Lock in Linux hook stdin BrokenPipe coverage

Latest main already contains the functional BrokenPipe tolerance in
plugins::hooks::CommandWithStdin::output_with_stdin, but the only
coverage for the original CI failure was the higher-level plugin hook
test. Add a deterministic regression that exercises the exact low-level
EPIPE path by spawning a hook child that closes stdin immediately while
the parent writes an oversized payload.

This keeps the real root cause explicit: Linux surfaced BrokenPipe from
the parent's stdin write after the hook child closed fd 0 early. Missing
execute bits were not the primary bug.

Constraint: Keep the change surgical on top of latest main
Rejected: Re-open the production code path | latest main already contains the runtime fix
Rejected: Inflate HookRunner payloads in the regression | HOOK_* env injection hit ARG_MAX before the pipe path
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep BrokenPipe coverage near CommandWithStdin so future refactors do not regress the Linux EPIPE path
Tested: cargo test -p plugins hooks::tests::collects_and_runs_hooks_from_enabled_plugins -- --exact (10x)
Tested: cargo test -p plugins hooks::tests::output_with_stdin_tolerates_broken_pipe_when_child_closes_stdin_early -- --exact (10x)
Tested: cargo test --workspace
Not-tested: GitHub Actions rerun on the PR branch

.claw.json

@@ -1,5 +0,0 @@
-{
-  "aliases": {
-    "quick": "haiku"
-  }
-}

.gitignore

@@ -5,11 +5,3 @@ archive/
 # Claude Code local artifacts
 .claude/settings.local.json
 .claude/sessions/
-# Claw Code local artifacts
-.claw/settings.local.json
-.claw/sessions/
-# #160/#166: default session storage directory (flush-transcript output,
-# dogfood runs, etc.). Claws specifying --directory elsewhere are fine.
-.port_sessions/
-.clawhip/
-status-help.txt

CLAUDE.md

@@ -1,195 +1,21 @@
-# CLAUDE.md — Python Reference Implementation
+# CLAUDE.md
 
-**This file guides work on `src/` and `tests/` — the Python reference harness for claw-code protocol.**
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
 
-The production CLI lives in `rust/`; this directory (`src/`, `tests/`, `.py` files) is a **protocol validation and dogfood surface**.
+## Detected stack
+- Languages: Rust.
+- Frameworks: none detected from the supported starter markers.
 
-## What this Python harness does
-
-**Machine-first orchestration layer** — proves that the claw-code JSON protocol is:
-- Deterministic and recoverable (every output is reproducible)
-- Self-describing (SCHEMAS.md documents every field)
-- Clawable (external agents can build ONE error handler for all commands)
-
-## Stack
-- **Language:** Python 3.13+
-- **Dependencies:** minimal (no frameworks; pure stdlibs + attrs/dataclasses)
-- **Test runner:** pytest
-- **Protocol contract:** SCHEMAS.md (machine-readable JSON envelope)
-
-## Quick start
-
-```bash
-# 1. Install dependencies (if not already in venv)
-python3 -m venv .venv && source .venv/bin/activate
-# (dependencies minimal; standard library mostly)
-
-# 2. Run tests
-python3 -m pytest tests/ -q
-
-# 3. Try a command
-python3 -m src.main bootstrap "hello" --output-format json | python3 -m json.tool
-```
-
-## Verification workflow
-
-```bash
-# Unit tests (fast)
-python3 -m pytest tests/ -q 2>&1 | tail -3
-
-# Type checking (optional but recommended)
-python3 -m mypy src/ --ignore-missing-imports 2>&1 | tail -5
-```
+## Verification
+- Run Rust verification from `rust/`: `cargo fmt`, `cargo clippy --workspace --all-targets -- -D warnings`, `cargo test --workspace`
+- `src/` and `tests/` are both present; update both surfaces together when behavior changes.
 
 ## Repository shape
+- `rust/` contains the Rust workspace and active CLI/runtime implementation.
+- `src/` contains source files that should stay consistent with generated guidance and tests.
+- `tests/` contains validation surfaces that should be reviewed alongside code changes.
 
