garrytan
diff --git a/‎.github/workflows/windows-free-tests.yml‎
Lines changed: 1 addition & 0 deletions b/‎.github/workflows/windows-free-tests.yml‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎CHANGELOG.md‎
Lines changed: 43 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 43 additions & 0 deletions
diff --git a/‎VERSION‎
Lines changed: 1 addition & 1 deletion b/‎VERSION‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎bin/gstack-brain-sync‎
Lines changed: 57 additions & 12 deletions b/‎bin/gstack-brain-sync‎
Lines changed: 57 additions & 12 deletions
diff --git a/‎bin/gstack-developer-profile‎
Lines changed: 72 additions & 4 deletions b/‎bin/gstack-developer-profile‎
Lines changed: 72 additions & 4 deletions
diff --git a/‎bin/gstack-diff-scope‎
Lines changed: 1 addition & 1 deletion b/‎bin/gstack-diff-scope‎
Lines changed: 1 addition & 1 deletion
@@ -116,6 +116,7 @@ jobs:
             test/setup-windows-fallback.test.ts \
             test/build-script-shell-compat.test.ts \
             test/docs-config-keys.test.ts \
+            test/brain-sync-windows-paths.test.ts \
             make-pdf/test/browseClient.test.ts \
             make-pdf/test/pdftotext.test.ts
         shell: bash
@@ -1,5 +1,48 @@
 # Changelog
 
+## [1.44.1.0] - 2026-05-24
+
+## **Nine community fixes ship in one bundle.** Office-hours session counter works again, iOS QA tunnels survive macOS 26.x, Windows brain-sync stops dropping artifacts, browse server tells you whether the bind failure was a port collision or a sandbox block.
+
+The fix wave pattern runs its second pass after v1.43.2.0's 15-PR Daegu wave. Nine contributor PRs land in eleven commits plus a merge from new main. Each cherry-pick routes through `git cherry-pick` per-commit so contributor authorship survives in `git log --author`, with `Co-Authored-By` trailers for GitHub's contribution UI. Wave-meta files (VERSION, CHANGELOG, version-only `package.json` bumps) stripped per cherry-pick so the wave owns its own bump cleanly.
+
+The triage caught a real failure mode mid-flight. An initial scope of 18 PRs went through Codex review as outside voice; Codex flagged that 9 of the 18 had already shipped via v1.43.2.0 or sibling commits. Verified against current main (`bin/gstack-gbrain-sync.ts:404` already wraps `{sources:[...]}`, `browser-manager.ts:30` already has `isCustomChromium`, `server.ts:209` already has `ownsTerminalAgent`). Recompute trimmed the wave from 18 to 9, saving nine empty cherry-picks and nine misleading "landed in" close comments to contributors whose work had already merged via another route.
+
+### The numbers that matter
+
+Source: `git log origin/main..HEAD` and `gh pr view --json closingIssuesReferences` per wave PR.
+
+| Metric                                       | Value      |
+|----------------------------------------------|------------|
+| Community PRs landed                         | 9          |
+| Distinct contributors credited               | 9          |
+| Issues auto-closed by merge                  | 4          |
+| Files changed                                | 26         |
+| Lines added                                  | 1,651      |
+| Lines removed                                | 114        |
+| Wave commits (excluding merge)               | 11         |
+| Already-shipped PRs caught + politely closed | 9          |
+| Paid eval suites that ran (all PASS)         | 6          |
+
+### What this means for contributors
+
+Your fix lands as a commit with your name in `git log --author=<your-handle>`. If your PR had multiple commits, each lands separately so dates and trailers survive. If your fix was the same as something that shipped via another route in v1.43.2.0, you get a close comment pointing at the CHANGELOG line that credits you by name. The recompute step that catches duplicates is now part of every future fix wave.
+
+### Itemized changes
+
+**Added**
+- `/investigate` freeze hook resolves on standalone marketplace installs. Falls back through both bundled and standalone freeze-bin paths instead of crashing on a hardcoded `../freeze/` lookup. Closes #1647. Contributed by @Gujiassh via PR #1648.
+- `gstack-next-version --version-path` flag plus `.gstack/version-path` config: monorepo VERSION layouts now work. Contributed by @cfeddersen via PR #1627.
+
+**Fixed**
+- `/office-hours` SESSION_COUNT stuck at 0 since v1.0. Writer wrote to legacy `builder-profile.jsonl`, reader read from new `developer-profile.json`. Reader-path auto-migrates existing legacy data on first call; existing users keep their session history. 33 regression tests plus a static-grep invariant pinning the no-legacy-writes contract. Closes #1671, #1677. Contributed by @pryow via PR #1676.
+- `gstack-timeline-read --branch "feature/o'hare"` no longer breaks on single-quoted branch names. Filters passed as data, not interpolated into a shell command. Closes #1634. Contributed by @jbetala7 via PR #1635.
+- `browse` server localhost bind: distinguishes `EADDRINUSE` (real port collision) from sandbox `EPERM` (Codex/Conductor shell sandbox blocking the bind syscall). Tells the user which one happened. Contributed by @spacegeologist via PR #1664.
+- `v1.40.0.0` migration on jq-less machines: defers done-marker until every repair succeeds, instead of writing it unconditionally. Re-runs the migration on next upgrade for users who hit the pre-fix path. 8-case regression test. Closes #1581. Contributed by @stedfn via PR #1589.
+- Three Windows brain-sync bugs: backslash vs forward-slash globs, bash-shebang subprocess fail on `cmd.exe`, CRLF on stdout breaking `git add`. Static-invariant tests added to `windows-free-tests.yml`. Contributed by @daveowenatl via PR #1672.
+- `gstack-diff-scope` detects `bun.lock` (Bun v1.2+ text lockfile) alongside `bun.lockb`. Without this, eval-select skipped lockfile changes on Bun 1.2+. Contributed by @hiSandog via PR #1649.
+- iOS QA on macOS 26.x: `coredevice.local` resolution falls through `xcrun devicectl` → `dns.lookup` → `dns.resolve6` so the tunnel comes up even when mDNSResponder is bypassed. Tunnel keepalive added so long-running QA sessions survive. Contributed by @sternryan via PR #1673.
+
 ## [1.44.0.0] - 2026-05-23
 
