@omega.js/desktop 0.53.0 → 0.54.1

package/dist/test/suites/build/build-workflow-jobs.test.js

@@ -122,8 +122,8 @@ module.exports = defineCases({
         ctx.expect(decode.run).toContain('if [ -n "${{ secrets.CSC_LINK }}" ]; then');
         ctx.expect(decode.run).toContain('if [ -n "${{ secrets.APPLE_API_KEY }}" ]; then');
         // The standalone verb is gone (#891): the deploy precheck pushes them.
-        ctx.expect(decode.run).toContain('No CSC_LINK secret: run omega deploy from targets/desktop');
-        ctx.expect(decode.run).toContain('No APPLE_API_KEY secret: run omega deploy from targets/desktop');
+        ctx.expect(decode.run).toContain('No CSC_LINK secret: run omega deploy at the brand root');
+        ctx.expect(decode.run).toContain('No APPLE_API_KEY secret: run omega deploy at the brand root');
         ctx.expect(decode.run).not.toContain('push-secrets');
         ctx.expect(decode.run.match(/exit 1/g).length).toBe(2);
         ctx.expect(decode.run).not.toContain('this build will not be signed');

package/dist/test/suites/build/cli.test.js

@@ -145,6 +145,34 @@ module.exports = defineCases({
         }
       },
     },
+    {
+      name: 'update: --dry-run reaches devkit runUpdate as dryRun, and a bare run installs',
+      run: async (ctx) => {
+        const devkitUpdate = require('../../../vendor/devkit/update.js');
+        const { BOOLEAN_FLAGS } = require(path.join(root, 'dist', 'cli-run.js'));
+        const { parseArgv } = require('../../../vendor/devkit/argv.js');
+        const commandFile = path.join(root, 'dist', 'commands', 'update.js');
+
+        // The command destructures runUpdate at load, so the stub lands before a fresh require
+        async function run(args) {
+          const original = devkitUpdate.runUpdate;
+          const seen = [];
+          devkitUpdate.runUpdate = async (options) => { seen.push(options); };
+          delete require.cache[commandFile];
+          try {
+            await require(commandFile)(parseArgv(args, { booleans: BOOLEAN_FLAGS }));
+          } finally {
+            devkitUpdate.runUpdate = original;
+            delete require.cache[commandFile];
+          }
+          ctx.expect(seen.length).toBe(1);
+          return seen[0];
+        }
+
+        ctx.expect((await run(['update', '--dry-run'])).dryRun).toBe(true);
+        ctx.expect(Boolean((await run(['update'])).dryRun)).toBe(false);
+      },
+    },
     {
       name: 'mirrored aliases: -t routes to test, -d routes to deploy (wave-6 D6)',
       run: (ctx) => {

package/dist/test/suites/build/defaults-em-dash.test.js

@@ -0,0 +1,22 @@
+// Every defaults file is copied into a consumer's repo, whose own guard may
+// refuse an em dash (U+2014) at commit time. So no defaults file carries one.
+
+const path = require('path');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+const { dashedFiles } = require('../../../vendor/devkit/test/dashed-files.js');
+
+const DEFAULTS = path.join(__dirname, '..', '..', '..', 'defaults');
+
+module.exports = defineCases({
+  type: 'group',
+  layer: 'build',
+  description: 'defaults tree carries no em dash',
+  tests: [
+    {
+      name: 'no defaults file carries an em dash',
+      run: (ctx) => {
+        ctx.expect(dashedFiles(DEFAULTS)).toEqual([]);
+      },
+    },
+  ],
+});