-- **`src/`** — Python reference harness implementing SCHEMAS.md protocol
-  - `main.py` — CLI entry point; all 14 clawable commands
-  - `query_engine.py` — core TurnResult / QueryEngineConfig
-  - `runtime.py` — PortRuntime; turn loop + cancellation (#164 Stage A/B)
-  - `session_store.py` — session persistence
-  - `transcript.py` — turn transcript assembly
-  - `commands.py`, `tools.py` — simulated command/tool trees
-  - `models.py` — PermissionDenial, UsageSummary, etc.
-
-- **`tests/`** — comprehensive protocol validation (22 baseline → 192 passing as of 2026-04-22)
-  - `test_cli_parity_audit.py` — proves all 14 clawable commands accept --output-format
-  - `test_json_envelope_field_consistency.py` — validates SCHEMAS.md contract
-  - `test_cancel_observed_field.py` — #164 Stage B: cancellation observability + safe-to-reuse semantics
-  - `test_run_turn_loop_*.py` — turn loop behavior (timeout, cancellation, continuation, permissions)
-  - `test_submit_message_*.py` — budget, cancellation contracts
-  - `test_*_cli.py` — command-specific JSON output validation
-
-- **`SCHEMAS.md`** — canonical JSON contract
-  - Common fields (all envelopes): timestamp, command, exit_code, output_format, schema_version
-  - Error envelope shape
-  - Not-found envelope shape
-  - Per-command success schemas (14 commands documented)
-  - Turn Result fields (including cancel_observed as of #164 Stage B)
-
-- **`.gitignore`** — excludes `.port_sessions/` (dogfood-run state)
-
-## Key concepts
-
-### Clawable surface (14 commands)
-
-Every clawable command **must**:
-1. Accept `--output-format {text,json}`
-2. Return JSON envelopes matching SCHEMAS.md
-3. Use common fields (timestamp, command, exit_code, output_format, schema_version)
-4. Exit 0 on success, 1 on error/not-found, 2 on timeout
-
-**Commands:** list-sessions, delete-session, load-session, flush-transcript, show-command, show-tool, exec-command, exec-tool, route, bootstrap, command-graph, tool-pool, bootstrap-graph, turn-loop
-
-**Validation:** `test_cli_parity_audit.py` auto-tests all 14 for --output-format acceptance.
-
-### OPT_OUT surfaces (12 commands)
-
-Explicitly exempt from --output-format requirement (for now):
-- Rich-Markdown reports: summary, manifest, parity-audit, setup-report
-- List commands with query filters: subsystems, commands, tools
-- Simulation/debug: remote-mode, ssh-mode, teleport-mode, direct-connect-mode, deep-link-mode
-
-**Future work:** audit OPT_OUT surfaces for JSON promotion (post-#164).
-
-### Protocol layers
-
-**Coverage (#167–#170):** All clawable commands emit JSON
-**Enforcement (#171):** Parity CI prevents new commands skipping JSON
-**Documentation (#172):** SCHEMAS.md locks field contract
-**Alignment (#173):** Test framework validates docs ↔ code match
-**Field evolution (#164 Stage B):** cancel_observed proves protocol extensibility
-
-## Testing & coverage
-
-### Run full suite
-```bash
-python3 -m pytest tests/ -q
-```
-
-### Run one test file
-```bash
-python3 -m pytest tests/test_cancel_observed_field.py -v
-```
-
-### Run one test
-```bash
-python3 -m pytest tests/test_cancel_observed_field.py::TestCancelObservedField::test_default_value_is_false -v
-```
-
-### Check coverage (optional)
-```bash
-python3 -m pip install coverage  # if not already installed
-python3 -m coverage run -m pytest tests/
-python3 -m coverage report --skip-covered
-```
-
-Target: >90% line coverage for src/ (currently ~85%).
-
-## Common workflows
-
-### Add a new clawable command
-
-1. Add parser in `main.py` (argparse)
-2. Add `--output-format` flag
-3. Emit JSON envelope using `wrap_json_envelope(data, command_name)`
-4. Add command to CLAWABLE_SURFACES in test_cli_parity_audit.py
-5. Document in SCHEMAS.md (schema + example)
-6. Write test in tests/test_*_cli.py or tests/test_json_envelope_field_consistency.py
-7. Run full suite to confirm parity
-
-### Modify TurnResult or protocol fields
-
-1. Update dataclass in `query_engine.py`
-2. Update SCHEMAS.md with new field + rationale
-3. Write test in `tests/test_json_envelope_field_consistency.py` that validates field presence
-4. Update all places that construct TurnResult (grep for `TurnResult(`)
-5. Update bootstrap/turn-loop JSON builders in main.py
-6. Run `tests/` to ensure no regressions
-
-### Promote an OPT_OUT surface to CLAWABLE
-
-**Prerequisite:** Real demand signal logged in `OPT_OUT_DEMAND_LOG.md` (threshold: 2+ independent signals per surface). Speculative promotions are not allowed.
-
-Once demand is evidenced:
-1. Add --output-format flag to argparse
-2. Emit wrap_json_envelope() output in JSON path
-3. Move command from OPT_OUT_SURFACES to CLAWABLE_SURFACES
-4. Document in SCHEMAS.md
-5. Write test for JSON output
-6. Run parity audit to confirm no regressions
-7. Update `OPT_OUT_DEMAND_LOG.md` to mark signal as resolved
-
-### File a demand signal (when a claw actually needs JSON from an OPT_OUT surface)
-
-1. Open `OPT_OUT_DEMAND_LOG.md`
-2. Find the surface's entry under Group A/B/C
-3. Append a dated entry with Source, Use Case, and Markdown-alternative-checked explanation
-4. If this is the 2nd signal for the same surface, file a promotion pinpoint in ROADMAP.md
-
-## Dogfood principles
-
-The Python harness is continuously dogfood-tested:
-- Every cycle ships to `main` with detailed commit messages
-- New tests are written before/alongside implementation
-- Test suite must pass before pushing (zero-regression principle)
-- Commits grouped by pinpoint (#159, #160, ..., #174)
-- Failure modes classified per exit code: 0=success, 1=error, 2=timeout
-
-## Protocol governance
-
-- **SCHEMAS.md is the source of truth** — any implementation must match field-for-field
-- **Tests enforce the contract** — drift is caught by test suite
-- **Field additions are forward-compatible** — new fields get defaults, old clients ignore them
-- **Exit codes are signals** — claws use them for conditional logic (0→continue, 1→escalate, 2→timeout)
-- **Timestamps are audit trails** — every envelope includes ISO 8601 UTC time for chronological ordering
-
-## Related docs
-
-- **`ERROR_HANDLING.md`** — Unified error-handling pattern for claws (one handler for all 14 clawable commands)
-- **`SCHEMAS.md`** — JSON protocol specification (read before implementing)
-- **`OPT_OUT_AUDIT.md`** — Governance for the 12 non-clawable surfaces
-- **`OPT_OUT_DEMAND_LOG.md`** — Active survey recording real demand signals (evidence base for decisions)
-- **`ROADMAP.md`** — macro roadmap and macro pain points
-- **`PHILOSOPHY.md`** — system design intent
-- **`PARITY.md`** — status of Python ↔ Rust protocol equivalence
+## Working agreement
+- Prefer small, reviewable changes and keep generated bootstrap files aligned with actual repo workflows.
+- Keep shared defaults in `.claude.json`; reserve `.claude/settings.local.json` for machine-local overrides.
+- Do not overwrite existing `CLAUDE.md` content automatically; update it intentionally when repo workflows change.

