Prepare the MetalSharp 0.60.0 preview runtime

[aaf2tbz]

Summary

Completes the official MetalSharp 0.60.0 preview plan across Phases 1–8. This PR integrates the canonical complete multi-architecture Wine runtime, makes the installer and launch paths consume that runtime consistently, preserves the no-TSO FEX contract, adds the final global controller/Msync controls, and replaces the legacy split-bundle release pipeline.

Changes

• Replace the legacy setup archives with the verified four-part complete runtime installer, gated by canonical archive SHA and required Wine, graphics, font, NLS, and provider surfaces.
• Build Steam prefixes with ARM64, ARM64EC, x86_64, and i386/WoW64 components; add the loopback-only two-cycle updater handoff and hash-gated CEF wrapper repair.
• Keep FEX TSO modes disabled through prefix creation, Steam, redistributables, and game launch.
• Require functional Homebrew while keeping GPTK/D3DMetal separate and Homebrew-owned.
• Route interactive x64/x86 VC++ redistributables through the complete Wine adapter and accepted all-architecture prefix.
• Migrate M12 to one explicit VKD3D-Proton/DXVK/Wine Vulkan/MoltenVK ownership chain and route M9–M11 through the complete runtime's x86_64/i386 PE lanes and native ARM64 Unix bridge.
• Update bottle save, migration, preparation, Play, route diagnostics, shader caches, and runtime doctors for the complete-runtime contract.
• Add persisted global Controller [D | X] and Msync controls and propagate them through MTSP, Steam, GOG, prefix initialization, and ordinary Wine launch paths.
• Replace release packaging with a manifest-pinned, checksum-verified complete-runtime pipeline. The DMG carries the lean bootstrap metadata while GitHub publishes the four runtime parts as separate release assets to respect GitHub's per-file release limit.

PR Readiness (MANDATORY)

• Compatibility verified with at least one real game (game + launch method noted below)
• No hardcoded paths, secrets, or absolute /Users/... paths introduced
• Config/rules TOML validated if configs/mtsp-rules.toml or DLL maps changed
• Version triple (CMakeLists.txt, Cargo.toml, package.json, package-lock.json) in sync if version bumped
• Bottle/runtime migration and launch behavior preserved (rollback plan noted if changed)
• Docs / compatibility matrix updated for user-facing changes
• Regression test added for each bug fix

Validation

• cargo fmt --all
• cargo clippy --all-targets -- -D warnings
• cargo test --all-targets -- --test-threads=1 — 644 passed
• cargo build --all-targets
• Electron TypeScript, Biome, Prettier, and Vite production build
• Shell syntax, Rules TOML, DMG workflow contract, and live release package verification
• Full PR CI: Rust, Electron, Vue, Metal, C/C++/Objective-C, shell, docs, rules, DMG workflow, and CodeQL

The canonical archive MetalSharp-Wine-Runtime-COMPLETE-all-arch-2026-07-31.tar.zst passed the strengthened layout gate with SHA-256 93a456a40a7bf0ad2fecace5c01c58a366f85cc2901f6f8780c056c9e3b256ee. The pinned release manifest SHA-256 is bba8103217dbc72914a8496cb782882af0883fbb18664956ba365dba68fec4eb.

Artifact inspection confirmed x86-64 and i386 guest PE lanes and native ARM64 Mach-O Unix bridges. M12 has no DXMT/winemetal payload ownership; D3DMetal remains isolated in the Homebrew GPTK prefix.

Compatibility baseline: Nidhogg 2 (Steam appid 535520), M9 route, installed from /Volumes/AverySSD/SteamLibrary. This PR preserves that established real-game launch route; the final PR cycle revalidated its route contracts, complete-runtime contract, and 644-test regression suite. It does not claim a new interactive game session was run during this PR cycle.

Risk and rollback

Runtime installation is transactional and keeps prefixes, bottles, saves, and shader caches outside the replaceable runtime directory. Steam handoff and wrapper repair are prefix-confined; graphics ownership is explicit; controller and Msync retain prior defaults. Rollback is to revert this PR and restore the prior installer entry point—the user data directories do not need to be removed or migrated backward.
\n\n## Post-Phase 8: native GOG integration\n\n- Added a pinned, self-contained native ARM64 Heroic GOGDL 1.2.2 release asset with embedded Requests/TLS and compiled xdelta3 support.\n- GOG prefix initialization now repairs and verifies the complete ARM64, ARM64EC, x86_64, and i386/WoW64 runtime contract instead of accepting a partial drive_c.\n- GOG install, update, verify/repair, uninstall, and Play inherit the canonical provider, library, Msync/controller, and no-TSO environment.\n- Existing complete runtime installations receive the verified 4.3 MB GOG layer transactionally, without rebuilding Wine or unpacking the 2.8 GB archive.\n- Live GitHub release downloads of the GOG asset, installer, and manifest passed checksum and package-contract verification.\n\n\n## Bundled Mono cleanup\n\nWine Mono 11.2.0 is now supplied by the complete runtime, so the redundant GOG and Settings install/upgrade/reset controls, polling code, /wine-mono/* routes, and interactive MSI installer module were removed. Mono/FNA execution and bottle compatibility surfaces remain. The current deterministic Rust suite is 644/644 after removal of 11 tests belonging solely to the deleted installer module.\n

[aaf2tbz]

Migration acceptance update (commit 55074d3):

• Ran the real installed 0.57 Steam prefix through the 0.60 migration: 8/8 complete.
• Steam executable remained byte-identical: eb823470675e0a8f8b91c4f4f1e4bb6148e72b606a518f250a10c598bb1705b8.
• Same-prefix execution passed ARM64 (0), ARM64EC (42), x86_64 (7), and i386 (0), with all expected markers and every FEX TSO mode disabled.
• Fixed i386 provider selection to xtajit.dll and reject/remove competing wow64cpu.dll or candidate providers.
• Corrected migration cleanup to preserve configs, cover/API metadata, logs, and shader caches; only runtime and transient download/update scratch are replaced.
• Refreshed the complete runtime/source bundles with the bounded EGL diagnostic fix and new hash e44a84bceeca62f01fd95a133364ec82467cd8883ff81bcc1bdfdf4a6c3ad146.
• Local validation: 649/649 Rust tests, strict Clippy, release build, Electron/Vite build, DMG workflow, manifest, archive, and four-part reassembly gates pass. All PR CI checks pass.

[aaf2tbz]

Fresh 0.57 -> 0.60 release-path acceptance completed on an isolated copy-on-write clone of the immutable existing install:

• empty AverySSD cache downloaded all four published runtime parts plus GOG support
• canonical runtime reassembled, verified, and activated transactionally
• migration completed 8/8 and now reports up_to_date
• 6,841/6,845 baseline payload files remained byte-identical; expected deltas were stale SteamSetup.exe / .crash removal and two appended logs
• preserved steam.exe SHA-256 remains eb823470675e0a8f8b91c4f4f1e4bb6148e72b606a518f250a10c598bb1705b8
• ARM64 rc0, ARM64EC rc42, x86_64 rc7, and i386/WoW64 rc0+marker passed in the upgraded prefix with all FEX TSO modes disabled
• production POST /steam/launch started the preserved executable and produced an on-screen Wine window titled Sign in to Steam

The test exposed and commit 6b86e606 fixes two release-only installer defects: unset same-line local expansion under set -u, and non-idempotent recreation of packaged symlinks. The fixed installer and manifest were clobber-uploaded to v0.60.0-dependency-bundles and freshly downloaded/verified.