fix(ci): restore target-correct native Rust builds

[moomooskycow]

Root cause

The three Rust cache jobs on main were failing during real compilation, not cache restore. Original run: https://github.com/r90group/Cap/actions/runs/32886434230 (logs expired). Fresh native triage on the same 78913a4be1b0221f9c720d26588e68376b0d8cf1 head: https://github.com/r90group/Cap/actions/runs/36784226990.

• Both macOS jobs reached Tauri without its real cap-muxer sidecar. The x86_64 matrix entry also silently built the ARM host because Cargo commands omitted --target.
• Windows generated one-byte FFmpeg structs and failed binding layout assertions (E0080). Setup forced Visual Studio's newer LLVM instead of standalone LLVM 20.1.8 on PATH; locked bindgen 0.70.1 predates the LLVM 22 AST fix. Primary sources: Missing fields in nested class with LLVM 22 rust-lang/rust-bindgen#3264 and Bump bindgen to 0.72 for LLVM 22 compatibility CCExtractor/rusty_ffmpeg#150.
• After repairing FFmpeg, Windows exposed locked cmake 0.1.54 panicking on Visual Studio 18/2026 during Whisper's real native build. The released compatibility fix is cmake 0.1.55: Add Visual Studio 2026 support rust-lang/cmake-rs#255.
• Newly reached Clippy gates exposed constant-chunk iteration and redundant formatting borrows. Optional sccache config also put Windows native environment keys under Cargo [build] instead of [env].

Repair

• Build the existing real sidecar before workspace builds and real desktop frontend assets before release checking.
• Select matching native dependencies and explicit Cargo targets, including an Intel macOS runner for Intel builds.
• Exercise cache build jobs on relevant PRs/manual CI; save caches only from the main ref. Expose the existing desktop changes output instead of silently skipping its existing gate.
• Select standalone clang (or explicit CLANG_PATH) and derive its paired libclang.dll. Keep these native keys under [env] with or without sccache.
• Update only native build helpers to their minimal VS 2026-compatible releases: cmake 0.1.54 -> 0.1.55, cc 1.2.37 -> 1.2.46, find-msvc-tools 0.1.1 -> 0.1.5. Cargo resolution preserves all 1,159 other locked package records; no blanket dependency/FFmpeg upgrade, runner downgrade, vendoring, or generator fallback.
• Replace production constant chunk iterators with allocation-free typed slice chunks and remove redundant formatting borrows. Preserve conversion/alpha/row padding, camera identifiers, deeplink/Sentry diagnostics, and sharing URLs. Update the existing contributor guide.

No useful check is disabled or suppressed. No Sonar steps were present. Unrelated operator release/UI edits are excluded. Existing consumer tests remain unchanged; no tests merely assert workflow text. The same lint also occurs in test-only fixtures outside production Clippy scope; unrelated fixtures are intentionally untouched.

