[OrcaWin]

	Files	Added	Deleted	Net
Test	6	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​224	$\color{#cf222e}{\Huge{\mathbf{−}}}$​556	$\color{#cf222e}{\Huge{\mathbf{−}}}$​332
Prod	13	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​195	$\color{#cf222e}{\Huge{\mathbf{−}}}$​146	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​49

ELI5

Headless Orca starts directly with its bundled Bun runtime. It checks that runtime before loading application code or opening a profile. Starting a new bundle with node orcad.js now fails with instructions instead of spawning another runtime.

What Changed

Owned Bun processes now ignore project bunfig preloads and dotenv files and cannot implicitly install missing packages. This includes daemon scopes, scanner/transcript readers and runtime checks; Electron and legacy Node paths keep their existing flags. Split-bundle health and deployment identities now hash the application payload as well as its launcher, preserving legacy single-file hashes.

Keep a small validation entry separate from the application bundle, target both at Bun-compatible modern JavaScript, and remove the Node-to-Bun child process, signal forwarding and launcher-disconnect handling. Bundled executable identity, pinned version checks, resolved symlink paths and exit code 78 for damaged installations remain.

Managed installation slots already select bundled Bun. Legacy slots without Bun keep their existing Node selection; the public npm CLI bootstrap is outside this PR.

Why

Orca controls the runtime it installs, so an extra Node process adds lifecycle complexity and startup overhead without serving a demonstrated managed-install caller. Runtime validation remains separate to reject a wrong executable before loading application dependencies or touching saved state.

Compatibility note: a custom service or script that explicitly runs node orcad.js must instead invoke the adjacent bun-runtime orcad.js (bun-runtime.exe on Windows). Auditing managed launch commands and the historical deploy API found no production caller requiring the handoff; this cannot establish the absence of user-authored scripts.

Linked Issue

No linked issue supplied. First PR in the runtime stack; followed by #23353, #23354 and #23355.

Visual Proof

N/A — runtime startup and process lifetime change; no UI changes.

Testing

Latest focused stack check: Node and CLI typechecks pass; 78 tests across 13 suites pass, including actual pinned-Bun isolation and loopback-registry controls. Relay/CLI/WSL backport checks also passed before restacking. These overlap earlier counts. Fresh CI and platform qualification for the updated heads remain required; signed-package results below are historical.

• Automated tests updated.
• Local macOS direct-Bun entry tests: bundled-only application loading, argument preservation, symlink resolution, missing application, and rejection of Node before application loading.
• Local real-Bun process tests: nohup survival, graceful TERM and a bounded stalled shutdown.
• Node TypeScript check, scoped lint and changed-code quality gate passed on the combined source checkpoint.
• Updated four-layer heads need CI after publication. Prior stack CI does not qualify this revision.

The focused final run passed 38 tests across five files on the combined checkpoint. The rebuilt first-layer commit requires its own CI; this report does not claim independent or cross-platform approval of that new head.

Review

Latest scoped Codex and Claude Opus reviews found no unresolved P0/P1 after the owned-runtime fixes and reliability-manifest correction. The final supervisor/probe changes pass 59 focused tests; all 135 reliability gates validate, and the checker/consumer tests pass. Native Windows packaged and generated C# launchers passed the final three-flag policy, including hostile workspace config, argument/environment and lifecycle checks; private test resources were cleaned up. Fresh CI and final release qualification remain open.

Retained graceful shutdown, runtime validation and explicit configuration failures. Deleted tests specific to the removed parent/child bridge; direct-runtime lifecycle and packaged entry checks remain.

Agent skill upstream boundary

• Not applicable; no upstream skill source copied or translated.

Notes

No user data migration is introduced. Removing a custom Node invocation is an intentional entry-point compatibility change. Desktop remains Electron, and legacy installation-slot selection remains unchanged.

Checklist

• Focused on orcad entry validation and direct runtime startup.
• Explained user behavior, mechanism and alternatives.
• N/A visual proof explained.
• Self-reviewed runtime and shutdown boundaries.
• Cross-platform and SSH launch impact considered.
• Fresh stack CI and final platform qualification pending.

[OrcaWin]

Closing as defunct: Orca stays on Node outside Electron, and the bundled-Bun runtime migration this stack belongs to was wound down. Servers and remote hosts now run on the bundled Node 24 runtime (#26171).