feat(v2): manage session families across worktrees - #649

Use the shared OpenCode V2 service to inventory complete project session families and move them through the native session.move API. Serialize project operations, verify authoritative locations, and roll back only transaction-owned moves when failures occur.

Make worktree deletion transactional by evacuating inactive session families before Git removal. Strict NUL-delimited inventory checks, HEAD revalidation, physical-root workspace reservations, nested workspace projection, and cache invalidation prevent stale or in-use worktrees from being removed.

Cover cursor pagination, family resolution, rollback, deletion evacuation, nested logical roots, exact Git slug resolution, and workspace creation races. Validated with server typecheck and the full 237-test server suite.

Treat SessionInfo.location as the authoritative worktree assignment, load every project-scoped cursor page, and project complete session families for search, filtering, and activity/name/worktree sorting. Family moves now run through the server transaction and refresh from OpenCode instead of mutating local paths optimistically.

Show localized root and linked-worktree badges, preserve complete ancestry during filters, refresh worktrees and sessions after deletion, and apply the complete authoritative session.moved payload. Expose the desktop file-manager action only for local paths with keyboard support.

Add coverage for project query construction, path normalization, family projection, native move events, request authority, serialized family moves, and deletion refresh; register the new runnable tests in CI. Validated with UI typecheck, 35 affected CI-mode tests, and production builds.

Add desktop-only Electron and Tauri commands for revealing local worktree directories. Reuse the existing renderer token, origin, frame, and generation authority instead of introducing a separate bridge.

Reject relative, control, network, device, and non-directory targets before opening. Canonicalize inputs, require exact NUL-delimited Git inventory membership, constrain logical subdirectories beneath registered worktrees, and repeat authorization and inventory checks to narrow races.

Keep Electron and Tauri behavior aligned with targeted parser, validation, authorization, containment, and revalidation tests. Validated with Electron typecheck and 124/124 native tests plus cargo check and 87/87 Rust tests.

Remove the duplicate Tauri native event transport and use the server EventSource stream consistently across web, Electron, and Tauri clients. Align the generated client and required opencode2 CLI on next-17353.

Restrict workspace proxying to the required V2 API surface, enforce session and directory ownership, validate local file URIs, strip routing headers, and tighten provider, Yolo, worktree, and session event state handling.

Protect the shared service lifecycle with private registration state, process-identity leases, safe ownership transfer, bounded shutdown, Windows executable resolution, and WSL namespace-aware PID verification. Unknown wrappers now fail closed rather than leaving an unowned service.

Validated with server and UI typechecks, 433 UI tests, focused server lifecycle and proxy suites, 67 Rust tests, server and UI builds, and a real next-17353 service lifecycle smoke test.

Treat the persisted V1 default command 'opencode' as 'opencode2' so restored and newly selected workspaces use the required V2 service instead of waiting for the obsolete binary to time out.

Keep the folder selection view mounted while startup restore is active and feed it the existing loading state, preventing the renderer from appearing blank while saved workspaces are recreated.

Cover the legacy binary setting and restore loading gate with regression tests. Server/UI typechecks, targeted restore tests, the UI production build, and a real lifecycle smoke from an 'opencode' configuration pass.

Load sessions from each logical root and worktree using the native V2 directory filter, preserve locally known sessions when a combined response may be incomplete, and resolve locationless events through their session IDs. This restores worktree sessions, prompt activity, and deletion updates without reintroducing the removed transport.

Require the bundled OpenCode prerelease for shared-service discovery and surface structured prompt errors. Move Electron and Tauri restore state and election files under the V2 namespace, copying V1 state once without mutating or deleting the legacy files.

Cover multi-directory loading, locationless event routing, version-constrained discovery, and cross-host state isolation. Validated UI, server, Electron, and Tauri tests and built the Tauri release executable and NSIS installer.

Restore reliable V2 catalogs, agent identifiers, cursor pagination, prompts, variants, attachments, forms, native event reconciliation, Yolo persistence, and location-aware PTY controls. Prevent completed control records from appearing as streaming placeholders and keep live output refreshing during sustained token streams.