package/dist/test/suites/build/defaults-scaffold.test.js

@@ -34,10 +34,11 @@ module.exports = defineCases({
         // .env and every verb delivers them.
         ctx.expect(jetpack.exists(path.join(tmp, '.env'))).toBe(false);
         ctx.expect(jetpack.exists(path.join(tmp, '.gitignore'))).toBeTruthy();
-        // The agent-docs chain (#63): AGENTS.md carries the content, CLAUDE.md is
-        // the one-line `@AGENTS.md` pointer.
-        ctx.expect(jetpack.read(path.join(tmp, 'AGENTS.md'))).toContain('node_modules/@omega.js/AGENTS.md');
-        ctx.expect(jetpack.read(path.join(tmp, 'CLAUDE.md')).trim()).toBe('@AGENTS.md');
+        // A standalone project root gets the same AGENTS.md a brand root does:
+        // the manager import under Default, its notes under Custom. Claude Code reads
+        // AGENTS.md natively, so no CLAUDE.md scaffolds beside it.
+        ctx.expect(jetpack.read(path.join(tmp, 'AGENTS.md'))).toBe('<!-- ========== Default Values ========== -->\n@node_modules/@omega.js/manager/AGENTS.md\n\n<!-- ========== Custom Values ========== -->\n');
+        ctx.expect(jetpack.exists(path.join(tmp, 'CLAUDE.md'))).toBe(false);
         ctx.expect(jetpack.exists(path.join(tmp, '_mas'))).toBe(false);
         // `_`-prefixed FILENAMES are not archives — test/_init.js ships.
         ctx.expect(jetpack.exists(path.join(tmp, 'test', '_init.js'))).toBeTruthy();
@@ -213,6 +214,20 @@ module.exports = defineCases({
         ctx.expect(jetpack.exists(path.join(targetDir, 'config', 'omega.json5'))).toBe(false);
       },
     },
+    {
+      name: 'an old-template AGENTS.md converges, keeping the consumer notes under the Custom marker',
+      run: async (ctx) => {
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-defaults-'));
+        jetpack.write(path.join(tmp, 'AGENTS.md'),
+          `${DEFAULT_MARKER}\n# OMEGA Desktop consumer project\nframework guidance\n\n${CUSTOM_MARKER}\n\n## Project-specific notes\n\nAdd anything specific to THIS project here. Edits below this line are preserved across framework re-syncs.\n\nOur deploy needs the VPN up.\n`);
+        const warnings = [];
+        const applied = await copyDefaults(tmp, { log: () => {}, warn: (m) => warnings.push(m), error: () => {} });
+
+        ctx.expect(jetpack.read(path.join(tmp, 'AGENTS.md'))).toBe('<!-- ========== Default Values ========== -->\n@node_modules/@omega.js/manager/AGENTS.md\n\n<!-- ========== Custom Values ========== -->\nOur deploy needs the VPN up.\n');
+        ctx.expect(applied.merged.includes('AGENTS.md')).toBe(true);
+        ctx.expect(warnings.some((m) => m.includes('Converged AGENTS.md'))).toBe(true);
+      },
+    },
     {
       name: 'brand target scaffolds NO per-target docs (brand doc unification: the brand root is the doc home)',
       run: async (ctx) => {
@@ -240,7 +255,6 @@ module.exports = defineCases({
         // Standalone scaffold first (no brand config yet) — per-target docs land.
         await copyDefaults(targetDir);
         ctx.expect(jetpack.exists(path.join(targetDir, 'AGENTS.md'))).toBeTruthy();
-        ctx.expect(jetpack.exists(path.join(targetDir, 'CLAUDE.md'))).toBeTruthy();
 
         // Wrap it in a brand monorepo: the next setup sweeps the untouched docs.
         jetpack.write(path.join(tmp, 'brand', 'config', 'omega.json5'), "{ brand: { id: 'acme', name: 'Acme' } }\n");

package/dist/test/suites/build/deploy-direct.test.js

@@ -26,10 +26,10 @@ const COMMANDS = path.join(__dirname, '..', '..', '..', 'commands');
 const DEPLOY = path.join(COMMANDS, 'deploy.js');
 const WORKFLOW = path.join(__dirname, '..', '..', '..', 'defaults', '.github', 'workflows', 'build.yml');
 
-// The scripts every target gets from the scaffold, read from the one place that
-// declares them: expanding the workflow's command through THESE is what ties
+// The scripts every target gets from the scaffold, derived the one way the
+// scaffold derives them: expanding the workflow's command through THESE is what ties
 // the runner's step to the verb this laptop runs.
-const SCRIPTS = require(path.join(__dirname, '..', '..', '..', '..', 'package.json')).projectScripts;
+const SCRIPTS = require('../../../vendor/devkit/verb-scripts.js').projectScripts(require(path.join(__dirname, '..', '..', '..', '..', 'package.json')));
 
 const { directPlatform } = require(DEPLOY);
 
