal
 run_smoke permission-helper
 run_smoke resolver
-echo "Recordings.app runtime smoke passed: menu bar, retained window, helper isolation, and packaged resolver."
+if [ "$SMOKE_VARIANT" = "bar" ]; then
+  echo "HasnaRecordings.app runtime smoke passed (bar variant): menu bar, windowless launch, helper isolation, and packaged resolver."
+else
+  echo "HasnaRecordings.app runtime smoke passed: menu bar, retained window, helper isolation, and packaged resolver."
+fi

package/scripts/vacuity-manifests/version-sites.tsv

@@ -15,9 +15,13 @@
 # manifest is not wired into a package.json aggregate script.
 #
 # --- every version site agrees with package.json. Models 8de7068: one site bumped, the rest not.
-duplicate	src/__tests__/version-site-guard.test.ts	agree in the working tree, on the version package.json declares	src/version.ts	.15	1
-duplicate	src/__tests__/version-site-guard.test.ts	agree in the working tree, on the version package.json declares	src/native/Recordings/RecordingsLib/Info.plist	0.2.15	1
-duplicate	src/__tests__/version-site-guard.test.ts	agree in the working tree, on the version package.json declares	src/native/Recordings/RecordingsLib/Info.plist	0.2.15	2
+# I38-00553 (2026-08-21): src/version.ts now DERIVES from package.json and holds no literal, so it
+# is no longer a writer site (see set-version.ts) and cannot be mutated here. The residual drift
+# class is the mirror direction: the package.json authority corrupted while the native sites stay
+# put. Rows below were re-needled to the 0.3.5 tree.
+delete	src/__tests__/version-site-guard.test.ts	agree in the working tree, on the version package.json declares	package.json	0.3.5	1
+duplicate	src/__tests__/version-site-guard.test.ts	agree in the working tree, on the version package.json declares	src/native/Recordings/RecordingsLib/Info.plist	0.3.5	1
+duplicate	src/__tests__/version-site-guard.test.ts	agree in the working tree, on the version package.json declares	src/native/Recordings/RecordingsLib/Info.plist	0.3.5	2
 # --- a stale site is reported, not silently accepted: the mismatch filter removed.
 delete	src/__tests__/version-site-guard.test.ts	a single stale site is reported rather than silently accepted	scripts/set-version.ts	.filter((reading) => reading.version !== expected)	1
 # --- applyVersion writes every site in one pass: the per-file grouping removed.
@@ -58,4 +62,4 @@ delete	src/__tests__/version-site-guard.test.ts	applyVersion rewrites every site
 #
 # The generated SDK's version stamp -- a fifth copy of the release version that `versionSites`
 # deliberately does not write -- goes stale again.
-delete	src/__tests__/version-site-guard.test.ts	the generated SDK header carries the version package.json declares	src/sdk/v1.generated.ts	.15	1
+delete	src/__tests__/version-site-guard.test.ts	the generated SDK header carries the version package.json declares	src/sdk/v1.generated.ts	0.3.5	1

package/src/native/Recordings/App/MenuBarStatusView.swift

@@ -24,6 +24,9 @@ struct MenuBarStatusLabel: View {
 struct MenuBarStatusView: View {
     @ObservedObject var store: RecordingsStore
     let openRecordings: () -> Void
+    /// Bar-only builds have no workspace window to open; the entry point is hidden so
+    /// the affordance does not exist where the surface cannot exist.
+    let barOnly: Bool
 
     var body: some View {
         VStack(alignment: .leading, spacing: 12) {
@@ -50,11 +53,13 @@ struct MenuBarStatusView: View {
 
             Divider()
 
-            Button(action: openRecordings) {
-                Label("Open Recordings", systemImage: "macwindow")
-                    .frame(maxWidth: .infinity, alignment: .leading)
+            if !barOnly {
+                Button(action: openRecordings) {
+                    Label("Open Recordings", systemImage: "macwindow")
+                        .frame(maxWidth: .infinity, alignment: .leading)
+                }
+                .buttonStyle(.plain)
             }
-            .buttonStyle(.plain)
 
             SettingsLink {
                 Label("Settings", systemImage: "gearshape")

package/src/native/Recordings/App/RecordingsApp.swift

@@ -56,6 +56,8 @@ final class RecordingsAppDelegate: NSObject, NSApplicationDelegate {
 final class RecordingsAppState: ObservableObject {
     let store: RecordingsStore?
     let declaresMenuBar: Bool
+    let barOnly: Bool
+    let declaresWindow: Bool
     let runtimeSmokeProbe: RuntimeSmokeProbe?
     private let runtimeSmokeMode: String?
     private let runtimeSmokeOutputPath: String?
@@ -67,6 +69,8 @@ final class RecordingsAppState: ObservableObject {
 
     init(plan: PermissionRequestLaunchPlan) {
         declaresMenuBar = plan.declaresMenuBar
+        barOnly = plan.isBarOnly
+        declaresWindow = plan.declaresWindow
         runtimeSmokeMode = plan.runtimeSmokeMode
         runtimeSmokeOutputPath = plan.runtimeSmokeOutputPath
         runtimeSmokeAcknowledgementPath = plan.runtimeSmokeAcknowledgementPath
@@ -86,6 +90,14 @@ final class RecordingsAppState: ObservableObject {
     }
 