Harden the shared service and workspace proxy with explicit OPENCODE_DB isolation, launch-signature validation, traversal protection, WSL namespace translation, ownership-scoped routes, bounded SSE backpressure, reconnect recovery, and safe process-proof transfer and shutdown semantics.

Align provider, VCS, LSP, update, documentation, and CI behavior with the experimental next-17353 contract. Validation includes server/UI/Electron typechecks, 252 workflow UI tests, focused server suites, production UI/server builds, 68 Tauri tests, and a real V2 workspace/session/prompt smoke.

Merge upstream dev into the OpenCode V2 foundation while preserving native V2 session, provider, proxy, PTY, and explicit database behavior.

Resolve desktop workspace-open and provider visibility conflicts across Electron and Tauri, bound local API requests, refresh standalone dependency locks, and keep grouped integration preferences keyed by native provider IDs.

Validated with desktop typechecks, 267 UI tests, 308 server tests, 122 Electron tests, 74 Tauri tests, packaged builds, and an exact OpenCode 0.0.0-next-17353 Tauri smoke covering prompt, reload, agent fallback, and PTY lifecycle.

Force the V2 service to use the opencode2 database under the current user's data directory so parallel V1 launches cannot redirect it through shared environment settings.

Keep the bare opencode and opencode2 commands out of custom binary history while preserving real executable paths, and document the parallel desktop smoke procedure. Existing history entries are intentionally left untouched for manual cleanup.

The server manager test and typecheck passed, and the Tauri package built successfully before the final UI-only simplification. No additional compilation was run per request.

Update the experimental OpenCode client, protocol, and schema dependencies to the latest reviewed next release while removing the exact CLI version gate from shared-service discovery. This lets CodeNomad use current opencode2 releases instead of timing out solely because the runtime advanced.

Refresh migration, contributor, architecture, and skill guidance to require release-note, documentation, declaration, and proxy-parity review on each upgrade. The isolated opencode2 database behavior is documented consistently.

Validated with server and UI typechecks, 36 passing targeted service/workspace tests, a release Tauri build, and a packaged desktop smoke. The smoke opened D:\CodeNomad, reused three existing sessions, and received three distinct exact prompt responses from opencode2 next-17444.

Give the V2 desktop runtime its own WebView2 user-data folder so it cannot reuse V1 service workers, browser caches, or locked profile state. Preserve an explicitly supplied WEBVIEW2_USER_DATA_FOLDER for debugging and custom launches.

Defer installation of the Windows session-end subclass until the main thread can provide a native window handle, preventing startup from aborting during slower WebView creation.

Validated with nine shutdown tests, a release build, simultaneous V1/V2 WebView processes using distinct data folders, and sequential CodeNomad/openchamber workspace launches without UI or runtime exceptions.

Keep established conversations mounted while V2 performs authoritative message refreshes. Background loads no longer insert the initial loader or clear timeline segments, preventing the measured prompt displacement and timeline flicker during native streaming.

Restore saved sessions directly before the expensive all-worktree session scan, while preserving every referenced draft, attachment, scroll, expansion, idle, and generation record. Make workspace readiness follow newer reconnect loads without leaking waits after cancellation, and exclude synthetic views from native session hydration.

Harden question interruption races by rebinding requests when authoritative tool parts arrive late or replace optimistic parts, and clear inline question state immediately after reply or rejection. Isolate PTY loading reads from Solid effects to prevent recursive reload storms.

Add focused regressions to the PR workflow. Validated with 223 standard UI tests, 58 browser-condition tests, full TypeScript checks, 307 server tests, 74 Rust tests, 28 Windows spawn tests, a production Tauri build, and real cold-start state restoration.

Apply OpenCode V2 text and reasoning delta events directly to the normalized message store so assistant responses appear as they are generated instead of waiting for periodic HTTP snapshots.

Deduplicate replayed events, preserve ordinal part ordering, reconcile stale or superseded snapshots, settle terminal messages, retry failed terminal refreshes, and clear streaming state when sessions or workspaces are removed. This keeps snapshot refreshes as authoritative recovery without erasing visible streamed content or recreating removed stores.

