From e4e1dc04045d5df058570ff5b939c1e243b8aa72 Mon Sep 17 00:00:00 2001
From: EMRG Evolution <emrg@argszero.dev>
Date: Tue, 25 Aug 2026 13:49:04 +0800
Subject: [PATCH] =?UTF-8?q?emrg:=20fix=20v0.2.78=20build=20=E2=80=94=20ent?=
 =?UTF-8?q?itlements=20plist=20comment=20breaks=20codesign=20AMFI=20+=20Wi?=
 =?UTF-8?q?ndows=20smoke=20cleanup=20file-lock=20failure?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 packaging/assets/python-entitlements.plist | 8 --------
 packaging/smoke-test.sh                    | 7 ++++++-
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/packaging/assets/python-entitlements.plist b/packaging/assets/python-entitlements.plist
index 5f89f548..2f4ef70f 100644
--- a/packaging/assets/python-entitlements.plist
+++ b/packaging/assets/python-entitlements.plist
@@ -2,14 +2,6 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-  <!-- rant 2026-08-25 (journal R2 scipy ILP blocked): the bundled python is
-       Developer ID signed with hardened runtime (--options runtime) but WITHOUT
-       this entitlement, so macOS library validation blocks loading ANY
-       pip-installed C extension (.so) — "mapping process and mapped file have
-       different Team IDs" — numpy/scipy/mypyc all fail to import even inside a
-       working venv. This entitlement is the standard plugin-loading allowance;
-       notarization accepts it. Applied to the python interpreter binaries only
-       in packaging/make-installer.sh (dylibs/so do not need it). -->
   <key>com.apple.security.cs.disable-library-validation</key>
   <true/>
 </dict>
diff --git a/packaging/smoke-test.sh b/packaging/smoke-test.sh
index 8b82914f..0bf3aef0 100755
--- a/packaging/smoke-test.sh
+++ b/packaging/smoke-test.sh
@@ -18,7 +18,12 @@ INSTALL_ROOT="${1:-$ROOT/dist/runtime}"
 PASS=0; FAIL=0
 
 smoke_home="$(mktemp -d)"
-trap 'rm -rf "$smoke_home"' EXIT
+# 红线守卫（rant 2026-08-25T10:38:34 / MANIFESTO 第四条附则二）：绝不以任何形式
+# stop/restart daemon。临时 daemon（步骤 2 自起）在 Windows 上仍持有
+# $HOME/.emrg/emrgd.log 等文件句柄 → 此处 rm 可能 "Device or resource busy"；
+# 2>/dev/null || true 使清理尽力而为（失败不改变退出码），残留临时 HOME 由
+# CI runner 的 orphan-process 清理兜底，本机由 56031 端口守卫降级兜底。
+trap 'rm -rf "$smoke_home" 2>/dev/null || true' EXIT
 export HOME="$smoke_home"
 mkdir -p "$HOME/.emrg"
 # R114: Windows 下经 cmd 启动的原生 python.exe 不认 Git Bash 的 $HOME —