#328 made IGamePathProvider a required dependency and #329 added the macOS host, but neither could carry the macOS registrations: they reference types from the first and a module from the second, so they only compile once both are in. Each PR was green in isolation and the merged state is not — GenHub.app now aborts at container build with 'Unable to resolve service for type IGamePathProvider while attempting to activate GameSettingsService', cascading across roughly twenty descriptors including MainViewModel and IGameLauncher.

Registers IGamePathProvider, ISymlinkCapabilityProvider and IFileOperationsService for macOS. Only the first breaks startup; without the other two macOS silently copies instead of hard-linking and cannot reach symlink strategies, which are the behaviours #328 set out to fix.

Also moves the macOS test run before publish. GenHub.Tests.MacOS was already covered by the job's final 'Run Tests' step, but that sits after Publish and Smoke Test App Launch, so the startup crash killed the job first and the assertion naming the service never ran. MacOSHost_ResolvesEveryRequiredService already asserted this; it was reached too late to be useful. The project is skipped in the later sweep so it runs once.

…331)

#328 made IGamePathProvider a required dependency and #329 added the macOS host, but neither could carry the macOS registrations: they reference types from the first and a module from the second, so they only compile once both are in. Each PR was green in isolation and the merged state is not — GenHub.app now aborts at container build with 'Unable to resolve service for type IGamePathProvider while attempting to activate GameSettingsService', cascading across roughly twenty descriptors including MainViewModel and IGameLauncher.

Registers IGamePathProvider, ISymlinkCapabilityProvider and IFileOperationsService for macOS. Only the first breaks startup; without the other two macOS silently copies instead of hard-linking and cannot reach symlink strategies, which are the behaviours #328 set out to fix.

Also moves the macOS test run before publish. GenHub.Tests.MacOS was already covered by the job's final 'Run Tests' step, but that sits after Publish and Smoke Test App Launch, so the startup crash killed the job first and the assertion naming the service never ran. MacOSHost_ResolvesEveryRequiredService already asserted this; it was reached too late to be useful. The project is skipped in the later sweep so it runs once.

…port zero-exit stderr

Validation checked both games' declared roots regardless of which was launching, so a stale Zero Hour path could block a Generals launch that would have worked. It now checks only the launching game's root, taking the game type from the client.

A process exiting immediately with code 0 and no spawned child returned a bare message while the stderr drained moments earlier went unreported — the one diagnostic available for that case, and contrary to the point of the capture work in this branch.

Test changes: the native-client fixture discovery was duplicated across three classes and is now a shared NativeClientFixture, so they cannot diverge on when to skip; engine-only staging includes .so alongside .dylib, having been macOS-only; and SetUnixFileMode calls are guarded so the platform analyzer can follow them.

Also clears every warning in GenHub.Tests.Core, including five that reached development through #328 because I had only ever built the main project.

#332)

* feat(launching): surface native launch failures and set the loader search path

* test(launching): verify the real native client launches through GenHub

* test(launching): serialize real-client launches around the engine instance lock

* feat(launching): reach retail archives via install-path environment instead of copying them

* fix(launching): stop setting DYLD_LIBRARY_PATH and LD_LIBRARY_PATH

Measured unnecessary: the BGFX build declares every dependency as @executable_path/ with a matching rpath and launches with the variable cleared. Two costs outweighed a fallback for a build we do not ship: dyld consults DYLD_LIBRARY_PATH before @executable_path for leaf-name references, so a same-named library elsewhere silently wins; and the hardened runtime ignores it, so behaviour would change silently once GenHub is signed and notarized.

Closes #317.

* feat(launching): validate retail archive roots before spawning the engine

The engine reaches its main loop with zero content and no error when the archive roots are wrong: no exit code, no log line, nothing a host process can observe. Launch success therefore cannot distinguish a working game from an empty one, so the roots are checked before spawn and the launch fails with the offending root named.

Presence of at least one .big archive is the sentinel rather than a specific filename, which varies by localisation and version. An archive that exists but fails to mount still needs a machine-readable failure from the engine.

Closes #315.

* fix(launching): capture complete stderr when a launch fails

The buffer was read as soon as the process exited, but the asynchronous stderr handlers had not necessarily delivered their final lines — truncating diagnostics precisely on the path where they explain the failure. Wait via the parameterless WaitForExit overload, which also waits for redirected-output handlers, before reading.

The buffer now treats a null line as the end-of-stream signal rather than content, retains the head as well as the tail so startup context survives alongside the failure, and bounds line length and total size so a pathological writer cannot exhaust memory. Only stderr is redirected, so there is no stdout stream to drain.

Closes #318.

* chore: add stderr capture regression test and clear stack build warnings

Adds an end-to-end check that a process failing immediately still reports both the head and tail of its stderr. It does not deterministically pin the end-of-stream drain: removing the WaitForExit() call leaves it passing on macOS and .NET 8, because the handlers complete before the capture is read even at twenty thousand lines. The drain stands on the documented contract instead.

The GameLauncher fixture now uses a real retail root holding an archive. It previously pointed at a Windows path that does not exist off Windows, which the new pre-spawn validation correctly rejected.

Clears the warnings this stack introduced; development itself builds clean. Two remain, both predating these fixes and needing invasive reordering of long files: SA1204 in GameLauncher and SA1202 in WorkspaceStrategyBase.

* chore(workspace): order static helper before instance members

* chore(workspace): remove trailing class separator

* chore: clear native launch style warnings

* chore(workspace): keep member order valid after the executable materialization change

EnsureExecutableAsync became protected when the rethrow was added, which put it after a private helper. Moved it above, and dropped the trailing blank line the earlier reordering left.