 ## **Sidebar Claude Code now survives the day.** WebSocket keepalive, transparent re-attach across network blips with scrollback intact, and a restart button that actually kills the old claude before spawning the new one. Outer supervisor opt-in so the browse server itself can crash and recover without you noticing.
 
@@ -1 +1 @@
-1.44.0.0
+1.44.1.0
@@ -136,7 +136,11 @@ def load_privacy_map(path):
 
 allowlist_globs = load_lines(allowlist_path)
 privacy_map = load_privacy_map(privacy_path)
-skip_lines = set(load_lines(skip_path))
+# Normalize skip entries to the POSIX form queued paths use, so a backslash
+# entry in .brain-skip.txt still matches on Windows. The drain is the safety
+# boundary that actually stages files, so it must normalize identically to
+# discover_new — otherwise an explicitly-skipped file gets committed.
+skip_lines = {s.replace(os.sep, "/") for s in load_lines(skip_path)}
 
 # Read queue; collect unique file paths.
 queue_paths = set()
@@ -253,6 +257,8 @@ subcmd_once() {
 
   # Stage with git add -f (forces past .gitignore=*) explicit paths only.
   while IFS= read -r p; do
+    p="${p%$'\r'}"   # Windows: compute_paths_to_stage's python print() emits CRLF;
+                     # a trailing CR makes the pathspec match nothing (silent no-stage).
     [ -z "$p" ] && continue
     git -C "$GSTACK_HOME" add -f -- "$p" 2>/dev/null || true
   done < "$paths_file"
@@ -376,10 +382,13 @@ subcmd_discover_new() {
     exit 0
   fi
   # Walk allowlist globs; enqueue any file where mtime+size differs from cursor.
-  python3 - "$GSTACK_HOME" "$ALLOWLIST" "$DISCOVER_CURSOR" "$SCRIPT_DIR/gstack-brain-enqueue" <<'PYEOF' 2>/dev/null || true
-import sys, os, json, glob, fnmatch, subprocess, hashlib
+  python3 - "$GSTACK_HOME" "$ALLOWLIST" "$DISCOVER_CURSOR" <<'PYEOF' 2>/dev/null || true
+import sys, os, json, fnmatch
+from datetime import datetime, timezone
 
-gstack_home, allowlist_path, cursor_path, enqueue_bin = sys.argv[1:5]
+gstack_home, allowlist_path, cursor_path = sys.argv[1:4]
+queue_path = os.path.join(gstack_home, ".brain-queue.jsonl")
+skip_path = os.path.join(gstack_home, ".brain-skip.txt")
 
 def load_lines(path):
     try:
@@ -403,8 +412,12 @@ def save_cursor(path, data):
         pass
 
 allowlist = load_lines(allowlist_path)
+# Normalize skip entries to the same POSIX form as `rel` below, so a
+# backslash entry in .brain-skip.txt still matches a normalized path on Windows.
+skip = {s.replace(os.sep, "/") for s in load_lines(skip_path)}
 cursor = load_cursor(cursor_path)
 new_cursor = dict(cursor)
+to_enqueue = []
 