@@ -147,6 +147,7 @@ module.exports = defineCases({
         const resolved = require.resolve(DEPLOY);
         const cached = require.cache[resolved];
         delete require.cache[resolved];
+        const restoreTee = attachLogFile.mark();
 
         try {
           const deploy = require(resolved);
@@ -159,7 +160,7 @@ module.exports = defineCases({
           ctx.expect(ran).toEqual(['ensure-target']);
         } finally {
           // The verb tees this process' writers now (#873): hand them back.
-          attachLogFile.detach();
+          restoreTee();
           for (const restore of restores) restore();
           if (cached) require.cache[resolved] = cached;
           else delete require.cache[resolved];
@@ -206,6 +207,7 @@ module.exports = defineCases({
         const resolved = require.resolve(DEPLOY);
         const cached = require.cache[resolved];
         delete require.cache[resolved];
+        const restoreTee = attachLogFile.mark();
 
         try {
           const deploy = require(resolved);
@@ -229,7 +231,7 @@ module.exports = defineCases({
           ctx.expect(script.split(' ').filter((word) => word.startsWith('--'))).toEqual(['--local']);
         } finally {
           // The verb tees this process' writers now (#873): hand them back.
-          attachLogFile.detach();
+          restoreTee();
           deployRecord.recordDeploy = recordDeploy;
           for (const restore of restores) restore();
           if (cached) require.cache[resolved] = cached;

package/dist/test/suites/build/deploy-dispatch.test.js

@@ -108,6 +108,7 @@ async function runRelease(follower, options = {}, token = {}) {
   else process.env.GH_TOKEN = envToken;
   process.chdir(targetDir);
   delete require.cache[require.resolve(RELEASE)];
+  const restoreTee = attachLogFile.mark();
 
   let error = null;
   try {
@@ -117,7 +118,7 @@ async function runRelease(follower, options = {}, token = {}) {
   } finally {
     // The verb tees this process' writers: hand them back before the next
     // suite prints through a fixture that is about to be gone.
-    attachLogFile.detach();
+    restoreTee();
     console.log = previousLog;
     process.chdir(previousCwd);
     if (previousToken === undefined) delete process.env.GH_TOKEN;

package/dist/test/suites/build/deploy-hook.test.js

@@ -69,6 +69,7 @@ async function runDeploy(options) {
   const origCwd = process.cwd();
 
   delete require.cache[resolved];
+  const restoreTee = attachLogFile.mark();
   global.__omegaDeployHookRan = ran;
 
   try {
@@ -80,7 +81,7 @@ async function runDeploy(options) {
     return ran;
   } finally {
     // The verb tees this process' writers now (#873): hand them back.
-    attachLogFile.detach();
+    restoreTee();
     process.chdir(origCwd);
     delete global.__omegaDeployHookRan;
     for (const restore of restores) restore();
@@ -116,6 +117,7 @@ async function runDriftedDeploy() {
   const origCwd = process.cwd();
 
   delete require.cache[resolved];
+  const restoreTee = attachLogFile.mark();
 
   try {
     const deploy = require(resolved);
@@ -124,7 +126,7 @@ async function runDriftedDeploy() {
     return ran;
   } finally {
     // The verb tees this process' writers now (#873): hand them back.
-    attachLogFile.detach();
+    restoreTee();
     process.chdir(origCwd);
     for (const restore of restores) restore();
     if (cached) require.cache[resolved] = cached;