Verification

• Explicit implementation model: openai-codex/gpt-6.1-sol --thinking high for all repair revisions.
• node --check scripts/setup.js: passed after its completed revision.
• Scoped Rust formatting checks passed for the converter, camera and downstream formatting files; the one new Windows line wrap reported by rustfmt was repaired. Hosted Cargo formatting verifies the complete final tree.
• Executed the exact BGRA converter in a throwaway Rust harness: 72 chunk-boundary, padded-row, alpha-preservation and empty-height cases passed. Off-host execution of the exact screenshot/icon pixel core with real image 0.25.8 passed 126 RGB/RGBA padded-row scenarios, 8 invalid-layout cases and 6 Windows icon cases. No desktop/browser or server was opened.
• System One strict full base-to-head diff review passed across all 12 files (+104/-58) with no blocks and four advisory complexity/churn/test-defense warnings; native CI and actual pixel execution supply the consequential proof.
• First PR native run https://github.com/r90group/Cap/actions/runs/36786348568: Intel cache build/check passed; ARM build/check passed before camera Clippy; newer VS clang pairing alone was insufficient on Windows.
• Second native run https://github.com/r90group/Cap/actions/runs/36790649916: Intel cache passed again; Windows sidecar passed with standalone LLVM 20 (headers confirmed in logs), then exposed the released CMake generator bug; ARM build/check passed before screenshot Clippy. Current head repairs the remaining exact lint family in production code, including the downstream desktop thumbnail/deeplink/upload sites. This intentionally exercises the existing desktop build gate too.
• Third native run https://github.com/r90group/Cap/actions/runs/36795106035: both real desktop builds, plugin verification, Intel cache, and ARM/Windows debug/frontend/release stages passed. The only remaining errors were two eprintln! redundant borrows in deeplink diagnostics, now repaired without changing messages or disabling Clippy.
• Fourth native run https://github.com/r90group/Cap/actions/runs/36798899230: both real desktop builds, plugin verification, Intel cache, and ARM/Windows debug/frontend/release stages passed again. Desktop library Clippy now passed; binary Clippy exposed five redundant println! borrows in existing debug Sentry diagnostics, now removed without changing logging or debug/release behavior.
• Fresh full-title/body/diff independent anthropic/claude-sonnet-5-5 --thinking high approved exact final 12-file head 98c68656dc9189de0b4fca7087cd590ba840ec2a, no blockers: fix(ci): restore target-correct native Rust builds #7 (comment).
• Final exact-head CI https://github.com/r90group/Cap/actions/runs/36801698877: all 13 required/advisory checks passed, including all three native cache jobs, both Clippy jobs, both real desktop builds, plugin verification, typecheck, Cargo/Biome format, and Biome lint. Normal exact-head merge only; no bypass or suppression.
• Normal exact-head squash merge landed fafa4933c1f5f097152ddd46b0a61ab2693197ea on main. Its push CI https://github.com/r90group/Cap/actions/runs/36804850042 completed success on that exact SHA: all 13 jobs actually ran and succeeded, including Intel/ARM/Windows cache compilation/release checks, ARM/Windows Clippy, and both real desktop builds. Default head was independently confirmed as that SHA at completion; concurrent CD PR ci: publish verified fork desktop artifacts on merge #8 subsequently advanced main to its direct child eb7ca4b191dcca92f9d932d73fdfafe55177c8af.
• Enabled Performance Regressions was not retired or disabled. Retained historical run https://github.com/r90group/Cap/actions/runs/36386337169 failed only Windows, with the identical FFmpeg E0080 one-byte struct failure repaired by shared setup; Mac passed. Current benchmark owner https://github.com/r90group/Cap/actions/runs/36808721819 completed successfully on repaired main fafa4933: both suite invocations and enforcement steps succeeded. Actual artifacts: Mac 3 passed/0 failed/0 skipped/0 errors, including a real 120-frame export; Windows 0 passed/3 skipped/0 failed/0 errors because its pre-existing GitHub Actions software-adapter guard rejected unrepresentative Microsoft Basic Render Driver metrics. No benchmark source/gate change or new suppression; Windows GPU performance is not claimed.
• After concurrent CD PR ci: publish verified fork desktop artifacts on merge #8, exact current-main CI https://github.com/r90group/Cap/actions/runs/36809970889 completed success on eb7ca4b191dcca92f9d932d73fdfafe55177c8af: 12 jobs succeeded, including every native cache/Clippy/desktop job; only unchanged plugin-dependency verification was path-filter skipped. That commit changes release/UI ownership, not the CI or benchmark workflow, shared native setup, Cargo lock, or benchmark Rust inputs. Its newly added manual alert-route-probe deliberately executes exit 1 to exercise triage; that expected probe failure is not a CI/benchmark regression.
• Local actionlint reports inherited Node-action version and shellcheck findings in unchanged steps; no clean actionlint result is claimed.