 # Walk all files under gstack_home, match against allowlist.
 for root, dirs, files in os.walk(gstack_home):
@@ -413,22 +426,54 @@ for root, dirs, files in os.walk(gstack_home):
         continue
     for name in files:
         full = os.path.join(root, name)
-        rel = os.path.relpath(full, gstack_home)
+        # Repo paths are POSIX-relative. os.path.relpath yields backslash
+        # separators on Windows, which never match the forward-slash allowlist
+        # globs (e.g. "projects/*/learnings.jsonl"), so discovery silently
+        # enqueued nothing under projects/ on Windows. Normalize to "/".
+        rel = os.path.relpath(full, gstack_home).replace(os.sep, "/")
         if rel.startswith(".brain-"):
             continue
-        matched = any(fnmatch.fnmatchcase(rel, pat) for pat in allowlist)
-        if not matched:
+        if not any(fnmatch.fnmatchcase(rel, pat) for pat in allowlist):
+            continue
+        if rel in skip:
             continue
         try:
             st = os.stat(full)
             key = f"{int(st.st_mtime)}:{st.st_size}"
         except OSError:
             continue
-        prev = cursor.get(rel)
-        if prev != key:
-            # Enqueue via the shim (respects sync mode + skip list).
-            subprocess.run([enqueue_bin, rel], check=False)
-            new_cursor[rel] = key
+        if cursor.get(rel) != key:
+            to_enqueue.append((rel, key))
+
+# Append to the queue directly. The previous implementation shelled out to
+# gstack-brain-enqueue once per file, but Windows Python cannot exec a
+# bash-shebang script (the spawn fails with a fork error), so discovery
+# enqueued nothing on Windows even after the path-match fix above.
+# Writing the queue line here is platform-agnostic; the drain step
+# (compute_paths_to_stage) still re-applies the skip-list + privacy filters.
+if to_enqueue:
+    ts = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    try:
+        # One atomic append per record (O_APPEND, each line < PIPE_BUF), matching
+        # gstack-brain-enqueue's concurrency contract so a writer-shim append
+        # running in parallel can't interleave mid-record. Buffered text writes
+        # don't guarantee that. Compact separators match the shim's JSON shape.
+        fd = os.open(queue_path, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o644)
+        try:
+            for rel, key in to_enqueue:
+                rec = json.dumps({"file": rel, "ts": ts}, separators=(",", ":"))
+                os.write(fd, (rec + "\n").encode("utf-8"))
+        finally:
+            os.close(fd)
+    except OSError:
+        # Queue write failed (disk full, AV file lock). Leave the cursor
+        # unadvanced so these files are retried on the next discover instead of
+        # being silently recorded as synced (which loses the change until the
+        # file next changes).
+        to_enqueue = []
+    # Advance the cursor only for records actually written.
+    for rel, key in to_enqueue:
+        new_cursor[rel] = key
 
 save_cursor(cursor_path, new_cursor)
 PYEOF
 
@@ -17,6 +17,9 @@
 #   --check-mismatch    detect meaningful gaps between declared and observed.
 #   --migrate           migrate builder-profile.jsonl → developer-profile.json.
 #                       Idempotent; archives the source file on success.
+#   --log-session    append a session entry (from /office-hours) to
+#                       sessions[] and update aggregates. Required fields:
+#                       date, mode. Silent skip on invalid input.
 #
 # Profile file: ~/.gstack/developer-profile.json (unified schema — see
 # docs/designs/PLAN_TUNING_V0.md). Event file: ~/.gstack/projects/{SLUG}/
@@ -154,6 +157,65 @@ ensure_profile() {
 EOF
 }
 