ERROR_HANDLING.md

@@ -1,489 +0,0 @@
-# Error Handling for Claw Code Claws
-
-**Purpose:** Build a unified error handler for orchestration code using claw-code as a library or subprocess.
-
-After cycles #178–#179 (parser-front-door hole closure), claw-code's error interface is deterministic, machine-readable, and clawable: **one error handler for all 14 clawable commands.**
-
----
-
-## Quick Reference: Exit Codes and Envelopes
-
-Every clawable command returns JSON on stdout when `--output-format json` is requested.
-
-**IMPORTANT:** The exit code contract below applies **only when `--output-format json` is explicitly set**. Text mode follows argparse conventions and may return different exit codes (e.g., `2` for argparse parse errors). Claws consuming claw-code as a subprocess MUST always pass `--output-format json` to get the documented contract.
-
-| Exit Code | Meaning | Response Format | Example |
-|---|---|---|---|
-| **0** | Success | `{success fields}` | `{"session_id": "...", "loaded": true}` |
-| **1** | Error / Not Found | `{error: {kind, message, ...}}` | `{"error": {"kind": "session_not_found", ...}}` |
-| **2** | Timeout | `{final_stop_reason: "timeout", final_cancel_observed: ...}` | `{"final_stop_reason": "timeout", ...}` |
-
-### Text mode vs JSON mode exit codes
-
-| Scenario | Text mode exit | JSON mode exit | Why |
-|---|---|---|---|
-| Unknown subcommand | 2 (argparse default) | 1 (parse error envelope) | argparse defaults to 2; JSON mode normalizes to contract |
-| Missing required arg | 2 (argparse default) | 1 (parse error envelope) | Same reason |
-| Session not found | 1 | 1 | Application-level error, same in both |
-| Command executed OK | 0 | 0 | Success path, identical |
-| Turn-loop timeout | 2 | 2 | Identical (#161 implementation) |
-
-**Practical rule for claws:** always pass `--output-format json`. This eliminates text-mode surprises and gives you the documented exit-code contract for every error path.
-
----
-
-## One-Handler Pattern
-
-Build a single error-recovery function that works for all 14 clawable commands:
-
-```python
-import subprocess
-import json
-import sys
-from typing import Any
-
-def run_claw_command(command: list[str], timeout_seconds: float = 30.0) -> dict[str, Any]:
-    """
-    Run a clawable claw-code command and handle errors uniformly.
-    
-    Args:
-        command: Full command list, e.g. ["claw", "load-session", "id", "--output-format", "json"]
-        timeout_seconds: Wall-clock timeout
-    
-    Returns:
-        Parsed JSON result from stdout
-    
-    Raises:
-        ClawError: Classified by error.kind (parse, session_not_found, runtime, timeout, etc.)
-    """
-    try:
-        result = subprocess.run(
-            command,
-            capture_output=True,
-            text=True,
-            timeout=timeout_seconds,
-        )
-    except subprocess.TimeoutExpired:
-        raise ClawError(
-            kind='subprocess_timeout',
-            message=f'Command exceeded {timeout_seconds}s wall-clock timeout',
-            retryable=True,  # Caller's decision; subprocess timeout != engine timeout
-        )
-    
-    # Parse JSON (valid for all success/error/timeout paths in claw-code)
-    try:
-        envelope = json.loads(result.stdout)
-    except json.JSONDecodeError as err:
-        raise ClawError(
-            kind='parse_failure',
-            message=f'Command output is not JSON: {err}',
-            hint='Check that --output-format json is being passed',
-            retryable=False,
-        )
-    
-    # Classify by exit code and error.kind
-    match (result.returncode, envelope.get('error', {}).get('kind')):
-        case (0, _):
-            # Success
-            return envelope
-        
-        case (1, 'parse'):
-            # #179: argparse error — typically a typo or missing required argument
-            raise ClawError(
-                kind='parse',
-                message=envelope['error']['message'],
-                hint=envelope['error'].get('hint'),
-                retryable=False,  # Typos don't fix themselves
-            )
-        
-        case (1, 'session_not_found'):
-            # Common: load-session on nonexistent ID
-            raise ClawError(
-                kind='session_not_found',
-                message=envelope['error']['message'],
-                session_id=envelope.get('session_id'),
-                retryable=False,  # Session won't appear on retry
-            )
-        
-        case (1, 'filesystem'):
-            # Directory missing, permission denied, disk full
-            raise ClawError(
-                kind='filesystem',
-                message=envelope['error']['message'],
-                retryable=True,  # Might be transient (disk space, NFS flake)
-            )
-        
-        case (1, 'runtime'):
-            # Generic engine error (unexpected exception, malformed input, etc.)
-            raise ClawError(
-                kind='runtime',
-                message=envelope['error']['message'],
-                retryable=envelope['error'].get('retryable', False),
-            )
-        
-        case (1, _):
-            # Catch-all for any new error.kind values
-            raise ClawError(
-                kind=envelope['error']['kind'],
-                message=envelope['error']['message'],
-                retryable=envelope['error'].get('retryable', False),
-            )
-        
-        case (2, _):
-            # Timeout (engine was asked to cancel and had fair chance to observe)
-            cancel_observed = envelope.get('final_cancel_observed', False)
-            raise ClawError(
-                kind='timeout',
-                message=f'Turn exceeded timeout (cancel_observed={cancel_observed})',
-                cancel_observed=cancel_observed,
-                retryable=True,  # Caller can retry with a fresh session
-                safe_to_reuse_session=(cancel_observed is True),
-            )
-        
-        case (exit_code, _):
-            # Unexpected exit code
-            raise ClawError(
-                kind='unexpected_exit_code',
-                message=f'Unexpected exit code {exit_code}',
-                retryable=False,
-            )
-
-
-class ClawError(Exception):
-    """Unified error type for claw-code commands."""
-    
-    def __init__(
-        self,
-        kind: str,
-        message: str,
-        hint: str | None = None,
-        retryable: bool = False,
-        cancel_observed: bool = False,
-        safe_to_reuse_session: bool = False,
-        session_id: str | None = None,
-    ):
-        self.kind = kind
-        self.message = message
-        self.hint = hint
-        self.retryable = retryable
-        self.cancel_observed = cancel_observed
-        self.safe_to_reuse_session = safe_to_reuse_session
-        self.session_id = session_id
-        super().__init__(self.message)
-    
-    def __str__(self) -> str:
-        parts = [f"{self.kind}: {self.message}"]
-        if self.hint:
-            parts.append(f"Hint: {self.hint}")
-        if self.retryable:
-            parts.append("(retryable)")
-        if self.cancel_observed:
-            parts.append(f"(safe_to_reuse_session={self.safe_to_reuse_session})")
-        return "\n".join(parts)
-```
-
----
-
-## Practical Recovery Patterns
-
-### Pattern 1: Retry on transient errors
-
-```python
-from time import sleep
-
-def run_with_retry(
-    command: list[str],
-    max_attempts: int = 3,
-    backoff_seconds: float = 0.5,
-) -> dict:
-    """Retry on transient errors (filesystem, timeout)."""
-    for attempt in range(1, max_attempts + 1):
-        try:
-            return run_claw_command(command)
-        except ClawError as err:
-            if not err.retryable:
-                raise  # Non-transient; fail fast
-            
-            if attempt == max_attempts:
-                raise  # Last attempt; propagate
-            
-            print(f"Attempt {attempt} failed ({err.kind}); retrying in {backoff_seconds}s...", file=sys.stderr)
-            sleep(backoff_seconds)
-            backoff_seconds *= 1.5  # exponential backoff
-    
-    raise RuntimeError("Unreachable")
-```
-
-### Pattern 2: Reuse session after timeout (if safe)
-
-```python
-def run_with_timeout_recovery(
-    command: list[str],
-    timeout_seconds: float = 30.0,
-    fallback_timeout: float = 60.0,
-) -> dict:
-    """
-    On timeout, check cancel_observed. If True, the session is safe for retry.
-    If False, the session is potentially wedged; use a fresh one.
-    """
-    try:
-        return run_claw_command(command, timeout_seconds=timeout_seconds)
-    except ClawError as err:
-        if err.kind != 'timeout':
-            raise
-        
-        if err.safe_to_reuse_session:
-            # Engine saw the cancel signal; safe to reuse this session with a larger timeout
-            print(f"Timeout observed (cancel_observed=true); retrying with {fallback_timeout}s...", file=sys.stderr)
-            return run_claw_command(command, timeout_seconds=fallback_timeout)
-        else:
