fix(site): automatically select the latest complete desktop release

[loopx-agent]

Goal And Delivered Outcome

A stable release can be published before its desktop assets finish uploading, leaving the homepage's releases/latest Mac link unavailable. Resolve the highest complete stable release during Pages builds, use its immutable versioned URL in both download buttons, and show the actual version in English and Chinese.

• Source: maintainer request for automatic latest-available downloads; existing complete-set/manifest-last publisher contract, roadmap S12 first-use and release delivery.
• Before → after: an incomplete newer release could break the primary download; it now retains the preceding complete release. Corrupt or foreign assets are ineligible; inventory/transport failure stops publication before replacing output.
• Intended base: main; no separate issue is required for this reproduced defect.

Author Declaration

• Written by: model_agent — OpenAI GPT-6 (Codex).
• Implemented against: scripts/desktop_release_artifacts.py at fb5273002 and the request stated above.

Criterion	Disposition	Owner / path	Decisive evidence
Four uploaded, nonempty official desktop assets and exact SHA-256 manifest	implemented	scripts/desktop_release_artifacts.py; site/scripts/desktop-download.ts	Canonical filename parity; complete/partial/corrupt/foreign fixtures; real v1.4.0 selection
One selected version for rendered homepage and browser links	implemented	site/scripts/build.mjs; site/src/App.tsx	Real build, English/Chinese desktop/mobile readback, versioned ZIP HTTP 200
Refresh after trusted successful desktop publication; retain ordinary offline builds	implemented	frontstage-pages.yml; build opt-in	Actual workflow-expression positive/negative fixtures; API failure preserves prior output; offline zero-request build

Scope And Continuation

The site and Pages workflow consume the existing desktop publication contract. Production Pages opts in with LOOPX_SITE_RESOLVE_DESKTOP_RELEASE=1; ordinary local builds retain the known offline preview. Successful trusted release/manual desktop publications rebuild current default-branch source; failed uploads and PR/fork runs cannot initiate deployment. The existing schedule also refreshes inventory.

GH_TOKEN authenticates only build-time GitHub API requests. It is excluded from manifest redirects and browser assets; visitors perform no GitHub API retrieval. The App's signed update channel retains its existing owner.

The reviewable change is complete within this PR. Activation and hosted-site readback follow authorized merge/deployment. Guaranteed release runner priority is a separate capacity boundary; #6269 retires obsolete closed-PR work.

The bounded refactor shares one selection between client and prerender builds, reuses the canonical producer, and keeps provider-specific GitHub data local to the build helper. No new shared semantic vocabulary or capability configuration owner is introduced.

Validation

• Final revision: 029c58bd82c6c4e1edebc9571f049d5b2d8ef110. Final commit adds only the approved public-safe screenshot bytes. Source is unchanged from 87ef6efbee33078a228d1037dfd39289d4b51427, where integration was revalidated after updating to latest main.
• Run state: finished. Input classes: synthetic and public_fixture.

Check kind	Result	Evidence / limitation
unit	passed	node --test scripts/desktop-download.test.mjs: semantic ordering, incomplete/corrupt assets, excluded tags, exact URLs/digests, pagination, token isolation, provider failures/search bound, trusted release trigger
real_entrypoint	passed	LOOPX_SITE_RESOLVE_DESKTOP_RELEASE=1 npm run build: actual v1.4.0 selection and TypeScript check; exact canonical producer filename parity and versioned ZIP HTTP 200
regression_parity	passed	Real API-403 build preserves previous output; default offline build performs zero API calls
integration	passed	npm run smoke:frontstage-share-bundle with live release selection, repeated against updated main; complete public-boundary export
integration	passed	SEO, analytics consent/DNT/GPC/grant/withdraw/event boundaries, complete export, fragment/history and reduced-motion browser matrix
manual	passed	English/Chinese at 1365px and 390px: actual version, both download links, no overflow, no visitor GitHub API calls; first-screen owner approval obtained
static	passed	Diff/public-private scans; DCO trailers; semantic advisory run, with manual review because the advisory does not scan apps carriers

Earlier local direct Node requests timed out; using the existing environment proxy completed the real build. Both phases are retained in validation evidence. Hosted deployment has not been exercised for this unmerged head; CI is separately reported by GitHub.

Frontend / Visual Evidence

• UI impact: changed version note and download targets; layout/navigation unchanged.
• Before: baseline homepage source uses an unversioned latest-release link and omits the selected version. A historical baseline bitmap was not retained.
• After: approved public-data previews below. Both locales and widths were tested; figures show English desktop and Chinese phone.
• Source data: public_fixture; workflow illustration is synthetic. Screenshots contain no browser chrome or PNG text/EXIF metadata.
• Attention/craft review: preserve the existing hero and primary interaction; the version adds useful download certainty beside the prerequisite and first-launch guide. Inventory failures preserve the last deployment rather than adding a visitor-facing configuration flow.

