tenant.openagents/omega

Decide the first launch, and photograph disclosure after a real restart

Decide the first launch, and photograph disclosure after a real restart omega#76 and omega#77 were each one observation short, and the two observations were different in kind: one was a question nobody had the standing to answer, the other was a picture nobody had taken. OMEGA-DELTA-0040 — a first-ever launch lands on identity onboarding, and finishing it opens the front door. The owner decided the ordering: Omega is identity-first, omega#9's packet exists to put identity before editor setup, and an agent thread before an identity would invert it. The decision is recorded rather than applied silently, and the owner may veto it. What is *tested* is the thing the decision rests on, because "onboarding first" and "onboarding instead" are the same picture on a first launch and completely different products on the second: `restore_or_create_workspace` waits on `await_identity_ready` before it opens anything, the first-run arm of `on_finish` closes its own window and releases that wait, and `release_identity_waiters` completes the channel the startup path is parked on. Each link fails silently on its own — delete the middle one and setup completes into a launchpad that never becomes an agent, which no check on the front door alone can see. The first-run arm is sliced out before the assertion, because `on_finish` releases the waiters on both journeys and a whole-function check would stay green on the editor-setup copy of the same call. Abandoning onboarding is a dead end in that launch, and it is written down under "what this does not cover" rather than fixed here. Closing the page calls `onboarding_closed`, which clears a flag and does not complete the startup channel, so nothing ever opens behind it. Relaunching shows onboarding again and nothing is lost but the session; refusing to continue without an identity is the identity-first posture working. Whether that page should be closeable at all is omega#9's surface, not this packet's. `the_new_thread_chord_is_window_global` closes omega#76's other exit clause under OMEGA-DELTA-0013. The chord is asserted bound window-globally to `agent::NewThread` in all three default keymaps — editor, welcome and panel are all inside `Workspace`, which is what "from every context" means — and every narrower binding of it is checked against an allowlist. There is no editor-context collision to fix on macOS: upstream's `editor::SelectToBeginningOfLine` is on `ctrl-shift-a`, a different chord. The bindings that do shadow it are two modal pickers and, on Linux and Windows, a terminal's select-all; they are admitted by name, so a *new* shadow fails instead of quietly making the chord focus-dependent again. omega#77's restart, observed rather than expected. The previous lane demonstrated a real relaunch for the native kind and said plainly that the `codex-acp` and engine-lane kinds after a restart were unobserved, and that "the mechanism is shared, so I expect them to hold" is not the standard the issue set. `script/omega-visual-proof` now runs **two processes** over one data directory. The first captures what it captured before and then leaves behind what a relaunch would find: the correlation journal, in its production schema, at its production path. The second is a genuinely cold process — it asserts it knows no lane run *before* it reads the journal, reloads through the same function `omega_effectd_host_handler` calls at startup, and photographs the executor line it derives for both threads. Each reopened thread is asserted to be the *same* `ThreadId` the first process wrote, because a new thread wearing the same content proves nothing about a restart, and each rendered line is asserted equal to the line the process that owned the thread rendered — not merely plausible. Nine captures now, all at 100.00% and 0 differing pixels against their baselines. The runner's failure print moves from `{}` to `{:#}`: every failure here is wrapped in the suite's name, and `{}` printed the wrapper and nothing else, so a run that failed on a restored record naming the wrong run reported only "omega_agent_surfaces". Falsified, each aimed at the code path the proof actually traverses. Deleting the first-run `release_identity_waiters` fails the handoff check while the editor-setup copy remains — the whole-function check that would have passed is why the arm is sliced. Removing the `await_identity_ready` gate fails it the other way. Shadowing the chord with an `Editor`-context binding fails the keymap check by name. Stopping the restart edge from republishing leaves phase 1 green and fails phase 2 with "the reloaded journal does not name ...". Reopening under a fresh id leaves phase 1 green and fails phase 2 with "a new thread wearing the same content proves nothing about a restart". Every falsification edit was asserted to match before it was applied, so none of them could no-op into a green run. Numbers moved twice under this lane: `origin/main` gained 0036 through 0039 between the first draft and the commit, so this is 0040, re-checked against `origin/main` immediately before committing rather than allocated once and trusted. Release Notes: - N/A