D-12: Revert mobile/pubspec.lock to origin/main.  The meta 1.17→1.18 /
test 1.30→1.31 churn was a no-source-change lockfile bump introduced by
accident; reverting eliminates the unrelated diff.

D-15: Add OpenClaw execution-locus note to the preset's install_hint.
Eva's finding: openclaw acp executes tools inside the Gateway daemon, not
in the Desktop process.  Desktop-injected BUZZ_* env vars reach the
openclaw harness process itself but do NOT automatically propagate to
the Gateway's execution environment.  The install_hint now surfaces this
caveat so users who need BUZZ_* credentials at execution time know they
must set them on the Gateway's own environment.

F8 (onboarding navigate test): New pure-logic test file
postOnboardingNav.test.mjs proves the App.tsx postOnboardingNav
useEffect predicate — navigateAfterComplete does not fire before
machine.stage reaches 'ready', fires exactly once on the ready
transition, is cleared after firing (no double-fire), fires immediately
if nav arrives while already ready, and carries the exact
{to: '/settings', search: {section: 'agents'}} shape from
MachineOnboardingFlow's navigateToAgentSettings action.

C-10 (e2eBridge + handler tests): Extract save_custom_harness /
delete_custom_harness handler logic into e2eBridgeCustomHarnesses.ts
(exported module-level functions + mockCustomHarnesses Map +
resetMockCustomHarnesses).  Wire the handlers into e2eBridge.ts:
  - mockCustomHarnesses imported and appended to discover_acp_providers
    results so saved custom harnesses appear in future discovery calls
  - case 'save_custom_harness' → handleSaveCustomHarness
  - case 'delete_custom_harness' → handleDeleteCustomHarness
New test file e2eBridgeCustomHarnesses.test.mjs (14 tests across 3
describe groups) proves: save → store, non-empty env preserved,
empty env absent, same-ID edit replaces, rename removes old + inserts
new, delete removes, delete idempotent, Map reference is shared.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

… delete-error knob

C-10 (full form — Playwright spec):
  Add desktop/tests/e2e/harness-management.spec.ts with 10 tests covering:
    - Preset gallery: detected badge present for available preset
    - Preset gallery: install link shown, no badge for not-installed preset
    - Add custom harness: form save → row appears in list
    - Edit preserves env vars: definitionEnv round-trip via edit form
    - Same-ID edit replaces row without duplication
    - Rename: old row gone, new row present
    - Delete success: row disappears
    - Delete failure: inline error shown, row kept (error-injection knob)
    - PATH badge on custom row: Detected badge when availability === 'available'
    - F8 onboarding navigate: setup-page More-harnesses click →
      completes onboarding → Settings → Agents (settings-harness-management)
      This exercises the real App.tsx effect that gates router.navigate()
      on machine.stage === 'ready', which postOnboardingNav.test.mjs cannot
      cover (it simulates the predicate, not the render path).

Delete-error injection knob:
  - Add deleteCustomHarnessError?: string to MockBridgeOptions in bridge.ts
  - Add same field to MockE2eConfig in e2eBridge.ts
  - Thread config through to handleDeleteCustomHarness so the e2e bridge
    throws when the knob is set (mirrors acpAuthMethodsError pattern)
  - Add unit test: throws when knob set + entry survives in store

D-15 (README execution-locus sentence, full placement):
  The install_hint placement (already in discovery.rs) is correct and stays.
  Add the missing sentence to the README blockquote at line 265 per the brief:
  Desktop-injected BUZZ_* env vars do NOT reach the execution locus unless
  set on the Gateway's own environment.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

Brings the branch up to date with origin/main (2a051a4) so CI and local
gates run against the tree that will actually merge. Requested as a merge
commit rather than a rebase to keep Duncan's authored history intact.

Two ratchet entries in desktop/scripts/check-file-sizes.mjs needed
composing, since both sides raised per-file ceilings from a shared base:

- src-tauri/src/commands/agent_discovery.rs — textual conflict. BYOH took
  1826 -> 2038 (+212); main #2767 took 1826 -> 1836 (+10). Resolved to
  2048 with both comment blocks kept, preserving the slack each side
  intended rather than discarding one growth.
- src-tauri/src/managed_agents/discovery.rs — no textual conflict, but the
  BYOH ceiling of 1715 predates main's +17 and the merged file is 1729
  lines, so the check failed on a clean auto-merge. Composed to 1732.

The overrides map is a ceiling (violation only when lineCount > limit), so
composing deltas is the resolution that matches the file's convention.

Verified on the merged tree: desktop file-size check clean, frontend suite
3554/3555 (the one failure is the pre-existing styled-qr-code 'Cannot find
package qrcode' local module-resolution fault, which fails identically on
pristine heads), presetLogos drift guard 10/10 with all 8 preset ids still
parsing out of main's modified discovery.rs, tsc --noEmit clean, biome
clean over 1640 files, just test-unit 5/5 crates, and desktop-tauri-test
1691/1691.

Co-authored-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>

Replace the incorrect Oh My Posh and Dify marks with the exact upstream Oh My Pi and Kimi Code assets. Use xAI’s official Grok logomark under its nominative brand terms, with presentation-only backgrounds for marks that need contrast.