Signing, installer publication, interactive recording, and OS capture APIs are not exercised by this CI repair and are not claimed. Native build results, pure pixel-path execution, reviewed head and new-main evidence are recorded on this PR.

[moomooskycow]

Coordination: a separate continuous-publication cutover is being implemented in the isolated ci/fork-cd worktree. It will rebase onto this native-CI prerequisite after this PR lands through its normal review/checks; it does not absorb or overwrite these native changes. The canonical checkout and this PR remain owned by the native-CI task. Publication cutover will replace manual dispatch with automatic green-default-branch releases, installed-artifact smoke, healthy-channel promotion, and agent-only failure alerts. Please keep the native-CI change independently reviewed and landed; no overlapping edits requested.

[moomooskycow]

Independent exact-head review

Command: omp -p --model anthropic/claude-sonnet-5-5 --thinking high --tools read,grep,glob --no-session

Fresh read-only review of the complete PR title/body/diff and surrounding source. Exact reviewed head: 1caeda6a4609660f4d5f7b0a5075ef3d4f2217b8. Decision: APPROVE, no blockers. Native CI is still awaited; the model did not claim executed native verification.

Reviewer output

Decision: APPROVE
Reviewed head: 1caeda6a4609660f4d5f7b0a5075ef3d4f2217b8 (base 78913a4b)

I found no blockers. I read the full diff and the surrounding files: scripts/setup.js, .github/workflows/ci.yml, the setup-rust-cache and setup-js actions, scripts/build-cap-muxer.sh, tauri.conf.json, and the camera and converter sources.

What I checked and found correct

• Cargo config order: setup.js writes [env] with FFMPEG_DIR, then the Windows LIBCLANG_PATH and CLANG_PATH keys, then [build] (sccache) last. The Windows keys now stay in [env] with or without sccache, which repairs the earlier ordering bug.
• Clang selection (setup.js:166-174):
  • clang.exe comes from CLANG_PATH if set, otherwise from where.exe, and libclang.dll is derived from the same directory. The script throws if no clang is found.
  • CLANG_PATH is the variable clang-sys uses to find the compiler that detects include paths. LIBCLANG_PATH pointing at a file is what the old code already did, and the first-head run got past loading it.
  • Library and compiler now come from one install, and standalone LLVM 20 sits below the LLVM 22 break in bindgen 0.70.1.
  • All Windows consumers of setup.js (publish.yml, self-build.yml, performance-regressions.yml) use windows-latest, so they get the same fix.
• Targets: RUST_TARGET_TRIPLE selects the darwin native-deps asset through arch. The Intel job now runs on macos-15-intel with --target on every cargo command, so it no longer builds the ARM host by accident. The sidecar script builds target/<triple>/release/cap-muxer and copies it to binaries/cap-muxer-<triple>, which matches externalBin.
• Frontend path: frontendDist is ../.output/public, i.e. apps/desktop/.output/public. app.config.ts uses the static preset, so pnpm turbo build --filter @cap/desktop writes there.
• Fork safety: the rust-cache job uses no secrets and sets no TURBO_TOKEN, and it saves the cache only on refs/heads/main.
• Rust 1.88: slice::as_chunks and as_chunks_mut are stable in 1.88, which is the repo minimum.
• Converter: behaviour is unchanged. The 32-byte body runs as before, the remainder goes through 4-byte pixels, and processed is fully replaced with no stale use. frame_converter.rs has a cfg(target_os = "macos") guard on this function, so the Windows clippy job never sees it.
• Camera: self.vid and self.pid are String. Serialize and Display output is identical.
• Constraints: no code comments were added, and nothing is suppressed. The clippy steps stay -D warnings.

