v2.0.0: remove pi, relocate npm-global prefix, bump opencode 1.17.2->1.17.4

PR-5 (per docs/CLEANUP-v2.0.0.md). Major release with two breaking changes:

1. pi fully removed (deprecated in v1.17.2). Gone: INSTALL_PI + all PI_*
   build args; with-pi/omos-with-pi/pi-only variants; base-pi-only publish
   job; all ~/.pi entrypoint wiring; the 3 pi smoke/validate/build-variant
   CI jobs. Only base + omos variants remain (4 tags/release).

2. NPM_CONFIG_PREFIX relocated ~/.pi/npm-global -> ~/.config/opencode/npm-global
   (persistent in both compose files). entrypoint-user.sh gains a one-time
   migration shim that copies old global npm packages forward.

Also: opencode 1.17.2->1.17.4; DOCKER_HUB.md gains {{OPENCODE_VERSION}}
placeholder filled by CI at publish time (mirrors pi-devbox); full docs
drift sweep across README/AGENTS/.gitea-README/.env.example/manual-host-publish;
DOCKER_HUB.md regenerated + --check passes; both workflows YAML-valid;
all shell scripts pass bash -n.

.gitea/workflows/docker-publish-split.yml

@@ -7,10 +7,10 @@ name: Publish Docker Image
 #   1. base-decide      compute base hash from Dockerfile.base + rootfs/
 #                       + entrypoints; probe Docker Hub for existing tag.
 #   2. build-base       only if probe missed; multi-arch push of base-<hash>.
-#   3. smoke-* (×4)     amd64-only build of each variant FROMing the base
+#   3. smoke-* (×2)     amd64-only build of each variant FROMing the base
 #                       tag; runs scripts/smoke-test.sh.
 #   4. build-variant-*  multi-arch push of each variant tag (the user-
-#       (×4)            facing release tags, unchanged in shape).
+#       (×2)            facing release tags, unchanged in shape).
 #   5. promote-base-latest  re-tag base-<hash> → base-latest with `crane copy`
 #                       (manifest copy, no rebuild).
 #   6. update-description   patch Docker Hub description (unchanged).
@@ -37,11 +37,6 @@ concurrency:
 env:
   BUILDKIT_PROGRESS: plain
   IMAGE: ${{ vars.DOCKERHUB_USERNAME }}/opencode-devbox
-  # The pi-only variant is built here (single source of truth for the pi stack)
-  # but published into the pi-devbox repo as an internal building-block tag,
-  # NOT under opencode-devbox — so opencode-devbox never shows a tag with no
-  # opencode in it. pi-devbox's own CI FROMs PI_IMAGE:base-pi-only.
-  PI_IMAGE: ${{ vars.DOCKERHUB_USERNAME }}/pi-devbox
   RELEASE_TAG: ${{ github.ref_type == 'tag' && github.ref_name || inputs.release_tag }}
   PROMOTE_LATEST: ${{ github.ref_type == 'tag' && 'true' || inputs.promote_latest }}
 
@@ -107,30 +102,27 @@ jobs:
             echo "Base tag ${IMAGE}:${{ steps.compute.outputs.base_tag }} missing — will build."
           fi
 