-            # Engine didn't see the cancel signal; session may be wedged
-            print(f"Timeout not observed (cancel_observed=false); session is potentially wedged", file=sys.stderr)
-            raise  # Caller should allocate a fresh session
-```
-
-### Pattern 3: Detect parse errors (typos in command-line construction)
-
-```python
-def validate_command_before_dispatch(command: list[str]) -> None:
-    """
-    Dry-run with --help to detect obvious syntax errors before dispatching work.
-    
-    This is cheap (no API call) and catches typos like:
-    - Unknown subcommand: `claw typo-command`
-    - Unknown flag: `claw bootstrap --invalid-flag`
-    - Missing required argument: `claw load-session` (no session_id)
-    """
-    help_cmd = command + ['--help']
-    try:
-        result = subprocess.run(help_cmd, capture_output=True, timeout=2.0)
-        if result.returncode != 0:
-            print(f"Warning: {' '.join(help_cmd)} returned {result.returncode}", file=sys.stderr)
-            print("(This doesn't prove the command is invalid, just that --help failed)", file=sys.stderr)
-    except subprocess.TimeoutExpired:
-        pass  # --help shouldn't hang, but don't block on it
-```
-
-### Pattern 4: Log and forward errors to observability
-
-```python
-import logging
-
-logger = logging.getLogger(__name__)
-
-def run_claw_with_logging(command: list[str]) -> dict:
-    """Run command and log errors for observability."""
-    try:
-        result = run_claw_command(command)
-        logger.info(f"Claw command succeeded: {' '.join(command)}")
-        return result
-    except ClawError as err:
-        logger.error(
-            "Claw command failed",
-            extra={
-                'command': ' '.join(command),
-                'error_kind': err.kind,
-                'error_message': err.message,
-                'retryable': err.retryable,
-                'cancel_observed': err.cancel_observed,
-            },
-        )
-        raise
-```
-
----
-
-## Error Kinds (Enumeration)
-
-After cycles #178–#179, the complete set of `error.kind` values is:
-
-| Kind | Exit Code | Meaning | Retryable | Notes |
-|---|---|---|---|---|
-| **parse** | 1 | Argparse error (unknown command, missing arg, invalid flag) | No | Real error message included (#179); valid choices list for discoverability |
-| **session_not_found** | 1 | load-session target doesn't exist | No | session_id and directory included in envelope |
-| **filesystem** | 1 | Directory missing, permission denied, disk full | Yes | Transient issues (disk space, NFS flake) can be retried |
-| **runtime** | 1 | Engine error (unexpected exception, malformed input) | Depends | `error.retryable` field in envelope specifies |
-| **timeout** | 2 | Engine timeout with cooperative cancellation | Yes* | `cancel_observed` field signals session safety (#164) |
-
-*Retry safety depends on `cancel_observed`:
-- `cancel_observed=true` → session is safe to reuse
-- `cancel_observed=false` → session may be wedged; allocate fresh one
-
----
-
-## What We Did to Make This Work
-
-### Cycle #178: Parse-Error Envelope
-
-**Problem:** `claw nonexistent --output-format json` returned argparse help text on stderr instead of an envelope.
-**Solution:** Catch argparse `SystemExit` in JSON mode and emit a structured error envelope.
-**Benefit:** Claws no longer need to parse human help text to understand parse errors.
-
-### Cycle #179: Stderr Hygiene + Real Error Message
-
-**Problem:** Even after #178, argparse usage was leaking to stderr AND the envelope message was generic ("invalid command or argument").
-**Solution:** Monkey-patch `parser.error()` in JSON mode to raise an internal exception, preserving argparse's real message verbatim. Suppress stderr entirely in JSON mode.
-**Benefit:** Claws see one stream (stdout), one envelope, and real error context (e.g., "invalid choice: typo (choose from ...)") for discoverability.
-
-### Contract: #164 Stage B (`cancel_observed` field)
-
-**Problem:** Timeout results didn't signal whether the engine actually observed the cancellation request.
-**Solution:** Add `cancel_observed: bool` field to timeout TurnResult; signal true iff the engine had a fair chance to observe the cancel event.
-**Benefit:** Claws can decide "retry with fresh session" vs "reuse this session with larger timeout" based on a single boolean.
-
----
-
-## Common Mistakes to Avoid
-
-❌ **Don't parse exit code alone**  
-```python
-# BAD: Exit code 1 could mean parse error, not-found, filesystem, or runtime
-if result.returncode == 1:
-    # What should I do? Unclear.
-    pass
-```
-
-✅ **Do parse error.kind**  
-```python
-# GOOD: error.kind tells you exactly how to recover
-match envelope['error']['kind']:
-    case 'parse': ...
-    case 'session_not_found': ...
-    case 'filesystem': ...
-```
-
----
-
-❌ **Don't capture both stdout and stderr and assume they're separate concerns**  
-```python
-# BAD (pre-#179): Capture stdout + stderr, then parse stdout as JSON
-# But stderr might contain argparse noise that you have to string-match
-result = subprocess.run(..., capture_output=True, text=True)
-if "invalid choice" in result.stderr:
-    # ... custom error handling
-```
-
-✅ **Do silence stderr in JSON mode**  
-```python
-# GOOD (post-#179): In JSON mode, stderr is guaranteed silent
-# Envelope on stdout is your single source of truth
-result = subprocess.run(..., capture_output=True, text=True)
-envelope = json.loads(result.stdout)  # Always valid in JSON mode
-```
-
----
-
-❌ **Don't retry on parse errors**  
-```python
-# BAD: Typos don't fix themselves
-error_kind = envelope['error']['kind']
-if error_kind == 'parse':
-    retry()  # Will fail again
-```
-
-✅ **Do check retryable before retrying**  
-```python
-# GOOD: Let the error tell you
-error = envelope['error']
-if error.get('retryable', False):
-    retry()
-else:
-    raise
-```
-
----
-
-❌ **Don't reuse a session after timeout without checking cancel_observed**  
-```python
-# BAD: Reuse session = potential wedge
-result = run_claw_command(...)  # times out
-# ... later, reuse same session
-result = run_claw_command(...)  # might be stuck in the previous turn
-```
-
-✅ **Do allocate a fresh session if cancel_observed=false**  
-```python
-# GOOD: Allocate fresh session if wedge is suspected
-try:
-    result = run_claw_command(...)
-except ClawError as err:
-    if err.cancel_observed:
-        # Safe to reuse
-        result = run_claw_command(...)
-    else:
-        # Allocate fresh session
-        fresh_session = create_session()
-        result = run_claw_command_in_session(fresh_session, ...)
-```
-
----
-
-## Testing Your Error Handler
-
-```python
-def test_error_handler_parse_error():
-    """Verify parse errors are caught and classified."""
-    try:
-        run_claw_command(['claw', 'nonexistent', '--output-format', 'json'])
-        assert False, "Should have raised ClawError"
-    except ClawError as err:
-        assert err.kind == 'parse'
-        assert 'invalid choice' in err.message.lower()
-        assert err.retryable is False
-
-def test_error_handler_timeout_safe():
-    """Verify timeout with cancel_observed=true marks session as safe."""
-    # Requires a live claw-code server; mock this test
-    try:
-        run_claw_command(
-            ['claw', 'turn-loop', '"x"', '--timeout-seconds', '0.0001'],
-            timeout_seconds=2.0,
-        )
-        assert False, "Should have raised ClawError"
-    except ClawError as err:
-        assert err.kind == 'timeout'
-        assert err.safe_to_reuse_session is True  # cancel_observed=true
-
-def test_error_handler_not_found():
-    """Verify session_not_found is clearly classified."""
-    try:
-        run_claw_command(['claw', 'load-session', 'nonexistent', '--output-format', 'json'])
-        assert False, "Should have raised ClawError"
-    except ClawError as err:
-        assert err.kind == 'session_not_found'
-        assert err.retryable is False
-```
-
----
-
-## Appendix: SCHEMAS.md Error Shape
-
-For reference, the canonical JSON error envelope shape (SCHEMAS.md):
-
-```json
-{
-  "timestamp": "2026-04-22T11:40:00Z",
-  "command": "load-session",
-  "exit_code": 1,
-  "output_format": "json",
-  "schema_version": "1.0",
-  "error": {
-    "kind": "session_not_found",
-    "operation": "session_store.load_session",
-    "target": "nonexistent",
-    "retryable": false,
-    "message": "session 'nonexistent' not found in .port_sessions",
-    "hint": "use 'list-sessions' to see available sessions"
-  }
-}
-```
-
-All commands that emit errors follow this shape (with error.kind varying). See `SCHEMAS.md` for the complete contract.
-
----
-
-## Summary
-
-After cycles #178–#179, **one error handler works for all 14 clawable commands.** No more string-matching, no more stderr parsing, no more exit-code ambiguity. Just parse the JSON, check `error.kind`, and decide: retry, escalate, or reuse session (if safe).
-
-The handler itself is ~80 lines of Python; the patterns are reusable across any language that can speak JSON.