Advisory, not blocking

1. build-desktop goes live. The desktop output (ci.yml:21) makes build-desktop run for the first time, since needs.changes.outputs.desktop was previously empty. It runs tauri build --debug --target … --no-bundle on Windows and macOS ARM.
   • This PR touches no apps/desktop/** path, so its CI cannot exercise that job. The first desktop PR to touch those paths will be its first run.
   • The change matches the PR's "no silent skip" intent. It is still an extra unproven gate.
2. Inherited LIBCLANG_PATH. The Windows keys are not force = true, so a LIBCLANG_PATH already in the environment beats the derived one while CLANG_PATH still comes from the config. This matters only for a stale, mismatched environment. Adding force = true to both keys, or failing when an inherited LIBCLANG_PATH disagrees, would guarantee the pairing.
3. No fail-fast checks in setup.js.
   • A bare CLANG_PATH such as clang gives a dirname of . and a bogus ./libclang.dll.
   • A missing libclang.dll is reported only later by clang-sys.
   • LLVM 22 on a future windows-latest image would fail loudly in bindgen, which is not a suppression.
4. Intel clippy is skipped. This follows the existing condition in the job. The ARM job covers most of the same code, but there is no Intel-specific clippy.

Verification limits

• I read only. I ran no build, test or CI.
• I did not observe the final native CI results for this head, and the Windows job is the main unproven piece. The Windows fix rests on the primary-source reasoning (bindgen#3264, rusty_ffmpeg#150) plus the first-head result.
• I did not check the runner image's LLVM 20.1.8 claim. The Intel, ARM and first-head Windows results come from your packet.
• I did not run the converter or any smoke test myself.

[moomooskycow]

Fresh independent final-head review

Command: omp -p --model anthropic/claude-sonnet-5-5 --thinking high --tools read,grep,glob --no-session

Fresh read-only review of the full title/body/diff and surrounding source for all 11 files. Exact reviewed head: bae472863a8f43069c83562cfb8e32223a192bf0. Decision: APPROVE, no blockers. Implementation used explicit Sol high. System One strict full diff review passed, 0 blocks, 4 advisories. All required/advisory hosted checks are still awaited before normal merge.

Evidence clarification: earlier Intel/ARM build/check successes predate the three native-helper lock updates; the reviewer's statement about those successes covering current locked resolution is an inference, not new-head proof. Current-head native CI will supply that proof. Actual pure-pixel smoke is already exercised: 72 converter cases plus off-host real-image smoke with 126 screenshot scenarios, 8 invalid layouts and 6 icon-buffer cases. No OS capture APIs, interactive desktop/browser, signing or publication claimed.

Reviewer output

Verdict: APPROVE on bae472863a8f43069c83562cfb8e32223a192bf0. I found no blockers.

What I checked

• scripts/setup.js:
  • The sccache [build] block is now appended last, so the Windows LIBCLANG_PATH and CLANG_PATH keys stay under [env]. That fixes the ordering bug.
  • On Windows, LIBCLANG_PATH is derived from the same clang.exe directory that CLANG_PATH points to, so the DLL and the header-detecting compiler come from one install.
  • findExecutable uses where.exe on Windows and takes the first hit, which matches the "first on PATH" contract in CONTRIBUTING.md.
  • The new code adds no comments.
• .github/workflows/ci.yml:
  • Every cargo invocation in the touched jobs now passes --target. The Intel entry runs on macos-15-intel, so it no longer builds the ARM host by accident.
  • The sidecar is built before the workspace build and clippy, and RUST_TARGET_TRIPLE is set in both jobs that run scripts/setup.js.
  • save-cache is limited to refs/heads/main. The rust-cache condition now also fires for Rust-path PRs and workflow_dispatch.
  • The desktop filter output is wired to the existing build-desktop job. scripts/setup.js and scripts/build-cap-muxer.sh are now in the rust filter.
  • setup-js replaces the bare setup-node@v3 and also runs pnpm install. pnpm turbo build --filter @cap/desktop therefore resolves.
• Cargo.lock: Only cc, cmake and find-msvc-tools change. Version and checksum pairs are internally consistent. Your reports of --locked clippy and build runs passing on Intel and ARM cover resolution.
• Chunk rewrites: I read each site in full and the semantics match the originals.
  • frame_converter.rs: the as_chunks_mut::<32> remainder feeds as_chunks_mut::<4>. That equals the old processed = (row_len / 32) * 32 tail, and any sub-4-byte leftover is dropped as before.
  • screenshot.rs: both rewrites keep row padding, channel order and alpha identical, and the src/dst row lengths are exact multiples of 4 and 3, so zip loses nothing.
  • thumbnails/mac.rs: extend_from_slice(chunk) takes &[u8; 4], which coerces to &[u8].
  • win.rs: the as_chunks_mut borrow ends before buffer is moved into RgbaImage::from_raw.
  • slice::as_chunks and as_chunks_mut are stable from 1.88, which matches the AGENTS floor.
  • The remaining chunks_exact_mut calls are in #[cfg(test)] or tests/ files only, matching the PR body.
• Formatting-borrow removals in camera/src/lib.rs, deeplink_actions.rs and upload.rs are behavior-neutral. In upload.rs, s3_config.id is read inside format! before it is moved into id:.
• Scope: No gate is disabled, test fixtures are untouched, and the diff matches the stated minimal scope.

