Push261026 — Asset Update (v2 2.0.32 + 2.1.4, native)

Overview

New batch: upstream v2 2.0.32 and v2 2.1.4, both in the native
family (B-line source build, android bun) as deb + pacman .pkg.tar.xz.

4 assets + SHA256SUMS.txt.

Why two versions: 2.0.32 is the last of the 2.0 line (opentui 0.5.17) and
2.1.4 is the first upstream release on the 0.6.x renderer ABI (opentui 0.6.8).
They are separate ABI tracks, both verified on device — pick by the version
line you want, not by "newest wins".

Build provenance (both at d7ddcb5): scripts/build-bionic.sh from each
version's source tree with the per-version pins in scripts/lib/build-pins.sh
(2.0.32 → pty 0.3.1, opentui 0.5.17, tlsdesc bionic lib; 2.1.4 → pty
0.3.1, opentui 0.6.8, dedicated 0.6.8 bionic lib).

2.1.4 blocker found and fixed in this cycle: the first 2.1.4 build paired
the 0.6.8 JS with the 0.5.x-era bionic libopentui.so (a hardcoded single
path), so the TUI aborted with Symbol "ot_scene_set_hooks" not found —
a wrong-ABI substitution of exactly the kind this project refuses to ship.
build-bionic.sh now selects the renderer library by OPENTUI_VER, hard-fails
for versions with no matching bionic build, and gates FFI symbols per ABI.
The 0.6.8 library was rebuilt from upstream sst/OpenTUI v0.6.8 source for
bionic (export surface diffed against the upstream glibc artifact: 0 missing
of 1829).

Verification (both versions): make verify-artifact PASS (seccomp harden +
web UI assets) for deb and pacman; embedded renderer library carries
ot_scene_set_hooks and has no libc.so.6 NEEDED; on-device (Android 9,
kernel 3.18.140, aarch64):

• 2.0.32 — --version OK, serve HTTP 200, TUI 123,184 B / alive past 15 s.
• 2.1.4 — --version OK, serve HTTP 200, TUI 101,980 B / alive past 15 s,
  tmux screen capture shows the full UI (banner, prompt, session list).
  Shell test suite: 76 ok.

Scope note: compressed (UPX) and wrapper families are not part of this
batch — only the native line was built and verified this cycle.

v1 is unchanged in this batch: upstream 1.19.4 still pins
effect 4.0.0-beta.83, which segfaults on this target through the standard
transplant pipeline; it needs the source-rebuild track before it can ship.

Family matrix & coexistence

• Same generation is mutually exclusive: opencode vs opencode-wrapper
  vs opencode-compressed.
• Cross-generation coexistence: opencode1* packages may be installed
  alongside opencode* packages.
• v1 packages cover opencode < 2.0.0; v2 packages cover >= 2.0.0.
• Within v2, 2.0.x and 2.1.x share the opencode package name — installing
  one replaces the other (both are present here for pinned deployments).

Install

# pacman
pacman -U opencode-2.0.32-1-aarch64.pkg.tar.xz
pacman -U opencode-2.1.4-1-aarch64.pkg.tar.xz

# dpkg
dpkg -i opencode_2.0.32_aarch64.deb
dpkg -i opencode_2.1.4_aarch64.deb

Both install the hardened aarch64 ELF to /usr/bin/opencode and the web UI
assets under the package data dir. Installing v2 alongside opencode1
requires --force-overwrite for the shared seccomp shim path
(/usr/lib/opencode/libopencode-crhandler.so); see the runbook for details.

Checksums

See SHA256SUMS.txt in this release.