perf: backport Windows install and cold-start speedups

[bolichen97]

Problem / Motivation

Backport the Windows install and cold-start performance fix from merged PR #6047 to release/0.4.0. The release branch otherwise retains the NSIS double-copy path that took about 5 minutes 25 seconds and caused the native progress bar to jump, followed by a 44–50 second first gateway start while Defender scanned newly generated bytecode.

Why it matters

Windows users installing the 0.4.0 release would still see a healthy install look stalled and then wait nearly another minute before the app becomes usable. This backport keeps the measured fix in the active release line.

What changed (motivation → approach → change)

• Cherry-picked source commit a2028c2847cbb28dcd40ba189528ce3eb16948ff from merged PR perf: speed up Windows install and cold start #6047 with -x attribution.
• Same-volume per-user NSIS installs rename the staged resources and locales directories, retaining upstream CopyFiles for the small remainder and every failure/cross-volume fallback. Per-machine installs deliberately retain CopyFiles so Program Files ACL inheritance stays correct.
• Windows packaging imports the actual gateway closure after pruning and writes deterministic checked-hash pycs. Packaged Windows launches consume those adjacent pycs; other platforms keep their external runtime cache behavior.
• The electron-builder 26.15.3 template patch is pinned, idempotent, and fails closed on template drift.
• Installer validation now enforces a 120-second install ceiling and, for a real backend payload, a 30-second installed-gateway readiness ceiling.
• Release-specific conflict resolution kept test/test_ai_review_workflows.py unchanged because the source hunk only adjusted Bash lookup inside a main-only test block absent from release/0.4.0.
• All other changed file blobs match the merged source commit exactly; website/electron/package.json differs only by retaining release version 0.4.0-rc.9.

Tests

• Targeted Python release coverage: 136 passed, 2 skipped.
• Full Electron suite: 1,337 passed, 2 skipped, 0 failed.
• Website production build and TypeScript passed.
• Full backend release run collected 65,618 tests: 63,013 passed, 2,593 skipped, 6 xfailed; the eight failures caused by a local forced xdist worker cap / high-load browser recording all passed in a clean no-cap rerun (8 passed).
• Black baseline gate passed.
• The source PR perf: speed up Windows install and cold start #6047 was green before merge, including full frontend, static gates, synthetic Windows NSIS build, and real installer validation. This backport PR's CI is authoritative for the release branch.

Manual verification

The merged source change was verified with the full Windows backend and unsigned x64 NSIS package: 9,449 files / 661.4 MiB installed in 27.48 seconds locally and 59.91 seconds in the CI-equivalent run, both below 120 seconds. The just-installed bundled gateway reached /api/ready in 5.05–5.68 seconds, down from 44–50 seconds. Uninstall registration, payload removal, pre-existing sentinel preservation, cache isolation, and cleanup also passed.

Related Issues

no linked issue: this is a release backport of merged PR #6047.

Related PR: #6012 covers visible update progress; #6047 is the complementary install/cold-start performance fix.

Checklist

• At most two commits (one is the norm), with a Conventional Commits title (feat|fix|docs|refactor|perf|test|chore|ci|build|revert: ...)
• Existing tests pass and new tests added for new functionality
• Self-review completed; code follows project style guidelines
• Documentation updated (if applicable)
• No secrets, credentials, or internal references in the diff

Contribution License Agreement

[github-actions]

UX Review (Fable 5) — ✅ PASS

UX-level review of 8da27920b133576778c4d1a2efa865ce7fd3d315 — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

The diff is entirely packaging, installer scripting, tests, and docs — no dashboard UI, no new user-facing strings, no screenshots. The user-visible effect is purely positive perceived performance (install no longer looks stalled; first launch reaches ready in seconds instead of ~45). Nothing in the UX lenses is touched.

UX-Verdict: PASS

No UI surface changes; the work removes a stalled-looking install and a false-failure cold start — pure perceived-performance win with fallbacks intact.