OPT_OUT_AUDIT.md

@@ -1,151 +0,0 @@
-# OPT_OUT Surface Audit Roadmap
-
-**Status:** Pre-audit (decision table ready, survey pending)
-
-This document governs the audit and potential promotion of 12 OPT_OUT surfaces (commands that currently do **not** support `--output-format json`).
-
-## OPT_OUT Classification Rationale
-
-A surface is classified as OPT_OUT when:
-1. **Human-first by nature:** Rich Markdown prose / diagrams / structured text where JSON would be information loss
-2. **Query-filtered alternative exists:** Commands with internal `--query` / `--limit` don't need JSON (users already have escape hatch)
-3. **Simulation/debug only:** Not meant for production orchestration (e.g., mode simulators)
-4. **Future JSON work is planned:** Documented in ROADMAP with clear upgrade path
-
----
-
-## OPT_OUT Surfaces (12 Total)
-
-### Group A: Rich-Markdown Reports (4 commands)
-
-**Rationale:** These emit structured narrative prose. JSON would require lossy serialization.
-
-| Command | Output | Current use | JSON case |
-|---|---|---|---|
-| `summary` | Multi-section workspace summary (Markdown) | Human readability | Not applicable; Markdown is the output |
-| `manifest` | Workspace manifest with project tree (Markdown) | Human readability | Not applicable; Markdown is the output |
-| `parity-audit` | TypeScript/Python port comparison report (Markdown) | Human readability | Not applicable; Markdown is the output |
-| `setup-report` | Preflight + startup diagnostics (Markdown) | Human readability | Not applicable; Markdown is the output |
-
-**Audit decision:** These likely remain OPT_OUT long-term (Markdown-as-output is intentional). If JSON version needed in future, would be a separate `--output-format json` path generating structured data (project summary object, manifest array, audit deltas, setup checklist) — but that's a **new contract**, not an addition to existing Markdown surfaces.
-
-**Pinpoint:** #175 (deferred) — audit whether `summary`/`manifest` should emit JSON structured versions *in parallel* with Markdown, or if Markdown-only is the right UX.
-
----
-
-### Group B: List Commands with Query Filters (3 commands)
-
-**Rationale:** These already support `--query` and `--limit` for filtering. JSON output would be redundant; users can pipe to `jq`.
-
-| Command | Filtering | Current output | JSON case |
-|---|---|---|---|
-| `subsystems` | `--limit` | Human-readable list | Use `--query` to filter, users can parse if needed |
-| `commands` | `--query`, `--limit`, `--no-plugin-commands`, `--no-skill-commands` | Human-readable list | Use `--query` to filter, users can parse if needed |
-| `tools` | `--query`, `--limit`, `--simple-mode` | Human-readable list | Use `--query` to filter, users can parse if needed |
-
-**Audit decision:** `--query` / `--limit` are already the machine-friendly escape hatch. These commands are **intentionally** list-filter-based (not orchestration-primary). Promoting to CLAWABLE would require:
-1. Formalizing what the structured output *is* (command array? tool array?)
-2. Versioning the schema per command
-3. Updating tests to validate per-command schemas
-
-**Cost-benefit:** Low. Users who need structured data can already use `--query` to narrow results, then parse. Effort to promote > value.
-
-**Pinpoint:** #176 (backlog) — audit `--query` UX; consider if a `--query-json` escape hatch (output JSON of matching items) is worth the schema tax.
-
----
-
-### Group C: Simulation / Debug Surfaces (5 commands)
-
-**Rationale:** These are intentionally **not production-orchestrated**. They simulate behavior, test modes, or debug scenarios. JSON output doesn't add value.
-
-| Command | Purpose | Output | Use case |
-|---|---|---|---|
-| `remote-mode` | Simulate remote execution | Text (mock session) | Testing harness behavior under remote constraints |
-| `ssh-mode` | Simulate SSH execution | Text (mock SSH session) | Testing harness behavior over SSH-like transport |
-| `teleport-mode` | Simulate teleport hop | Text (mock hop session) | Testing harness behavior with teleport bouncing |
-| `direct-connect-mode` | Simulate direct network | Text (mock session) | Testing harness behavior with direct connectivity |
-| `deep-link-mode` | Simulate deep-link invocation | Text (mock deep-link) | Testing harness behavior from URL/deeplink |
-
-**Audit decision:** These are **intentionally simulation-only**. Promoting to CLAWABLE means:
-1. "This simulated mode is now a valid orchestration surface"
-2. Need to define what JSON output *means* (mock session state? simulation log?)
-3. Need versioning + test coverage
-
-**Cost-benefit:** Very low. These are debugging tools, not orchestration endpoints. Effort to promote >> value.
-
-**Pinpoint:** #177 (backlog) — decide if mode simulators should ever be CLAWABLE (probably no).
-
----
-
-## Audit Workflow (Future Cycles)
-
-### For each surface:
-1. **Survey:** Check if any external claw actually uses --output-format with this surface
-2. **Cost estimate:** How much schema work + testing?
-3. **Value estimate:** How much demand for JSON version?
-4. **Decision:** CLAWABLE, remain OPT_OUT, or new pinpoint?
-
-### Promotion criteria (if promoting to CLAWABLE):
-
-A surface moves from OPT_OUT → CLAWABLE **only if**:
-- ✅ Clear use case for JSON (not just "hypothetically could be JSON")
-- ✅ Schema is simple and stable (not 20+ fields)
-- ✅ At least one external claw has requested it
-- ✅ Tests can be added without major refactor
-- ✅ Maintainability burden is worth the value
-
-### Demote criteria (if staying OPT_OUT):
-
-A surface stays OPT_OUT **if**:
-- ✅ JSON would be information loss (Markdown reports)
-- ✅ Equivalent filtering already exists (`--query` / `--limit`)
-- ✅ Use case is simulation/debug, not production
-- ✅ Promotion effort > value to users
-
----
-
-## Post-Audit Outcomes
-
-### Likely scenario (high confidence)
-
-**Group A (Markdown reports):** Remain OPT_OUT
-- `summary`, `manifest`, `parity-audit`, `setup-report` are **intentionally** human-first
-- If JSON-like structure is needed in future, would be separate `*-json` commands or distinct `--output-format`, not added to Markdown surfaces
-
-**Group B (List filters):** Remain OPT_OUT
-- `subsystems`, `commands`, `tools` have `--query` / `--limit` as query layer
-- Users who need structured data already have escape hatch
-
-**Group C (Mode simulators):** Remain OPT_OUT
-- `remote-mode`, `ssh-mode`, etc. are debug tools, not orchestration endpoints
-- No demand for JSON version; promotion would be forced, not driven
-
-**Result:** OPT_OUT audit concludes that 12/12 surfaces should **remain OPT_OUT** (no promotions).
-
-### If demand emerges
-
-If external claws report needing JSON from any OPT_OUT surface:
-1. File pinpoint with use case + rationale
-2. Estimate cost + value
-3. If value > cost, promote to CLAWABLE with full test coverage
-4. Update SCHEMAS.md
-5. Update CLAUDE.md
-
----
-
-## Timeline
-
-- **Post-#174 (now):** OPT_OUT audit documented (this file)
-- **Cycles #19–#21 (deferred):** Survey period — collect data on external demand
-- **Cycle #22 (deferred):** Final audit decision + any promotions
-- **Post-audit:** Move to protocol maintenance mode (new commands/fields/surfaces)
-
----
-
-## Related
-
-- **OPT_OUT_DEMAND_LOG.md** — Active survey recording real demand signals (evidentiary base for any promotion decision)
-- **SCHEMAS.md** — Clawable surface contracts
-- **CLAUDE.md** — Development guidance
-- **test_cli_parity_audit.py** — Parametrized tests for CLAWABLE_SURFACES enforcement
-- **ROADMAP.md** — Macro phases (this audit is Phase 3 before Phase 2 closure)