Add focused streaming regression coverage and extend native event tests for immediate text, reasoning, periodic refresh behavior, replay handling, deletion cleanup, and terminal reconciliation. Validated with 223 standard UI tests, 64 browser/integration tests, full workspace typechecks, a production Tauri build, and a live CDP smoke covering progressive rendering and reload restoration.

Align the V2 delta reducer with the live OpenCode contract, where many unique events append to the same message, content type, and ordinal. Keep one provisional part per source part instead of treating ordinals as fragment sequence numbers.

Render the first fragment immediately, then coalesce subsequent store and Markdown updates to one 16 ms window. Flush pending content before terminal reconciliation, preserve authoritative snapshot IDs and error states, cancel timers on session or workspace cleanup, and retain bounded replay protection.

Validated against a live 1,485-event response that streamed 100 lines and 6,387 characters continuously to completion. Added repeated-ordinal, timer, snapshot, tool-boundary, cleanup, terminal, and error regressions; all 223 standard UI tests, 72 browser/integration tests, and workspace typechecks pass.

Keep follow ownership tied to explicit user intent so Virtua measurement corrections cannot silently escape an actively followed response. Large key jumps now land immediately, while explicit timeline and top navigation cancel submit pinning without confusing programmatic movement for user scrolling.

Rebuild timeline segments from cached V2 structural signatures instead of part-count and same-length replacement heuristics. This handles provisional-to-authoritative part replacement, type and renderability changes, terminal status updates, locale changes, duplicate part IDs, and the V2 time.completed contract without rebuilding streamed text on every token.

Add follow-state, timeline projection, and duplicate-part regression coverage to the PR workflow. Validated with 264 standard UI tests, 72 browser/integration tests, full UI and Electron typechecks, production UI build, and live Tauri WebView navigation/follow scenarios.

Preserve the last authoritative non-empty tab snapshot through native shutdown, make shutdown capture terminal, and restore the exact saved active tab. Seed scroll snapshots before session selection and wait for usable Virtua measurements so project, tab, session, and anchor position survive A/B restarts.

Render native runtime forms inline only when their active-session tool target is resolved, retain the floating fallback for unresolved requests, share form schema visibility and URL validation with provider auth, and remove the unused session form-list proxy route and obsolete V1 request wrapper.

Return the native V2 session.active map without a legacy data envelope, avoid full-history refreshes for deltas already applied locally, and bound timeline projection refreshes during streaming. Coverage includes UI restoration, form targeting, proxy contracts, native streaming, and CI test registration.

Validated with root typecheck, 529 UI tests, 305 passing server tests with 3 skips, 74 Tauri tests, 122 Electron native tests, production A/B builds, a no-seed native handoff, and runtime verification of the active-session proxy shape.

Attempt configured WSL host-to-service translation before treating POSIX paths as already service-native. This preserves real Windows behavior while allowing Linux CI to exercise Windows workspace ownership with temporary git worktrees.

Remove the environment-dependent assertion that a bare opencode2 command resolves to a packaged executable. Deterministic shim coverage remains in buildServiceLaunchSpec and the Windows PATH/PATHEXT tests.

Validated with full typecheck, 27 spawn tests, 9 workspace manager tests, and the complete server suite with 304 passing tests and 3 skips.

Stop deleting OPENCODE_DB from legacy CodeNomad environment preferences during settings layout migration. Environment variables now migrate uniformly without a database-specific exception.

The OpenCode V2 service destination remains unchanged and continues to use ~/.local/share/opencode2/opencode.db through the launch-time service environment override.

Validated with the settings migration test, root typecheck, the complete server suite, and git diff --check.

When a native V2 form resolves to a tool call, render it as the sole interactive surface and suppress the legacy QuestionToolBlock for that call. Legacy questions remain available when no native form is pending, while unresolved and cross-session forms continue to use the existing floating fallback.

