Context

The helper's launchd job runs leashd from /Applications/Short Leash.app (leash_core::setup), so Short Leash only works from there. People often open the app straight from its disk image or from Downloads instead of dragging it across; it then started leashd from a read-only, translocated copy, and the disk image couldn't be ejected while it ran. The disk image's window was also plain: release builds run with CI set, which makes Tauri skip the Finder step that lays the window out.

Decision

On macOS, a release build that isn't running from /Applications itself (a disk image, Downloads, ~/Applications, or a copy macOS translocated) starts nothing: no daemon, no menu bar item, no updater. Its main window becomes the install screen (src-tauri/src/install.rs, screens/install/). Holding Teddy and letting go, or choosing Install, copies the app beside its final place in /Applications with ditto --noqtn, moves any copy already there to the Trash, renames the new one into place, then quits. A shell it leaves behind waits for it to exit, opens Short Leash from /Applications and ejects the disk images that hold it. The progress shown is the copy's.

The copy runs as the person, never as root (invariant 1). When the account can't write to /Applications, the screen opens Applications and the disk image in Finder and quits; Finder moves the app and asks for an administrator's password itself. Quarantine isn't copied: macOS checked this copy when it opened it, and a quarantined copy would ask again on its first launch from Applications.

The disk image's window is laid out by Tauri's own Finder step in CI too, by setting TAURI_BUNDLER_DMG_IGNORE_CI=true on the macOS jobs; scripts/check-dmg-layout.sh fails the build when the layout didn't land. Its background and the Windows installer's sidebar and header are drawn from Teddy's grids by pnpm -C packages/brand installer (0092), with no words in them.

Consequences

Opening Short Leash from the disk image works, and installs it properly, instead of running from a place the helper can't find.
Debug builds never show the screen (just dev runs from target/), so it's checked in the mocked UI (?install=older, finder, fails) and by hand with a release build.
A Short Leash that's already running from Applications takes over a launch from the disk image (one instance at a time), so the screen only shows when it isn't running.
Laying the window out still goes through Finder's AppleScript on the runner, which can time out; the check makes that a failed build rather than a plain window. A separate disk image tool would avoid Finder, but would be another dependency and another signing and notarization step.
The install screen and the first-launch moment are motion the UI rules list by name.