ci(s001): the serve step's curl loop had no bound and hung the Windows runner

`until curl ...; do sleep 0.05; done` with no limit. Linux and macOS passed it in under two
seconds; Windows — which had never been curled before this slice, because the step used to
carry `if: runner.os != 'Windows'` — sat in it until I cancelled run 34075929160 by hand.

Bounded to 60 s, and on failure it prints serve.log rather than just exiting, because the
question 'does the Windows artifact serve?' has never been answered and the next run needs to
answer it either way.

A step that hangs reports nothing and fails nothing, which is the same shape as the workflow
that never fired at 0326dea. Fourth defect this workflow's runs have surfaced, and again one
no local run could have.

mix gate exit=0.

Signed-off-by: Ayla Croft <aylacroft@proton.me>

Author: HackTuah

.github/workflows/package.yml

@@ -210,7 +210,19 @@ jobs:
             sleep 0.5
           done
           test -n "${PORT:-}"
-          until curl -sS -o /dev/null "http://127.0.0.1:$PORT/" 2>/dev/null; do sleep 0.05; done
+          # Bounded. The first version of this loop had no limit and the Windows runner sat in
+          # it until the run was cancelled by hand — a step that hangs reports nothing and
+          # fails nothing, which is the same shape as a workflow that never fires.
+          ok=0
+          for _ in $(seq 1 600); do
+            if curl -sS -o /dev/null "http://127.0.0.1:$PORT/" 2>/dev/null; then ok=1; break; fi
+            sleep 0.1
+          done
+          if [ "$ok" != "1" ]; then
+            echo "no HTTP response on port $PORT after 60 s" >&2
+            echo "--- serve.log ---" >&2; tail -40 serve.log >&2
+            exit 1
+          fi
           elapsed=$(( $(now_ms) - start ))
           code=$(curl -sS -o /dev/null -w '%{http_code}' "http://127.0.0.1:$PORT/")
           echo "HTTP $code on port $PORT"

slices/001-packaging-spike/PROOF.md

@@ -318,18 +318,34 @@ figure would understate the launch that forms the impression by a factor of six.
 **Partly proven, and the rest is not blocked by what I said it was.** Three sub-claims, three
 different answers:
 
-**Per-OS binary size — proven**, by the runners, run `34067973983`:
+**Per-OS binary size — proven**, by the runners. Two sets of figures, because D7 changed what
+is in the binary between them:
 
-| OS | Bytes |
+| OS | run `34067973983`, before D7 | run `34075257183`, after D7 |
+|---|---|---|
+| linux x86_64 | 20 790 808 | 21 298 216 |
+| macOS aarch64 | 11 927 096 | 12 435 992 |
+| Windows x86_64 | 24 519 680 | — see AC3 |
+
+The later column is the artifact this slice ships. Both are kept rather than the first being
+overwritten: the difference is `ex_tauri` and its dependency tail entering `:prod`, and a reader
+comparing sizes across slices needs to know a dependency moved rather than the code growing.
+
+**Per-OS cold-start-to-serving — measured, at G4 item 2**, run `34075257183`:
+
+| OS | exec to first HTTP 200 |
 |---|---|
-| linux x86_64 | 20 790 808 |
-| macOS aarch64 | 11 927 096 |
-| Windows x86_64 | 24 519 680 |
-
-**Per-OS cold-start-to-serving — now measured in CI, at G4 item 2.** The jobs previously
-launched and curled without timing the interval, and Windows was never curled at all
-(`if: runner.os != 'Windows'`). Both were holes in `package.yml` rather than missing machines.
-Every job now times exec-to-first-200 and writes it to its own summary.
+| linux x86_64 | **699 ms** |
+| macOS aarch64 | **1 416 ms** |
+
+The jobs previously launched and curled without timing the interval, and Windows was never
+curled at all (`if: runner.os != 'Windows'`). Both were holes in `package.yml` rather than
+missing machines.
+
+**These are not comparable with AC5's 231–245 ms.** That figure is a warm launch on this
+machine with the Burrito payload already extracted; a runner is cold every time, so 699 ms is
+the runner's equivalent of AC5's 1 578 ms first-launch figure, not of its warm one. Reporting
+them in one column would invite exactly that mistake.
 
 **Cold-start-to-first-paint — PROVEN on Linux, 2026-09-07.** The owner timed **2–3 seconds**
 from pressing Enter on `mix ex_tauri.dev` to the scaffold appearing in the window. Timed by hand,