-  # ── Phase 1b: resolve floating npm versions (pi, omos) to concrete
+  # ── Phase 1b: resolve floating npm versions (omos) to concrete
   # versions so the variant build-args carry a different value when an
-  # upstream package bumps. Without this, when PI_VERSION / OMOS_VERSION
-  # default to 'latest', the docker/build-push-action build-arg string
-  # is byte-identical across builds, so the resulting layer-hash is
-  # identical, so the registry buildcache silently reuses the layer
-  # from whatever pi/omos version was current when the cache was first
-  # populated. Same class of bug as pi-devbox v0.74.0..v0.75.5 (fixed in
-  # v0.75.5b 2026-05-23). Currently masked here because OPENCODE_VERSION
-  # is hard-coded in Dockerfile.variant and bumps every release —
-  # invalidating the parent-chain cache key for the pi/omos layers — but
-  # that masking would fail the moment we cut a vN.N.Nb opencode-version-
-  # unchanged release that only bumps pi or omos. Fix is preventative.
+  # upstream package bumps. Without this, when OMOS_VERSION defaults to
+  # 'latest', the docker/build-push-action build-arg string is byte-
+  # identical across builds, so the resulting layer-hash is identical,
+  # so the registry buildcache silently reuses the layer from whatever
+  # omos version was current when the cache was first populated. Same
+  # class of bug as pi-devbox v0.74.0..v0.75.5 (fixed in v0.75.5b
+  # 2026-05-23). Currently masked because OPENCODE_VERSION is hard-coded
+  # in Dockerfile.variant and bumps every release — invalidating the
+  # parent-chain cache key for the omos layer — but that masking would
+  # fail the moment we cut a vN.N.Nb opencode-version-unchanged release
+  # that only bumps omos. Fix is preventative.
   resolve-versions:
     runs-on: ubuntu-latest
     container:
       image: catthehacker/ubuntu:act-latest
     outputs:
-      pi_version: ${{ steps.resolve.outputs.pi_version }}
       omos_version: ${{ steps.resolve.outputs.omos_version }}
-      fork_ref: ${{ steps.resolve.outputs.fork_ref }}
-      obsmem_ref: ${{ steps.resolve.outputs.obsmem_ref }}
     steps:
-      - name: Resolve pi + omos versions from npm registry
+      - name: Resolve omos version from npm registry
         id: resolve
         run: |
           set -eu
@@ -139,27 +131,9 @@ jobs:
           # and adds it to PATH only via /etc/environment — which act_runner never
           # sources (it reads the Docker image's ENV instructions, not /etc/environment).
           # curl and jq are both guaranteed present in every job in this workflow.
-          PI_VERSION=$(curl -sf "https://registry.npmjs.org/@earendil-works%2Fpi-coding-agent/latest" | jq -r '.version')
           OMOS_VERSION=$(curl -sf "https://registry.npmjs.org/oh-my-opencode-slim/latest" | jq -r '.version')
-          echo "pi_version=${PI_VERSION}"     >> "$GITHUB_OUTPUT"
           echo "omos_version=${OMOS_VERSION}" >> "$GITHUB_OUTPUT"
-          # Resolve the pi-fork / pi-observational-memory git refs (default
-          # branch master) to concrete commit SHAs so the build-arg string
-          # changes whenever upstream moves — defeating the same registry-
-          # buildcache cache-hit footgun that PI_VERSION/OMOS_VERSION guard
-          # against. The Accept: application/vnd.github.sha media type returns
-          # the bare SHA. Falls back to the branch name if the API is
-          # unreachable/rate-limited (still functional, just cache-stale-prone).
-          FORK_REF=$(curl -sf -H "Accept: application/vnd.github.sha" \
-            "https://api.github.com/repos/elpapi42/pi-fork/commits/master" || echo "master")
-          OBSMEM_REF=$(curl -sf -H "Accept: application/vnd.github.sha" \
-            "https://api.github.com/repos/elpapi42/pi-observational-memory/commits/master" || echo "master")
-          [ -n "$FORK_REF" ]   || FORK_REF=master
-          [ -n "$OBSMEM_REF" ] || OBSMEM_REF=master
-          echo "fork_ref=${FORK_REF}"     >> "$GITHUB_OUTPUT"
-          echo "obsmem_ref=${OBSMEM_REF}" >> "$GITHUB_OUTPUT"
-          echo "Resolved PI_VERSION=${PI_VERSION}, OMOS_VERSION=${OMOS_VERSION}"
-          echo "Resolved PI_FORK_REF=${FORK_REF}, PI_OBSMEM_REF=${OBSMEM_REF}"
+          echo "Resolved OMOS_VERSION=${OMOS_VERSION}"
 
   # ── Phase 2: build & push base (multi-arch), only when needed ──────
   build-base:
@@ -292,7 +266,6 @@ jobs:
             BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
             INSTALL_OPENCODE=true
             INSTALL_OMOS=false
-            INSTALL_PI=false
       - name: Smoke test (amd64)
         run: bash scripts/smoke-test.sh opencode-devbox:smoke-base --variant base
 
@@ -335,158 +308,11 @@ jobs:
             BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
             INSTALL_OPENCODE=true
             INSTALL_OMOS=true
-            INSTALL_PI=false
             OMOS_VERSION=${{ needs.resolve-versions.outputs.omos_version }}
       - env:
           EXPECTED_OMOS_VERSION: ${{ needs.resolve-versions.outputs.omos_version }}
         run: bash scripts/smoke-test.sh opencode-devbox:smoke-omos --variant omos
 