Improve the native form hierarchy with token-based panel and field surfaces, explicit required and focus states, consistent checkbox controls, square action buttons, and responsive stacked actions on narrow screens.

Validated with UI typecheck, 530 UI tests, a production desktop build, git diff checks, and desktop/mobile inspection in the deployed WebView.

Render native V2 string option lists with up to four answers as visible radio cards, including each option description, so question-style forms retain the scannable V1 interaction. Lists with five or more answers continue to use a compact select control.

Apply the same selected-card treatment to multiselect answers, preserve custom-value entry, validate required inline strings, and keep grouped controls accessibly labelled. Option styling lives in a focused component stylesheet and uses existing square-corner design tokens.

Validated with UI typecheck, 531 UI tests, a production desktop build, git diff checks, and visual inspection in the deployed WebView.

Electron and Tauri can each publish a legacy running marker immediately before publishing their shared cross-host participant. On a simultaneous Windows startup, both hosts could observe that transient gap and yield ownership, leaving no primary.

When legacy detection initially blocks a primary candidate, wait for one bounded 50ms participant grace period and reconcile once before yielding. Apply the same protocol on both Node and Rust hosts; genuine legacy clients still block ownership after the grace period.

Validated with root typecheck, 50 repeated cross-host election runs, 122 Electron native tests, 74 Tauri tests, and git diff checks.

A session can mount from startup discovery before native workspace restoration seeds its saved scroll snapshot. The message stream previously marked that no-snapshot pass complete and ignored the authoritative seed when it arrived, leaving Virtua at the top despite a valid anchor.

Track no-snapshot completion as provisional and permit exactly one later restore when the reactive seed appears. Normal completed restores remain terminal, and session changes reset the provisional authority.

Validated with UI typecheck, 48 targeted restoration tests, 532 complete UI tests, and git diff checks.

The Tauri client-state tests exercise process-global file locks and invoke PowerShell/CIM for process identity. Running them concurrently on the shared Windows runner can starve those probes, causing both cross-host election and bounded registration timing assertions to fail together despite passing independently.

Run the 74-test Windows Tauri suite with one test thread. Linux coverage remains parallel, and product-side participant reconciliation remains covered by repeated cross-host tests.

Validated with the exact serial Windows cargo command: 74 passed, 0 failed.

The Tauri macOS ARM prebuild combines DOM and Node timer declarations, so injected and global setTimeout implementations can return either a numeric browser handle or a Node Timeout. The previous inferred alias accepted only the Node variant and failed server compilation on that matrix leg.

Represent the manager timer handle as the actual portable union and avoid Array.prototype.at in a server test because the server TypeScript target predates ES2022.

Validated with the complete server build, 304 passing server tests with 3 platform skips, 11 targeted workspace tests, and git diff checks.

Real question-backed V2 forms set custom=true. The long-option branch therefore bypassed the intended select and rendered a text input with a datalist, so the tested 4/5 threshold did not hold for actual native requests.

Render every long option list as a select regardless of custom-value support, and preserve free-form answers in a separate custom input. Short lists remain visible cards.

Validated against a live four-option V2 form, targeted form tests, the UI typecheck, 532 UI tests, and git diff checks.

OpenCode SDK location responses expose workspaceID, while generated request inputs require workspace. Passing a response LocationRef directly was structurally accepted by TypeScript but caused the generated client to omit the workspace selector from catalog requests.

Centralize the output-to-request conversion and apply it to agent, provider, model, default-model, and command catalog calls. Internal session state continues using the SDK response shape.

Validated with 21 targeted request-authority tests, the UI typecheck, 533 UI tests, and git diff checks.

Volatile V2 events previously refreshed every catalog, metadata, and filesystem domain. Even an agent or command update therefore caused unrelated API requests and cache invalidation, with a trailing full rerun when events overlapped.

Map each native event to the state domains it can affect and merge pending domains in one coordinator. Reconnects retain a complete refresh, while agent, command, integration, metadata, filesystem, and VCS events now update only their relevant stores.

Validated with 21 targeted invalidation and request-authority tests, the UI typecheck, 535 UI tests, and git diff checks.

