[zrmarley]

Summary

• Separate the macOS native-preparation adapter from onboarding window-preservation policy, so MockRuntime tests do not dereference a synthetic AppKit window handle.
• Keep the native operation in the command's deferred closure. Preserve main-window rejection before preparation, preparation before persistence, exact errors/state flags, the immutable first snapshot and restore consumption only after success.
• Retain regression coverage for repeated preparation, non-main rejection, preparation failure without file mutation, and saving the real plugin cache after preparation.

This is a standalone one-file repair, not the onboarding feature from #2336. No frontend, terminal, dependency, configuration or CI changes. Production net change is +10 lines; complete diff is +132/−8 including tests.

Validation

At reviewed head 8893c7004e7f889706980b6bf1c2ce479435f0b3:

• Independent source/base-integration review completed with no material defect found.
• Normal bootstrap and commit hooks passed.
• bin/cargo fmt --all --check passed.
• bin/cargo build --workspace --locked passed on macOS.
• cargo clippy --workspace --locked --all-targets -- -D warnings passed through the normal local pre-push job.
• Explicitly requested focused agent regression command bin/cargo test -p Buzz --lib --locked window_state::tests::onboarding_ passed: 4 passed, 0 failed, 0 ignored (1,004 other tests filtered out). This is not the full workspace suite or personal human testing.

Existing automatic PR CI is requested for full unfiltered workspace tests/doctests and the repository's other checks. PR CI normally checks GitHub's synthetic merge commit incorporating this head; pending results must be attributed to the actual tested revision, not represented as bare-head execution.

Remaining acceptance / draft status

• Full workspace tests have not run on this standalone state locally. A prior dependent-state macOS run timed out in the real-login-shell terminal test with a security acknowledgment banner visible; the cause is unproved. Its test results do not qualify this head. No prompt bypass, test skip or timeout change is included.
• Ubuntu workspace success will not establish macOS full-login-shell-suite or AppKit/Wry behavior.
• The focused agent command exercises the changed testability/policy workflow. Zach Marley subsequently reported personally running the same guarded command at head 8893c7004e7f889706980b6bf1c2ce479435f0b3: 4 passed, 0 failed, 0 ignored. The human affected-command testing item is satisfied; no scoped exception is needed. AppKit/Wry and full macOS workspace testing remain unperformed, not additional blanket gates for this unchanged-semantics repair. Keep draft until supported full CI is green and independently verified.
• No merge is requested.

Affected-workflow acceptance

• Independent agent source/integration review completed; no material blocker.
• Agent ran the focused onboarding regression command successfully.
• Human affected-command testing: Zach Marley explicitly confirmed personal execution of the same pinned-head/Hermit command, 4 passed / 0 failed / 0 ignored.
• Supported full CI green and independently verified; PR remains draft pending this evidence.

Human confirmation concerns the focused regression workflow only, not GUI/AppKit, native onboarding acceptance or the full workspace suite.