fix: [AI-7520] first-run gate keys off sync.status; scan-gate fallback; port cleanup; marker

Round-3 review (rizvi):
- BLOCKING (app.tsx): the first-run onboarding gate keyed off `ready()` (plugin-host
  startup only), which can settle before sync loads providers — transiently making a
  returning, connected user look un-onboarded and re-showing the welcome picker + scan
  gate. Now also require `sync.status === "complete"` (the provider-load signal) before
  deciding, so a returning user never sees the first-run flow.
- scan gate (app.tsx): if the prompt ref isn't mounted, `onChoose` no longer silently
  drops the Yes/No — it surfaces a toast telling the user how to continue.
- port cleanup (altimate.ts): the loopback callback server is now stopped on the
  pending-flow TIMEOUT path too (not only in callback().finally), so a dismissed
  sign-in can't leave port 7317 bound for the process lifetime.
- Marker Guard: wrap the fork-added `writeJsonAtomic` in `util/filesystem.ts`
  (introduced by the merged #1046 into an upstream-shared file) in altimate_change
  markers so the guard passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: saravmajestic

packages/opencode/src/altimate/plugin/altimate.ts

@@ -172,6 +172,10 @@ function registerPending(state: string, timeoutMs = 5 * 60 * 1000): Promise<Call
   return new Promise<CallbackResult>((resolve, reject) => {
     const timeout = setTimeout(() => {
       if (pending.delete(state)) reject(new Error("Timed out waiting for browser sign-in"))
+      // If the dialog was dismissed and callback() never ran its finally, the
+      // loopback server would otherwise stay bound past the timeout. Free the
+      // port once nothing is waiting on it.
+      if (pending.size === 0) stopCallbackServer()
     }, timeoutMs)
     pending.set(state, {
       resolve: (creds) => {

packages/opencode/src/util/filesystem.ts

@@ -272,6 +272,7 @@ export namespace Filesystem {
     }
   }
 
+  // altimate_change start — fork util (AI-7520 onboarding/materialize): atomic JSON write
   /**
    * Atomic JSON write via tmp-file + rename. Serializes `value` with 2-space
    * indent + trailing newline, writes to `<targetPath>.tmp-<random>`, then
@@ -292,6 +293,7 @@ export namespace Filesystem {
     writeFileSync(tmpPath, JSON.stringify(value, null, 2) + "\n")
     renameSync(tmpPath, targetPath)
   }
+  // altimate_change end
 
   export async function findUp(target: string, start: string, stop?: string) {
     let current = start

packages/tui/src/app.tsx

@@ -562,7 +562,13 @@ function App(props: { onSnapshot?: () => Promise<string[]>; pluginHost: TuiPlugi
   let armScanGate = false
   createEffect(() => {
     if (firstRunPickerHandled) return
-    if (!ready()) return // wait until providers are loaded before deciding
+    // Decide only once BOTH the plugin host has started AND sync has finished
+    // loading providers. `ready()` alone is plugin-host startup, which can settle
+    // before sync populates `sync.data.provider` — deciding then would transiently
+    // see a returning (connected) user as un-onboarded and re-show the picker +
+    // scan gate (the AI-7774 regression). `sync.status` is the provider-load signal
+    // (same one used for continue/fork above).
+    if (!ready() || sync.status !== "complete") return
     firstRunPickerHandled = true
     if (onboardingReady()) return // already set up — no gate
     armScanGate = true
@@ -592,7 +598,16 @@ function App(props: { onSnapshot?: () => Promise<string[]>; pluginHost: TuiPlugi
               // menu (sample dbt, downstream impact, SQL PR, or free chat).
               // Template lives at packages/opencode/src/command/template/onboard-connect.txt.
               const ref = promptRef.current
-              if (!ref) return
+              if (!ref) {
+                // The prompt should be mounted by the time the gate resolves, but
+                // if it isn't, don't silently drop the user's choice — tell them
+                // how to continue instead of a dead keypress.
+                toast.show({
+                  message: `Run /onboard-connect ${arg} to continue.`,
+                  variant: "error",
+                })
+                return
+              }
               ref.set({ input: `/onboard-connect ${arg}`, parts: [] })
               ref.submit()
             }}