[Sev7eNup]

Deployment follow-ups: the update health probe, the manual ZIP update, the failover drill and the desktop runtime.

Update health probe

Update-NodePilot.ps1 used to install a process-wide trust-all certificate policy for its readiness probe. It now goes through LocalServerHttp.ps1, like the server setup, pinned to Kestrel:Https:CertificateThumbprint from the installed appsettings.Production.json. Nothing new has to be passed, and the settings are read before the service is stopped.

If that file cannot be parsed, or HTTPS is enabled without a usable thumbprint, the update warns and checks that one request without the pin. It does not stop. The probe sends no credentials, so this only affects the health verdict. The unpinned path of the helper is limited to a plain GET without headers, so the setup token and first-login password can never go out unpinned. With Kestrel:Https:Enabled off, the probe uses plain HTTP.

Other changes

• Preserve the GUI uninstaller during a manual ZIP update #622: after the artifact is verified, a manual ZIP update copies the GUI setup's unins* files and deploy\ back from the backup it just took. It checks them against the hashes recorded with that backup, and a failed restore rolls the update back. "Apps & features" can still uninstall. Its displayed version stays the old one until the next GUI setup run.
• Recognize a healthy leader response in the failover acceptance script #624: Test-Failover.ps1 reads nodeId, leaseEpoch and reason through PSObject.Properties, so a healthy HTTP 200 without reason no longer aborts the drill.
• Replace the outdated Kestrel runtime bundled with the desktop package #787: the desktop package pins .NET 10.0.14, the newest patch on nuget.org, for the API, np and nodepilot-mcp. Assert-DesktopRuntimePayload.ps1 now also checks the two client stages (-BaseRuntimeOnly). It rejects older framework declarations and older binaries, including a lone old Kestrel or hostfxr.dll in an otherwise current stage. The desktop docs say that existing installations get the runtime only through the new package.
• PR-Review #764: extract-zip-Bump auf 1.0.8 bricht den Desktop-Pin-Vertrag (package-contract.test.ts) #773: @electron-internal/extract-zip 1.0.8, which includes the RUSTSEC-2026-0367/0368/0369 fixes from 1.0.6, and @types/node 26.6.6, both taken over from Dependabot PR Bump the npm-minor-patch group across 1 directory with 2 updates #764. The exact pin and the contract test move to 1.0.8. The lockfile changes come from that PR unchanged. The licence changes from BSD-2-Clause to MIT.

Tests run

• deploy\Test-LocalServerHttp.ps1 (44), Test-DeploymentTemplates.ps1, Test-DesktopRuntimePayload.ps1 (18, new and registered in ci.yml), Test-FailoverFixtures.ps1, Test-FailoverRecovery.ps1, Test-ArtifactSecurity.ps1, Test-SwitcherConfig.ps1: passed
• Test-SetupAdapter.ps1: 282 passed. The four occupied-port assertions fail on this machine on main too, and were skipped locally.
• Api.Tests DesktopDeploymentSecurityTests|DocsSiteDeploymentTests: 13 passed
• Desktop shell vitest: 126 passed, tsc --noEmit clean
• A self-contained publish of the API, np and nodepilot-mcp with RuntimeFrameworkVersion=10.0.14 passes Assert-DesktopRuntimePayload. All checked binaries report 10.0.14, and a 10.0.15 floor rejects them. The full installer build and signing were not run.
• Not run locally: the PowerShell 7 leg

Closes #622
Closes #624
Closes #787
Closes #773

🤖 Generated with Claude Code