## Summary
Retire the prerelease private OpenCode installation completely as an
executable source. Automatic selection now uses PATH and the
conventional shared user npm installation. Existing private files are
neither migrated nor deleted.
- Remove the private installer, receipt reader and fallback
introduced/retained by #756.
- Ignore saved private selections and reject validation/launch from
`~/.local/share/codenomad/opencode`, including private PATH entries.
Prevent installation into that retired prefix.
- Remove private-copy descriptions from all ten locales and update the
runtime policy documentation.
- Keep supported custom installations, native shared-service
ownership/authentication and explicit restart behavior.
## Reproduction and scope
The initial genuinely empty-profile test passed, but it did not match
the affected machine: that machine had no Git and retained a private
prerelease OpenCode copy.
On the exact installed `v0.20.0-dev-20260923-baf674fc` Tauri artifact,
seeding a valid private copy plus its `selected` receipt and `current`
marker makes setup report `state: ready`, `installationSource: legacy`,
and suppresses the missing-installation screen. The new desktop
regression fails against that release with `ready !== missing`.
With rebuilt server/UI resources in an isolated copy of the same Tauri
host, the identical private-copy scenario reports missing, offers
installation, installs the shared npm package, authenticates OpenCode
2.0.15 and resumes the requested folder without Git. This demonstrates
the missing-setup cause; it does not claim to explain every initially
reported startup slowdown.
## Validation
- 59 targeted server tests passed: discovery/install/update, retired
paths, binary selection, Windows/WSL spawn and binary validation routes.
- 13 real-component setup browser tests passed.
- 23 focused retirement/launch tests passed after the final network-path
preflight adjustment.
- UI TypeScript check passed; production server/UI/automation/pruning
build passed.
- Installed-release private-copy reproduction failed as expected;
corrected isolated Tauri acceptance passed.
- `git diff --check` passed.
Desktop qualification uses isolated profiles, services and databases.
The sole simulated installation side effect is HKCU PATH registration,
captured by a fixture preload; bundled npm installation, package
verification, native-parent service start and authenticated API checks
are real. The shared user daemon and installed application were not
replaced by the fix. Remote CI is pending.
## Maintenance notes
Existing oversized files touched: `packages/server/src/api-types.ts`
(~583 lines) and `packages/ui/src/lib/i18n/messages/*/settings.ts`
(~625–639 lines). No size-only refactor is included.
Prefer terminal PATH and a common user npm installation, migrate historical private and official npm copies, and retain explicit authority for custom and WSL executables. Preserve running daemon ownership and defer locked Windows updates. Align recovery and settings presentation across locales.\n\nReviewed through an independent gatekeeper loop (final zero-finding review on e33a6a16). Validated 34 targeted server tests, 13 browser scenarios, typechecks, isolated Windows npm installation and real historical migrations. Full CI browser job has unrelated existing system-message search failures reproduced locally; merge requested with administrator authority without waiting for CI.
Keep activation explicit after optional upgrades while reconnecting backend authority to the newly selected executable. Supported running daemons remain usable and new workspaces can open when restart is deferred. Recheck executable selection and execution-host eligibility before mutating the shared service.
Publish verified installations with immutable, exclusive version receipts. Concurrent older installs cannot downgrade a newer selection, and same-version Windows publishers no longer replace an open receipt. Continue reading previous current markers.
Cover the gatekeeper findings with real manager/shared-service ownership regressions, browser recovery tests, and concurrent installer tests. Extend native migration to beta and stable seeds, same-version Forms durability controls and historical provider connections. Provide the POSIX shell explicitly in the no-system-Node fixture, fixing Linux/macOS installation CI isolation.
Require stable OpenCode >=2.0.11 <3.0.0 from authenticated daemon metadata before functional clients and plugin provisioning. Keep bounded contract recognition, connection-generation fencing and native ownership checks while retiring old request, response and event conversions.
Unify missing and outdated runtime recovery with Preferences. Install exact stable releases through bundled Node/npm into a verified versioned user prefix, preserve custom and WSL selections, and separate installation from explicit shared-service restart through the native-parent starter. Fence stale setup responses, retain pending folder opening and never replay prompts.
Certify isolated 2.0.3-to-2.0.11 history migration with executable hashes, untouched seed storage, paginated messages, forks, compaction checkpoints, location moves and pending inbox data. Add minimum/latest cross-platform migration and installation gates, packaged npm closure checks, real Solid recovery regressions and supported-contract authority tests.
Validated server/UI types, focused unit and reducer suites, browser captures, actual packaging-prepared Node 24.20.0 installation without system Node, and native location, automation and pruning fixtures. Document packaged-desktop, WSL, broader historical-state and remote-CI evidence as remaining release gates.