package/dist/test/suites/build/dev-verb.test.js

@@ -0,0 +1,67 @@
+// Build-layer tests for the `dev` verb, what the target's `start` script runs:
+// clean, then the gulp default task (build, then launch electron), with the
+// `--` flags it was given forwarded to the gulp lane. No build-mode flag, and
+// never a shell-out back to `npm start` (that script IS this verb).
+
+const path = require('path');
+const fs   = require('fs');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const SRC      = path.join(__dirname, '..', '..', '..');
+const pipeline = require(path.join(SRC, 'utils', 'build-pipeline.js'));
+const dev      = require(path.join(SRC, 'commands', 'dev.js'));
+
+const stepsOf = (plan) => plan.steps.map((s) => (s.task ? `${s.type}:${s.task}` : s.type));
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'dev verb: clean, then the gulp default task',
+  tests: [
+    {
+      name: 'dev: clean → gulp default, no build-mode flag',
+      run: (ctx) => {
+        const plan = dev.plan({}, []);
+        ctx.expect(stepsOf(plan)).toEqual(['clean', 'gulp:default']);
+        ctx.expect(plan.env.OMEGA_BUILD_MODE).toBe(undefined);
+      },
+    },
+    {
+      name: 'dev forwards its `--` flags to the gulp lane (`npm start -- --remote-debugging-port=9222`)',
+      run: (ctx) => {
+        const plan = dev.plan({}, ['dev', '--remote-debugging-port=9222', 'stray', '--debug']);
+        ctx.expect(plan.steps[1].args).toEqual(['--remote-debugging-port=9222', '--debug']);
+        ctx.expect(pipeline.gulpCommand('default', plan.steps[1].args))
+          .toBe('npm run gulp -- default --remote-debugging-port=9222 --debug');
+      },
+    },
+    {
+      name: 'runPipeline runs the dev plan in order and leaves the build-mode flag unset',
+      run: async (ctx) => {
+        const log = [];
+        const record = (type) => (options, step) => { log.push(step.task ? `${type}:${step.task}` : type); };
+        const previous = process.env.OMEGA_BUILD_MODE;
+        delete process.env.OMEGA_BUILD_MODE;
+        try {
+          await pipeline.runPipeline(dev.plan({}, []), {}, { clean: record('clean'), gulp: record('gulp') });
+          ctx.expect(process.env.OMEGA_BUILD_MODE).toBe(undefined);
+        } finally {
+          if (previous !== undefined) process.env.OMEGA_BUILD_MODE = previous;
+        }
+        ctx.expect(log).toEqual(['clean', 'gulp:default']);
+      },
+    },
+    {
+      name: 'the CLI answers dev and its aliases, and the verb never shells back to `npm start`',
+      run: (ctx) => {
+        const { aliases } = require(path.join(SRC, 'cli.js')).config;
+        ctx.expect(aliases.dev).toEqual(['serve', 'start', '--dev']);
+
+        const source = fs.readFileSync(path.join(SRC, 'commands', 'dev.js'), 'utf8')
+          .replace(/\/\/[^\n]*/g, '')
+          .replace(/\/\*[\s\S]*?\*\//g, '');
+        ctx.expect(/npm (run )?start/.test(source)).toBe(false);
+      },
+    },
+  ],
+});

package/dist/test/suites/build/ensure-target.test.js

@@ -67,7 +67,7 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'refuses a workspace root, loudly, without writing a single file (#699)',
+      name: 'refuses a workspace root, loudly, leaving its AGENTS.md and .gitignore byte-identical (#699, #973)',
       run: async (ctx) => {
         // The accident: `omega deploy` at a workspace root scaffolded a whole
         // desktop target into it — gulpfile, src/, hooks/, workflows, rewritten
@@ -78,6 +78,12 @@ module.exports = defineCases({
         manifest.workspaces = ['packages/*'];
         jetpack.write(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
         const before = jetpack.read(manifestPath);
+        // A root's hand-authored AGENTS.md and .gitignore are what the marker
+        // merge rewrites in place: `#` headings and blank lines are its comments.
+        const agentsDoc = '# Monorepo\n\n## HARD RULES\n\n1. Rule one.\n';
+        const ignoreFile = '# Dependencies\nnode_modules/\n\n# Scratch\n.temp/\n';
+        jetpack.write(path.join(tmp, 'AGENTS.md'), agentsDoc);
+        jetpack.write(path.join(tmp, '.gitignore'), ignoreFile);
 
         try {
           let refusal = null;
@@ -92,9 +98,11 @@ module.exports = defineCases({
           ctx.expect(refusal.message).toMatch(/declares "workspaces"/);
           ctx.expect(refusal.message.includes(tmp)).toBe(true);
 
