Backport the exact read-only macOS maximize getter from Tao #1182 into the existing 0.34.6 vendor override, preserving the Windows input backport. The original borderless getter changed AppKit style masks and generated geometry events whose persistence capture called the getter again, starving startup independently of OpenCode readiness. Window chrome, persistence policy and shared OpenCode lifecycle remain unchanged.
Add a bounded native AppKit regression with isolated original-crate negative-control artifacts, repeated warm-cache runs, getter-phase capture evidence, maximize/restore and fixed-size/decorated cases. Reject unrelated watchdog timeouts and validate runner results with platform-independent tests. Run the native regression in macOS ARM64 CI.
Validation includes the macOS Intel VM reproduction and rebuilt Tauri startup, second-window quit/relaunch with isolated OpenCode 2.0.21, 181 macOS and 188 Windows Tauri tests, Windows input negative controls, 44 targeted Electron regressions, successful ARM64 CI tests and a published ARM64 test artifact. Both independent gatekeeper findings were fixed and re-reviewed to zero findings. All test jobs passed; remaining platform builds were still running at the explicitly requested admin merge.
Fixes#819.
Use one Attach file action for native device selection and retain project-scoped @ references in the active session worktree. Remove the duplicate upload entry and composer server browser, document the outside-project scope change, and translate attachment origins and feedback across all locales.
Share serialized, bounded byte ingestion across picker, drop and clipboard. Fence open pickers and late reads across session/worktree/lifecycle changes, preserve edits and newer selections without stealing focus, release rejected-read budgets, and restore failed custom-command drafts by attachment identity. Validate project directories through existing workspace ownership before filesystem listing/search.
Cover the behavior with 20 attachment and 11 session-aside browser scenarios, attachment/submission/persistence units, server budget/proxy/ownership regressions, and isolated native Windows picker fixtures. Three independent review passes corrected five P2 findings and ended at zero; the final merged-head review confirmed that result. UI checks/build, Tauri release build and native picker smoke passed. Remote CI was still in progress at the explicitly requested admin merge.
## Summary
Retire the prerelease private OpenCode installation completely as an
executable source. Automatic selection now uses PATH and the
conventional shared user npm installation. Existing private files are
neither migrated nor deleted.
- Remove the private installer, receipt reader and fallback
introduced/retained by #756.
- Ignore saved private selections and reject validation/launch from
`~/.local/share/codenomad/opencode`, including private PATH entries.
Prevent installation into that retired prefix.
- Remove private-copy descriptions from all ten locales and update the
runtime policy documentation.
- Keep supported custom installations, native shared-service
ownership/authentication and explicit restart behavior.
## Reproduction and scope
The initial genuinely empty-profile test passed, but it did not match
the affected machine: that machine had no Git and retained a private
prerelease OpenCode copy.
On the exact installed `v0.20.0-dev-20260923-baf674fc` Tauri artifact,
seeding a valid private copy plus its `selected` receipt and `current`
marker makes setup report `state: ready`, `installationSource: legacy`,
and suppresses the missing-installation screen. The new desktop
regression fails against that release with `ready !== missing`.
With rebuilt server/UI resources in an isolated copy of the same Tauri
host, the identical private-copy scenario reports missing, offers
installation, installs the shared npm package, authenticates OpenCode
2.0.15 and resumes the requested folder without Git. This demonstrates
the missing-setup cause; it does not claim to explain every initially
reported startup slowdown.
## Validation
- 59 targeted server tests passed: discovery/install/update, retired
paths, binary selection, Windows/WSL spawn and binary validation routes.
- 13 real-component setup browser tests passed.
- 23 focused retirement/launch tests passed after the final network-path
preflight adjustment.
- UI TypeScript check passed; production server/UI/automation/pruning
build passed.
- Installed-release private-copy reproduction failed as expected;
corrected isolated Tauri acceptance passed.
- `git diff --check` passed.
Desktop qualification uses isolated profiles, services and databases.
The sole simulated installation side effect is HKCU PATH registration,
captured by a fixture preload; bundled npm installation, package
verification, native-parent service start and authenticated API checks
are real. The shared user daemon and installed application were not
replaced by the fix. Remote CI is pending.
## Maintenance notes
Existing oversized files touched: `packages/server/src/api-types.ts`
(~583 lines) and `packages/ui/src/lib/i18n/messages/*/settings.ts`
(~625–639 lines). No size-only refactor is included.
Follow up #737 with a shared focused-or-MRU menu snapshot, UI-thread refresh serialization, lock-free native calls, popup-tracking deferral and atomic admission before native getters. Preserve remote/Preferences isolation and trailing state publication after native tracking. Iterative independent gatekeeper review reached ZERO FINDINGS after fixes; isolated real Windows popup/focus/concurrent-request and mouse-selection acceptance passes, alongside Rust and Electron/UI regressions. Administrator merge requested by the user. CI is not fully green: final checks pending, baseline migration/system-search failures and an unexplained initial Windows pruning UI exit are documented in the PR gatekeeper report.
Exercise the real Windows-to-WSL service lifecycle and plugin provisioning through native, mounted and aliased discovery roots. Use guarded fixture-owned registrations, unique service ports and fully isolated environments; record actual watcher behavior, measured lease heartbeats, explicit reload, restart and cleanup.
Characterize reload with a held synthetic provider stream and native pending Form, Shell and PTY. Verify one successful provider request without replay and record native resource teardown. Update all locale descriptions to explicitly include terminals and background commands.
Bound the whole fixture, native requests, predicates and cleanup independently. Handle detached event-consumer failures immediately while preserving awaited failure reporting. Seven guard regressions and final real aliased reload-safety acceptance pass; autonomous gatekeeper re-review reports no remaining fixture findings.
