[servicememeai]

Scope

Foundation for low-privilege portable Agent2, scheduled checks and actionable V2 errors. This PR does not implement mandatory updates or auto-install.

Changes

• Keep startup check and add resident 4h + 0–10 min jitter check; wake/sleep catch-up, failed-check backoff (15/30/60/120/240 min), once-per-version notification.
• Remove Windows taskkill /F /IM cloudfile-desktop.exe from install/restart path. Preserve running edits, original process, checkout and worker copies; defer active version handoff until safe exit.
• Remove reg.exe subprocess for current-user URL associations; use native Win32 registry operations, plus HKCR reads for ownership checks and LOCALAPPDATA fallback.
• Rewrite install-directory permission advice for portable user-writable ZIP location; no admin, CMD, PowerShell or PATH dependency.
• Split generic "服务端文件元数据无效" into X-CF-File-ID, X-CF-Repo-ID, X-CF-Path-B64, X-CF-Mode, invalid encoding, missing Content-Length, plus mode-specific 1 GiB size guidance. The former 128 MiB cap has already been fixed by merged fix(edit): 对齐 1 GiB 文件读取与快照保存（阶段一） #28.
• Document Windows 10 and 11 x64 ordinary-user deployment and release-acceptance matrix.

Verification

On connected macOS bb-dev using pinned Rust 1.90:

• cargo fmt --all --check: PASS
• cargo clippy --workspace --all-targets --locked -- -D warnings: PASS
• cargo test --workspace --locked --no-fail-fast: PASS (one preexisting ignored OS-keyring test)
• git diff --check: PASS
• Added unit cases for schedule and metadata field-specific errors.

Explicit gates

Windows 10/11 ordinary-user runtime, HKCU/URL registration, PATH-free/PowerShell-free environments, CAD file E2E, running old desktop version handoff, corporate WDAC/AppLocker policies and signed distribution remain unverified; do not release yet.

For future mandatory updates: the signed release manifest uses deny_unknown_fields; do not add mandatory fields there. Use a separately signed policy and capability-based routing via Agent/Extension/Web, and never conflate manual force (bypasses task-exit protection) with mandatory-update enforcement. Old non-updatable clients require one-time portable EXE replacement. This remains separate work.

Draft pending Windows CI and physical Win10/11 acceptance. No production deployment.

Follow-up: existing Windows field compatibility (2026-11-11)

• Current deployment has multiple successfully running Windows customers. Preserved the shipped native installer, Win10 curl + certutil/publisher-pinned SHA-256 fallback, Windows x64 packaging, existing Native Host ID and WebView2 self-service; did not rewrite CMD or require PowerShell.
• Added --self-test Windows-only checks: OS build classifies Win10/Win11 while separately reporting Server builds, architecture, and the actual current-user write permission on versioned bin directory. When writable directory missing, report status; when read-only, give non-admin portable relocation guidance without deleting user work copies.
• Initial GitHub matrix CI failed at scripts/installer-guard.test.cjs: the assertions still required obsolete PowerShell Get-FileHash, even though shipped scripts had migrated to native certutil -hashfile and curl fallback. Updated only the test, retaining signature/digest checks and fail-closed behavior. Local Node 2/2 now PASS; rerunning CI is required.
• Windows-only source must still pass its actual GitHub CI; macOS unit tests are not proof of Windows registry behavior.

CI / Windows installer compatibility follow-up

• Legacy Windows install.cmd and install.dev.cmd are explicitly GBK + CRLF (no BOM). Preserved both files and their trusted SHA-256 verification and download/installation control flow. Only added ASCII [WARN] / [ERROR] tags before existing Chinese messages, to make Windows CI fail-closed checks and support logs stable across Windows code pages.
• .gitattributes now marks the -text CMD files as whitespace=cr-at-eol so git diff --check correctly accepts mandatory CRLF while still prohibiting Git encoding/newline conversion. Added small deterministic installer tests asserting the exact safety tags. No scripts are executed on live customer machines.
• Recheck the latest Windows CI after this follow-up, keep Draft until actual Windows 10/11 unrestricted and enterprise-limited E2E verification.