* fix(launching): scope archive-root validation to non-Windows and normalize profile overrides

Two defects from review, both introduced by the earlier validation change.

Windows never reads CNC_ZH_INSTALLPATH or CNC_GENERALS_INSTALLPATH — it resolves install paths from the registry — so a Windows layout without loose top-level archives is not a misconfiguration. BuildEnvironmentVariables returns before setting them there, but validation reads the installation's declared paths, so it needed the same guard rather than inheriting it. Without it, valid Windows launches were rejected with a misleading message about missing archives.

A profile setting a root explicitly chooses the directory, not whether the trailing separator is applied. AddArchiveRoot returned early on an existing value and never normalized it, so the engine concatenated it with the archive filename to produce paths like '/path/toINIZH.big' and silently mounted nothing — precisely the failure this validation exists to prevent, reachable through the override path.

The variable names are an external contract with the engine, so they move to RetailArchiveConstants alongside the archive search pattern.

The normalization test fails against the previous early-return. The Windows guard asserts only on Windows and is a no-op elsewhere.

* test(launching): scope the archive-root rejection tests to non-Windows

Two of these asserted that validation rejects a bad root, which stopped being true on Windows once validation was guarded there — the platform guard was added without updating the tests that asserted the previous cross-platform behaviour, and Build Windows caught it.

Rejection is non-Windows behaviour by design; the Windows side is asserted separately by Validate_OnWindows_SkipsEntirely. The guards do not hollow the tests out: on non-Windows they still assert, and three still fail if the validation fix is reverted.

* fix(launching): scope archive validation to the launching game and report zero-exit stderr

Validation checked both games' declared roots regardless of which was launching, so a stale Zero Hour path could block a Generals launch that would have worked. It now checks only the launching game's root, taking the game type from the client.

A process exiting immediately with code 0 and no spawned child returned a bare message while the stderr drained moments earlier went unreported — the one diagnostic available for that case, and contrary to the point of the capture work in this branch.

Test changes: the native-client fixture discovery was duplicated across three classes and is now a shared NativeClientFixture, so they cannot diverge on when to skip; engine-only staging includes .so alongside .dylib, having been macOS-only; and SetUnixFileMode calls are guarded so the platform analyzer can follow them.

Also clears every warning in GenHub.Tests.Core, including five that reached development through #328 because I had only ever built the main project.

* fix(launching): validate the base Generals root when launching Zero Hour

Scoping validation to the launching game went one step too far. Zero Hour is an expansion and mounts the base Generals archives as well — this file's own remarks say so — so checking only the Zero Hour root let a stale or archive-free Generals root through and the game would run without base content: the same silent failure, one directory over.

Generals still reads only its own root, so launching it does not fail over a stale Zero Hour path. For Zero Hour the Generals root is checked only when declared, since an installation carrying the base archives itself needs no separate root; a declared root that is broken is an error.

The Zero Hour test fails if the second root is dropped.

* docs(launching): correct why an absent Generals root is tolerated and record the gap

The previous comment claimed a Zero Hour installation may carry the base archives itself. That was asserted, not verified, and is not the reason. The actual reason is that the engine mounts archives from the working directory as well, so base content may sit in the workspace rather than a retail root — the arrangement this mechanism replaces, but still valid.

Records the residual gap review identified: with no Generals root declared and no base content in the workspace either, Zero Hour starts with nothing to mount and this check cannot tell. Archive filenames are arbitrary, so testing for '*.big' proves nothing about base content; a workspace check was considered and rejected because a Zero Hour workspace always contains archives and it would always pass. Closing it needs the engine to report a failed mount.

* docs(launching): correct the engine-behaviour claim behind archive-root validation

The comments asserted the engine reaches its main loop with zero content and no error, and that no post-spawn check could tell. Verified against bobtista/GeneralsGameCode at bobtista/topic/trunk, that is false for the cases described: a root holding no archives aborts during initialisation with exit 1 and a ReleaseCrashInfo.txt, and an unmountable archive also writes '[ggc] ARCHIVE MOUNT FAILED' to stderr. Neither reaches the main loop.

The claim came from the plan and was repeated here without ever being checked against the engine, which is public.

Validating before spawn still earns its place, for reasons that are actually true: exit 1 is generic, the stderr sentinel exists only in StdBIGFileSystem and not the Win32 twin, and ReleaseCrash shows a system-modal dialog before _exit(1) so a host-launched child on Windows hangs instead of dying. The comments now say that, and bound what the .big sentinel can detect.

* test(launching): validate the fixture override and recognise versioned Linux libraries

Three review findings, all in the integration fixtures.

The GENHUB_NATIVE_CLIENT_DIR override only checked the directory existed, while the discovered default also required the engine binary. A directory without one is a misconfigured override and these tests should skip, not fail; both paths now validate the same way.

The '.so' suffix test missed versioned libraries such as libSDL3.so.0, which is the common shape of a shipped Linux library, and a second copy of the same filter in the manifest fixture had not been updated at all when '.so' was added earlier. Both now use a shared NativeClientFixture.IsDynamicLibrary.

The manifest fixture asserted only that something executable was present, so it would have passed with just the binary and never exercised library handling. It now requires a captured dynamic library.

The predicate is unit-tested because every test that uses it skips without a local engine install, so it would otherwise never run in CI. Writing those tests caught a real bug: matching on '.so' found the coincidental one inside '.sound' and stopped, so 'mylib.sound.so.1' was rejected. It matches on '.so.' now, and that case is pinned.

* fix(launching): match retail archives case-insensitively when validating roots

* fix(launching): ground archive-root failure messages in the verified engine abort

* chore(launching): reference launch constants in tests and fix stale name references