-  smoke-with-pi:
-    needs: [base-decide, build-base, resolve-versions]
-    if: |
-      always() &&
-      needs.base-decide.result == 'success' &&
-      needs.resolve-versions.result == 'success' &&
-      (needs.build-base.result == 'success' || needs.build-base.result == 'skipped')
-    runs-on: ubuntu-latest
-    container:
-      image: catthehacker/ubuntu:act-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: echo 'precedence ::ffff:0:0/96  100' >> /etc/gai.conf
-      - run: |
-          rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
-            /usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
-            /usr/local/lib/android /usr/local/share/powershell \
-            /usr/local/share/chromium /usr/local/share/boost \
-            /usr/lib/jvm 2>/dev/null || true
-          docker system prune -af --volumes || true
-          docker builder prune -af || true
-      - uses: docker/setup-buildx-action@v4
-        with: {driver-opts: network=host}
-      - uses: docker/login-action@v3
-        with:
-          username: ${{ vars.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: docker/build-push-action@v7
-        with:
-          context: .
-          file: Dockerfile.variant
-          platforms: linux/amd64
-          push: false
-          load: true
-          tags: opencode-devbox:smoke-with-pi
-          build-args: |
-            BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
-            INSTALL_OPENCODE=true
-            INSTALL_OMOS=false
-            INSTALL_PI=true
-            PI_VERSION=${{ needs.resolve-versions.outputs.pi_version }}
-            PI_FORK_REF=${{ needs.resolve-versions.outputs.fork_ref }}
-            PI_OBSMEM_REF=${{ needs.resolve-versions.outputs.obsmem_ref }}
-      - env:
-          EXPECTED_PI_VERSION: ${{ needs.resolve-versions.outputs.pi_version }}
-          STRICT_REGISTRATION: "1"
-        run: bash scripts/smoke-test.sh opencode-devbox:smoke-with-pi --variant with-pi
-
-  smoke-omos-with-pi:
-    needs: [base-decide, build-base, resolve-versions]
-    if: |
-      always() &&
-      needs.base-decide.result == 'success' &&
-      needs.resolve-versions.result == 'success' &&
-      (needs.build-base.result == 'success' || needs.build-base.result == 'skipped')
-    runs-on: ubuntu-latest
-    container:
-      image: catthehacker/ubuntu:act-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: echo 'precedence ::ffff:0:0/96  100' >> /etc/gai.conf
-      - run: |
-          rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
-            /usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
-            /usr/local/lib/android /usr/local/share/powershell \
-            /usr/local/share/chromium /usr/local/share/boost \
-            /usr/lib/jvm 2>/dev/null || true
-          docker system prune -af --volumes || true
-          docker builder prune -af || true
-      - uses: docker/setup-buildx-action@v4
-        with: {driver-opts: network=host}
-      - uses: docker/login-action@v3
-        with:
-          username: ${{ vars.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: docker/build-push-action@v7
-        with:
-          context: .
-          file: Dockerfile.variant
-          platforms: linux/amd64
-          push: false
-          load: true
-          tags: opencode-devbox:smoke-omos-with-pi
-          build-args: |
-            BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
-            INSTALL_OPENCODE=true
-            INSTALL_OMOS=true
-            INSTALL_PI=true
-            PI_VERSION=${{ needs.resolve-versions.outputs.pi_version }}
-            OMOS_VERSION=${{ needs.resolve-versions.outputs.omos_version }}
-            PI_FORK_REF=${{ needs.resolve-versions.outputs.fork_ref }}
-            PI_OBSMEM_REF=${{ needs.resolve-versions.outputs.obsmem_ref }}
-      - env:
-          EXPECTED_PI_VERSION: ${{ needs.resolve-versions.outputs.pi_version }}
-          EXPECTED_OMOS_VERSION: ${{ needs.resolve-versions.outputs.omos_version }}
-          STRICT_REGISTRATION: "1"
-        run: bash scripts/smoke-test.sh opencode-devbox:smoke-omos-with-pi --variant omos-with-pi
-
-  smoke-pi-only:
-    needs: [base-decide, build-base, resolve-versions]
-    if: |
-      always() &&
-      needs.base-decide.result == 'success' &&
-      needs.resolve-versions.result == 'success' &&
-      (needs.build-base.result == 'success' || needs.build-base.result == 'skipped')
-    runs-on: ubuntu-latest
-    container:
-      image: catthehacker/ubuntu:act-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: echo 'precedence ::ffff:0:0/96  100' >> /etc/gai.conf
-      - run: |
-          rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
-            /usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
-            /usr/local/lib/android /usr/local/share/powershell \
-            /usr/local/share/chromium /usr/local/share/boost \
-            /usr/lib/jvm 2>/dev/null || true
-          docker system prune -af --volumes || true
-          docker builder prune -af || true
-      - uses: docker/setup-buildx-action@v4
-        with: {driver-opts: network=host}
-      - uses: docker/login-action@v3
-        with:
-          username: ${{ vars.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: docker/build-push-action@v7
-        with:
-          context: .
-          file: Dockerfile.variant
-          platforms: linux/amd64
-          push: false
-          load: true
-          tags: opencode-devbox:smoke-pi-only
-          build-args: |
-            BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
-            INSTALL_OPENCODE=false
-            INSTALL_OMOS=false
-            INSTALL_PI=true
-            PI_VERSION=${{ needs.resolve-versions.outputs.pi_version }}
-            PI_FORK_REF=${{ needs.resolve-versions.outputs.fork_ref }}
-            PI_OBSMEM_REF=${{ needs.resolve-versions.outputs.obsmem_ref }}
-      - env:
-          EXPECTED_PI_VERSION: ${{ needs.resolve-versions.outputs.pi_version }}
-          STRICT_REGISTRATION: "1"
-        run: bash scripts/smoke-test.sh opencode-devbox:smoke-pi-only --variant pi-only
-
   # ── Phase 4: multi-arch publish per variant ────────────────────────
 