-          // Nothing scaffolded, and the manifest is byte-identical.
-          ctx.expect(jetpack.list(tmp)).toEqual(['package.json']);
+          // Nothing scaffolded, and every root file is byte-identical.
+          ctx.expect(jetpack.list(tmp).sort()).toEqual(['.gitignore', 'AGENTS.md', 'package.json']);
           ctx.expect(jetpack.read(manifestPath)).toBe(before);
+          ctx.expect(jetpack.read(path.join(tmp, 'AGENTS.md'))).toBe(agentsDoc);
+          ctx.expect(jetpack.read(path.join(tmp, '.gitignore'))).toBe(ignoreFile);
         } finally {
           fs.rmSync(tmp, { recursive: true, force: true });
         }

package/dist/test/suites/build/merge-line-files.test.js

@@ -222,17 +222,17 @@ ${CUSTOM_MARKER}
       },
     },
     {
-      name: 'normalizeEnvLine: empty value stays unquoted',
+      name: 'normalizeEnvLine: an empty value becomes KEY=""',
       run: (ctx) => {
-        ctx.expect(normalizeEnvLine('KEY=')).toBe('KEY=');
-        ctx.expect(normalizeEnvLine('KEY=   ')).toBe('KEY=');
+        ctx.expect(normalizeEnvLine('KEY=')).toBe('KEY=""');
+        ctx.expect(normalizeEnvLine('KEY=   ')).toBe('KEY=""');
       },
     },
     {
-      name: 'normalizeEnvLine: escapes embedded double quotes and backslashes',
+      name: 'normalizeEnvLine: keeps embedded quotes and backslashes as dotenv reads them',
       run: (ctx) => {
-        ctx.expect(normalizeEnvLine('KEY=he said "hi"')).toBe('KEY="he said \\"hi\\""');
-        ctx.expect(normalizeEnvLine('KEY=back\\slash')).toBe('KEY="back\\\\slash"');
+        ctx.expect(normalizeEnvLine('KEY=he said "hi"')).toBe('KEY="he said "hi""');
+        ctx.expect(normalizeEnvLine('KEY=back\\slash')).toBe('KEY="back\\slash"');
       },
     },
     {

package/dist/test/suites/build/migrate.test.js

@@ -0,0 +1,29 @@
+// migrateTarget: the desktop leg of the brand root's `omega migrate`. Desktop
+// carries no legacy move today, yet exposes the same entry as every framework,
+// so the manager's walk never special-cases a framework name.
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+const SRC = path.join(__dirname, '..', '..', '..');
+const { migrateTarget } = require(path.join(SRC, 'commands', 'lib', 'migrate.js'));
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  type: 'group',
+  layer: 'build',
+  description: 'migrateTarget: the desktop leg answers the shared shape, empty',
+  tests: [
+    {
+      name: 'report mode and execute both answer three empty lists',
+      run: (ctx) => {
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-migrate-'));
+
+        ctx.expect(migrateTarget(tmp)).toEqual({ due: [], changed: [], errors: [] });
+        ctx.expect(migrateTarget(tmp, { execute: true })).toEqual({ due: [], changed: [], errors: [] });
+        ctx.expect(fs.readdirSync(tmp)).toEqual([]);
+      },
+    },
+  ],
+});

package/dist/test/suites/build/project-scripts-deps.test.js

@@ -13,6 +13,7 @@
 const path = require('path');
 const fs = require('fs');
 const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+const { projectScripts } = require('../../../vendor/devkit/verb-scripts.js');
 
 module.exports = defineCases({
   type: 'suite',
@@ -26,7 +27,7 @@ module.exports = defineCases({
         const peers = pkg.peerDependencies || {};
 
         const tools = new Set();
-        for (const script of Object.values(pkg.projectScripts || {})) {
+        for (const script of Object.values(projectScripts(pkg))) {
           for (const match of String(script).matchAll(/npx\s+([a-z0-9@/_-]+)/g)) {
             const tool = match[1];
             if (tool !== 'omega' && !tool.startsWith('@omega.js/')) {
@@ -44,7 +45,7 @@ module.exports = defineCases({
       name: 'the build-mode env flags live in the CLI verbs, not in the scaffolded scripts',
       run: (ctx) => {
         const pkg = require(path.join(__dirname, '..', '..', '..', '..', 'package.json'));
-        const scripts = pkg.projectScripts || {};
+        const scripts = projectScripts(pkg);
 
