docs: record packaged smoke results on all four platforms

.github/dependabot.yml

@@ -14,8 +14,8 @@ updates:
           - minor
           - patch
     ignore:
-      # Canvas 1.0.12/1.0.13 SIGSEGV under Electron 41 on Linux; see #29.
-      # Keep 1.0.11 until a newer release passes the native verification gate.
+      # Canvas 1.0.12/1.0.13 SIGSEGV'd under Electron 41 on Linux (#29, closed). main is on 1.1.0
+      # with Electron 45; this ignore only keeps those two builds from ever coming back.
       - dependency-name: '@napi-rs/canvas'
         versions: ['1.0.12', '1.0.13']
 

CLAUDE.md

@@ -118,24 +118,31 @@ These are tracked gaps that the project slash commands help address:
    dark/light themes with `critical+serious` hard-fail. The graph-canvas keyboard path closed
    2026-07-03 (U-T14: React Flow node focus + selection toolbars, pinned by oracles). Remaining for
    a formal AA claim: a manual screen-reader pass (NVDA) only.
-2. **SW-40 packaged verification: Windows x64 done, rest outstanding** — `asarUnpack` unpacks only
-   the eight worker entry bundles (`dist/{…,oramaRestoreWorker}.js`) plus the packages they require
-   at runtime (the pino, sharp and tesseract.js dependency closures), so main/preload/renderer stay
-   inside the integrity-validated asar. `verify:electron-fuses-config` fails if a pattern unpacks
-   `dist/main.js` again; `verify-packaged-artifacts` fails if a worker's externals do not resolve
-   inside `app.asar.unpacked`. On 2026-11-08/09 a Windows x64 build of main (installer + zip) passed
-   in Windows Sandbox (clean Windows 11, networking off): fuses match config, the renderer loads
-   from `app.asar`, a tampered asar header stops the app ("Integrity check failed for asar archive
-   entry"), silent install and first/second launch work, the zip launches and its updater skips with
-   the zip reason, the bundled VC++ runtime installs, local AI initializes, the OCR,
-   image-preprocess and embedding worker pools run, and four synthetic files analyze. The same test
-   on the published v5.1.2 (latest release, 2026-11-01) found local AI broken on clean PCs (missing
-   VC++ runtime, `NoBinaryFoundError`) and those workers crashing (`pino-std-serializers`); both are
-   fixed on main but **not yet released**. Not yet verified: Defender real-time-protection timing
-   (Sandbox disables Defender), the interactive UAC/decline path, the zip's **Install now**
-   click-through, whether an Azure-signed build keeps Microsoft's signature on `vc_redist`, the
-   vision model (timed out in the memory-limited sandbox), and macOS, Linux and Windows-arm64
-   packaged builds. The checklist lives in
+2. **SW-40 packaged verification: all four platforms smoke-tested; a few manual checks remain** —
+   `asarUnpack` unpacks only the eight worker entry bundles (`dist/{…,oramaRestoreWorker}.js`) plus
+   the packages they require at runtime (the pino, sharp and tesseract.js dependency closures), so
+   main/preload/renderer stay inside the integrity-validated asar. `verify:electron-fuses-config`
+   fails if a pattern unpacks `dist/main.js` again; `verify-packaged-artifacts` fails if a worker's
+   externals do not resolve inside `app.asar.unpacked`. On 2026-11-08/09 a Windows x64 build of main
+   (installer + zip) passed in Windows Sandbox (clean Windows 11, networking off): fuses match
+   config, the renderer loads from `app.asar`, a tampered asar header stops the app ("Integrity
+   check failed for asar archive entry"), silent install and first/second launch work, the zip
+   launches and its updater skips with the zip reason, the bundled VC++ runtime installs, local AI
+   initializes, the OCR, image-preprocess and embedding worker pools run, and four synthetic files
+   analyze. The same test on the published v5.1.2 (latest release, 2026-11-01) found local AI broken
+   on clean PCs (missing VC++ runtime, `NoBinaryFoundError`) and those workers crashing
+   (`pino-std-serializers`); both are fixed on main but **not yet released**. On 2026-11-09 the
+   dispatch-only `.github/workflows/packaged-smoke.yml` (run 42649893628) built, installed and
+   launched all four packages with a throwaway profile and `scripts/packaged-launch-smoke.js`:
+   Windows x64 and arm64 Azure-signed (silent NSIS install; our files carry the Kennedy Applied
+   Sciences signature and `vc_redist.<arch>.exe` keeps Microsoft's, in the installer and the
+   installed copy), macOS arm64 (unsigned, Metal) and Linux x64 (xvfb, CPU). Each reached
+   coordinated startup, loaded the native AI engine (Windows x64 on a Hyper-V GPU falls back from
+   Vulkan to CPU, which the check reports but allows) and ran the packaged OCR worker on a synthetic
+   image. Still not verified: Defender real-time-protection timing (Sandbox disables Defender), the
+   interactive UAC/decline path, the zip's **Install now** click-through, the vision model (timed
+   out in the memory-limited sandbox), the Atlas, log-export, settings-import and large-library
+   restore workers, and a signed and notarized macOS build. The checklist lives in
    [`docs/RELEASING.md` § Packaged-integrity checks](docs/RELEASING.md#packaged-integrity-checks) —
    keep that the single source and do not re-fork it here.
 