OPT_OUT_DEMAND_LOG.md

@@ -1,167 +0,0 @@
-# OPT_OUT Demand Log
-
-**Purpose:** Record real demand signals for promoting OPT_OUT surfaces to CLAWABLE. Without this log, the audit criteria in `OPT_OUT_AUDIT.md` have no evidentiary base.
-
-**Status:** Active survey window (post-#178/#179, cycles #21+)
-
-## How to file a demand signal
-
-When any external claw, operator, or downstream consumer actually needs JSON output from one of the 12 OPT_OUT surfaces, add an entry below. **Speculation, "could be useful someday," and internal hypotheticals do NOT count.**
-
-A valid signal requires:
-- **Source:** Who/what asked (human, automation, agent session, external tool)
-- **Surface:** Which OPT_OUT command (from the 12)
-- **Use case:** The concrete orchestration problem they're trying to solve
-- **Would-parse-Markdown alternative checked?** Why the existing OPT_OUT output is insufficient
-- **Date:** When the signal was received
-
-## Promotion thresholds
-
-Per `OPT_OUT_AUDIT.md` criteria:
-- **2+ independent signals** for the same surface within a survey window → file promotion pinpoint
-- **1 signal + existing stable schema** → file pinpoint for discussion
-- **0 signals** → surface stays OPT_OUT (documented rationale in audit file)
-
-The threshold is intentionally high. Single-use hacks can be served via one-off Markdown parsing; schema promotion is expensive (docs, tests, maintenance).
-
----
-
-## Demand Signals Received
-
-### Group A: Rich-Markdown Reports
-
-#### `summary`
-**Signals received: 0**
-
-Notes: No demand recorded. Markdown output is intentional and useful for human review.
-
-#### `manifest`
-**Signals received: 0**
-
-Notes: No demand recorded.
-
-#### `parity-audit`
-**Signals received: 0**
-
-Notes: No demand recorded. Report consumers are humans reviewing porting progress, not automation.
-
-#### `setup-report`
-**Signals received: 0**
-
-Notes: No demand recorded.
-
----
-
-### Group B: List Commands with Query Filters
-
-#### `subsystems`
-**Signals received: 0**
-
-Notes: `--limit` already provides filtering. No claws requesting JSON.
-
-#### `commands`
-**Signals received: 0**
-
-Notes: `--query`, `--limit`, `--no-plugin-commands`, `--no-skill-commands` already allow filtering. No demand recorded.
-
-#### `tools`
-**Signals received: 0**
-
-Notes: `--query`, `--limit`, `--simple-mode` provide filtering. No demand recorded.
-
----
-
-### Group C: Simulation / Debug Surfaces
-
-#### `remote-mode`
-**Signals received: 0**
-
-Notes: Simulation-only. No production orchestration need.
-
-#### `ssh-mode`
-**Signals received: 0**
-
-Notes: Simulation-only.
-
-#### `teleport-mode`
-**Signals received: 0**
-
-Notes: Simulation-only.
-
-#### `direct-connect-mode`
-**Signals received: 0**
-
-Notes: Simulation-only.
-
-#### `deep-link-mode`
-**Signals received: 0**
-
-Notes: Simulation-only.
-
----
-
-## Survey Window Status
-
-| Cycle | Date | New Signals | Running Total | Action |
-|---|---|---|---|---|
-| #21 | 2026-04-22 | 0 | 0 | Survey opened; log established |
-
-**Current assessment:** Zero demand for any OPT_OUT surface promotion. This is consistent with `OPT_OUT_AUDIT.md` prediction that all 12 likely stay OPT_OUT long-term.
-
----
-
-## Signal Entry Template
-
-```
-### <surface-name>
-**Signal received: [N]**
-
-Entry N (YYYY-MM-DD):
-- Source: <who/what>
-- Use case: <concrete orchestration problem>
-- Markdown-alternative-checked: <yes/no + why insufficient>
-- Follow-up: <filed pinpoint / discussion thread / closed>
-```
-
----
-
-## Decision Framework
-
-At cycle #22 (or whenever survey window closes):
-
-### If 0 signals total (likely):
-- Move all 12 surfaces to `PERMANENTLY_OPT_OUT` or similar
-- Remove `OPT_OUT_SURFACES` from `test_cli_parity_audit.py` (everything is explicitly non-goal)
-- Update `CLAUDE.md` to reflect maintainership mode
-- Close `OPT_OUT_AUDIT.md` with "audit complete, no promotions"
-
-### If 1–2 signals on isolated surfaces:
-- File individual promotion pinpoints per surface with demand evidence
-- Each goes through standard #171/#172/#173 loop (parity audit, SCHEMAS.md, consistency test)
-
-### If high demand (3+ signals):
-- Reopen audit: is the OPT_OUT classification actually correct?
-- Review whether protocol expansion is warranted
-
----
-
-## Related Files
-
-- **`OPT_OUT_AUDIT.md`** — Audit criteria, decision table, rationale by group
-- **`SCHEMAS.md`** — JSON contract for the 14 CLAWABLE surfaces
-- **`tests/test_cli_parity_audit.py`** — Machine enforcement of CLAWABLE/OPT_OUT classification
-- **`CLAUDE.md`** — Development posture (maintainership mode)
-
----
-
-## Philosophy
-
-**Prevent speculative expansion.** The discipline of requiring real signals before promotion protects the protocol from schema bloat. Every new CLAWABLE surface adds:
-- A SCHEMAS.md section (maintenance burden)
-- Test coverage (test suite tax)
-- Documentation (cognitive load for new developers)
-- Version compatibility (schema_version bump risk)
-
-If a claw can't articulate *why* it needs JSON for `summary` beyond "it would be nice," then JSON for `summary` is not needed. The Markdown output is a feature, not a gap.
-
-The audit log closes the loop on "governed non-goals": OPT_OUT surfaces are intentionally not clawable until proven otherwise by evidence.

