fix(core): PRD-616 - warm the output pass before startup and streamed draws

.github/workflows/ci.yml

@@ -764,11 +764,14 @@ jobs:
             timeout: 60_000,
           });
           await page.keyboard.down("ArrowRight");
-          await page.waitForTimeout(3_000);
+          const moved = await page.waitForFunction(() => {
+            const position = Number(document.body.innerText.match(/POSITION\n(-?\d+)/)?.[1]);
+            return Number.isFinite(position) && Math.abs(position) >= 1;
+          }, undefined, { timeout: 60_000 }).then(() => true, () => false);
           await page.keyboard.up("ArrowRight");
           const text = await page.locator("body").innerText();
           const position = Number(text.match(/POSITION\n(-?\d+)/)?.[1]);
-          if (!Number.isFinite(position) || Math.abs(position) < 1 || errors.length > 0) {
+          if (!moved || !Number.isFinite(position) || Math.abs(position) < 1 || errors.length > 0) {
             throw new Error(`Scaffold smoke failed: ${JSON.stringify({ text, errors })}`);
           }
           await browser.close();
@@ -804,7 +807,11 @@ jobs:
     # Hosted on purpose: template legs use hosted while the balancer routes builds and tests
     # to the local pool, avoiding one routing variable sending the whole burst to a single pool.
     runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    # rain relaunches the page for each of its five GPU-free scenarios. On the hosted SwiftShader
+    # adapter each launch now takes about 7 minutes, against about 1 minute on develop (runs
+    # 38818830914 and 38824021621), so five launches exceed the 30-minute cap. Only rain gets the
+    # larger cap until that software launch cost is reduced; every other leg keeps 30 minutes.
+    timeout-minutes: ${{ matrix.template == 'rain' && 60 || 30 }}
     env:
       TN_CI_SHA: ${{ needs.scope.outputs.candidate_sha }}
       TN_PLAYTEST_ALLOW_SOFTWARE: "1"

.github/workflows/native-platforms.yml

@@ -1536,15 +1536,36 @@ jobs:
           # The release container is a ZIP on macOS and Windows and desktop-distribution.mjs shells
           # out to `zip -r -q`. A missing archiver must be a red job, never a silent pass.
           if [ "${{ matrix.platform }}" = "Windows" ]; then
-            # The community feed drops requests now and then ("package was not found" for a listed
-            # version, run 37079046851). Retry twice; makensis -VERSION below still fails closed.
-            for attempt in 1 2 3; do
-              choco install zip -y --no-progress && choco install nsis --version=3.11.0 -y --no-progress && break
-              [ "$attempt" = 3 ] || sleep 30
-            done
-            nsis='/c/Program Files (x86)/NSIS'
-            "$nsis/makensis.exe" -VERSION
-            cygpath -w "$nsis" >> "$GITHUB_PATH"
+            # Pinned upstream archives keep the Windows packaging proof independent of Chocolatey's feed.
+            root=$(cygpath -u "$RUNNER_TEMP")
+            tools="$root/tn-packaging-tools"
+            mkdir -p "$tools/nsis" "$tools/zip"
+            curl -fsSL --retry 2 --retry-all-errors --retry-delay 3 --connect-timeout 15 --max-time 120 \
+              -o "$tools/nsis.zip" \
+              'https://downloads.sourceforge.net/project/nsis/NSIS%203/3.11/nsis-3.11.zip'
+            curl -fsSL --retry 2 --retry-all-errors --retry-delay 3 --connect-timeout 15 --max-time 120 \
+              -o "$tools/zip.zip" \
+              'https://fossies.org/windows/misc/zip300xn-x64.zip'
+            printf '%s  %s\n' \
+              'c7d27f780ddb6cffb4730138cd1591e841f4b7edb155856901cdf5f214394fa1' "$tools/nsis.zip" \
+              '63f32f1f797680d9c68379d36cff4373674d405527d7fa2b4bbd34edcc3370d2' "$tools/zip.zip" \
+              | sha256sum --check
+            export TN_NSIS_ARCHIVE="$(cygpath -w "$tools/nsis.zip")"
+            export TN_NSIS_DEST="$(cygpath -w "$tools/nsis")"
+            export TN_ZIP_ARCHIVE="$(cygpath -w "$tools/zip.zip")"
+            export TN_ZIP_DEST="$(cygpath -w "$tools/zip")"
+            powershell.exe -NoLogo -NoProfile -NonInteractive -Command '
+              $ErrorActionPreference = "Stop"
+              Expand-Archive -LiteralPath $env:TN_NSIS_ARCHIVE -DestinationPath $env:TN_NSIS_DEST -Force
+              Expand-Archive -LiteralPath $env:TN_ZIP_ARCHIVE -DestinationPath $env:TN_ZIP_DEST -Force
+            '
+            nsis="$tools/nsis/nsis-3.11"
+            export NSISDIR="$(cygpath -w "$nsis")"
+            "$nsis/Bin/makensis.exe" -VERSION
+            printf 'NSISDIR=%s\n' "$NSISDIR" >> "$GITHUB_ENV"
+            cygpath -w "$nsis/Bin" >> "$GITHUB_PATH"
+            cygpath -w "$tools/zip" >> "$GITHUB_PATH"
+            PATH="$tools/zip:$PATH"
             # The starter sets app.icon, so desktop-distribution.mjs shells out to rcedit to embed
             # the icon and version strings in the PE resources. rcedit is not on the runner image.
             # Pin the release: `latest` would make the packaged identity move under us.