[VirgilMing]

Summary

Follow-up to #1616. The optional catalog must tolerate unrelated display metadata errors and keep disabled local feature metadata out of distributed artifacts.

• Discover public feature declarations during builds, including disabled public features. Diagnose and omit invalid display entries while keeping configuration and patch-integrity checks strict; include local metadata only for enabled features.
• Keep generated catalog data out of the source repository. Native package hooks snapshot the built ASAR catalog into the minimal update-builder, so other feature PRs can change metadata without regenerating a file in this optional feature.
• Preserve public descriptions and subfeatures across updater rebuilds, refresh available manifests and recompute local entries and selection state. The snapshot travels inside the selected feature tree and survives the Rust updater copy, which omits top-level .codex-linux/ metadata.
• Retain legacy-snapshot cleanup and the disabled-local packaging guard. Accept SHA-256 Git revisions and normalize recognized Nix dirty revisions.

Validation

node --test \
  linux-features/community-features-in-gui-settings/test.js \
  scripts/lib/linux-features.test.js \
  scripts/patch-linux-window-ui.test.js \
  linux-features/reasoning-visibility/test.js \
  linux-features/start-minimized-to-tray/test.js \
  linux-features/ui-tweaks/test.js

• 256 passed, 5 skipped, 0 failed, including all 31 adjacent feature tests. Package-hook syntax, 178 relative documentation links and diff checks passed.
• Merged with base 6f2b12f9 and feat: add experimental browser UI as an opt-in Linux feature #1577 (69b00dea) in an isolated integration worktree: 82 passed, 0 failed. The added, disabled web-ui feature appeared automatically, with no catalog regeneration.
• Built the feature alone against signed stable official chatgpt 26.1021.22027 on amd64 after verifying signed repository metadata and the cached package hash.
• Built and inspected actual deb and pacman packages using enabled/disabled local metadata fixtures. The disabled-private marker was absent from the ASAR and all 72 inspected builder files; staged legacy snapshots were removed while source fixtures remained untouched. RPM and AppImage staging and Nix amd64 evaluation also passed.
• Recreated the Rust updater's exact bundle-copy allowlist from the packaged minimal builder, without top-level metadata. With unchanged selections the rebuilt ASAR was byte-identical. After deselecting/removing the local feature, it disappeared from the rebuilt view and next packaged snapshot while all 47 public entries / 55 countable units remained.
• Reviewed the complete updated base-to-working-tree diff twice with gpt-6.1-sol at model_reasoning_effort=max. Fixed the first review's updater-copy finding and reran the relevant tests and review; the final review reported no remaining findings. The committed diff matches the validated diff exactly.
• Full RPM/AppImage/Nix builds, arm64 and manual GUI acceptance were not run.

Checklist

• This pull request is ready for review and is no longer a draft.
• I followed CONTRIBUTING.md, kept the change focused, edited source files rather than generated output, and removed unrelated changes.
• If this fixes upstream drift, it targets only the latest signed stable OpenAI Linux package and removes obsolete fallback code and tests. (Not an upstream drift fix.)
• I added or updated relevant tests, ran the validation listed above, and confirmed that required CI checks pass.
• I reviewed the final diff with my coding agent using maximum reasoning effort, addressed all findings, and reran the relevant tests.

[ilysenko]

Thanks for the quick follow-up — all three points from #1616 are addressed functionally: invalid display metadata is skipped with a warning, disabled local metadata no longer reaches the ASAR or the update-builder, and SHA-256 revisions are accepted.

One blocker before this can merge:

The checked-in catalog.json couples every feature PR to this optional feature. The synchronization test in community-features-in-gui-settings/test.js runs in CI through linux-features/*/test.js, so any PR that adds a feature or changes a public title, description, requires, conflicts or catalogSubfeatures now fails CI until it regenerates a file in this feature's directory. I verified this by merging this branch with current main and the open #1577: the published public catalog matches repository declarations fails. feature.json changed 31 times on main in the last 60 days, so this would hit most feature work, conflict between concurrent PRs, and contradicts the rule that feature changes stay inside their own directory.

Please drop the committed dataset and generator. A smaller design covers both original issues: keep build-time discovery of public manifests (skipping invalid entries with a warning, as you do now), never include disabled local/ entries, and have the package hook write a public-only snapshot (repository entries plus enabled local ones) into the minimal update-builder so disabled public descriptions survive rebuilds. The legacy-snapshot cleanup and the packaged-catalog guard can stay.

Before requesting re-review, please run the complete updated base-to-head diff through your own code-review model, fix every blocker it reports, rerun the review, and repeat until it reports no remaining blockers.

[ilysenko]

Thanks — the blocker is resolved on 0c0ad19. The committed catalog and its sync check are gone, so other feature PRs no longer need to regenerate anything here (verified by merging with #1577: the adjacent tests pass). Build-time discovery skips invalid display metadata, disabled local entries stay out of the ASAR and the update-builder, and the packaged snapshot survives updater rebuilds. CI is green.