README.md

@@ -5,8 +5,6 @@
   ·
   <a href="./USAGE.md">Usage</a>
   ·
-  <a href="./ERROR_HANDLING.md">Error Handling</a>
-  ·
   <a href="./rust/README.md">Rust workspace</a>
   ·
   <a href="./PARITY.md">Parity</a>
@@ -35,154 +33,35 @@ The canonical implementation lives in [`rust/`](./rust), and the current source
 
 > [!IMPORTANT]
 > Start with [`USAGE.md`](./USAGE.md) for build, auth, CLI, session, and parity-harness workflows. Make `claw doctor` your first health check after building, use [`rust/README.md`](./rust/README.md) for crate-level details, read [`PARITY.md`](./PARITY.md) for the current Rust-port checkpoint, and see [`docs/container.md`](./docs/container.md) for the container-first workflow.
->
-> **ACP / Zed status:** `claw-code` does not ship an ACP/Zed daemon entrypoint yet. Run `claw acp` (or `claw --acp`) for the current status instead of guessing from source layout; `claw acp serve` is currently a discoverability alias only, and real ACP support remains tracked separately in `ROADMAP.md`.
 
 ## Current repository shape
 
 - **`rust/`** — canonical Rust workspace and the `claw` CLI binary
 - **`USAGE.md`** — task-oriented usage guide for the current product surface
-- **`ERROR_HANDLING.md`** — unified error-handling pattern for orchestration code
 - **`PARITY.md`** — Rust-port parity status and migration notes
 - **`ROADMAP.md`** — active roadmap and cleanup backlog
 - **`PHILOSOPHY.md`** — project intent and system-design framing
-- **`SCHEMAS.md`** — JSON protocol contract (Python harness reference)
 - **`src/` + `tests/`** — companion Python/reference workspace and audit helpers; not the primary runtime surface
 
 ## Quick start
 
-> [!NOTE]
-> [!WARNING]
-> **`cargo install claw-code` installs the wrong thing.** The `claw-code` crate on crates.io is a deprecated stub that places `claw-code-deprecated.exe` — not `claw`. Running it only prints `"claw-code has been renamed to agent-code"`. **Do not use `cargo install claw-code`.** Either build from source (this repo) or install the upstream binary:
-> ```bash
-> cargo install agent-code   # upstream binary — installs 'agent.exe' (Windows) / 'agent' (Unix), NOT 'agent-code'
-> ```
-> This repo (`ultraworkers/claw-code`) is **build-from-source only** — follow the steps below.
-
 ```bash
-# 1. Clone and build
-git clone https://github.com/ultraworkers/claw-code
-cd claw-code/rust
+cd rust
 cargo build --workspace
+./target/debug/claw --help
+./target/debug/claw prompt "summarize this repository"
+```
 
-# 2. Set your API key (Anthropic API key — not a Claude subscription)
+Authenticate with either an API key or the built-in OAuth flow:
+
+```bash
 export ANTHROPIC_API_KEY="sk-ant-..."
-
-# 3. Verify everything is wired correctly
-./target/debug/claw doctor
-
-# 4. Run a prompt
-./target/debug/claw prompt "say hello"
+# or
+cd rust
+./target/debug/claw login
 ```
 
