chore(release): all four lanes — mobile/hub/host 2026.730.1231-alpha, desktop 2026.730.1242

[physercoe]

Cuts all four release lanes. Mobile, hub and host share one version (2026.730.1231-alpha); the desktop workbench has its own CalVer (2026.730.1242).

Mobile — mobile-v2026.730.1231-alpha

Eleven commits since mobile-v2026.727.206-alpha: env profiles on the phone (spawn-sheet picker + management screen + fail-closed review fixes, #402/#403), client-side env-secret sealing KAT-locked across Rust/Dart/Go with a host-key fingerprint short code (#409/#410/#413), session teleport (#428), the run report's Issues sheet (#439), the streaming-transcript perf work (#440/#442), and the flutter_markdown_plus migration (#443).

Hub + host — hub-v… / host-v…

Last tagged at 2026.724.335, so these ship 51 commits:

• Env profiles E1–E3 (ADR-056) — the entity + CRUD, env vars materialized into the spawn spec, setup_script, project inherit + MCP schema; then the sealing chain: X25519 sealed-box core with AAD binding, host identity via capabilities, the env_secret_envelope column with presence-enforcement 422s, and host-side unseal + injection into the child's real process environment for M4/exec and M1/M2 stdio — never the command string, spawn spec, temp files, or logs (D-5).
• Session teleport (ADR-057) — chunked-manifest bundle transport, worktree and non-worktree (capped directory tar) handoff, engine-state snapshot/restore for claude-code and kimi-code-ts, session_handoff_pack/unpack, heterogeneous-host path portability, the endpoint with pause-first orchestration, secrets re-sealed to the target.
• Datasets (ADR-060) — datasetmeta for both LeRobot generations, the entity + REST CRUD + host read verbs, per-episode series reader + endpoint, uniform per-episode video paths, run→dataset provenance.
• Detached host jobs (ADR-058) + the dataset_export_rrd kind, blob lifetime (ADR-061), runs.env_ref (environments E0, feat(hub,desktop): env_ref on runs + episodes (environments E0) #478), and P5 A1 session-integrity issues folded into the digest.
• Fixes including: plain env vars no longer shadow a same-key secret; teleport refuses a secret-bearing session until it can re-seal; a queued host job heartbeats so the stale sweep can't fail a healthy backlog; a backup survives a blob vanishing mid-walk; the session read-repair write moved to the writer pool; team guarded against path traversal.

⚠️ Operators must redeploy the hub and host-runner binaries — including the host.update fixes the 2026.727.206 section described as waiting on exactly this.

Desktop — electron-v2026.730.1242-alpha

52 commits, the largest desktop cut so far, because five plans reached their shipping wedges at once:

• J8 Replay, end to end — dataset library + digest card + episodes table, Open in Replay from Inspect, the episode player (channel plots + multi-camera video grid over a range-serving media scheme), URDF reader + forward kinematics + robot manifest driving a 3D pose panel, the Rerun companion (launch policy, manager, export, remote .rrd over the director's own SSH session), a run's episodes one step from the player, remote roots reading video over SFTP.
• Architecture graph W1–W5 — hybrid linear-attention classification, honest hybrid KV sizing, heterogeneous-stack layout + pattern strip, zoom/annotate/SVG-PNG export, and compare-against-another-config over a pure diffArchCards.
• Agent browser bridge W1–W3 — read-only webtabs → action tools behind a per-spawn opt-in with an audit trail → hub-relayed remote driving with approval cards.
• Split pane S1–S3 and UI context + pointing D1–D2.
• SSH parity with mobile (ProxyJump + SOCKS5, ssh_config round-trip), the app-level assistant dock, ⌘K palette, Issues drawer.
• Fix worth naming: the vault detail pane could carry the previous item's secret across a selection change.

After merge — four tags on the merge commit

mobile-v2026.730.1231-alpha    → release.yml (APK) + release-ios.yml (IPA), non-prerelease, owns releases/latest
hub-v2026.730.1231-alpha       → release-server.yml (hub-server tarballs), prerelease
host-v2026.730.1231-alpha      → release-server.yml (host-runner tarballs), prerelease
electron-v2026.730.1242-alpha  → desktop-electron-release.yml, unsigned alpha, prerelease

Verification

• All 10 CI lints + lint-openapi.sh clean; desktop tsc --noEmit clean; package.json and package-lock.json agree on the version; hub builds with the new Version constant.
• The mobile build number 3459631 is minutes-since-2020-01-01 UTC; CI recomputes it from the tag for the Android versionCode.
• Flutter is not installed on the authoring host — flutter analyze / flutter test / the APK build are CI's to prove (they passed on the first commit of this branch).

🤖 Generated with Claude Code