V2.10.43f - record v0.6.1 npmRebuild investigation and release-feed verification

Author: JZKK720

V2.10.36-HANDOFF.md

@@ -159,4 +159,29 @@ using the same scripts (they are idempotent — they assert exact-match
 
 **V2.10.43d is committed and pushed** (commit a7e117d). v0.6.1 is **PUBLISHED** at https://github.com/JZKK720/cubecloud-agentic-os/releases/tag/v0.6.1 with 4 assets (setup.exe, portable.exe, blockmap, latest.yml), all SHA-256 verified, all download URLs HTTP 200. v0.6.0 marked as pre-release (superseded). Build path: d:\v0.6.1-build\dist (redirected via --config.directories.output to bypass the Windows Defender file lock on the standard dist).
 
-**Cleanup**: d:\temp-cubecloud-build\ (1.7 GB) and d:\v0.6.1-build\ (1.7 GB) are no longer needed for the release. Safe to remove via `Remove-Item d:\temp-cubecloud-build,d:\v0.6.1-build -Recurse -Force`. The canonical cubecloud-desktop\dist\ is still locked by Windows Defender — leave it alone until Defender releases the file handle (may take hours).
+**Cleanup**: d:\temp-cubecloud-build\ (1.7 GB) and d:\v0.6.1-build\ (2.6 GB) removed. The canonical cubecloud-desktop\dist\ is still locked by Windows Defender — left alone until Defender releases the file handle (may take hours).
+
+**V2.10.43f — npmRebuild investigation (2026-06-09).** During the v0.6.1 build, electron-builder logged: `skipped dependencies rebuild reason=npmRebuild is set to false`. Investigated whether this was a risk:
+
+- `electron-builder.yml` line 67: `npmRebuild: false` is **explicitly configured**.
+- `package.json` `postinstall`: `electron-builder install-app-deps` — this **does** rebuild native modules against the Electron ABI.
+- Source `node_modules\better-sqlite3\build\Release\.forge-meta`: `x64--140` — confirms the binding was built for Electron 39 (NODE_MODULE_VERSION=140), not Node 24 (137).
+- The unpacked asar's `better_sqlite3.node` is **byte-identical** to the source binding (SHA-256 `b938d698f0302c35004025528c99ea14b0f04c8849d3a1e89cf6c2f9055eae1e`).
+- Launch test of v0.6.1 exe: window opens, 4 processes spawn, i18next initializes, DevTools opens.
+
+**Conclusion**: `npmRebuild: false` is a **safe optimization**, not a bug. The `postinstall` hook does the rebuild; setting `npmRebuild: false` in electron-builder prevents a redundant second rebuild. ABI is correct, no fix needed.
+
+**v0.6.1 release feed verification (2026-06-09).** Fetched `latest.yml` from the v0.6.1 release:
+```yaml
+version: 0.6.1
+files:
+  - url: cubecloud-agent-desktop-0.6.1-setup.exe
+    sha512: AQyK1kRRvP5rgeSwMushuUadLJzV2JXMyWCGpDxbp6pQNjBl9nvBHu9/453jVQSWrNEBHLOkDKADUq+andudXw==
+    size: 434980108
+path: cubecloud-agent-desktop-0.6.1-setup.exe
+sha512: AQyK1kRRvP5rgeSwMushuUadLJzV2JXMyWCGpDxbp6pQNjBl9nvBHu9/453jVQSWrNEBHLOkDKADUq+andudXw==
+releaseDate: '2026-06-08T21:50:35.945Z'
+```
+The `electron-updater` client on v0.6.0 installs will read this feed, see v0.6.1 is available, and offer the upgrade. Upgrade path is live.
+
+**Open question — multi-platform coverage.** v0.6.1 was built **Windows-only**. The `release.yml` workflow at the repo root has macOS and Linux jobs, but they were not triggered for v0.6.1. Mac users and Linux users on the v0.6.0 install path cannot get the fix yet. Triggering these requires either a CI runner (macOS needs a real Mac or a paid CI service) or local builds. The release workflow has 6 jobs; only `release_windows` and `publish` are Windows-runnable.