chore: retire plan-a branch

[senseix21]

RETIRE_AUDIT — feature/plan-a-rusty-user-surface vs main (2026-05-18)

Base: origin/main@46fc3b5e7 (#155/#156/#157/#158 merged) vs
origin/feature/plan-a-rusty-user-surface@25a49e9eb. merge-base
85c53240f. Divergence: plan-a +74 / main +239; tree diff 378 files
(54 plan-a-only A, 117 main-only D, 200 M, 7 R).

Verdict: retire via -s ours is correct for 373/378 files; 5 files BLOCK it pending owner decision.

Bucket 1 — Superseded (resolve to main; the 52 tagged session commits)

[0.1]→chunk A, [0.2.b]→chunk B, [1.1]→chunk B, [1.3]→chunk C,
[0.2.d]→Makefile/CI lane. main holds the ported canonical equivalent of
every file these touched. Net effect vs main: none wanted. Discard plan-a side.

Bucket 2 — Superseded by deliberate redesign (old-API app wave, commits 20-22 + app trust artifacts)

• userland/capsule_{calculator,terminal,file_manager,text_editor,settings, process_manager,about}/** (old single-file app_skeleton API) → main has
  the ported multi-module canonical versions (chunk E / PR Integrate Plan A (rusty user surface) onto main #156).
• nonos-data/trust/{capsules,keys}/{about,calculator,...}.* (28 files) —
  signed artifacts for the discarded old-API binaries; main's app model
  is feature-gated unsigned dev-spawn (about-style) → these signings unused.
• userland/capsule_*/Capsule.mk, */README.md, */Cargo.lock,
  src/userspace/capsule_{terminal,text_editor}/state.rs → superseded by
  chunk E's no-Capsule.mk + about-style 3-file mirror design.
  Discard plan-a side.

Bucket 3 — Dead code (not wanted anywhere)

• userland/desktop_shell/src/main.rs — the dead shadow stub
  (mk_exit(0), no Cargo.toml) flagged for deletion in the plan. Discard.

Bucket 4 — main is newer (200 M + 117 D)

For every modified file main's version is the 239-commit-evolved one;
117 "D" are main-only files plan-a never had. main's side stands. Keep main.

Bucket 5 — ABSENT & potentially-wanted — OWNER DECISION (blocks blanket -s ours)

Genuine plan-a integration main lacks, from the untagged feat() commits
(feat(desktop-shell): add wm and policy clients, feat(capsule_wallpaper): complete a3 service path) that the Step-2 port did not carry (chunk B =
compositor + typed-errno only):

File(s)	What	main equivalent?
userland/capsule_desktop_shell/src/wm_client/mod.rs	desktop_shell→wm OP_HEALTHCHECK IPC	none (main ds has only compositor_client)
userland/capsule_desktop_shell/src/wallpaper_client/mod.rs	desktop_shell→wallpaper OP_SET_POLICY IPC	none
userland/capsule_desktop_shell/src/market_client/mod.rs	desktop_shell→market OP_HEALTHCHECK IPC	none
userland/capsule_wallpaper/src/decode_client/{header,seq}.rs	wallpaper image decode (PNG/BMP/JPEG/LZ4 → stretch-paint)	none (main wallpaper has only protocol-decode typed-errno parse)

Each is small (24–56 LOC) but sits on plan-a's pre-239-commit
wallpaper/desktop_shell base; porting onto main's evolved crates needs an
API-compat pass, not a blind cherry-pick.

Owner decision required: for the 5 files —
(A) Port-forward: re-implement the wm/wallpaper/market/decode client
integration against main's current capsule_desktop_shell /
capsule_wallpaper (small, but real work + API reconciliation), then retire
plan-a; or
(B) Confirm-obsolete: main's desktop_shell/wallpaper intentionally
diverged (no wm/market/decode driving) → discard, retire plan-a as-is.

Recommended execution

1. Owner picks (A) or (B) for Bucket 5.
2. If (A): port the 5 modules onto main on a small feature branch first
   (own PR, build-verified 3-triple), land it, then retire plan-a.
3. Retire: git merge -s ours origin/feature/plan-a-rusty-user-surface on
   chore/retire-plan-a (tree ≡ main, zero regression — assert
   git diff origin/main HEAD empty), PR, then delete the branch.
   -s ours is safe only after Bucket 5 is resolved by (A) or (B).

[Copilot]

Copilot wasn't able to review any files in this pull request.