Reduce card padding, metadata spacing, action spacing, and list gaps in the Status tab so multiple background shells remain scannable without consuming excessive vertical space.

All existing shell details and actions remain available.

Validated with the UI typecheck and production build.

Load root sessions and search results by workspace directory so V1 sessions that remain assigned to the global project stay visible beside sessions created under the resolved V2 project ID.

Keep the complete project inventory for descendant hydration, but reconcile removals against its union with the complete directory-scoped root inventory. This prevents authoritative refreshes from immediately pruning migrated roots and avoids pruning while directory pagination is incomplete.

Add regression coverage for mixed global and V2 project sessions. Validated with the 41-test session request authority suite, UI typecheck, and production UI build.

Move color schemes to the end of General settings and present every built-in and saved palette as a compact row with directly editable semantic color swatches. Saving prompts for an incremented preset name, validates contrast, and keeps unsaved edits behind the existing settings discard guard.

Persist palette selection and named presets in device UI state while retaining read fallback from the previous UI config location. Compact configured provider cards without removing model or disconnect actions, and remove redundant Agent and Model labels from assistant metadata.

Add preset normalization and naming coverage. Validated with the UI TypeScript check, focused Node tests, and the production UI build.

Restore the singleton Preferences window under Tauri Developer Mode by applying the shared WebView2 arguments to its webview and recovering stale window handles. The YOLO switch now uses the palette's dedicated session accent.

Protect unsaved palette edits across row changes, expose palette descriptions as native tooltips, and surface the 50-preset limit consistently on write. Simplify remaining agent/model metadata and keep provider identifiers readable in RTL layouts.

Validated with the UI typecheck and production build, palette/theme node tests, Rust Preferences tests, and cargo fmt.

Keep Preferences as a unique support window in Electron and Tauri, persist the latest validated section and caller context, restore it after process restart, and clear only its own restoration state after an explicit close. Final application-window shutdown now ignores Preferences without discarding its saved state.

Make second launches open a new application window by default while allowing the Advanced focus-existing-window preference to restore MRU focus. Reload the YAML setting for each launch and keep --new-window as the explicit override, with localized UI coverage across all supported locales.

Pin Developer Mode actions and restart to the latest inspected bridge, and include the actual desktop artifact in native restart identity so parallel worktrees cannot silently steal a relaunch.

Validated with 189 Electron native tests, 139 Rust tests, server automation route tests, UI/server/Electron typechecks, cargo fmt, Electron and Tauri release builds, and an isolated Tauri runtime lifecycle scenario.

Prevent empty timeline frames by carrying Virtua measurement caches across keyed window replacements, keep directional bottom pins from moving upward, and restore escaped message anchors when the composer changes the viewport height. Preserve saved scroll snapshots while instance state is rehydrated.

Harden Developer Mode discovery for concurrent sessions and worktrees by pruning dead local registrations, bounding registry reads, isolating inspected bridge pins per plugin setup, and requiring a genuinely new native generation after restart. Preserve the raw executable path when native canonicalization fails.

Cover follow pin behavior, escaped snapshot persistence, parallel session isolation, registry pressure, distractor bridges, and restart generation filtering. Validated with UI and server typechecks, 646 UI tests, 8 automation plugin tests, 139 Rust tests, packaged release builds, and a runtime resize smoke test.

Resolve the floating @opencode-ai/client beta dependency for both the server and UI at beta-18866 so CodeNomad builds against the same contract as the current OpenCode runtime. This release includes the bounded Windows post-exit pipe drain that prevents detached GUI processes from leaving parent sessions stuck.

Drop the obsolete local Session metadata override and inherit the SDK's durable JSON SessionMetadata contract introduced upstream. The beta tag remains in both package manifests, so future dependency refreshes continue following the current V2 beta rather than a numeric version range.

Validated with UI and server typechecks, the focused session type tests, a production UI build, npm dependency inspection, runtime health at beta-18866, and git diff checks.

