fix(execpolicy): a redirect is not a command separator

.config/nextest.toml

@@ -78,8 +78,9 @@ test-group = 'fleet-manager-lifecycle'
 
 [[profile.default.overrides]]
 # DSH preparation also launches the isolated host against the shared hermetic
-# home. Keep its ACL grants/retirement in this existing serial lane.
-filter = 'package(codewhale-tui) & kind(lib) & (test(/^extension_host::/) | test(/^core::engine::.*extension/) | test(/^plugins::install::dsh::/) | test(/^plugins::tests::dsh_/) | test(/^runtime_api::tests::dsh_package_preview_then_exact_install_over_http$/) | test(/^commands::contract::tests::plugin_adapter_dsh_preview_runs_from_live_runtime$/) | test(/^commands::groups::plugins::tests::dsh_import_reviews_without_installing_then_installs_the_exact_bundle$/))'
+# home. OCR/PDF consumers also launch real hosts outside extension_host's
+# namespace. Keep their process lifecycle checks in this existing serial lane.
+filter = 'package(codewhale-tui) & kind(lib) & (test(/^extension_host::/) | test(/^tools::image_ocr::host_tests::/) | test(/^tools::pdf::host_tests::/) | test(/^core::engine::.*extension/) | test(/^plugins::install::dsh::/) | test(/^plugins::tests::dsh_/) | test(/^runtime_api::tests::dsh_package_preview_then_exact_install_over_http$/) | test(/^commands::contract::tests::plugin_adapter_dsh_preview_runs_from_live_runtime$/) | test(/^commands::groups::plugins::tests::dsh_import_reviews_without_installing_then_installs_the_exact_bundle$/))'
 test-group = 'extension-host'
 
 [[profile.default.overrides]]
@@ -91,6 +92,10 @@ slow-timeout = { period = "120s" }
 filter = 'binary(integration)'
 test-group = 'spawns-binaries'
 
+[[profile.default.overrides]]
+filter = 'binary(owner_crash_reentry)'
+test-group = 'spawns-binaries'
+
 # CI (profiles inherit from default): the final summary lists every failure and
 # slow test in full so the run log is enough to diagnose without rerunning.
 [profile.ci]

.github/AUTHOR_MAP

@@ -254,5 +254,12 @@ Serendo = Serendo <8120397+Serendo@users.noreply.github.com>
 biiyunfei@gmail.com = Serendo <8120397+Serendo@users.noreply.github.com>
 dajiaohuang = dajiaohuang <108231307+dajiaohuang@users.noreply.github.com>
 shuwen.wu@bytedance.com = dajiaohuang <108231307+dajiaohuang@users.noreply.github.com>
+Wu Shuwen = dajiaohuang <108231307+dajiaohuang@users.noreply.github.com>
+mikewushuwen@outlook.com = dajiaohuang <108231307+dajiaohuang@users.noreply.github.com>
 harryvgiunta = Harry Giunta <37885714+harryvgiunta@users.noreply.github.com>
 harryvgiunta@gmail.com = Harry Giunta <37885714+harryvgiunta@users.noreply.github.com>
+xiaoray-blip = Arlo <253300483+xiaoray-blip@users.noreply.github.com>
+Arlo = Arlo <253300483+xiaoray-blip@users.noreply.github.com>
+xyzs996 = Mark Yan <396284+xyzs996@users.noreply.github.com>
+xyzs996@gmail.com = Mark Yan <396284+xyzs996@users.noreply.github.com>
+Mark Yan = Mark Yan <396284+xyzs996@users.noreply.github.com>

