Review: approved ✅ — the evidence is what makes this reviewable

An ADR that picks a runtime packaging strategy is normally hard to review because the tradeoff is asserted. Here it's measured, so the decision can actually be checked:

• current unsigned Tauri app: 6.7 MB
• target-thin Node runtime: 117.7 MB
• thin + stripped: 108.4 MB
• no-PATH protocol v1 handshake: passed, ~1.02 s cold

The size cost is the real decision, and it should be stated plainly: this takes the desktop app from ~6.7 MB to ~115 MB, roughly 17×. That is the price of getting provider credentials and the agent loop out of the WebView, and given threat #1 in security-model.md (credential exfiltration) I agree it's worth paying. But it is a permanent, user-visible download-size regression, not a rounding error — worth being explicit about in release notes so it doesn't read as a regression to users.

What I checked

• The no-PATH handshake probe is the right test. A sidecar that works only because the developer's PATH happens to have a Node is the classic way this breaks for end users, and it breaks after shipping.
• Choosing single-client JSONL stdio and explicitly deferring multi-client daemon attachment keeps v1's ownership model simple — one owner, one lock, no cross-client arbitration. Given the session-writer lock work in Sessions: canonical v1 writer and cross-process ownership #185, adding multi-client now would have multiplied the concurrency surface.
• Signing/notarization/rollback/DMG gates are recorded as explicit gates, and the PR is honest that release credentials were not available locally rather than claiming a verified signed build. That honesty is worth more than a green checkmark.

Validation: CI green; reproducible probe script included.