Non-blocking advisories

1. Windows LLVM version: Nothing asserts the clang major version. The fix depends on whatever LLVM sits first on the runner's PATH staying below 22. If the image moves to LLVM 22, the failure returns as the same opaque E0080. A one-line clang --version guard in setup.js or a pinned install would fail loudly. This is an optional follow-up.
2. Non-forced LIBCLANG_PATH/CLANG_PATH: The [env] entries are not force = true, so a preset environment variable overrides them. This is consistent with the documented PowerShell override. It does leave a mismatch possible if the runner image sets LIBCLANG_PATH. Your logs show LLVM 20 headers resolving, so it does not bite today.
3. Runtime DLLs and dylibs: setup.js still copies them to target/debug and target/release. With explicit --target the artifacts land in target/<triple>/…. Build and check jobs don't execute binaries, so this is harmless here. Any future test-running job would need that layout fixed.
4. Frontend assets in the dedicated clippy job: That job still has no frontend build step. I found no custom-protocol feature enabled anywhere in the workspace, so the desktop crate should stay in cfg(dev). I can't prove from source alone that generate_context! doesn't need .output/public there. The final CI run on this head settles it.
5. CI cost: The new rust-cache PR trigger overlaps with the clippy job on Rust-path PRs. This is a deliberate trade-off in the PR body.

Limitations

• I used read-only tools and ran nothing. I did not exercise Windows or macOS builds, the CMake/VS 2026 fix, or the cc 1.2.46 → find-msvc-tools 0.1.5 constraint. I did not verify rustfmt line wrapping for the new chains, though the format-rust job covers it.
• Windows is not yet known to pass through the CMake step, frontend build, release check and clippy on this head. The Windows Whisper/CMake path and Windows clippy results come from final CI, not from this review.
• I rely on your reported Intel and ARM passes and your pixel-path smoke runs. I did not verify them.

[moomooskycow]

Fresh independent exact landing-head review

Command: omp -p --model anthropic/claude-sonnet-5-5 --thinking high --tools read,grep,glob --no-session

Fresh read-only review of full title/body/diff and surrounding native source for all 11 files. Exact reviewed head: afa6908a787c0f66a8919bf6ba96983e18424623. Decision: APPROVE, no blockers. All implementation revisions used explicit Sol high; strict System One full diff review passed, 0 blocks, 4 advisories. All required and advisory hosted checks are still awaited before normal merge.

Reviewer output

APPROVE for exact head afa6908a787c0f66a8919bf6ba96983e18424623.

I found no blockers. I read the final versions of scripts/setup.js, ci.yml, the setup-rust-cache action, build-cap-muxer.sh, and the edited Rust files in full around each hunk.