Document the tested beta-18866 client and runtime baseline, durable SessionMetadata contract, Windows detached-process fix, and the reviewed disposition of newly generated plugin, RPC, persistent terminal, VCS, and service APIs.

Clarify that the project automation plugin is V2-compatible while legacy global plugins require independent migrations. Remove stale DEV-v2 worktree launch paths and correct the legacy deletion note now that native messageUpdate supports technical-part cleanup.

Validated against the installed beta-18866 declarations, runtime health and plugin inventory, current proxy allowlist, current CodeNomad callers, and the existing release executable path.

Distinguish browser EventSource recovery from native stream generation replacement, and document the hybrid native/server Git status path plus the server-owned worktree safety workflow.

Replace the obsolete fixed-port WebView2 launch instructions with the persisted Developer Mode workflow and dynamic CDP discovery. Clarify that legacy Question allowlist entries are inert under beta-18866 and point upgrade audits at the workspace-local generated clients.

Validated against the beta-18866 generated declarations and OpenAPI, the active runtime health endpoint, reconnect and projection stores, worktree routes, Git status integration, and Tauri Developer Mode startup code.

Prevent empty frames, black flashes, viewport jumps, and stale page restores while Virtua replaces resident message windows. Upgrade Virtua to 0.51.0, key measurement invalidation to resident item identity, and consolidate bottom stabilization into the explicit pin state machine.

Carry abort authority from MessageSection through shared message-page requests without allowing one cancelled consumer to invalidate another. Commit safe page-boundary snapshots, cancel stale pins synchronously, distinguish user cancellation from timeout or supersession, and persist the final user-selected viewport after settlement.

Cover key replacement, boundary navigation, shared request cancellation, immediate retry, safe snapshot publication, and loading cleanup. Validated with UI typecheck, focused pagination/follow and request-authority tests, opencode-data projection tests, a release Tauri build, and Developer Mode runtime stress scenarios for session switching, pagination, wheel cancellation, rapid scrolling, resizing, and active rendering.

Keep at-bottom restoration authoritative until Virtua reports a stable measured maximum for eight consecutive frames. Interrupted tab activations now retain the last committed snapshot instead of publishing a transient virtual offset, and first-time mounts use the same guarded restoration path.

Retain exact anchor ownership for intentionally escaped timelines while allowing user input to cancel restoration. Add focused settlement coverage that resets stability when Virtua discovers a later maximum.

Refresh the floating OpenCode V2 client lock from beta-18866 to beta-18999 so the UI, packaged server, and active runtime share one protocol version. Validated with UI and server typechecks, 141 focused tests, the Tauri release build, rapid tab-switch stress, persisted snapshot inspection, and native restart restoration.

Keep the last painted message viewport visible while a capped-window slide remounts Virtua and rebuilds its measurements. This masks the transient empty frame without restoring stale index-based cache data or changing the 200-message resident bound.

Release the inert, non-interactive continuity layer only after the replacement virtualizer is bottom-pinned and stable. Cancel it immediately for user scroll intent, session deactivation, hidden windows, and component cleanup so visual continuity never overrides navigation authority.

Validated with UI typechecking, 67 timeline and pagination tests, 46 session request authority tests, 28 OpenCode projection tests, a release Tauri build, repeated live capped-window remount probes, user-intent cancellation, restart restoration, and 60 rapid instance-tab round trips.

This reverts commit d308e21.

Stop remounting Virtua whenever the 200-message resident transcript advances by an ordered suffix. Those equal-length slides previously invalidated every indexed measurement and produced the recurring visible reset during active tool work.

Stage the appended tail before removing the evicted prefix, then use Virtua's native shift mode for the length reduction. This preserves key-aligned measurements and mounted content while leaving arbitrary reorders, pagination changes, and session resets on the existing protective remount path. Index-based scrolling and anchor lookup now use the staged virtual data so navigation remains authoritative during the one-frame transition.

Validated with UI typechecking, 68 timeline and pagination tests, a release Tauri build, ten live content-window mutations with zero virtualizer remounts or empty frames, exact instance-tab anchor restoration, native restart restoration within 0.125 px, and bottom follow at 0 px.