Type / Boundary

• Bug fix, public presentation, build/CI, focused validation and documentation.
• Shared-authority RFC fixtures: N/A; no control-plane/state-provider contract change.
• Public/private scan clean; no private state, raw trajectories, credentials, private links or machine paths in the diff/body/attachments.
• Explicit path staging; all commits DCO signed; unrelated work preserved.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | xhigh

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

从官网下载安装的用户需要按钮指向一个完整发布的桌面版本，维护者需要发布完成后自动刷新首页。
原首页依赖不区分桌面产物是否齐全的 latest 链接；候选根据完整稳定版本与校验清单选择固定版本，并在可信发布完成后重建当前主干。
真实联网构建选出完整 v1.4.0，双语桌面和手机的两处下载按钮与版本说明一致；API失败保留旧产物，关闭选择时零API请求。
不授予浏览器GitHub凭据，不改变App更新渠道，不保证release runner优先，也不声称未合并代码已部署。

改动思路

沿用桌面发布的四文件、清单最后上传契约，网站构建只投影公开事实。GitHub 专用 TypeScript helper 留在 site/scripts，不创建第二套通用能力或持久 readiness 标记。构建一次解析结果给 client/SSR 共用；错误必须在 Vite 清空旧输出前显式失败。Pages 用 literal LOOPX_SITE_RESOLVE_DESKTOP_RELEASE=1 启用；普通本地构建保持离线。已有下载步骤和版式不增加表单、权限或额外确认。

具体改动

精确 head 029c58bd82c6c4e1edebc9571f049d5b2d8ef110，基线 fb5273002fae9d652a0c21c579bb65ee07755f18。依据基线 canonical desktop producer、manifest-last workflow 和已有前端交付约束核验完整十文件差异；既有首屏 owner approval 与公开预览已读回。

• resolveDesktopDownload（desktop-download.ts:44）按数值稳定版本排序，四个文件和清单须唯一、uploaded、非空、精确官方URL及SHA256；实际 manifest hash 与 canonical 排序内容均一致才选版本。Python producer 与 TS 四文件名执行后逐项相同。清单残缺、损坏、重复、外部URL、draft/plugin标签均不能冒充完整发布；分页1000项上界显式报错。
• desktopDownload（build.mjs:17）仅 literal1触发构建网络读取。公开真实API/manifest完成 v1.4.0 解析后，相同版本交给 client 与 SSR。API429 的实际构建入口抛错，原输出每个文件hash不变；关闭为0时真实Vite/SSR完成且API调用0次。API凭据只进API请求，清单重定向和浏览器不带凭据。
• macAppDownloadUrl（App.tsx:66）给 header/hero 两按钮共用固定版本地址，版本说明紧邻安装要求与首次启动指南。Ego 读回英文/中文×1365/390px两URL相同、版本相同、无横向溢出、无访客API请求。

可信 Desktop Release Artifacts 的成功 release/manual completion 可刷新 Pages，但checkout取默认分支；PR、fork、失败完成均被实际工作流谓词测试排除。普通 push/dispatch/schedule 保留原 owner，既有Pages权限未扩大。单一版本传递已完成相关小重构，不加入App更新或泛化发布框架。

规范：scripts/desktop_release_artifacts.py（基线版本），并参考 .github/workflows/desktop-release-artifacts.yml 与 docs/development/frontend-delivery.md。验收 complete_release 已实现，四文件加精确清单；one_version 已实现，同一版本进入 SSR 与两处按钮；activation_recovery 已实现，可信触发、失败保留和离线零请求均核验。

对主干的风险

8项 selector/workflow 正负例通过；真实联网和离线 build/typecheck、完整 public export、SEO、base/head analytics consent/DNT/GPC/下载事件及完整 semantic drift 通过。实际build429保留旧输出、off零请求的反事实通过。旧 latest 与新固定地址此刻 HEAD 均200；历史缺资产场景由独立负例验证，不写成当前404。线上 workflow/deployment 尚未执行，未来release完成及runner调度不由本地构建证明。CI依配置不查询、轮询或等待。

默认变化明确：关闭选择仍把原 latest 链接改为已知 v1.4.0预览并显示版本；这项目标修正已在README/PR披露。flag隔离的是构建网络选择，不能宣称关闭时URL字节保持旧行为。Pages启用、unset/0关闭、权限/隐私及App更新边界已有说明。失效API使发布失败并保留旧部署，维护者恢复来源后重试；1000项上限保守停止，不静默宣称最新。

保留初始环境失败：基线和候选网站依赖都缺vite/client；两工作树实际npmci后同源构建通过。首次SEO未找到标准dist，是仅生成命名审查目录的前置错误；标准build后原SEO通过。Ego宽泛按钮选择因歧义拒绝执行，改为已观察语言按钮后四视图通过。已批准截图与本轮浏览器读回仅资格化此源码构建，未冒充当前部署。

我的整体评价

APPROVE：原完整桌面发布契约被复用，所有受影响构建和下载消费者、默认变化、信任范围与失败保留都有独立当前证据。既有一次点击旅程保持，重复发布的来源投影更明确；无需新增LoopX capability/权限 owner。未发现当前精确 head 阻断问题。源码范围可供维护者合并，安装、App更新及线上发布仍保留其原验收责任。作者同账户发布 COMMENTED 批准结论，平台正式批准和合并状态另读回，不自合并。

English verdict: APPROVE — 029c58b. Live source selected complete v1.4.0; canonical filename parity,8 selector/workflow cases,actual build429 preserving prior bytes,off zero API calls,4 locale/viewport views,export/SEO and base/head analytics checks passed. The offline URL intentionally changes latest→fixedv1.4.0 and is disclosed; opt-in isolates network selection, not the unconditional URL correction. API credentials never reach manifest redirects or visitors. Initial dependency/output setup failures retained; hosted deployment,installer/updater and runner priority unqualified. Author-owned COMMENTED conclusion; maintainer merge required. No CI fetched/polled/waited.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | xhigh

English verdict: APPROVE — 029c58b. Live source selected complete v1.4.0; canonical filename parity,8 selector/workflow cases,actual build429 preserving prior bytes,off zero API calls,4 locale/viewport views,export/SEO and base/head analytics checks passed. The offline URL intentionally changes latest→fixedv1.4.0 and is disclosed; opt-in isolates network selection, not the unconditional URL correction. API credentials never reach manifest redirects or visitors. Initial dependency/output setup failures retained; hosted deployment,installer/updater and runner priority unqualified. Author-owned COMMENTED conclusion; maintainer merge required. No CI fetched/polled/waited.