Remove the unproven Cursor bitmap and deliberately retain the generic terminal fallback because Cursor publishes assets without granting redistribution permission. Record exact provenance and keep the drift guard explicit about that exception.

Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>

…lete coherence, registry races

Review fixes for the BYOH generic ACP harness PR (backend layer):

- Reject commas in harness args at validate_harness_definition, the
  shared boundary used by both save_custom_harness and the disk loader,
  so a definition that would corrupt the comma-joined agent_args wire
  format can neither be saved nor loaded.
- Dangling harness references (agent pins a deleted harness id) now
  resolve to a typed sentinel: summaries render 'harness (deleted): <id>'
  instead of silently falling back to buzz-agent, and spawn converts the
  sentinel to an actionable sentence via user_facing_harness_error.
- ManagedAgentSummary carries the record-level runtime pin so the UI can
  count referencing agents in the delete confirmation.
- Collision filtering moved into load_custom_harnesses so both loaders
  inherit preset-shadowing rules; discovery publishes the registry by
  re-reading the directory under persist_mutex (lock scoped to the
  publish only, never across auth probes), with deterministic
  interleaving tests for save-during-discovery and delete-during-discovery.
- load_global_agent_config hoisted out of build_managed_agent_summary
  into a parameter: one disk read per caller instead of per record.
- Cleanup: drop discarded sweep arg from buzz_sweep_owns_process, remove
  duplicated doc paragraph and stray SAFETY comment.
- De-flake grandchild PGID test: keep the process-group leader alive
  through the getpgid assertion with a trailing sleep.

Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>

…a-arg inline mirror

Frontend layer of the review fixes:

- installHint survives edit: form seeding extracted to
  formValuesFromCatalogEntry (single source of truth for edit
  initialization — every user-editable field must appear there), input
  rendered, and a lossless entry -> form -> save-payload round-trip
  regression covers the full definition, not one field at a time.
- Delete confirmation counts referencing agents (direct record pins plus
  persona-inherited runtime) and names the blast radius: 'N agents use
  this harness and will stop launching.' Queries only run while the
  confirmation is open.
- Comma-in-args rejection mirrored inline in the form with an error
  naming the offending argument; the authoritative gate stays in
  validate_harness_definition on the Rust side.
- ManagedAgent (TS) carries the record-level runtime pin; e2e bridge
  mirrors the native wire shape (key always present, null when unpinned).

Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>

Conflicts resolved in agent_models.rs / agent_models_tests.rs: main's #2890
(live Databricks discovery via effective_discovery_provider +
provider_env_var) composed with this branch's unified
resolve_effective_harness_descriptor. get_agent_models now passes the
record's saved provider plus the runtime's provider_env_var (from
known_acp_runtime on the descriptor command) into
effective_discovery_provider, replacing both main's
SavedAgentModelDiscoveryConfig snapshot and this branch's ad-hoc
BUZZ_AGENT_PROVIDER env read.

Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>

check-file-sizes ceilings composed with the review-fix growth (each entry
documents the delta and why it is load-bearing): agents.rs +47 (config
hoist + dangling-summary tests), custom_harnesses.rs +153 (shared
collision filter + mutex-scoped publish seam + comma validation + tests),
discovery.rs +13 (publish-under-mutex), discovery/tests.rs +90
(interleaving regressions), types.ts +6 (runtime pin field). Also one
biome optional-chain warning in the new form-logic test.

Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>

…outing (#2773)

Dawn's blocker: the loader-boundary collision/dedup enforcement was
untested — deleting either block left the full suite green. The stale
load_applies_id_collision_check only called check_id_collision directly
and its comment described the pre-fix architecture. Replaced with a
version that drives the REAL load_custom_harnesses against a shadowing
goose.json, plus a dedup twin (two files, same id -> len()==1). Both
verified to kill the mutants locally.

Wren's test-quality gap: the interleaving regressions pinned the
warm_harness_registry_locked seam but never executed discovery — a
stale-publish mutant of discover_acp_runtimes_from stayed green. Added
a cfg(test) pre_publish_test_hook between discovery's scan and its
registry publish, and two production-path regressions that land a
save/delete through the real discover_acp_runtimes_from call. Verified
both red under the stale-publish mutant.

Wren's product gap: the delete confirmation could be confirmed before
the blast-radius queries settled (pending queries rendered as zero
dependents with an enabled destructive button). New deleteConfirmState
drives the confirm UI: disabled + 'Checking which agents…' while
either query is initial-loading; on query failure deletion stays
possible but the copy says the count is unknown instead of claiming
zero. Unit-tested for pending/error/settled states.

Dawn + Wren both: get_agent_models now routes harness-resolution
errors through user_facing_harness_error (model_discovery_error
helper), so a dangling harness renders as a sentence, never the raw
DANGLING_HARNESS_ID sentinel. Also added Dawn's requested comment at
discovery's publish noting which tests pin the seam.

File-size ratchets bumped with documented deltas (all test/test-seam
growth).

Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>