Complete ordered capped-window shifts in a microtask so Virtua can preserve its measurements without exposing the intermediate appended window to a painted frame.

Observe the connected Virtua measurement root and flush followed-content growth from ResizeObserver delivery. This keeps the viewport pinned before paint while preserving escaped user anchors, restore authority, hold behavior, and the 200-message memory bound.

Validated with UI typechecking, 68 focused timeline and pagination tests, a release Tauri build, deterministic native resize probes, inactive-tab anchor restoration, and prolonged Developer Mode mutation monitoring.

Synchronize the migration guide, Desktop V2 comparison, and PR-facing capability decisions with the beta-18999 client and dea2099 timeline stabilization head. Record native redo, cancel-first queued prompt editing, bounded Virtua window shifts, pre-paint settlement, and resize compensation so completed work is no longer presented as a gap.

Refresh the DEV-v2 code-growth accounting against origin/dev, distinguish the historical migration-gate feature estimates from later product work, and update the largest test-growth paths. The category and package totals both reconcile to the current +21,486-line branch delta.

Validation: git diff --check; verified category and package totals; retained the previously completed UI typecheck, 68 focused timeline/pagination tests, Tauri release build, and native Developer Mode observations documented for dea2099.

Merge DEV-v2 at 44a1816 while preserving the worktree-session ownership, pagination, mutation-fencing, verification, and rollback guarantees from PR NeuralNomadsAI#649. This also brings the current native preferences window, theme scheme, titlebar, desktop state, and persistent Developer Mode behavior into the branch.

Resolve the OpenCode V2 overlap by combining superseded-request cancellation with complete native pagination. Session continuations carry only opaque upstream cursors; native location, workspaceID, and durable metadata survive projection; Yolo restore exhausts cursor pages; and project-family moves remain serialized, inactive-only, verified, and rollback-safe.

Keep the workspace proxy deliberately narrow: plugin lifecycle mutations, generic RPC, and the raw upstream event route remain blocked. Typed plugin events are covered by native-location routing, and the beta-18684 to beta-18999 impact audit is recorded against published declarations and V2 documentation without adding V1 fallbacks or private service ownership.

Maintain Electron and Tauri parity, including the persistent Developer Mode profile, host-assigned CDP ports, authenticated bridge reconnection, and the externally owned shared OpenCode daemon.

Validation: npm ci --ignore-scripts; UI/server/Electron typechecks; 467 UI tests; 390 passing server tests (2 skipped); 189 Electron native tests; 139 Rust tests; targeted pagination/proxy/event/worktree suites; server/UI and Electron builds; Windows Electron packaging/resource smoke checks; Tauri release/NSIS build; and a Developer Mode restart that reattached this session to the rebuilt Tauri artifact.

Use the published beta artifacts, installed declarations, and official V2 documentation as the compatibility authorities. Remove the remaining ambiguous release-reference wording and describe native worktree APIs against the currently tested beta.

Make Developer Mode bridge tests select a temporary registry through the platform-native HOME, LOCALAPPDATA, and XDG_RUNTIME_DIR inputs instead of assuming the Windows directory shape. Clear WSL discovery during each isolated test and derive the stale-pressure directory from the same helper used by production.

This fixes the Linux PR job's deterministic ENOENT while preventing the tests from reading or writing a developer's real bridge registry. Validated with the focused eight-test bridge suite, the server typecheck, and the complete 392-test server matrix (390 passed, 2 Windows-only skips).

Record dev@52f0e629 as an ancestor after incorporating the byte-identical PR NeuralNomadsAI#647 source tree at 8777eb7. GitHub landed NeuralNomadsAI#647 as a squash commit, so a normal content merge would replay the same V2 migration from unrelated history and manufacture conflicts across the already reviewed worktree-session files.

The ours strategy is intentional and content-safe here: the complete dev tree was incorporated by the preceding merge, its tree identity was verified before this commit, and this ancestry-only bridge leaves the candidate tree unchanged so the retargeted PR contains only NeuralNomadsAI#649's 65-file payload.