Windows desktop update performance

Investigation · 9 November 2026 · ready for maintainer merge; PR remains open and unmerged

The installer grew from 135.6 to 310.5 MiB. The bundled WSL archive accounts for roughly 69% of the changed bytes in the latest nightly pair. These are artifact measurements and blockmap calculations, not observed Windows transfer or installation timings.

Delivery status

PR #33335 is open at commit 69822028ec1587e5d8e4d53623d76b647b81d5dd. Four parallel council rounds finished at Opus 9/10, Sol 9/10 and Grok 9/10. Local cubic found no issues; final audit found no material proof gap within the stated scope. Rebased changed-file checks passed 80 tests. All 30 hosted checks passed. Macroscope approved the exact head and CodeRabbit completed with no actionable findings. GitHub reports the PR mergeable, and auto-merge is disabled. Full stop: the PR stays open for Wout to merge.

Native prototype result

Five alternating pairs passed the predeclared download gate. Every run took the differential path and started the target version. The private WSL archive is normalized and stored without another compression pass inside the installer. The public Linux release archive is unchanged.

Windows 11 x64, 4 virtual CPUs, 6 GiB RAM, Defender real-time enabled. Local feed paced at 50 Mbit/s and 35 ms per request. Rebuilt test-signed fixtures use nightlies 4392 → 4399, with each arm using its own archive format at both ends. Metrics include blockmaps, reused-block copying, SHA-512 and Authenticode checks. This does not measure the first transition from the old format, production signing, or ARM64.

The full installer grows about 2.8 MiB (0.9%). Paired median download-plus-verification improvement is 17.06 seconds (41.2%). Installer extraction improved about half a second; relaunch differences are small with overlapping ranges. Shutdown totals vary with Defender scanning and are not a reliable claim of improvement.

Every counted sample

Warmups were excluded before these counted trials. A post-relaunch feed 404 occurred equally in both arms, outside the timed download/readiness windows, due to inherited mock settings in the fixture desktop session. It is a harness limitation. Installed version and updater cache hashes were verified on every counted trial.

Correctness and work remaining

Windows extraction matches the source payload. On Linux, the product loader script installs the normalized archives offline, reuses its cache, preserves file contents and executable modes, and rejects tampering. Final proof now also covers Windows-to-WSL offline backend startup, CLI version, node-pty and a targeted production fff API search with the packaged native library. Cache reuse passed and tampering was rejected. Final-code sidecars reproduce the prototype archives byte for byte, and final builder app packages match the measured packages. The installed test repack is not a newly compiled final-head app. The graph records the earlier prototype stage; its final verification footer has since been resolved for x64, while ARM64 remains unmeasured. The PR embeds this graph and explains these limits.

Measured payload growth

Compressed Windows x64 installer size, MiB. Published release assets, analysed on Linux.

What a recent update changes

The current payload has 67 loose files, below the existing 80-file gate. The earlier file-count optimization still holds. The WSL archive changes broadly between releases because versioned tar headers, build timestamps and nested compression defeat block reuse. The current Windows release has no prepared bytecode cache because it is cross-packaged on Linux.

Council decision

Measure the native critical path before selecting a fix. Grok prioritizes separating payload growth from wall time. Sol identifies a conditional PowerShell prompt-name scan during silent installation. Opus identifies the WSL archive as the dominant changed payload. The subsequent native experiment above now confirms a download improvement for the private-sidecar prototype.

Preserve offline WSL support and the backend shutdown safety fixes. Investigate packaging changes that improve reuse without changing the public Linux CLI artifact. Removing the bundled WSL runtime would change offline behavior and is not the selected plan.

Experiment protocol and delivery gate

1. Baseline: disposable Windows 11 x64 VM, isolated app state, Defender enabled. Record source/target commits, signed status, SHA-256, OS, hardware, installer bytes, cache state and actual file count.
2. Separate the stages: transfer through update-downloaded; backend shutdown; NSIS installation; relaunch through usable client/backend. Installer and shutdown may overlap. Capture process lifetimes and existing trace spans; do not sum overlapping intervals.
3. Controls: ordinary quit, cold launch and manual installation after clean quit. For differential transfer, retain the old installer cache and verify HTTP 206 from a fixed local feed. A blockmap calculation alone does not prove actual transfer.
4. Choose the smallest supported change: optimize archive representation if changed bytes dominate; skip silent-only prompt-name work only if it appears on the critical path; investigate shutdown or startup only if their measured spans dominate.
5. Paired proof: at least five alternating baseline/candidate pairs under equivalent payload and cache conditions. Retain every sample and failure. Plot individual samples plus median and range. Label missing stages as unmeasured.
6. Correctness: target version runs, native modules load, persisted state survives, old owned backends stop, update failure recovers, offline WSL behavior remains available. Add focused behavioral tests for the actual change.
7. PR: before/after graph embedded in the description, durable raw samples and method, council code review, local review, evidence audit and changed checks. Leave the real PR open and unmerged under full stop.

Research plan scores

These score research plans, not the implementation. The final PR will carry its separate council review rounds.

Primary evidence

Published release installers and blockmaps · Archive layout and file limit · Installer prompt-name hook · Existing installer performance work

PostPlan uses fallback black, white and system fonts because the active client theme could not be read. Prototype timings above are observed; final product readiness is not claimed.