         for (const script of Object.values(scripts)) {
           ctx.expect(String(script).includes('cross-env')).toBe(false);
@@ -58,7 +59,9 @@ module.exports = defineCases({
         ctx.expect(scripts.build).toBe('omega build');
         ctx.expect(scripts.package).toBe('omega package');
         ctx.expect(scripts['package:quick']).toBe('omega package --quick');
-        ctx.expect(scripts.publish).toBe('omega publish');
+        // A single-target command is the CLI's, reached from the brand root, never a script
+        ctx.expect(scripts.publish).toBe(undefined);
+        ctx.expect(scripts.release).toBe(undefined);
         ctx.expect(scripts['release:local']).toBe('omega publish --local');
       },
     },
@@ -79,12 +82,5 @@ module.exports = defineCases({
         ctx.expect(source.includes('cross-env')).toBe(false);
       },
     },
-    {
-      name: 'ensure-target syncs projectScripts unconditionally — consumers heal on the next verb',
-      run: (ctx) => {
-        const source = fs.readFileSync(path.join(__dirname, '..', '..', '..', 'commands', 'lib', 'ensure-target.js'), 'utf8');
-        ctx.expect(/project\.scripts\[key\] = package\.projectScripts\[key\]/.test(source)).toBe(true);
-      },
-    },
   ],
 });

package/dist/test/suites/build/runner-env-write.test.js

@@ -0,0 +1,73 @@
+// runner-env-write tests: the box .env writer rewrites a key in place, one line
+// per key, and every case runs against its own temp home, never the box's.
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const jetpack = require('fs-jetpack');
+const runnerEnv = require('../../../utils/runner-env.js');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  type: 'group',
+  layer: 'build',
+  description: 'runner-env writeRunnerEnvValues',
+  tests: [
+    {
+      name: 'a write replaces every line assigning the key, a placeholder above a set line included',
+      run: (ctx) => {
+        // dotenv reads a key's LAST line, so a later line left behind would
+        // win over the new value and the read-back would refuse the write.
+        const home = fs.mkdtempSync(path.join(os.tmpdir(), 'omega-runner-home-'));
+        try {
+          jetpack.write(path.join(home, '.env'), '# GH_TOKEN=""\nGH_TOKEN="old"\nSIGNTOOL_PATH="s"\n');
+          runnerEnv.writeRunnerEnvValues(home, { GH_TOKEN: 'new' });
+
+          const written = jetpack.read(path.join(home, '.env'));
+          ctx.expect((written.match(/^\s*#?\s*GH_TOKEN\s*=/gm) || []).length).toBe(1);
+          ctx.expect(written).toContain('SIGNTOOL_PATH="s"');
+          const back = {};
+          runnerEnv.loadRunnerEnv({ home, env: back });
+          ctx.expect(back.GH_TOKEN).toBe('new');
+        } finally {
+          jetpack.remove(home);
+        }
+      },
+    },
+    {
+      name: 'a write replaces a later export or indented assignment of the key',
+      run: (ctx) => {
+        for (const later of ['export GH_TOKEN="b"', '  GH_TOKEN="b"']) {
+          const home = fs.mkdtempSync(path.join(os.tmpdir(), 'omega-runner-home-'));
+          try {
+            jetpack.write(path.join(home, '.env'), `GH_TOKEN="a"\n${later}\n`);
+            runnerEnv.writeRunnerEnvValues(home, { GH_TOKEN: 'new' });
+
+            const written = jetpack.read(path.join(home, '.env'));
+            ctx.expect((written.match(/^\s*(?:export\s+)?GH_TOKEN\s*=/gm) || []).length).toBe(1);
+            const back = {};
+            runnerEnv.loadRunnerEnv({ home, env: back });
+            ctx.expect(back.GH_TOKEN).toBe('new');
+          } finally {
+            jetpack.remove(home);
+          }
+        }
+      },
+    },
+    {
+      name: 'a write replaces a multi-line quoted value whole',
+      run: (ctx) => {
+        const home = fs.mkdtempSync(path.join(os.tmpdir(), 'omega-runner-home-'));
+        try {
+          jetpack.write(path.join(home, '.env'), 'GH_TOKEN="first\nsecond"\nSIGNTOOL_PATH="s"\n');
+          runnerEnv.writeRunnerEnvValues(home, { GH_TOKEN: 'new' });
+
+          const written = jetpack.read(path.join(home, '.env'));
+          ctx.expect(written).toBe('GH_TOKEN="new"\nSIGNTOOL_PATH="s"\n');
+        } finally {
+          jetpack.remove(home);
+        }
+      },
+    },
+  ],
+});

