fix: hotspot/AP network resilience — Windows drain, watcher v2, rotation handoff

.github/workflows/release-ci.yml

@@ -75,6 +75,16 @@ jobs:
           cargo test --lib -p soth-extensions
           cargo test --lib -p soth-parse
           cargo test --lib -p soth-code
+      # soth-proxy and soth-cli carry Windows-divergent runtime code the
+      # ubuntu PR lanes never compile: the named drain event
+      # (drain_signal), the ipconfig-based network watcher, and the
+      # sequenced rotation in the supervisor. Test them natively so
+      # cfg(windows) API mistakes surface before a release.
+      - name: proxy + cli tests on Windows
+        shell: bash
+        run: |
+          cargo test --lib -p soth-proxy
+          cargo test --bins -p soth-cli
 
   # Phase 4b sidecar updater — Windows cross-compile validation.
   # The crate is windows-only at runtime; we cross-compile from
@@ -90,7 +100,9 @@ jobs:
       - shell: bash
         run: |
           cargo build -p soth-cli-update-sidecar --bin soth-update --release
-          cargo test --lib -p soth-cli-update-sidecar
+          # The sidecar is a binary-only crate: `cargo test --lib` errors
+          # with "no library targets found". Test the bin target instead.
+          cargo test --bins -p soth-cli-update-sidecar
 
   # FFI conformance is also a per-PR lane (paths-gated on
   # sdk-core / detect / classify / bindings / fixtures), but we

crates/soth-cli/Cargo.toml

@@ -59,7 +59,9 @@ comfy-table = "7.0"
 windows-sys = { version = "0.59", features = [
     "Win32_Foundation",
     "Win32_Networking_WinInet",
+    "Win32_System_Threading",
 ] }
+ipconfig = "0.3"
 
 [dev-dependencies]
 criterion = { version = "0.5", features = ["async_tokio"] }

crates/soth-cli/src/command_graph.rs

@@ -1510,16 +1510,25 @@ mod tests {
         std::fs::create_dir_all(&bundle_dir).expect("create bundle dir");
         std::fs::write(bundle_dir.join("manifest.json"), "{}").expect("write bundle marker");
         let old_home = env::var_os("HOME");
+        // dirs::home_dir() reads USERPROFILE on Windows, not HOME — without
+        // overriding both, `~` expansion escapes the temp sandbox into the
+        // real user profile and the test fails on missing bundle state.
+        let old_userprofile = env::var_os("USERPROFILE");
         let old_soth_home = env::var_os("SOTH_HOME_DIR");
         unsafe {
             env::set_var("HOME", temp.path());
+            env::set_var("USERPROFILE", temp.path());
             env::set_var("SOTH_HOME_DIR", &soth_home);
         }
         let result = std::panic::catch_unwind(|| f(&temp));
         match old_home {
             Some(value) => unsafe { env::set_var("HOME", value) },
             None => unsafe { env::remove_var("HOME") },
         }
+        match old_userprofile {
+            Some(value) => unsafe { env::set_var("USERPROFILE", value) },
+            None => unsafe { env::remove_var("USERPROFILE") },
+        }
         match old_soth_home {
             Some(value) => unsafe { env::set_var("SOTH_HOME_DIR", value) },
             None => unsafe { env::remove_var("SOTH_HOME_DIR") },