What I checked

• BGRA converter (frame_converter.rs): this is equivalent to the old code.
  • The old processed = (row_len/32)*32 tail is exactly the remainder returned by as_chunks_mut::<32>().
  • The 4-byte tail loop and its dropped sub-4 remainder match the old behaviour. row_len is a multiple of 4, so nothing is lost.
  • Row iteration (data.chunks(stride).take(height), &row[..row_len]) is unchanged.
• Screenshot conversions (screenshot.rs): rgb_from_rgba and rgba_from_raw are equivalent. Each row slice is exactly width*4 (src) and width*3 or width*4 (dst). The checked bounds and RgbImage::from_raw / RgbaImage::from_raw behave as before.
• Thumbnail (thumbnails/mac.rs): the row is exactly width*4 bytes, so no tail is dropped. extend_from_slice(chunk) takes &[u8;4] through unsize coercion. This already compiled in the ARM desktop build.
• Windows icon (win.rs): the buffer is a Vec<u8> of w*h*4 bytes. The as_chunks_mut borrow ends before buffer moves into from_raw. Line 952 is 98 columns, within the 100 limit.
• Rust version: as_chunks and as_chunks_mut need Rust 1.88, which matches the AGENTS requirement. There is no rust-toolchain file and no rust-version in Cargo.toml, and CI uses stable. No code comments were added.
• scripts/setup.js: the sccache [build] block now comes after all [env] appends. Before, it sat ahead of the Windows LIBCLANG_PATH line, so that key would have landed under [build]. The darwin branch appends nothing to the config.
  • LIBCLANG_PATH and CLANG_PATH come from the same standalone clang location, with an explicit error if clang isn't found.
  • Backslashes are converted to forward slashes, so the TOML needs no escaping.
  • findExecutable takes the first where.exe hit.
• ci.yml:
  • save-cache: ${{ github.ref == 'refs/heads/main' }} becomes the string 'true' or 'false'. The composite action passes it straight to swatinem/rust-cache save-if, so PR runs restore the cache but never save it.
  • The new desktop output fixes build-desktop, whose needs.changes.outputs.desktop gate was undefined before. That job was effectively never running, so this adds a real gate and is disclosed in the PR body.
  • Every Cargo command in the cache job now has an explicit --target. The sidecar script already builds for the target it is given and copies to the Tauri-expected suffixed name.
  • rust-cache on PRs triggers on rust == 'true', and the new scripts/setup.js and scripts/build-cap-muxer.sh filter paths keep the job in sync with its inputs.
• Cargo.lock: only cc, cmake and find-msvc-tools change, as the PR states. The CONTRIBUTING.md claims match the PR body.

Verification limits

• I observed no CI results for this head. Required checks that must pass before merge:
  • Intel, ARM and Windows rust-cache, including Clippy on ARM and Windows.
  • clippy, build-desktop, format-rust and tauri-plugins.
• Only run 36795106035 on the preceding head failed Clippy, and the two deeplink borrows it flagged are fixed here with the messages unchanged. Clippy never ran on Intel macOS, by existing design. Don't claim "all Clippy passed" until the final run shows it.
• cargo fmt --check for win.rs and the multi-line as_chunks chains is unconfirmed. Hosted format-rust decides it.
• I didn't verify the upstream cmake 0.1.55 → cc ≥1.2.46 → find-msvc-tools ≥0.1.5 dependency chain against crate manifests. The locked versions and the earlier Windows passes support it.
• The pure-pixel smoke results (72 BGRA cases, 126 padded-row scenarios, 6 Windows icon cases) are the PR's own claims. I re-derived equivalence by reading the code and didn't re-run them.
• OS capture APIs, signing and publication are not exercised, and the PR doesn't claim them.

Non-blocking: the eprintln!/format! changes in deeplink_actions.rs and the upload.rs URL change are cosmetic, and the messages are identical. Test-only fixtures still carry the same lint family, outside production Clippy scope, as the PR states.

