The packaged macOS Connect journey intermittently/deterministically exits before ready at JOURNEY_PAIR_BROWSER_APPROVAL after CONNECT_STATUS_READY, JOURNEY_DISCOVERY_VALIDATED, and JOURNEY_STORAGE_BACKEND=os-protected. Evidence spans Darwin x64 jobs 101098414585 and 101102549721; earlier rerun 101055474973 passed, so this is a readiness/race problem rather than signing or storage identity.
Implement a focused transport/harness correction that makes browser approval deterministic without weakening the real journey or exact evidence counts. Diagnose whether shell.openExternal interception, approval HTTP readiness, child lifecycle, or timeout ordering races. Preserve exactly three intended pairing starts/browser approvals, real browser-approval HTTP requests, pair + fresh reprobe processes, secret-safe bounded diagnostics, cancellation/expiry negative cases, and all auth/scope/storage evidence. Add a regression that reproduces delayed/macOS browser approval readiness and proves no duplicate or missing approval. Validate Linux x64/ARM64 and Darwin x64/ARM64. Windows behavior is out of scope and must not block or be changed.
The packaged macOS Connect journey intermittently/deterministically exits before ready at JOURNEY_PAIR_BROWSER_APPROVAL after CONNECT_STATUS_READY, JOURNEY_DISCOVERY_VALIDATED, and JOURNEY_STORAGE_BACKEND=os-protected. Evidence spans Darwin x64 jobs 101098414585 and 101102549721; earlier rerun 101055474973 passed, so this is a readiness/race problem rather than signing or storage identity.
Implement a focused transport/harness correction that makes browser approval deterministic without weakening the real journey or exact evidence counts. Diagnose whether shell.openExternal interception, approval HTTP readiness, child lifecycle, or timeout ordering races. Preserve exactly three intended pairing starts/browser approvals, real browser-approval HTTP requests, pair + fresh reprobe processes, secret-safe bounded diagnostics, cancellation/expiry negative cases, and all auth/scope/storage evidence. Add a regression that reproduces delayed/macOS browser approval readiness and proves no duplicate or missing approval. Validate Linux x64/ARM64 and Darwin x64/ARM64. Windows behavior is out of scope and must not block or be changed.