     func openRecordings() {
+        // Bar launches never create the workspace window — on any path, including the
+        // reopen handler and the runtime smoke. Keyed on declaresWindow (NOT on
+        // declaresMainWindow, which excludes every runtime smoke): a full build's
+        // normal-mode smoke must keep exercising the window, and only bar builds finish
+        // windowless. This was the cycle-2 P1 of the terminated PR #269 lineage — a
+        // windowless branch keyed on declaresMainWindow made the FULL smoke fail
+        // deterministically on every build.
+        guard declaresWindow else { return }
         if let store {
             showWindow(contentView: NSHostingView(rootView: ContentView(store: store)))
         } else if runtimeSmokeMode == "normal" {
@@ -181,6 +193,23 @@ final class RecordingsAppState: ObservableObject {
         runtimeSmokeProbe.completed = { [weak self, weak runtimeSmokeProbe] in
             guard let self, let runtimeSmokeProbe else { return }
             let accessibility = RuntimeSmokeAccessibilitySnapshot.processMenuBarExtras()
+            if self.barOnly {
+                // Windowless by construction: the bar smoke must never create the
+                // workspace window, and it reports the windowless state directly. This
+                // branch keys on barOnly, NOT on declaresMainWindow — that property
+                // excludes every runtime smoke and made the FULL build's smoke fail
+                // deterministically in the terminated PR #269 lineage (cycle-2 P1). A
+                // nil-window comparison would also read as a retained window (nil ===
+                // nil), so the windowless result is finished here explicitly.
+                self.finishRuntimeSmoke(
+                    mode: mode,
+                    surfaceCount: runtimeSmokeProbe.surfaceAppearances,
+                    labels: runtimeSmokeProbe.renderedLabels,
+                    accessibility: accessibility,
+                    retainedWindowReused: false
+                )
+                return
+            }
             self.openRecordings()
             let firstWindow = self.mainWindow
             self.openRecordings()
@@ -202,6 +231,9 @@ final class RecordingsAppState: ObservableObject {
         retainedWindowReused: Bool,
         attempt: Int = 0
     ) {
+        // Only the non-bar smoke reaches this (bar launches finish windowless in the
+        // probe completion handler above), so the settled state is exactly the retained
+        // window being key, unchanged from the base contract.
         let windowSettled = NSApplication.shared.isActive && (mainWindow?.isKeyWindow ?? false)
         guard windowSettled || attempt >= 60 else {
             DispatchQueue.main.asyncAfter(deadline: .now() + 0.05) { [weak self] in
@@ -316,7 +348,11 @@ struct RecordingsApp: App {
     @SceneBuilder var body: some Scene {
         MenuBarExtra(isInserted: menuBarInsertion) {
             if let store = state.store {
-                MenuBarStatusView(store: store, openRecordings: state.openRecordings)
+                MenuBarStatusView(
+                    store: store,
+                    openRecordings: state.openRecordings,
+                    barOnly: state.barOnly
+                )
             } else if state.runtimeSmokeProbe != nil {
                 EmptyView()
             }

package/src/native/Recordings/RecordingsLib/Info.plist

@@ -11,17 +11,17 @@
     <key>CFBundleName</key>
     <string>Recordings</string>
     <key>CFBundleDisplayName</key>
-    <string>Recordings</string>
+    <string>Hasna Recordings</string>
     <key>CFBundleExecutable</key>
     <string>Recordings</string>
     <key>CFBundleIdentifier</key>
     <string>com.hasna.recordings</string>
     <key>CFBundleVersion</key>
-    <string>0.3.1</string>
+    <string>0.3.8</string>
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>0.3.1</string>
+    <string>0.3.8</string>
     <key>LSMinimumSystemVersion</key>
     <string>26.0</string>
     <key>NSMicrophoneUsageDescription</key>

package/src/native/Recordings/RecordingsLib/PermissionRequestLaunchPlan.swift

@@ -7,10 +7,19 @@ public struct PermissionRequestLaunchPlan: Sendable, Equatable {
     public let runtimeSmokeOutputPath: String?
     public let runtimeSmokeAcknowledgementPath: String?
     public let runtimeSmokeCompletionPath: String?
+    public let isBarOnly: Bool
 
     public var isRuntimeSmoke: Bool { runtimeSmokeMode != nil }
     public var installsGlobalHandlers: Bool { !isHelper && !isRuntimeSmoke }
-    public var declaresMainWindow: Bool { !isHelper && !isRuntimeSmoke }
+    /// The workspace window may be created only when this holds: never for the permission
+    /// helper, never for a bar launch, and regardless of runtime-smoke mode — a full
+    /// build's smoke keeps exercising the window deterministically, and only bar builds
+    /// finish windowless.
+    public var declaresWindow: Bool { !isHelper && !isBarOnly }
+    /// Controls the init auto-open and the reopen handler ONLY. Runtime smoke launches
+    /// are excluded so the smoke controls window creation deterministically, and bar
+    /// launches are excluded so a real bar launch never auto-opens the workspace window.
+    public var declaresMainWindow: Bool { !isHelper && !isRuntimeSmoke && !isBarOnly }
     public var declaresMenuBar: Bool {
         if isRuntimeSmoke { return runtimeSmokeMode == "normal" }
         return !isHelper
@@ -31,6 +40,17 @@ public struct PermissionRequestLaunchPlan: Sendable, Equatable {
             "--runtime-smoke-completion",
             arguments: arguments
         )
+        #if RECORDINGS_BAR_ONLY
+        // A bar build is bar-only by construction on EVERY launch path — installer
+        // relaunch, manual `open`, LaunchAgent, smoke. Relying on the argument alone left
+        // real launches of the installed bar behaviorally identical to the full app
+        // (review lineage hasna/apps#269, cycle-1 P1). The explicit --bar-only argument
+        // remains a belt-and-suspenders self-describing launch record; it is never the
+        // only carrier of the bar property.
+        isBarOnly = true
+        #else
+        isBarOnly = arguments.contains("--bar-only")
+        #endif
     }
 
     private static func optionValue(_ name: String, arguments: [String]) -> String? {