Finish native window, menu, and dialog workflows

Start by reproducing the recorded Open Folder failure: a signed, isolated Ace build from main, the existing Cmd+O path, and the main window overlapping the native picker. Compare the desktop_focus timeout, the desktop_key refusal with no focused control, and the unknown click results to find the first proven blocker, and fix only that. Done when a real model run adds an owned project without creating a channel, cancel leaves projects unchanged, and the refusal and unknown evidence are preserved.

Status (Oct 7): activation/focus/restore (#74), move/resize (#86), minimize (#133), close (#134), quit (#132), launch (#136), open (#143), menu inventory (#138) and external-app menu commands (#140) are merged. Remaining after the current task: own-Ace menu delivery, context menus, sheets and save/alert workflows, and wider lifecycle validation (in-flight cancellation, crash, hosted routing, second machine), including the uncertain Finder close in this comment.

Current task: native Open Folder workflow

In a signed, isolated Ace built from current main, open the native picker with the existing Cmd+O path. Delivering menus to Ace's own serving process comes later. Freshly identify the real picker by exact process and window, operate it with native tools, select an owned folder, and verify that it adds a project without creating a channel. Cancel must leave projects unchanged.

First reproduce the recorded failure with the main window overlapping the picker (details). Fix only the first proven blocker. The recorded symptoms are a desktop_focus timeout, a desktop_key refusal with no focused control, and clicks returning unknown with a same-app occlusion message. They aren't assumed to share one cause; the focus timeouts are also recorded in githubnext/desktop-tools#5.

A real model run must complete the same workflow. Preserve refusal and unknown evidence, and show no replay after a distinct-worker reopen. General githubnext/desktop-tools#5 paste, own-Ace menus and broader lifecycle work stay separate.

Original scope

Add explicit application activation and window focus/restore tools as the first focused part of githubnext/ace2#8's applications/windows slice. This also gives an agent an explicit recovery step when a target is hidden, minimized, or not on the active desktop; inspection must never activate a target implicitly.

• Bind running applications to the PID and process-generation receipt returned by native inventory. Window targets additionally carry the exact window ID and observed bounds. Validate these with Peekaboo immediately before acting; never target an arbitrary current foreground window or introduce another target-handle store.
• Expose activation and window focus as deliberate foreground operations that can raise a window or change the active Space. Restore uses background Accessibility unminimize and does not promise foreground focus. Preserve the distinction between passive inspection and explicit management actions.
• Use the pinned dependency's existing targeted APIs, native coordination, and signed action receipts. An application-only result must not fabricate a window target. Verify the exact accepted receipt and preserve completed/refused/unknown outcomes, including uncertainty after interruption.
• Route through the existing injected desktop capability for local and hosted channels. Mutations use pi's existing unsafe-tool intent and must not be replayed after Stop, restart, or a lost workspace response. Access follows githubnext/ace2#8 and the current architecture: the channel owner's separate agent-access and desktop-tools settings, with no participant ACLs or per-action prompts.
• Refresh the relevant inventory/observation after delivery. Failure to refresh must retain the completed native action; it must not invite blindly repeating the operation.

Done when real signed native and pi runs activate the selected application, focus one exact window and restore a minimized window, with fresh evidence confirming the result. Validate stale process/window/bounds, interruption/replay, and the hosted workspace route. Keep macOS desktop lock and permission failures explicit.

Since then, application launch (#136) and quit (#132), window move/resize (#86), minimize (#133) and close (#134), document/URL opening (#143), menu inventory (#138) and external-app menu commands (#140) have merged. Own-Ace menu delivery, context menus and complete dialog workflows remain focused work under githubnext/ace2#8; this issue does not complete that whole slice.

Move and resize follow-up

PR githubnext/ace2#86 (merged) adds only desktop_move and desktop_resize through this existing exact-window management route. Positions are finite global desktop logical points, including negative coordinates; dimensions are positive and finite. The original inventory identity/bounds, native coordination and readback, signed outcome, cancellation semantics, refreshed targets, and pi unsafe intent remain in place. Launch/quit, close, menus, and dialogs are separate work under githubnext/ace2#8.

PR githubnext/ace2#86 head 8bd13eb5220f84833a8eb04df1157753060739b0 now passes its signed development rebuild, strict app/client signatures, and local live validation on an unlocked Mac (October 5). A fresh real AppKit fixture verified normal move/resize with returned targets, exact negative x=-40, position/size no-ops, stale-bounds refusal, and pre-dispatch cancellation. A 400×300 request constrained to 640×450 correctly returned unknown/dispatched_unverified; fresh inventory and inspection established the actual geometry before explicit restoration. Beta, text, Save count, focus state and unrelated callbacks stayed unchanged. A real pi/Anthropic run made one move and resize using the actual refreshed target; exact results/images and usage survived same-store reopen without another native call. Raw evidence and signed receipt bundles were retained and independently audited. The temporary validation apps/host are stopped. githubnext/ace2#86 has since merged; geometry-specific in-flight cancellation, lock transitions, crash recovery, hosted routing, multiple-display/negative-y coverage and a second machine remain unverified. This completes githubnext/ace2#86's requested local live-validation arm, not the broader validation tracked here.

Exact-window close follow-up

PR githubnext/ace2#134 adds desktop_close through the existing exact-window management route. It selects one read-supported background AX action, rechecks original PID/generation/window/bounds, and never falls through after accepted or ambiguous input. An accepted close that leaves an unsaved-work dialog open stays unknown with unsafe retry and refreshed inventory; confirmed disappearance survives later inventory failure. No forced close or automatic dialog handling.