   build-variant-base:
@@ -544,7 +370,6 @@ jobs:
                 --build-arg "BASE_IMAGE=${BASE_IMAGE_FULL}" \
                 --build-arg "INSTALL_OPENCODE=true" \
                 --build-arg "INSTALL_OMOS=false" \
-                --build-arg "INSTALL_PI=false" \
                 "${TAG_FLAGS[@]}" \
                 .; then
               echo "==> Attempt ${attempt} succeeded"
@@ -614,7 +439,6 @@ jobs:
                 --build-arg "BASE_IMAGE=${BASE_IMAGE_FULL}" \
                 --build-arg "INSTALL_OPENCODE=true" \
                 --build-arg "INSTALL_OMOS=true" \
-                --build-arg "INSTALL_PI=false" \
                 --build-arg "OMOS_VERSION=${OMOS_VERSION}" \
                 "${TAG_FLAGS[@]}" \
                 .; then
@@ -630,245 +454,12 @@ jobs:
           echo "==> All 3 build+push attempts failed"
           exit 1
 
-  build-variant-with-pi:
-    needs: [base-decide, smoke-with-pi, resolve-versions]
-    runs-on: ubuntu-latest
-    container:
-      image: catthehacker/ubuntu:act-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: echo 'precedence ::ffff:0:0/96  100' >> /etc/gai.conf
-      - run: |
-          rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
-            /usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
-            /usr/local/lib/android /usr/local/share/powershell \
-            /usr/local/share/chromium /usr/local/share/boost \
-            /usr/lib/jvm 2>/dev/null || true
-          docker system prune -af --volumes || true
-          docker builder prune -af || true
-      - uses: docker/setup-qemu-action@v3
-        with: {platforms: arm64}
-      - uses: docker/setup-buildx-action@v4
-        with: {driver-opts: network=host}
-      - uses: docker/login-action@v3
-        with:
-          username: ${{ vars.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Compute version-specific tags
-        id: tags
-        run: |
-          VERSION="${{ env.RELEASE_TAG }}"
-          { echo "tags<<EOF"
-            echo "${IMAGE}:${VERSION}-with-pi"
-            if [ "${{ env.PROMOTE_LATEST }}" = "true" ]; then
-              echo "${IMAGE}:latest-with-pi"
-            fi
-            echo "EOF"
-          } >> "$GITHUB_OUTPUT"
-      - name: Build and push variant (with retry)
-        shell: bash
-        env:
-          TAGS: ${{ steps.tags.outputs.tags }}
-          BASE_IMAGE_FULL: ${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
-          PI_VERSION: ${{ needs.resolve-versions.outputs.pi_version }}
-          FORK_REF: ${{ needs.resolve-versions.outputs.fork_ref }}
-          OBSMEM_REF: ${{ needs.resolve-versions.outputs.obsmem_ref }}
-        run: |
-          set -euo pipefail
-          TAG_FLAGS=()
-          while IFS= read -r t; do [[ -n "$t" ]] && TAG_FLAGS+=( -t "$t" ); done <<< "${TAGS}"
-          # 3-attempt retry (see build-base step for rationale). Variant: with-pi.
-          for attempt in 1 2 3; do
-            echo "==> Build+push attempt ${attempt}/3"
-            if docker buildx build \
-                --platform linux/amd64,linux/arm64 \
-                --file Dockerfile.variant \
-                --push \
-                --build-arg "BASE_IMAGE=${BASE_IMAGE_FULL}" \
-                --build-arg "INSTALL_OPENCODE=true" \
-                --build-arg "INSTALL_OMOS=false" \
-                --build-arg "INSTALL_PI=true" \
-                --build-arg "PI_VERSION=${PI_VERSION}" \
-                --build-arg "PI_FORK_REF=${FORK_REF}" \
-                --build-arg "PI_OBSMEM_REF=${OBSMEM_REF}" \
