docs(s001): ADR-0004's second appended correction — still proposed, for a different reason

Q2, answered yes at G4. Supersedes two rows of the first correction's table and nothing else:
macOS is now built natively and serves on a runner, and Windows builds here and on a runner
since the owner installed 7z. The ADR's literal exit condition — a running smoke build on macOS
and Windows — is satisfied for the sidecar.

The status still does not move, because the condition was written about the wrong thing. This
ADR chooses a desktop SHELL, and a Burrito binary that boots and serves says nothing about that
choice: every alternative in its table would pass, since they all wrap the same BEAM.

What is established about the shell: it opens a real window on exactly one OS, Linux, run by
the owner, with a screenshot. It compiles on three. It has never been launched on macOS or
Windows. One shell running on one OS is not a decision about a cross-platform shell, and the
fallback stays untriggered rather than eliminated.

New lift condition replaces the first correction's: a window on macOS and on Windows, and the
sidecar observed dying with its window by a mechanism this project owns. The build-and-launch
half is done and was never the question.

Caught while writing the G3 repost, which claimed this correction existed before it did —
the fifth claim-ahead-of-tree this slice, and the first I caught before it left the machine.

mix gate exit=0.

Signed-off-by: Ayla Croft <aylacroft@proton.me>

Author: HackTuah

docs/adr/0004-desktop-shell-ex-tauri.md

@@ -88,3 +88,77 @@ half on both. It does not satisfy the window half on any OS, and no runner will.
 
 No date is set on this, because the condition is a machine becoming available and I do not know
 when that is.
+
+---
+
+## Second correction, 2026-09-07 — Slice 001 G4. **Still `proposed`, and now for a different reason.**
+
+**This supersedes two lines in the first correction's table above**, and nothing else in it. That
+table read:
+
+> | Running smoke build on **macOS** | **not done** | The `macos_aarch64` target cross-compiles under Zig, unsigned. Nothing here can execute it. |
+> | Running smoke build on **Windows** | **not built** | Burrito unpacks the Windows ERTS `.exe` with 7z; none is installed and installing one needs root. |
+
+**Both are now done, and neither is what this ADR is about.**
+
+### What changed
+
+**macOS**: the `package` workflow builds it natively on `macos-latest` — 12 435 992 bytes — and
+it serves HTTP 200 under `--no-halt --smoke`, exiting on its own with the process list unchanged
+either side.
+
+**Windows**: the owner installed 7z, so it now cross-builds here as well —
+`desktop_windows_x86_64.exe`, 27 316 224 bytes — and it builds natively on `windows-latest` and
+runs under `--smoke`. **It has not been observed serving**; that step has been blocked by three
+Windows-only defects in the workflow, all now fixed, and the answer is not yet in.
+
+**So this ADR's literal exit condition — "a running smoke build on macOS and Windows" — is
+satisfied for the sidecar.** The status still does not move, and the reason is that the
+condition was written about the wrong thing.
+
+### Why `proposed` is still right
+
+**This ADR chooses a desktop shell.** Its subject is `ex_tauri` versus a hand-rolled Tauri
+sidecar versus elixir-desktop versus Electron versus local-server-plus-tray. A Burrito binary
+that boots and serves says nothing about any of them: **every alternative in the table would
+pass that test**, because they all wrap the same BEAM.
+
+What has been established about the *shell*, as opposed to the sidecar:
+
+* **`mix ex_tauri.dev` opens a real window showing the scaffold** — on **one** operating system,
+  Linux, run by the owner on 2026-09-07, with a screenshot at
+  `slices/001-packaging-spike/proof/ac4-linux-window.png`. That is the first evidence in this
+  project that the chosen shell does the thing it was chosen for.
+* The shell **compiles** on all three targets in CI. Compiling is not running, and no job claims
+  otherwise.
+* On macOS and Windows the shell has **never been launched**. Those are AC2 and AC3, both
+  `[manual]`, both needing a desktop that does not exist here.
+
+**One shell running on one OS is not a decision about a cross-platform shell.** The fallback
+path remains **untriggered**, not eliminated: its trigger is "Windows fails with `ex_tauri`",
+and the Windows *shell* has still never been attempted.
+
+### And a defect the choice has to answer for
+
+Slice 001 G4 measured the sidecar's death when its parent dies, which is what "closing the
+window stops the sidecar" means in practice:
+
+* dev path, through a real window: **14–19 ms**, six runs — but **not** by `ex_tauri`'s
+  heartbeat, whose 1500 ms timer never fired. `SIGKILL` matches `SIGTERM`, so it is the stdio
+  pipe closing, which is the OS and not this library.
+* production shape, three runs: **orphaned past 7.6 s, still answering HTTP 200**, with
+  `ExTauri.ShutdownManager` compiled in.
+
+**Across every measurement in slice 001 the heartbeat has never been observed to fire.** The
+mechanism this ADR's chosen shell provides for the problem is present and unexercised. That is
+not a reason to reject `ex_tauri` — no alternative has been shown to do better — but it is a
+reason not to write `accepted` beside it yet.
+
+### Lift condition, replacing the first correction's
+
+**Owner: Ayla Croft.** This ADR is confirmed or amended when **`mix ex_tauri.dev` has opened a
+window on macOS and on Windows**, and when the sidecar has been observed dying with its window
+on at least one of them **by a mechanism this project owns**. The build-and-launch half is done
+and was never the question.
+
+No date: the condition is two machines becoming available, and I do not know when that is.