.github/workflows/ci.yml

@@ -464,12 +464,7 @@ jobs:
           echo "SCCACHE_IGNORE_SERVER_IO_ERROR=1" >> "${GITHUB_ENV}"
       - name: Install Linux system dependencies
         run: |
-          for i in 1 2 3 4 5; do
-            sudo apt-get update && break
-            echo "apt-get update failed (attempt $i); retrying in 15s"
-            sleep 15
-          done
-          sudo apt-get install -y libdbus-1-dev pkg-config bubblewrap apparmor-profiles
+          bash scripts/ci-apt-install.sh libdbus-1-dev pkg-config bubblewrap apparmor-profiles
           sh scripts/prepare-linux-test-sandbox.sh
       - name: Ubuntu build headroom
         shell: bash
@@ -530,12 +525,7 @@ jobs:
       - name: Install Linux system dependencies
         if: needs.changes.outputs.heavy == 'true'
         run: |
-          for i in 1 2 3 4 5; do
-            sudo apt-get update && break
-            echo "apt-get update failed (attempt $i); retrying in 15s"
-            sleep 15
-          done
-          sudo apt-get install -y libdbus-1-dev pkg-config
+          bash scripts/ci-apt-install.sh libdbus-1-dev pkg-config
       - name: Ubuntu build headroom
         if: needs.changes.outputs.heavy == 'true'
         shell: bash
@@ -754,12 +744,7 @@ jobs:
           toolchain: "1.89"
       - name: Install Linux system dependencies
         run: |
-          for i in 1 2 3 4 5; do
-            sudo apt-get update && break
-            echo "apt-get update failed (attempt $i); retrying in 15s"
-            sleep 15
-          done
-          sudo apt-get install -y libdbus-1-dev pkg-config
+          bash scripts/ci-apt-install.sh libdbus-1-dev pkg-config
       - uses: Swatinem/rust-cache@v2
         with:
           cache-bin: false
@@ -882,6 +867,12 @@ jobs:
         run: ./scripts/installer/installer-path-regression.tests.ps1 -AllowUserPathMutation
       - uses: dtolnay/rust-toolchain@stable
         if: needs.changes.outputs.heavy == 'true' && (matrix.os != 'ubuntu-latest' || github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request')
+      - name: Omit macOS test debug metadata
+        if: needs.changes.outputs.heavy == 'true' && matrix.os == 'macos-latest'
+        shell: bash
+        # Match the existing full-workspace CNB gate. Keep debug assertions and
+        # every test; only disposable test debug tables change on this lane.
+        run: echo "CARGO_PROFILE_TEST_DEBUG=0" >> "$GITHUB_ENV"
       - uses: mozilla-actions/sccache-action@v0.0.11
         id: sccache
         continue-on-error: true
@@ -897,12 +888,7 @@ jobs:
       - name: Install Linux system dependencies
         if: needs.changes.outputs.heavy == 'true' && matrix.os == 'ubuntu-latest' && (github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request')
         run: |
-          for i in 1 2 3 4 5; do
-            sudo apt-get update && break
-            echo "apt-get update failed (attempt $i); retrying in 15s"
-            sleep 15
-          done
-          sudo apt-get install -y libdbus-1-dev pkg-config bubblewrap apparmor-profiles
+          bash scripts/ci-apt-install.sh libdbus-1-dev pkg-config bubblewrap apparmor-profiles
           sh scripts/prepare-linux-test-sandbox.sh
       - name: Ubuntu build headroom
         # Reuse the same fixed hosted-runner provisioning as Safety and Lint.
@@ -1333,12 +1319,7 @@ jobs:
       - name: Install Linux system dependencies
         if: needs.changes.outputs.heavy == 'true' && matrix.os == 'ubuntu-latest' && (github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request')
         run: |
-          for i in 1 2 3 4 5; do
-            sudo apt-get update && break
-            echo "apt-get update failed (attempt $i); retrying in 15s"
-            sleep 15
-          done
-          sudo apt-get install -y libdbus-1-dev pkg-config
+          bash scripts/ci-apt-install.sh libdbus-1-dev pkg-config
       - uses: Swatinem/rust-cache@v2
         if: needs.changes.outputs.heavy == 'true' && (matrix.os != 'ubuntu-latest' || github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request')
         with:
@@ -1396,12 +1377,7 @@ jobs:
           echo "SCCACHE_IGNORE_SERVER_IO_ERROR=1" >> "${GITHUB_ENV}"
       - name: Install Linux system dependencies
         run: |
-          for i in 1 2 3 4 5; do
-            sudo apt-get update && break
-            echo "apt-get update failed (attempt $i); retrying in 15s"
-            sleep 15
-          done
-          sudo apt-get install -y libdbus-1-dev pkg-config
+          bash scripts/ci-apt-install.sh libdbus-1-dev pkg-config
       - uses: Swatinem/rust-cache@v2
         with:
           cache-bin: false
@@ -1449,12 +1425,7 @@ jobs:
       - name: Install Linux system dependencies
         if: runner.os == 'Linux'
         run: |
-          for i in 1 2 3 4 5; do
-            sudo apt-get update && break
-            echo "apt-get update failed (attempt $i); retrying in 15s"
-            sleep 15
-          done
-          sudo apt-get install -y libdbus-1-dev pkg-config
+          bash scripts/ci-apt-install.sh libdbus-1-dev pkg-config
       - uses: Swatinem/rust-cache@v2
         with:
           cache-bin: false

.github/workflows/release-artifacts.yml

@@ -156,7 +156,7 @@ jobs:
       # No ref: — GITHUB_SHA only. CodeQL treats workflow_call checkout-with-ref
       # and any ref named *sha* as an untrusted checkout (cache-poisoning).
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master 2026-07-18
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # master 2026-07-18
         with:
           toolchain: stable
           targets: ${{ matrix.target }}

.github/workflows/release-candidate.yml

@@ -33,7 +33,7 @@ jobs:
         with:
           node-version: 22
           package-manager-cache: false
-      - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # stable 2026-07-18
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # stable 2026-07-18
         with:
           toolchain: stable
       - name: Match dispatch to the requested commit

.github/workflows/release-parity.yml

@@ -32,7 +32,7 @@ jobs:
       # CodeQL treats a *sha* ref as an untrusted checkout on workflow_dispatch
       # (default-branch cache write).
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master 2026-07-18
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # master 2026-07-18
         with:
           toolchain: stable
           components: clippy, rustfmt