-                "${TAG_FLAGS[@]}" \
-                .; then
-              echo "==> Attempt ${attempt} succeeded"
-              exit 0
-            fi
-            if [[ "${attempt}" -lt 3 ]]; then
-              backoff=$(( attempt * 15 ))
-              echo "==> Attempt ${attempt} failed, sleeping ${backoff}s before retry"
-              sleep "${backoff}"
-            fi
-          done
-          echo "==> All 3 build+push attempts failed"
-          exit 1
-
-  build-variant-omos-with-pi:
-    needs: [base-decide, smoke-omos-with-pi, resolve-versions]
-    runs-on: ubuntu-latest
-    container:
-      image: catthehacker/ubuntu:act-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: echo 'precedence ::ffff:0:0/96  100' >> /etc/gai.conf
-      - run: |
-          rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
-            /usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
-            /usr/local/lib/android /usr/local/share/powershell \
-            /usr/local/share/chromium /usr/local/share/boost \
-            /usr/lib/jvm 2>/dev/null || true
-          docker system prune -af --volumes || true
-          docker builder prune -af || true
-      - uses: docker/setup-qemu-action@v3
-        with: {platforms: arm64}
-      - uses: docker/setup-buildx-action@v4
-        with: {driver-opts: network=host}
-      - uses: docker/login-action@v3
-        with:
-          username: ${{ vars.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Compute version-specific tags
-        id: tags
-        run: |
-          VERSION="${{ env.RELEASE_TAG }}"
-          { echo "tags<<EOF"
-            echo "${IMAGE}:${VERSION}-omos-with-pi"
-            if [ "${{ env.PROMOTE_LATEST }}" = "true" ]; then
-              echo "${IMAGE}:latest-omos-with-pi"
-            fi
-            echo "EOF"
-          } >> "$GITHUB_OUTPUT"
-      - name: Build and push variant (with retry)
-        shell: bash
-        env:
-          TAGS: ${{ steps.tags.outputs.tags }}
-          BASE_IMAGE_FULL: ${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
-          PI_VERSION: ${{ needs.resolve-versions.outputs.pi_version }}
-          OMOS_VERSION: ${{ needs.resolve-versions.outputs.omos_version }}
-          FORK_REF: ${{ needs.resolve-versions.outputs.fork_ref }}
-          OBSMEM_REF: ${{ needs.resolve-versions.outputs.obsmem_ref }}
-        run: |
-          set -euo pipefail
-          TAG_FLAGS=()
-          while IFS= read -r t; do [[ -n "$t" ]] && TAG_FLAGS+=( -t "$t" ); done <<< "${TAGS}"
-          # 3-attempt retry (see build-base step for rationale). Variant: omos-with-pi.
-          for attempt in 1 2 3; do
-            echo "==> Build+push attempt ${attempt}/3"
-            if docker buildx build \
-                --platform linux/amd64,linux/arm64 \
-                --file Dockerfile.variant \
-                --push \
-                --build-arg "BASE_IMAGE=${BASE_IMAGE_FULL}" \
-                --build-arg "INSTALL_OPENCODE=true" \
-                --build-arg "INSTALL_OMOS=true" \
-                --build-arg "INSTALL_PI=true" \
-                --build-arg "PI_VERSION=${PI_VERSION}" \
-                --build-arg "OMOS_VERSION=${OMOS_VERSION}" \
-                --build-arg "PI_FORK_REF=${FORK_REF}" \
-                --build-arg "PI_OBSMEM_REF=${OBSMEM_REF}" \
-                "${TAG_FLAGS[@]}" \
-                .; then
-              echo "==> Attempt ${attempt} succeeded"
-              exit 0
-            fi
-            if [[ "${attempt}" -lt 3 ]]; then
-              backoff=$(( attempt * 15 ))