package/dist/test/suites/build/runner.test.js

@@ -1279,16 +1279,17 @@ module.exports = defineCases({
           ctx.expect(back.WIN_CSC_KEY_PASSWORD).toBe('p in spaces #1');
           ctx.expect(back.NEW_KEY).toBe('appended');
 
-          // A value carrying a double quote cannot be written at all — dotenv
-          // has no escape for it — so it is refused naming the key and the char.
+          // A `"` is written raw and reads back whole. A quote followed by # would
+          // not, so it is refused naming the key, never the value, file untouched.
+          runnerEnv.writeRunnerEnvValues(home, { WIN_CSC_KEY_PASSWORD: 'p in "quotes"' });
+          delete back.WIN_CSC_KEY_PASSWORD;
+          runnerEnv.loadRunnerEnv({ home, env: back });
+          ctx.expect(back.WIN_CSC_KEY_PASSWORD).toBe('p in "quotes"');
           let refused;
-          try {
-            runnerEnv.writeRunnerEnvValues(home, { WIN_CSC_KEY_PASSWORD: 'p in "quotes"' });
-          } catch (e) { refused = e; }
-          ctx.expect(refused).toBeDefined();
+          try { runnerEnv.writeRunnerEnvValues(home, { WIN_CSC_KEY_PASSWORD: 'p "x" #tail' }); } catch (e) { refused = e; }
           ctx.expect(refused.message).toContain('WIN_CSC_KEY_PASSWORD');
-          ctx.expect(refused.message).toContain('"');
-          ctx.expect(jetpack.read(path.join(home, '.env'))).toContain('WIN_CSC_KEY_PASSWORD="p in spaces #1"');
+          ctx.expect(refused.message).not.toContain('#tail');
+          ctx.expect(jetpack.read(path.join(home, '.env'))).toContain('WIN_CSC_KEY_PASSWORD="p in "quotes""');
         } finally {
           jetpack.remove(home);
         }

package/dist/test/suites/build/setup-scripts.test.js

@@ -12,6 +12,7 @@ const path = require('path');
 const fs   = require('fs');
 const os   = require('os');
 const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+const { verbScripts } = require('../../../vendor/devkit/verb-scripts.js');
 
 const SRC        = path.join(__dirname, '..', '..', '..');
 const SETUP_PATH = path.join(SRC, 'commands', 'lib', 'ensure-target.js');
@@ -134,6 +135,32 @@ module.exports = defineCases({
         }
       },
     },
+    {
+      name: 'the verb scripts derive from the verb table, `start` among them',
+      run: async (ctx) => {
+        const tmp = stageProject(CONSUMER_PKG);
+
+        try {
+          await inProject(tmp, async (setup) => {
+            setup.setupScripts();
+
+            const { scripts } = JSON.parse(fs.readFileSync(path.join(tmp, 'package.json'), 'utf8'));
+            const derived = verbScripts('@omega.js/desktop');
+            for (const [verb, command] of Object.entries(derived)) {
+              ctx.expect(scripts[verb]).toBe(command);
+            }
+            ctx.expect(scripts.start).toBe('omega dev');
+            ctx.expect(scripts.gulp).toBe('gulp');
+
+            // No verb script is typed by hand: the manifest declares only what the table cannot derive
+            const declared = require(path.join(SRC, '..', 'package.json')).projectScripts;
+            ctx.expect(Object.keys(declared).filter((key) => key in derived)).toEqual([]);
+          });
+        } finally {
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
     {
       name: 'a target still carrying the `npx omega` spelling heals to the bare verb (#748)',
       run: async (ctx) => {

