Pup - the AI's own browser

Brand sweep at startup and after rescans: re-asserts each live session's title suffix and re-stamps it to the current identity so icon rebrands propagate to already-open windows and the taskbar never shows mixed icon generations.

AD-version awareness: pup probes the desktop's AD at startup and on boxes older than 1.9.124 warns visibly that the foreground raise gate is bypassed there (yellow chip, status fields, open-response advisory); all other version gaps continue to self-gate silently.

pup owns its browser provisioning: warmup at every bridge spawn now background-fetches Chrome for Testing whenever it is not cached regardless of installed browsers, so fresh boxes provision at install time and first opens never wait; AD prewarm policy no longer involved and issue 204 withdrawn.

Browser glyph shrunk and tucked into the lower-right corner with clear teal space so it no longer touches the leaf mark; ships as adom-pup-browser3.ico under a new filename per the icon-cache rule.

Identity icon simplified to a minimal line-art browser glyph in the leaf dark-teal with no white, shipping as adom-pup-browser2.ico under a new filename per the icon-cache rule.

New Adom Pup identity icon: the favicon with a browser-window glyph inlaid lower-right so the icon reads as an Adom browser window; ships as adom-pup-browser.ico under a new filename per the icon-cache rule, master SVG in the repo pending promotion to the brand-icons wiki repo.

Full Adom Pup window identity on AD 1.9.134: self-registration at bridge start with a pin that launches a managed pup window, per-window identity stamp at create/park/heal with cacheKey, overlay badge demoted to a self-gating fallback for older AD, adom-pup.ico ships in the zip.

The demarcation gate: unpinned opens require cached Chrome for Testing and return the pollable installing status instead of ever silently driving the user's branded browser; explicit browser_use pin is the only branded path; AD issue 204 filed to flip the prewarm default so install-time prewarm erases the first-use wait.

Foreground gate matching abe's dual-key contract: foreground:true without foregroundReason opens background with foregroundDenied, raise/focus without a reason is refused with foreground_reason_required, and every granted foreground is logged, recorded in lastAgentUpdate, and surfaced as lastForeground in status.

Sized opens keep their requested x/y (the legacy re-assert clobbered geometry back to the primary origin, blocking second-monitor placement; now z-only via AD state:bottom force:false), and window-management is granted by default so getScreenDetails can enumerate the real monitor layout.

Park after the page settles so the first paint's window-raise happens invisibly off-screen; the window's first visible frame is full-size, z-bottomed, and z-confirmed, eliminating the transient on-top blip other threads' windows showed.

Re-assert z-bottom after the open's navigation and at the load event (the first cross-origin nav re-shows the window at first paint and raised it after the park's z-confirm had passed), and after open_tab's new-tab first paint; all with force:false so a user-held window is never yanked.

Placement doctrine: geometry via CDP plain bounds only sized from the page's own screen metrics, re-bottom after every move, confirm the z-order via desktop_list_windows, and move the window back off-screen if z-bottom cannot be confirmed; AD set_window_bounds and CDP maximize are both banned from background placement because each raises the window.

Never use CDP windowState maximized for background placement: Chromium implements it as SW_MAXIMIZE which raises the window to the top of the z-order and covered the user's work; placement now uses AD desktop_set_window_bounds restore:false sized from desktop_list_monitors, preserving the forced z-bottom.

Background windows now appear already-maximized: the park stages the window just past the left screen edge (invisible but monitor-adjacent) before the OS maximize, eliminating the visible small-then-grow; verify and heal thresholds tightened to catch a window stuck at the staging spot.

Adopt AD 1.9.115's force:true on desktop_set_window_state state:bottom so the launch park bottoms a foreground window in one AD call; legacy PS fallback retained only for AD 1.9.114 and older and auto-obsoletes as desktops update.

When AD skips z-bottom because the window is foreground (its requested skip-on-foreground semantics), the launch park now force-bottoms via the legacy path, fixing park-failed on the post-restart foreground-reassignment case; AD follow-up filed for a force flag.

Adopt AD 1.9.114's desktop_set_window_state state:bottom for the park's z-order step, deleting the last PowerShell from the open path so window management is fully direct API, with a legacy PS fallback for desktops on older AD.

Remove the launch-park user-click escape hatch entirely: foreground-at-park has non-user causes (Windows reassigns foreground to a fresh window after the previous foreground window is destroyed, e.g. on a bridge-update restart), which forced never-clicked windows onto the user's screen; the launch park now bottoms unconditionally and a user who clicked during the 2s gap just clicks once more.