-              echo "==> Attempt ${attempt} failed, sleeping ${backoff}s before retry"
-              sleep "${backoff}"
-            fi
-          done
-          echo "==> All 3 build+push attempts failed"
-          exit 1
-
-  build-variant-pi-only:
-    needs: [base-decide, smoke-pi-only, resolve-versions]
-    runs-on: ubuntu-latest
-    container:
-      image: catthehacker/ubuntu:act-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: echo 'precedence ::ffff:0:0/96  100' >> /etc/gai.conf
-      - run: |
-          rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
-            /usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
-            /usr/local/lib/android /usr/local/share/powershell \
-            /usr/local/share/chromium /usr/local/share/boost \
-            /usr/lib/jvm 2>/dev/null || true
-          docker system prune -af --volumes || true
-          docker builder prune -af || true
-      - uses: docker/setup-qemu-action@v3
-        with: {platforms: arm64}
-      - uses: docker/setup-buildx-action@v4
-        with: {driver-opts: network=host}
-      - uses: docker/login-action@v3
-        with:
-          username: ${{ vars.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Compute version-specific tags
-        id: tags
-        run: |
-          # Option B: push the pi-only build into the pi-devbox repo as an
-          # internal building-block tag (base-pi-only[-<version>]), NOT under
-          # opencode-devbox. pi-devbox's CI FROMs ${PI_IMAGE}:base-pi-only.
-          VERSION="${{ env.RELEASE_TAG }}"
-          { echo "tags<<EOF"
-            echo "${PI_IMAGE}:base-pi-only-${VERSION}"
-            if [ "${{ env.PROMOTE_LATEST }}" = "true" ]; then
-              echo "${PI_IMAGE}:base-pi-only"
-            fi
-            echo "EOF"
-          } >> "$GITHUB_OUTPUT"
-      - name: Build and push variant (with retry)
-        shell: bash
-        env:
-          TAGS: ${{ steps.tags.outputs.tags }}
-          BASE_IMAGE_FULL: ${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
-          PI_VERSION: ${{ needs.resolve-versions.outputs.pi_version }}
-          FORK_REF: ${{ needs.resolve-versions.outputs.fork_ref }}
-          OBSMEM_REF: ${{ needs.resolve-versions.outputs.obsmem_ref }}
-        run: |
-          set -euo pipefail
-          TAG_FLAGS=()
-          while IFS= read -r t; do [[ -n "$t" ]] && TAG_FLAGS+=( -t "$t" ); done <<< "${TAGS}"
-          # 3-attempt retry (see build-base step for rationale). Variant: pi-only.
-          for attempt in 1 2 3; do
-            echo "==> Build+push attempt ${attempt}/3"
-            if docker buildx build \
-                --platform linux/amd64,linux/arm64 \
-                --file Dockerfile.variant \
-                --push \
-                --build-arg "BASE_IMAGE=${BASE_IMAGE_FULL}" \
-                --build-arg "INSTALL_OPENCODE=false" \
-                --build-arg "INSTALL_OMOS=false" \
-                --build-arg "INSTALL_PI=true" \
-                --build-arg "PI_VERSION=${PI_VERSION}" \
-                --build-arg "PI_FORK_REF=${FORK_REF}" \
-                --build-arg "PI_OBSMEM_REF=${OBSMEM_REF}" \
-                "${TAG_FLAGS[@]}" \
-                .; then
-              echo "==> Attempt ${attempt} succeeded"
-              exit 0
-            fi
-            if [[ "${attempt}" -lt 3 ]]; then
-              backoff=$(( attempt * 15 ))
-              echo "==> Attempt ${attempt} failed, sleeping ${backoff}s before retry"
-              sleep "${backoff}"
