From the 1-app audit (2026-06-17). Non-blocking build/CI robustness items. - 3 Windows contract test scripts not wired to any CI job or npm script — silently dead (#20) - Node.js version mismatch: CI uses 22, release build uses 20 (#21) - `tauri-nspanel` depends on a git branch, not a pinned tag/rev — non-reproducible (Cargo.toml:119) (#22) - `backend-tests` is a separate crate with its own Cargo.lock, outside the 5-file version-sync gate (#23) - Ubuntu runner version differs between CI (24.04) and release-tauri (older) (#33) - `check-hotkey-recorder.mjs` / `check-window-hotkey-fallback.mjs` use esbuild as an undeclared dependency (#34) - `check-hotkey-injection.mjs` runs a full `cargo test` via spawnSync — only safe on macOS (#35) - (pre-existing, not from refactor) `windows-startup-lifecycle-contract.test.mjs` was stale — already fixed + wired in #695.
From the 1-app audit (2026-06-17). Non-blocking build/CI robustness items.
tauri-nspaneldepends on a git branch, not a pinned tag/rev — non-reproducible (Cargo.toml:119) ([tauri] 历史重新润色 IPC 契约前后端不一致 #22)backend-testsis a separate crate with its own Cargo.lock, outside the 5-file version-sync gate (fix(windows): 补齐运行时反馈和平台化交互 #23)check-hotkey-recorder.mjs/check-window-hotkey-fallback.mjsuse esbuild as an undeclared dependency ([settings] 凭据字段加载前失焦会清空已有密钥 #34)check-hotkey-injection.mjsruns a fullcargo testvia spawnSync — only safe on macOS ([windows] 热键链路缺少非人工自动注入门禁 #35)windows-startup-lifecycle-contract.test.mjswas stale — already fixed + wired in fix: audit batch 1 — critical Android updater + security hardening + bug fixes #695.