+# -----------------------------------------------------------------------
+# Record session: append a session entry from /office-hours to sessions[]
+# and update aggregates (signals_accumulated, resources_shown, topics).
+# Fix for #1671: the writer side of the v1.0.0.0 migration. Reader and
+# writer now share the same file.
+# Silent skip on invalid input (matches gstack-timeline-log:22-26 pattern).
+# -----------------------------------------------------------------------
+do_log_session() {
+  local INPUT="${1:-}"
+  if [ -z "$INPUT" ]; then
+    return 0
+  fi
+
+  # Validate: input must be parseable JSON with required fields (date, mode).
+  if ! printf '%s' "$INPUT" | bun -e "
+    const j = JSON.parse(await Bun.stdin.text());
+    if (!j.date || !j.mode) process.exit(1);
+  " 2>/dev/null; then
+    return 0
+  fi
+
+  ensure_profile
+
+  local TMPOUT
+  TMPOUT=$(mktemp "$GSTACK_HOME/developer-profile.json.XXXXXX.tmp")
+  trap 'rm -f "$TMPOUT"' EXIT
+
+  PROFILE_FILE_PATH="$PROFILE_FILE" RECORD_INPUT="$INPUT" TMPOUT_PATH="$TMPOUT" bun -e "
+    const fs = require('fs');
+    const entry = JSON.parse(process.env.RECORD_INPUT);
+    if (!entry.ts) entry.ts = new Date().toISOString();
+
+    const profile = JSON.parse(fs.readFileSync(process.env.PROFILE_FILE_PATH, 'utf-8'));
+    profile.sessions = profile.sessions || [];
+    profile.sessions.push(entry);
+
+    profile.signals_accumulated = profile.signals_accumulated || {};
+    for (const s of (entry.signals || [])) {
+      profile.signals_accumulated[s] = (profile.signals_accumulated[s] || 0) + 1;
+    }
+
+    profile.resources_shown = profile.resources_shown || [];
+    const resSet = new Set(profile.resources_shown);
+    for (const r of (entry.resources_shown || [])) resSet.add(r);
+    profile.resources_shown = Array.from(resSet);
+
+    profile.topics = profile.topics || [];
+    const topicSet = new Set(profile.topics);
+    for (const t of (entry.topics || [])) topicSet.add(t);
+    profile.topics = Array.from(topicSet);
+
+    fs.writeFileSync(process.env.TMPOUT_PATH, JSON.stringify(profile, null, 2));
+  "
+
+  mv "$TMPOUT" "$PROFILE_FILE"
+  trap - EXIT
+  "$SCRIPT_DIR/gstack-brain-enqueue" "developer-profile.json" 2>/dev/null &
+}
+
 # -----------------------------------------------------------------------
 # Read: emit legacy KEY: VALUE output for /office-hours compat.
 # -----------------------------------------------------------------------
@@ -168,14 +230,19 @@ do_read() {
     else if (count >= 4) tier = 'regular';
     else if (count >= 1) tier = 'welcome_back';
 
-    const last = sessions[count - 1] || {};
-    const prev = sessions[count - 2] || {};
+    // LAST_* / CROSS_PROJECT must reflect real sessions, not resource-tracking
+    // events (the Phase 6 auto-append). Without this filter, a session's
+    // resources entry written immediately after the real session would clobber
+    // LAST_PROJECT/LAST_ASSIGNMENT/LAST_DESIGN_TITLE.
+    const realSessions = sessions.filter(e => e.mode !== 'resources');
+    const last = realSessions[realSessions.length - 1] || {};
+    const prev = realSessions[realSessions.length - 2] || {};
     const crossProject = prev.project_slug && last.project_slug
       ? prev.project_slug !== last.project_slug
       : false;
 
-    const designs = sessions.map(e => e.design_doc || '').filter(Boolean);
-    const designTitles = sessions
+    const designs = realSessions.map(e => e.design_doc || '').filter(Boolean);
+    const designTitles = realSessions
       .map(e => (e.design_doc ? (e.project_slug || 'unknown') : ''))
       .filter(Boolean);
 
@@ -441,6 +508,7 @@ case "$CMD" in
   --vibe) do_vibe ;;
   --check-mismatch) do_check_mismatch ;;
   --migrate) do_migrate ;;
+  --log-session) do_log_session "$@" ;;
   --help|-h) sed -n '1,/^set -euo/p' "$0" | sed 's|^# \?||' ;;
   *)
     echo "gstack-developer-profile: unknown subcommand '$CMD'" >&2
 
@@ -57,7 +57,7 @@ while IFS= read -r f; do
     *.md) DOCS=true ;;
 
     # Config
-    package.json|package-lock.json|yarn.lock|bun.lockb) CONFIG=true ;;
+    package.json|package-lock.json|yarn.lock|bun.lock|bun.lockb) CONFIG=true ;;
     Gemfile|Gemfile.lock) CONFIG=true ;;
     *.yml|*.yaml) CONFIG=true ;;
     .github/*) CONFIG=true ;;