docs/RELEASING.md

@@ -412,6 +412,33 @@ feature on).
   through no UAC prompt and no **Install now**, and the memory-limited sandbox can time out the
   vision model.
 
+### Packaged smoke workflow (all platforms)
+
+`.github/workflows/packaged-smoke.yml` is dispatch-only and publishes nothing. Run it on the release
+branch before tagging (Actions → **Packaged Smoke** → **Run workflow**, or
+`gh workflow run packaged-smoke.yml --ref <branch>`). Each leg can be switched off with its input.
+
+- **Windows x64 and arm64** use the same Azure Trusted Signing steps as `release.yml`. With
+  `require_signing` on (the default), the leg fails unless our installer and app carry the Kennedy
+  Applied Sciences signature and `vc_redist.<arch>.exe` keeps Microsoft's, in the built package and
+  in the silently installed copy. That answers the Visual C++ item's signature check above.
+- **macOS arm64** builds unsigned (`CSC_IDENTITY_AUTO_DISCOVERY=false`), so it does not replace the
+  signed and notarized check in `mac-release.yml` and `verify-mac-signing.yml`.
+- **Linux x64** launches `release/build/linux-unpacked` (the files the AppImage wraps) under `xvfb`
+  with `--no-sandbox`.
+- **Every leg** launches the app with a throwaway profile through `scripts/packaged-launch-smoke.js`
+  (no model downloads, updater off). It passes only if coordinated startup completes, the native AI
+  engine loads, and the packaged OCR worker reads a synthetic image, with no `Cannot find module`,
+  worker error, `ERR_DLOPEN_FAILED`, integrity failure or failed startup in the log. A GPU backend
+  that fails and falls back to the CPU (Vulkan on the runner's Hyper-V GPU) is recorded under
+  `gpuFallbacks` and allowed; `NoBinaryFoundError` on the CPU backend fails the run. Logs, the
+  verdict and the Windows signature table are uploaded as
+  `packaged-smoke-<platform>-<arch>-<run number>`.
+- **Still manual.** The runners have no models and click nothing, so the vision model, Atlas, log
+  export, settings import, a large-library restore, the UAC and **Install now** paths, Defender
+  timing, the tamper test and the updater live smoke stay with the checklist and the Windows Sandbox
+  run above.
+
 ### Windows zip (no-install build)
 
 `StratoSortStack-<version>-win-x64.zip` is electron-builder's `zip` target (`win.target` in