[moomooskycow]

Fresh independent exact-head review, complete 12-file repair

Command: omp -p --model anthropic/claude-sonnet-5-5 --thinking high --tools read,grep,glob --no-session

Exact reviewed head: 98c68656dc9189de0b4fca7087cd590ba840ec2a. Fresh full title/body/diff and surrounding source; APPROVE, no blockers. All implementation revisions used explicit openai-codex/gpt-6.1-sol --thinking high. Strict System One complete base-to-head diff passed: 12 files, +104/-58, 0 blocks, 4 advisory complexity/churn/test-defense warnings. Required/advisory native checks are still awaited before normal merge.

Reviewer output

APPROVE for head 98c68656dc9189de0b4fca7087cd590ba840ec2a. I found no blockers. I read all 12 files and the surrounding source, and I reviewed statically only.

Diff since the last full APPROVE

• main.rs:29-32 only drops the & in the four debug println! calls. event.level, msg, event.user, event.tags and event.contexts are only borrowed by the format macros, so nothing is moved.
• The call sites, literals, #[cfg(debug_assertions)] structure, the None return and the Some(event) release path are unchanged.

Source semantics

• Rust version: as_chunks and as_chunks_mut need Rust 1.88 or later, which matches AGENTS. No repo file pins a toolchain, and CI uses dtolnay/rust-toolchain@stable.
• Converter: frame_converter.rs keeps the old behavior. The 32-byte as_chunks_mut::<32> / as_chunks::<32> calls replace the old chunks_exact loop. The remainder is row_len % 32, always a multiple of 4, so the second as_chunks::<4> loop picks up exactly the old processed.. tail. dst_chunks and dst_remainder are disjoint reborrows of dst, so the borrow checker is satisfied.
• Screenshot: the rgb_from_rgba and rgba_from_raw zips cover the same pixel count as before. Both rows have an exact length (row_bytes or width_stride), and the length checks reject short rows first, so there is no tail to drop.
• Windows icon: win.rs is fine. buffer is a Vec<u8>, the &mut [[u8;4]] loop calls chunk.swap(0, 2) via slice deref, and the immutable borrow in the .any() ends before the mutable one starts. buffer is then moved into RgbaImage::from_raw as before.
• mac thumbnail: mac.rs is fine. extend_from_slice(chunk) coerces &[u8;4] to &[u8], and the row is exactly width * 4 bytes, so nothing is dropped.
• Borrow removals: upload.rs, the deeplink_actions.rs sites and the camera/lib.rs sites only remove redundant &. In upload.rs, s3_config.id is still moved after the format! borrow, as before.

scripts/setup.js

• The old Windows code appended LIBCLANG_PATH after [build] when sccache was present, which put the key under the wrong Cargo table. The sccache [build] block now comes last, after the platform [env] keys, so the keys land under [env] in both cases.
• CLANG_PATH falls back to findExecutable("clang"), and libclang.dll is derived from the same clang.exe directory. The path-pairing logic is coherent.
• arch already reads RUST_TARGET_TRIPLE, so the new env wiring in CI is meaningful.

CI

• save-cache: ${{ github.ref == 'refs/heads/main' }} stringifies to 'true' or 'false', which swatinem/rust-cache's save-if accepts. The input default is also a string.
• The new desktop output matches the existing build-desktop gate.
• The rust filter and the rust-cache condition are consistent. .github/** is already in the filter, so this PR does exercise rust-cache.
• The --target flags are consistent across the build, check and clippy commands. The sidecar build, setup-js and the frontend build before cargo check --release match the Tauri frontendDist requirement.
• Cargo.lock changes only the three claimed packages, and the diff shows only version and checksum lines. I did not independently verify that the other 1,159 records are unchanged.
• CONTRIBUTING.md matches the implemented behavior. No code comments were added.

Verification limits

• Nothing here was compiled or executed. I rely on the PR's stated pixel-core harness results and on the prior CI stages that passed on afa6908a.
• I did not verify that the final native CI run on 98c68656 has passed. Merge only after every required and advisory check on that exact head is green, including binary Clippy on ARM and Windows.
• The remaining risk is a new Clippy lint on the binary or an untouched target. That is the reason to wait for the final run.

