Source: docs/installed-launch-coverage.md

# Installed launch coverage

The release workflow is manual-dispatch only. Its `installed-launch` job
consumes the uploaded installer in a **different runner VM** from `package`.
It checks out only the Node harness, installs OS runtime dependencies, and
never compiles the app or installs its JavaScript/Rust dependencies.
Publication depends on every installed-launch matrix row passing.

| Package | Build runner | Launch runner | What that covers | Installed-launch proof |
| --- | --- | --- | --- | --- |
| arm64 DMG | macos-15 | macos-15 | Sequoia, Apple Silicon | unproven |
| x86_64 DMG | macos-15-intel | macos-15 | Sequoia through Rosetta, not native Intel hardware | unproven |
| NSIS x64 | windows-latest | windows-2022 | Windows Server 2022, not Windows 10/11 desktop | unproven |
| deb x64 | ubuntu-22.04 | ubuntu-22.04 | Ubuntu 22.04 with GTK/WebKitGTK under xvfb | unproven |
| deb arm64 | ubuntu-22.04-arm | ubuntu-22.04-arm | Ubuntu 22.04 arm64 under xvfb | unproven |

The table is the managed-package installed-launch matrix. The same Windows
and Linux jobs also open the custom setup with `verify-custom-setup.mjs`, prove
the default location/component screen painted, and cancel without accepting
terms or installing. Windows additionally launches the portable ZIP without
host tools on PATH. These are separate checks, not a custom-install completion
claim; `unproven` does not assert a successful build or launch.

| Additional package/probe | Source support | Final-source acceptance |
| --- | --- | --- |
| Windows custom `BranchHelmSetup-…-windows-….exe` | native options paint/cancel and owned-install lifecycle tests | unproven |
| Linux custom `BranchHelmSetup-…-linux-….run` | native options paint/cancel and owned-install lifecycle tests | unproven |
| Windows portable ZIP | fresh-profile native launch without host tools | unproven |

## Local macOS ARM delivery — 2026-10-26

Source `399f06ecd9`, build `20261025.222358`, has a Developer ID signed,
notarized and stapled custom DMG. The quarantined DMG opened through Finder;
the user completed its location/component setup and installed the app. The
exact app also passed guarded `app:update` qualification on a private copy:
native WebView paint, two real TypeScript projects, Node and browser debugger
breakpoints, 20 project switches per phase, independent stops and cleanup.
The installed native hash matches that candidate. Digests and retained evidence
are in the [delivery reconciliation](audits/platform-consolidation-2026-10-26.md).

This is a local host result, separate from the clean-runner matrix above. Final
Windows/Linux packaging runs were cancelled at the owner's request, and no
public release was published by that delivery. The disposable-key drill then
[passed its signed and tampered feed scenarios](audits/release-drill-2026-10-31.md)
on an ad-hoc build of `c960d3369b`, against a loopback feed. The real feed, a
signed drill and the other platform/OS acceptance remain open.

The arm64 DMG was installed and rendered on **macOS 14.8.9** in a separate
GitHub runner on 2026-09-16, with a fresh HOME and harness-only checkout. That
signed, notarized artifact was built locally on macOS 26.6.2 / SDK 26.5, using
the owner's existing signing credentials. That proof ran on the `macos-14`
image, which GitHub retires on 2026-11-02; both macOS rows moved to `macos-15`
on 2026-10-23 and no installed launch has run there yet, so the arm64 cell
reads unproven until the next manual dispatch re-proves it on Sequoia. The
ordinary release build matrix and Windows/Linux installed-launch jobs remain
unproven for this change. The macOS manifest still claims 11.0. macOS 11–13,
native Intel, Windows desktop, other Linux distributions and MSI installation
remain unproven. Signing and notarization do not prove startup.