[abruption]

Summary

Part of #171. Prepare the separate Windows 0.5.0-alpha.1 diagnostic prerelease without publishing it or changing the stable npm version.

• Add a fixed, manual Release Please lane: draft component version PR, then draft release windows-v0.5.0-alpha.1 and verified ZIP/checksum/manifest assets. Release Please owns Cargo/version/changelog updates; this PR does not bump versions.
• Bind draft source to the merged component bot PR and immutable SHA. Refuse public tags/releases, unexpected provenance, differing existing assets and incomplete listings. No release publication, npm publish, asset deletion or overwrite path.
• Require a maintainer acknowledgement after independently checking that immutable releases are enabled. GITHUB_TOKEN cannot read that administration-only setting. Keep policy/config/workflows unchanged and do not manually publish during preparation. Draft GET and asset POST are not atomic; server immutability is the publication boundary.
• Make Windows packaging and observer validation version-aware; require the declared preview version as well as its expected hash.
• Statically link the release executable's MSVC CRT and verify final normal/delay-load PE imports with Visual Studio dumpbin before packaging. The earlier preview imported VCRUNTIME140.dll; a clean Windows host must not depend on a runner-installed runtime.
• Update English, Korean, Japanese and Simplified Chinese entry pages and platform/preview documentation: Windows support is a standalone diagnostic-only prerelease, not npm Windows support or automatic recovery. Preserve measured Windows 10 / NTFS / Medium-token scope and unmeasured Windows 11 / Defender-on limits.

Verification

• Local npm ci, check, lint, test and package smoke passed. Final local tests: 283 total, 280 passed, 3 Linux-only skips; focused packaging/static-CRT tests: 10/10. Windows CI run 39713166812 passed the actual static-linked PE, dumpbin, CLI and ZIP checks. Automatic current-head Code and Security Review completed without findings.
• All 41 checks passed at e90f559adbc5223c7b07f5afefdda5391af5f8b8. After the npm service recovered, the existing runtime-only audit succeeded on rerun without dependency or CI-policy changes (job 119635062762).
• Rust fmt/clippy/tests passed locally; version-aware Node tests included Rust-generated golden payloads.
• Separate Release Please configuration validated against the pinned action's release-please 17.6.0 schema; bootstrap SHA is an ancestor of main.
• Non-interactive independent review: Claude Code 2.1.306, requested/response model claude-opus-5-5; Codex CLI 0.163.0, actual model not exposed. Both read the same frozen source input (SHA-256 5888852fa2df04bc2396564ad8ea0910fbac447275999ecbbfa9a49e5e48c151), exited successfully, performed source review only, and did not execute the release pipeline. Review corrections cover release-state-neutral ZIP documentation, original-artifact-only partial upload retries, and publication/concurrency boundaries.

Release boundaries

PR #170 is merged. Node release PR #167 is deliberately excluded. The next generated Windows version PR requires normal current-head CI/reviews before merge. Draft asset construction and exact final-byte Windows measurements still follow this preparation PR; none are claimed complete here. Public publication remains a separate maintainer decision.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T02:52:05.900167Z	e90f559	PR opened
🔒 Security Review	✅ Completed 2026-10-22T02:50:15.196007Z	e90f559	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[abruption]

Validation update for e90f559adbc5223c7b07f5afefdda5391af5f8b8:

• Current-head automatic Code Review and Security Review completed with no findings.
• Windows CI run 39713166812 passed, including real Rust fixtures, generated payload checks, release CLI refusal checks and ZIP validation. Final PE dependencies were kernel32.dll, advapi32.dll, api-ms-win-core-synch-l1-2-0.dll, KERNEL32.dll, ntdll.dll; no dynamic MSVC CRT remained.
• 40 checks passed. The remaining security-audit failed after npm's runtime-only audit request timed out/fell back to the retired quick endpoint (HTTP 400). Its preceding full dependency audit reported zero vulnerabilities. A local runtime audit independently timed out against the bulk advisory endpoint.
• Failed-job retry initially repeated the runtime-only endpoint error. After the npm service recovered, the existing audit succeeded (job 119635062762), all 41 checks passed, and feat: prepare Windows 0.5.0-alpha.1 diagnostic prerelease #172 merged as 815c56e047cca57b71f50805bb487c856f047526. No lockfile/dependency or CI-policy changes were made to bypass the failed gate.

Release Please version PR #173 subsequently passed 41 checks and current-head Code/Security Review, then merged as 41aa81c1ff21d9695f1a5149cae2769e508d98c0. The draft release and final-alpha Windows measurement are complete; see the final validation record. Public publication remains pending, and stable npm remains unchanged.