[moomooskycow]

Native failure diagnosis from completed run36798899230: all four failed jobs (both standalone Clippy and ARM/Windows Rust-cache jobs) fail at the same five clippy::useless_borrows_in_formatting errors in apps/desktop/src-tauri/src/main.rs:29-32: &event.level, &msg, &event.user, &event.tags, &event.contexts passed to println!. Cache compilation itself reached the Clippy step; Intel cache and both real debug desktop builds passed. These are formatting-macro auto-borrows, so removing the redundant explicit borrows is the minimal repair; do not disable -D warnings or the gates. Diagnostics retrieved successfully with native gh run view36798899230 --repo r90group/Cap --log-failed; the GitHub wrapper incorrectly returned unavailable logs. Separate CD PR8 remains isolated and will rebase after this prerequisite lands.

[moomooskycow]

Landed repair and actual default/benchmark evidence

Normal squash merge of exact independently reviewed head 98c68656dc9189de0b4fca7087cd590ba840ec2a landed fafa4933c1f5f097152ddd46b0a61ab2693197ea; no bypass. Full Sonnet 5.5 high approval: #7 (comment). Explicit Sol high implementation; strict System One full 12-file review passed (0 blocks, 4 advisories).

• Exact PR head: https://github.com/r90group/Cap/actions/runs/36801698877 — 13 checks passed.
• Exact repaired push/main: https://github.com/r90group/Cap/actions/runs/36804850042 — all 13 jobs actually ran and succeeded, including Intel/ARM/Windows Rust cache debug/frontend/release-check paths, both Clippy and both real desktop builds.
• Concurrent independently owned CD PR ci: publish verified fork desktop artifacts on merge #8 advanced main to direct descendant eb7ca4b191dcca92f9d932d73fdfafe55177c8af. Its current CI https://github.com/r90group/Cap/actions/runs/36809970889 also succeeded: 12 success, unchanged plugin dependency gate path-filter skipped; every native job passed. CD changes do not alter benchmark/native core inputs. New manual alert-route-probe intentionally exits 1 to test triage, not a product CI failure.

Active performance owner

Performance Regressions remains active and unmodified. Retained historical run https://github.com/r90group/Cap/actions/runs/36386337169 failed only Windows with the same FFmpeg E0080 one-byte struct issue; Mac succeeded. Shared native setup repair addresses that compilation failure.

Actual post-repair existing owner run https://github.com/r90group/Cap/actions/runs/36808721819 on main fafa4933 succeeded on both platforms, including Run performance suite and Enforce suite gate steps. Downloaded artifacts show:

• Mac: 3 passed, 0 failed, 0 skipped, 0 errors. Real fixture open, editor playback and 120-frame export.
• Windows: CLI compiled and ran, 0 failed/errors, 3 capability skips. The unchanged pre-existing probe_windows_ci_software_adapter guard skips nonrepresentative Microsoft Basic Render Driver metrics on GitHub Actions. No Windows GPU performance measurement claim, and no benchmark/gate suppression was introduced.

Other changed-path proof and limits

Exact pixel core execution passed 72 BGRA boundary/padding/alpha/empty-height cases and, off-host with real image 0.25.8, 126 RGB/RGBA padded-row scenarios, 8 invalid layouts, 6 Windows icon cases. All throwaway code and smoke task resources removed; standing cap-ws retained. No operator desktop/browser or devserver touched. Signing/publication, interactive recording and OS capture APIs not exercised by this repair.

Own repair branch/worktree/lease removed. Foreign canonical release/UI work and foreign Cap-cd resources preserved, explicitly parked rather than reset/stashed/deleted. Session-close check: ok true, parked, no blockers or owned Cap leases. Read-only evidence retained under the run-scoped Cap directory.