Exact head a2c1870f68651bb898d0d52f0c9beccba0d9c77d includes landed minimization and passes types, CI, Swift parse, independent source review, signed development build, strict signatures and GitHub CI. Real AppKit stale-generation/bounds and pre-cancel checks refused with zero close callbacks. One actual deferred close produced a visible save sheet, one request and zero closes, with signed unknown/unsafe outcome and fresh inventory. A real pi/OpenAI run fetched the window inventory immediately before one normal close, received a confirmed result and empty window list, and recorded one actual close callback. Exact tool results, usage and execution counts survived worker exit and same-store reopen without another action.

The first model attempt correctly refused stale startup geometry before input; its original outcome remains preserved. Only the remaining normal/model phase was rerun after matching real AppKit/CG geometry and two inventories. All owned fixtures, workers, app/host processes and sockets are stopped; temporary channels/projects were removed. Evidence: /tmp/ace-close-smoke.bD8VDF, /tmp/ace-close-model-smoke.K0UnZY, /tmp/ace-close-model-live.1K1dxT/cleanup-final.json. githubnext/ace2#134 has since merged; close-specific in-flight cancellation, crash/hosted routing, self-close and a second machine remain unverified. This does not complete the broader management/dialog validation tracked here.

Read-only menu inventory — PR githubnext/ace2#138

#138 adds desktop_menus for an exact application target. Signed menu output and pre/post application inventory must match its process generation. Optional exact literal path returns one uniquely observed menu/item subtree; missing or ambiguous ancestry is refused. Complete title paths, native cache possibility and unknown completeness remain distinct from Ace truncation. No input authority or menu command is added; AX reads can populate lazy menus and trigger callbacks.

Exact head 1f8cde5d1a15f61023d52b22bce9bfdf5d4e0861 passes types, CI, Swift parse, independent source review, signed build, strict signatures and GitHub CI. Real native checks verified literal punctuation/Unicode paths, missing and ambiguous ancestors, cached previous state followed by updated state after expiry, and the isolated Ace application's File menu. One real pi/OpenAI run read the public Proof scope once; exact results, usage and execution counts survived actual worker exit/reopen without another native read. Population callbacks were recorded separately; actual menu tracking, command/key/click counters remained zero and fixture focus stayed unchanged.

Earlier signed c83b087 provides the preserved stale-generation and pre-cancel refusals. Original setup/counter-verifier failures remain recorded rather than rewritten; passed native requests were not repeated. All owned fixture, worker, app/host/launcher processes are stopped, sockets/ports closed, and temporary channel/project/settings removed. No clipboard access. Evidence: /tmp/ace-menu-smoke.7GzFXu/result.json, /tmp/ace-menu-live.dXPqws/result.json. githubnext/ace2#138 has since merged; existing synchronous AX responsiveness/in-flight cancellation, hosted routing and a second machine remain unverified. Menu mutation remains separate and this does not close githubnext/desktop-tools#4 or githubnext/ace2#8.

Final menu head a8059a519976d8a78012f35cb34c8981a7c67f53 integrates landed app launch githubnext/ace2#136. Its native menu implementation is byte-identical to live-tested 1f8cde5; the additive union was independently reviewed and final types/CI, signed rebuild, strict signatures and GitHub CI pass. No live repetition was needed for this integration.

Exact external-app menu commands — PR githubnext/ace2#140

#140 adds desktop_menu for one exact external application generation and literal title path. Fresh native reads require unique complete ancestry and an enabled leaf before one AXPress. There are no ancestor presses, separate activation request, fallback, or automatic retry. The app or macOS may still bring the app forward in response. Accepted delivery is distinct from the command's effect; ambiguous delivery stays signed unknown/unsafe, and the process mutation lane is retained until the native call actually returns. The read budget and native messaging timeout are finite but not hard completion guarantees.

Real AppKit validation passed ordinary and literal punctuation/Unicode commands, a modal once, and missing/ambiguous/disabled/parent/cached-old-title refusal cases. A real Anthropic model read the fixture's scoped menu and invoked its command once through an Ace channel. A distinct worker reopened the durable channel with identical tool results and usage, unchanged execution counts, and no second callback. The original provider-auth failure occurred before tools and is retained separately from this successful run. Final source d1993fe173d097baa2c68edab3c381986fab9fdb integrates githubnext/ace2#142, githubnext/ace2#143 and current main; its external menu implementation remains unchanged from the model-tested candidate except for content-free refusal diagnostics.

Commands targeting the native Ace process itself are explicitly unsupported before input; read-only menu inventory remains available. The exploratory own-app route returned signed unknown without an observed picker. Fresh read-only recovery found no sheet or Cancel, then the exact owned runtime was gracefully cleaned up without repeating the command. Its raw AXPress cause is not proven. The experimental self route is removed from this PR.

• Finish own-Ace menu delivery in a focused follow-up, with a supported self-target route and observed effect; retain exact generation/lane ownership and do not infer that accepted AX delivery completed a command.

The final own-PID check passed with a signed operation_unsupported refusal, dispatch_state: none, no dispatched units, and no new visible window. All five distinct owned PIDs were gone afterward; the bundle scan was empty, port closed, socket absent, channels empty, isolated settings removed, and project catalog unchanged. No Cancel, clipboard, model, or fixture was used for that final check. Types, formatting/lint, helper syntax, signed development build, strict signatures and GitHub CI passed. No in-flight Stop/crash, hosted, second-Mac, or complete dialog-workflow validation is claimed. This PR does not complete githubnext/desktop-tools#4 or githubnext/ace2#8.