package/dist/test/suites/build/validate-config.test.js

@@ -48,8 +48,8 @@ module.exports = defineCases({
       name: 'desktop refinements apply only with target: desktop',
       run: (ctx) => {
         const cfg = { ...VALID, startup: { mode: 'tray-only' } };
-        // Without a target, startup.mode is just an unknown key — silent.
-        ctx.expect(validateConfig(cfg).errors).toEqual([]);
+        // Without a target, startup.mode is a key nobody declared: the strict schema names it.
+        ctx.expect(validateConfig(cfg).errors.map((e) => e.split(' ')[0])).toEqual(['config.startup.mode']);
         // With the desktop target, the enum refinement fires.
         const { errors } = validateConfig(cfg, { target: 'desktop' });
         ctx.expect(errors.some((e) => e.includes('startup.mode') && e.includes('not allowed'))).toBe(true);
@@ -70,6 +70,17 @@ module.exports = defineCases({
         ctx.expect(errors.some((e) => e.includes('looks like a secret'))).toBe(true);
       },
     },
+    {
+      // The boot (main.js) and the audit validate a BAKED config, which carries
+      // the build facts; only `decorated: true` declares them.
+      name: 'a baked config passes as decorated, and its build facts fail an authored load',
+      run: (ctx) => {
+        const baked = { ...VALID, runtime: 'electron', environment: 'production', version: '1.0.0', buildTime: 1, target: 'desktop' };
+        ctx.expect(validateConfig(baked, { target: 'desktop', decorated: true }).errors).toEqual([]);
+        const authored = validateConfig(baked, { target: 'desktop' }).errors.map((e) => e.split(' ')[0]);
+        ctx.expect(authored).toEqual(['config.runtime', 'config.environment', 'config.version', 'config.buildTime', 'config.target']);
+      },
+    },
     {
       name: 'formatErrors renders a numbered block',
       run: (ctx) => {

package/dist/test/suites/build/verb-logs.test.js

@@ -10,6 +10,10 @@
 const path = require('path');
 const fs   = require('fs');
 const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+const { runTestVerbUnderOuterTee } = require('../../../vendor/devkit/test/run-verb-under-tee.js');
+
+const COMMANDS = path.join(__dirname, '..', '..', '..', 'commands');
+const PREFIX = 'desktop-test-verb-';
 
 module.exports = defineCases({
   type: 'suite',
@@ -39,5 +43,21 @@ module.exports = defineCases({
         ctx.expect(line).toBe(marker);
       },
     },
+    {
+      // The verb takes off only the layer its own attach pushed: a declined
+      // attach pushes none, and a blind pop would eat the tee underneath.
+      name: 'a verb whose attach declined leaves the outer tee receiving (no-match exit)',
+      run: async (ctx) => {
+        const { outer } = await runTestVerbUnderOuterTee({ commands: COMMANDS, prefix: PREFIX, positionals: ['project:does-not-exist'] });
+        ctx.expect(outer.includes('after the verb')).toBe(true);
+      },
+    },
+    {
+      name: 'a verb whose attach declined leaves the outer tee receiving (green exit)',
+      run: async (ctx) => {
+        const { outer } = await runTestVerbUnderOuterTee({ commands: COMMANDS, prefix: PREFIX, positionals: [] });
+        ctx.expect(outer.includes('after the verb')).toBe(true);
+      },
+    },
   ],
 });

package/dist/test/suites/renderer/window-desktop-surface.test.js

@@ -49,7 +49,7 @@ module.exports = defineCases({
     },
     {
       // wave-5 F4: ipc.on used to return ipcRenderer (stripped to a useless
-      // object across the contextBridge) — docs/ipc.md promises an unsubscribe fn.
+      // object across the contextBridge) — docs/desktop/ipc.md promises an unsubscribe fn.
       name: 'ipc.on returns an unsubscribe function (docs contract)',
       run: (ctx) => {
         const off = window.desktop.ipc.on('omega-test:noop-channel', () => {});