[UX-REVIEWED] 8da2792

[github-actions]

Design Review (Fable 5) — ✅ PASS

Design-level review of 8da27920b133576778c4d1a2efa865ce7fd3d315 — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

Design review complete. The PR is a faithful backport of merged PR #6047 to the release branch: the NSIS rename-instead-of-double-copy path (per-user only, with CopyFiles fallback and per-machine ACL preservation), build-time checked-hash pyc precompilation of the measured import closure, a pinned fail-closed patch of the electron-builder template at the one boundary it exposes no hook for, and tightened installer validation ceilings. I verified the fallback story (rename failure clears errors and falls through to upstream CopyFiles), the version-pinned idempotent template patch, that checked-hash pycs degrade safely if stale, and that the conflict resolutions described (unchanged test_ai_review_workflows.py, retained 0.4.0-rc.9 version) match the diff. The five new requires-real-symlinks.txt entries name tests absent on this branch, but the conftest skip-list mechanism treats unknown node ids as inert, so nothing breaks.

Design-Verdict: PASS

Faithful backport of an already-merged, measured fix; fallbacks preserved, template patch pinned and fail-closed, fully reversible.

[DESIGN-REVIEWED] 8da2792

[github-actions]

GPT 5.6 Review — ✅ no blocking findings

GPT 5.6 completed its review of 8da27920b133576778c4d1a2efa865ce7fd3d315 and found no blocking issues.

This comment is updated in place on each push.

Review details

No findings.
[GPT-REVIEWED] 8da2792

False positive or not applicable? A repository writer can comment:
/ai-review override gpt 8da27920b133576778c4d1a2efa865ce7fd3d315: <one-sentence reason>

[github-actions]

First Principles Review (Fable 5) — 🟡 CONCERNS

Premise-level review of 8da27920b133576778c4d1a2efa865ce7fd3d315 — why this exists and whether the shipped surface is the smallest honest version. Updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

I've read the contract, the intent file, and the patch, and verified the load-bearing claims against the repo: the five new requires-real-symlinks.txt entries name test functions that don't exist anywhere on this branch (grepped each function name — zero definitions), and the only CI invocation of the installer script in all 48 workflows is build.yml:118, which passes -SkipGatewayValidation, so the new 30-second gateway-readiness check never runs in this repository's CI while the shipped doc says it does. Everything else in the backport traces to the measured install/cold-start cost. Final review follows.

First-Principles-Verdict: CONCERNS

The doc ships "CI starts the just-installed bundled interpreter… within 30 seconds" while the same diff makes the only CI invocation skip exactly that check.

What this change ships

Intent: make the 0.4.0 Windows install fast and the first launch immediate — a FIX (backport of merged #6047).

1. Install finishes in seconds, not ~5.5 minutes (rename, not double copy) — justified
2. First launch ready in ~5s, not 44–50s (shipped checked-hash bytecode) — justified
3. Windows bundle drops tcl/tk, headers, non-Windows llama libs — rides along, same measured harm
4. npm install patches electron-builder's NSIS template, pinned, fail-closed — justified mechanism
5. CI install ceiling tightened 300s → 120s — justified (measured 27–60s)
6. Gateway-readiness validation (30s ceiling, ≥1000 pycs) — zero CI consumers on this branch
7. Installer test relocates to %TEMP%, exact DisplayName match, cleans up — rides along
8. Doctor venv probe timeout 5s → 15s — undeclared rider, named harm
9. MCP session-inject probe now protocol-valid — undeclared rider, unwedges a red test
10. Five symlink-skip entries for tests absent from this branch — rides along, zero effect

Watch

• docs/guides/windows-install.md:114 claims "CI starts the just-installed bundled interpreter … and requires /api/ready within 30 seconds", but the sole invocation (count: 1, grepped \.ps1 across .github/workflows/) is build.yml:118 with -SkipGatewayValidation over a synthetic @echo off payload. On this branch the check exists only for manual runs; the doc overstates it.
• Five test/requires-real-symlinks.txt entries (lines 12–14, 23, 76) name tests with zero definitions here (grepped each name in the named files: 0). The author's own conflict rule — "kept test/test_ai_review_workflows.py unchanged because the source hunk only adjusted a main-only test block" — was applied to one file and not this one.
• Items 8–9 are undeclared beyond the blanket "all other changed file blobs match the merged source commit"; each has a named harm, but neither is the fix.

Subtractions

• Delete the five dead test/requires-real-symlinks.txt lines — or, if blob-identity with main is the point, that reason applies to test_ai_review_workflows.py too; pick one rule.
• Shrink the windows-install.md CI sentence to what this branch runs: a synthetic-payload install ceiling, with gateway validation manual.

[FIRST-PRINCIPLES-REVIEWED] 8da2792