The release pipeline never ran the compiled CLI, so a binary could ship
broken behind a green typecheck/test suite. Add an additive, Linux-only
cli-smoke job to test.yml that builds the single native binary
(packages/opencode/script/build.ts --single) and runs offline-only
checks against it:

- `opencode --version` must print a semver-like string (stdout)
- `opencode --help` must print recognizable output (stderr, exit 0)

No auth, provider calls, or network-dependent prompts. macOS/Windows
matrix and the config-layer validation phase are deliberate follow-ups.

Expand the cli-smoke job from Linux-only to a 3-OS matrix
(blacksmith ubuntu + windows, macos-26) with fail-fast:false so each OS
reports independently. Same offline-safe checks per leg: build the
current-platform binary (--single), then --version (semver) and --help.

Binary lookup now matches both `opencode` (Linux/macOS) and
`opencode.exe` (Windows).

The .opencode config-layer validation stays Linux-only for now
(if: runner.os == 'Linux') — widening it to macOS/Windows is a later
phase.

The existing migration tests cover each migration in isolation plus a
fresh apply() and the registry-staleness check (`migration.ts --check`),
but nothing proved the *whole* chain replays cleanly across versions.

Add a test that replays every tracked migration on an empty database via
applyOnly() — exactly the path an existing install upgrading across all
versions takes, with the newest (e.g. just-synced) migration applied last
on top of the N-1 state — and asserts:
- the migration table records all migrations.length entries
- the incremental result's table set matches a fresh apply() (schema.gen),
  so a synced migration that diverges from the declared schema is caught

In-memory SQLite, offline, runs under `bun turbo test` (so it's exercised
by both test.yml and the upstream-sync gate). Table-name comparison avoids
false positives from benign SQL formatting differences.

…e 5 of #307)

Releases were cut without running tests: release.yml (unguarded — the path
that actually runs on clouds-anr) and publish.yml (anomalyco-only, heavier
signed/electron/npm publish) both jumped straight to version + build.

Add an inline `tests` gate job to each that runs `bun turbo typecheck` and
`bun turbo test`, and make the `version` job (which creates the draft
GitHub release/tag) depend on it. Every build/sign/electron/publish job
already depends on `version`, so a red gate yields no tag, no binaries,
and no publish — failure() then also blocks publish.yml's always()-guarded
publish job.

- Direct job dependency, same checkout/commit — no fragile workflow_run
  cross-workflow polling.
- publish.yml's gate carries the same `github.repository == anomalyco`
  guard as its other jobs, so it stays a no-op on forks.
- Deliberately typecheck + turbo test only (no Playwright e2e or the
  multi-OS CLI smoke matrix) to keep release blocking deterministic.

Close the remaining #307 items:

- Phase 4 (desktop smoke): add a Linux-only `desktop-smoke` job to
  test.yml that runs the Electron app's main/renderer unit tests and an
  `electron-vite build`, proving the app builds without launching the
  packaged binary (launch needs a display server + signing — out of
  scope). Kept in its own job and NOT wired into `bun turbo test` so
  Electron flakiness can't destabilize the core gate. (Desktop has no
  `test` script for the same reason — a Windows path test would fail the
  shared windows leg.)
- Phase 9 (pre-push): .husky/pre-push now runs `bun turbo test --affected`
  after typecheck, so affected packages' tests run before a push.
- Phase 10 (docs): CONTRIBUTING.md documents the test/sync/release gates.

…#307)

The anr-core integration test asserted ANR touch-points at paths that an
upstream sync moved, so it was red on dev (masked previously because most
suites ran with --only-failures). Re-point to the current locations:

- cli/cmd/tui/worker.ts -> cli/tui/worker.ts (file existence + OTEL check)
- drop the cli/cmd/tui/context/quota.tsx existence check (file removed
  upstream); validate the quota feature where it now lives instead —
  index.ts runs checkQuota and exports quotaInfo for the TUI.

anr-core: 187 pass / 0 fail.

AWS_REGION from the CI runner environment (GovCloud credentials) took
priority over the commercial env file's OPENCODE_AWS_REGION, causing the
commercial parse test to return us-gov-west-1 instead of us-east-2.
clearStaleEnv() already deletes AWS_REGION from STALE_KEYS — calling it
in beforeEach gives each test a clean slate.

The SDK build runs `bun dev generate` to produce openapi.json.
detectANR() triggers because .opencode/.env.* files exist in the repo,
activating full OIDC auth which times out in CI (no browser).

`generate` is a build-time tool — like --help and --version it has no
need for authentication. Exempt it from ANR mode the same way.

@opencode-ai/web has no test script, but turbo v2 still computes
^build dependencies for it, scheduling opencode#build (the full binary
cross-compile) on every test run. Add a package-scoped task override
so @opencode-ai/web#test has no dependencies — matching its actual
NONEXISTENT command.

sync.tsx calls useExit() after the centralize-exit refactor (anomalyco#31524)
but the test fixture never added ExitProvider, causing all sync tests
to crash with "Exit context must be used within a context provider".

abbreviateHome used path.sep in the return value, which is '\' on
Windows, breaking the path display test on that platform.