-            fi
-          done
-          echo "==> All 3 build+push attempts failed"
-          exit 1
-
   # ── Phase 5: promote base-<hash> → base-latest (manifest copy only) ─
   promote-base-latest:
     needs:
       - base-decide
       - build-variant-base
       - build-variant-omos
-      - build-variant-with-pi
-      - build-variant-omos-with-pi
-      - build-variant-pi-only
     # Skip on cache-hit base builds: when need_build=false, base-latest
     # already points at the same digest as base-<hash>, so the retag is
     # a tautology and any transient failure of it is purely cosmetic.
@@ -877,7 +468,7 @@ jobs:
     #
     # `always()` wrapper + explicit base-variant success check protects
     # against the gitea-Actions default of "skipped need => skip dependent":
-    # a partial-publish run (e.g., omos-with-pi smoke fails) shouldn't
+    # a partial-publish run (e.g., omos smoke fails) shouldn't
     # prevent the base-latest alias from advancing on a real base rebuild.
     if: |
       always() &&
@@ -919,11 +510,8 @@ jobs:
     needs:
       - build-variant-base
       - build-variant-omos
-      - build-variant-with-pi
-      - build-variant-omos-with-pi
-      - build-variant-pi-only
     # Run when at least the base variant published — don't let a single
-    # variant failure (e.g., omos-with-pi smoke threshold) prevent Hub
+    # variant failure (e.g., omos smoke threshold) prevent Hub
     # description refresh for the other variants that did publish.
     # Without this `always()` wrapper, gitea Actions' default behavior
     # of "skipped need => skip dependent" cascades from any failed/
@@ -940,6 +528,24 @@ jobs:
       - uses: actions/checkout@v4
       - name: Update Docker Hub description
         run: |
+          # Substitute {{OPENCODE_VERSION}} placeholders in DOCKER_HUB.md so
+          # the Hub page always shows which opencode version is baked into
+          # :latest. The placeholder lives in DOCKER_HUB.md (committed); CI
+          # fills it at publish time from the pinned ARG in
+          # Dockerfile.variant — the same value that was baked into the
+          # image — so the page and the image never drift. (Mirrors the
+          # {{PI_VERSION}} pattern in pi-devbox's docker-publish.yml.)
+          OPENCODE_VERSION=$(sed -n 's/^ARG OPENCODE_VERSION=//p' Dockerfile.variant | head -1)
+          if [ -z "${OPENCODE_VERSION}" ]; then
+            echo "::error::Could not extract OPENCODE_VERSION from Dockerfile.variant"
+            exit 1
+          fi
+          cp DOCKER_HUB.md /tmp/hub-full.md
+          sed -i "s/{{OPENCODE_VERSION}}/${OPENCODE_VERSION}/g" /tmp/hub-full.md
+          if grep -q '{{OPENCODE_VERSION}}' /tmp/hub-full.md; then
+            echo "::error::DOCKER_HUB.md still contains unsubstituted {{OPENCODE_VERSION}} markers"
+            exit 1
+          fi
           TOKEN=$(curl -s -X POST https://hub.docker.com/v2/auth/token \
             -H "Content-Type: application/json" \
             -d '{"identifier":"${{ vars.DOCKERHUB_USERNAME }}","secret":"${{ secrets.DOCKERHUB_TOKEN }}"}' \
@@ -949,7 +555,7 @@ jobs:
             exit 1
           fi
           HTTP_CODE=$(jq -n \
-            --rawfile full DOCKER_HUB.md \
+            --rawfile full /tmp/hub-full.md \
             --arg short "Portable AI dev environment for opencode. Debian-based with git, Node.js, AWS CLI, and SSH support." \
             '{"full_description": $full, "description": $short}' | \
             curl -s -o /tmp/hub-response.txt -w "%{http_code}" -X PATCH \