From 61a9b74cbd1cbd51512ab650c8ffb1237b0e86e1 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 7 Sep 2026 00:05:50 +0800
Subject: [PATCH] ci: make client packaging manual

Reduce Actions time by keeping only Server release automatic on main; Client matrix is manual.
---
 .github/workflows/repository-hygiene.yml |  3 +--
 CONTRIBUTING.md                          |  9 +++++----
 docs/deployment.md                       | 10 +++++-----
 docs/todo.md                             |  5 +++--
 4 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
index a521d88..0f4bfe6 100644
--- a/.github/workflows/repository-hygiene.yml
+++ b/.github/workflows/repository-hygiene.yml
@@ -107,8 +107,7 @@ jobs:
   release-application:
     needs: validate
     if: >-
-      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
-      needs.validate.outputs.client_scope == 'true'
+      github.event_name == 'workflow_dispatch' && inputs.client_checks == true
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 06b87e8..aa2ea1f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -71,10 +71,11 @@ Clean up worktrees and branches only after semantic review and integration are c
   isolated profiles, bounded deadlines, shared cleanup helpers, and a structured
   result. A manual diagnostic may locate a failure, but is not retained as pass
   evidence.
-- A Client-scoped pull request builds and smoke-tests all three platform
-  candidates before merge. A validated push to `main` uploads those short-lived
-  Server and Client candidates. Publishing a tag or GitHub Release remains an
-  explicit release decision rather than a side effect of every merge.
+- A validated push to `main` uploads a short-lived Server candidate. The three
+  platform Client candidates run only from an explicit manual workflow dispatch
+  with `client_checks=true`, because they are the expensive part of the matrix.
+  Publishing a tag or GitHub Release remains an explicit release decision rather
+  than a side effect of every merge.
 
 ## Pull Request Scope
 
diff --git a/docs/deployment.md b/docs/deployment.md
index 7e1e92a..97fba48 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -88,11 +88,11 @@ Retain the descriptor and successful deployment output as release metadata. Do
 not create a follow-up source commit solely to duplicate their revision, asset,
 or hashes.
 
-After `validate` succeeds on a push to `main`, CI packages this application
-release once and uses it to assemble Windows amd64, Linux amd64, and macOS arm64
-Client candidates on native runners. Each Client artifact contains one native
-archive and its SHA-256 file; Actions retains candidates for 14 days. This is
-automatic build output, not a tag, public GitHub Release, or deployment.
+After `validate` succeeds on a push to `main`, CI packages one short-lived
+Server application release. The three-platform Client matrix is an explicit
+manual workflow dispatch with `client_checks=true`; it consumes that same
+application artifact and retains the candidates for 14 days. Neither path is a
+tag, public GitHub Release, or deployment.
 
 Do not build or run the full repository check on a constrained production host.
 That host runs only the packaged binary and needs no Node, npm, or dependency
diff --git a/docs/todo.md b/docs/todo.md
index 737138e..6bab870 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -118,8 +118,9 @@ remain evidence gaps, not claims established by compilation or local loopback.
 15. **Unified release and update surface.** Build Client packages, Server
     runtime, future OCI images, and deployment bundles from one intentionally
     triggered immutable application release identified by its full commit SHA.
-    A validated `main` push now produces that application release and three
-    native-runner Client candidates with SHA-256 metadata. The default Client
+    A validated `main` push now produces that application release. An explicit
+    `client_checks=true` workflow dispatch produces the three native-runner
+    Client candidates with SHA-256 metadata. The default Client
     launcher now performs a non-blocking GitHub Releases check and the tracked
     deployment tree provides an operator-invoked read-only Server check. Formal
     GitHub Release publication, future OCI images, and deployment bundles remain