-> [!NOTE]
-> **Windows (PowerShell):** the binary is `claw.exe`, not `claw`. Use `.\target\debug\claw.exe` or run `cargo run -- prompt "say hello"` to skip the path lookup.
-
-### Windows setup
-
-**PowerShell is a supported Windows path.** Use whichever shell works for you. The common onboarding issues on Windows are:
-
-1. **Install Rust first** — download from <https://rustup.rs/> and run the installer. Close and reopen your terminal when it finishes.
-2. **Verify Rust is on PATH:**
-   ```powershell
-   cargo --version
-   ```
-   If this fails, reopen your terminal or run the PATH setup from the Rust installer output, then retry.
-3. **Clone and build** (works in PowerShell, Git Bash, or WSL):
-   ```powershell
-   git clone https://github.com/ultraworkers/claw-code
-   cd claw-code/rust
-   cargo build --workspace
-   ```
-4. **Run** (PowerShell — note `.exe` and backslash):
-   ```powershell
-   $env:ANTHROPIC_API_KEY = "sk-ant-..."
-   .\target\debug\claw.exe prompt "say hello"
-   ```
-
-**Git Bash / WSL** are optional alternatives, not requirements. If you prefer bash-style paths (`/c/Users/you/...` instead of `C:\Users\you\...`), Git Bash (ships with Git for Windows) works well. In Git Bash, the `MINGW64` prompt is expected and normal — not a broken install.
-
-## Post-build: locate the binary and verify
-
-After running `cargo build --workspace`, the `claw` binary is built but **not** automatically installed to your system. Here's where to find it and how to verify the build succeeded.
-
-### Binary location
-
-After `cargo build --workspace` in `claw-code/rust/`:
-
-**Debug build (default, faster compile):**
-- **macOS/Linux:** `rust/target/debug/claw`
-- **Windows:** `rust/target/debug/claw.exe`
-
-**Release build (optimized, slower compile):**
-- **macOS/Linux:** `rust/target/release/claw`
-- **Windows:** `rust/target/release/claw.exe`
-
-If you ran `cargo build` without `--release`, the binary is in the `debug/` folder.
-
-### Verify the build succeeded
-
-Test the binary directly using its path:
-
-```bash
-# macOS/Linux (debug build)
-./rust/target/debug/claw --help
-./rust/target/debug/claw doctor
-
-# Windows PowerShell (debug build)
-.\rust\target\debug\claw.exe --help
-.\rust\target\debug\claw.exe doctor
-```
-
-If these commands succeed, the build is working. `claw doctor` is your first health check — it validates your API key, model access, and tool configuration.
-
-### Optional: Add to PATH
-
-If you want to run `claw` from any directory without the full path, choose one of these approaches:
-
-**Option 1: Symlink (macOS/Linux)**
-```bash
-ln -s $(pwd)/rust/target/debug/claw /usr/local/bin/claw
-```
-Then reload your shell and test:
-```bash
-claw --help
-```
-
-**Option 2: Use `cargo install` (all platforms)**
-
-Build and install to Cargo's default location (`~/.cargo/bin/`, which is usually on PATH):
-```bash
-# From the claw-code/rust/ directory
-cargo install --path . --force
-
-# Then from anywhere
-claw --help
-```
-
-**Option 3: Update shell profile (bash/zsh)**
-
-Add this line to `~/.bashrc` or `~/.zshrc`:
-```bash
-export PATH="$(pwd)/rust/target/debug:$PATH"
-```
-
-Reload your shell:
-```bash
-source ~/.bashrc  # or source ~/.zshrc
-claw --help
-```
-
-### Troubleshooting
-
-- **"command not found: claw"** — The binary is in `rust/target/debug/claw`, but it's not on your PATH. Use the full path `./rust/target/debug/claw` or symlink/install as above.
-- **"permission denied"** — On macOS/Linux, you may need `chmod +x rust/target/debug/claw` if the executable bit isn't set (rare).
-- **Debug vs. release** — If the build is slow, you're in debug mode (default). Add `--release` to `cargo build` for faster runtime, but the build itself will take 5–10 minutes.
-
-> [!NOTE]
-> **Auth:** claw requires an **API key** (`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, etc.) — Claude subscription login is not a supported auth path.
-
-Run the workspace test suite after verifying the binary works:
+Run the workspace test suite:
 
 ```bash
 cd rust

SCHEMAS.md

@@ -1,377 +0,0 @@
-# JSON Envelope Schemas — Clawable CLI Contract
-
-This document locks the field-level contract for all clawable-surface commands. Every command accepting `--output-format json` must conform to the envelope shapes below.
-
-**Target audience:** Claws building orchestrators, automation, or monitoring against claw-code's JSON output.
-
----
-
-## Common Fields (All Envelopes)
-
-Every command response, success or error, carries:
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "list-sessions",
-  "exit_code": 0,
-  "output_format": "json",
-  "schema_version": "1.0"
-}
-```
-
-| Field | Type | Required | Notes |
-|---|---|---|---|
-| `timestamp` | ISO 8601 UTC | Yes | Time command completed |
-| `command` | string | Yes | argv[1] (e.g. "list-sessions") |
-| `exit_code` | int (0/1/2) | Yes | 0=success, 1=error/not-found, 2=timeout |
-| `output_format` | string | Yes | Always "json" (for symmetry with text mode) |
-| `schema_version` | string | Yes | "1.0" (bump for breaking changes) |
-
----
-
-## Turn Result Fields (Multi-Turn Sessions)
-
-When a command's response includes a `turn` object (e.g., in `bootstrap` or `turn-loop`), it carries:
-
-| Field | Type | Required | Notes |
-|---|---|---|---|
-| `prompt` | string | Yes | User input for this turn |
-| `output` | string | Yes | Assistant response |
-| `stop_reason` | enum | Yes | One of: `completed`, `timeout`, `cancelled`, `max_budget_reached`, `max_turns_reached` |
-| `cancel_observed` | bool | Yes | #164 Stage B: cancellation was signaled and observed (#161/#164) |
-
----
-
-## Error Envelope
-
-When a command fails (exit code 1), responses carry:
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "exec-command",
-  "exit_code": 1,
-  "error": {
-    "kind": "filesystem",
-    "operation": "write",
-    "target": "/tmp/nonexistent/out.md",
-    "retryable": true,
-    "message": "No such file or directory",
-    "hint": "intermediate directory does not exist; try mkdir -p /tmp/nonexistent"
-  }
-}
-```
-
-| Field | Type | Required | Notes |
-|---|---|---|---|
-| `error.kind` | enum | Yes | One of: `filesystem`, `auth`, `session`, `parse`, `runtime`, `mcp`, `delivery`, `usage`, `policy`, `unknown` |
-| `error.operation` | string | Yes | Syscall/method that failed (e.g. "write", "open", "resolve_session") |
-| `error.target` | string | Yes | Resource that failed (path, session-id, server-name, etc.) |
-| `error.retryable` | bool | Yes | Whether caller can safely retry without intervention |
-| `error.message` | string | Yes | Platform error message (e.g. errno text) |
-| `error.hint` | string | No | Optional actionable next step |
-
----
-
-## Not-Found Envelope
-
-When an entity does not exist (exit code 1, but not a failure):
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "load-session",
-  "exit_code": 1,
-  "name": "does-not-exist",
-  "found": false,
-  "error": {
-    "kind": "session_not_found",
-    "message": "session 'does-not-exist' not found in .claw/sessions/",
-    "retryable": false
-  }
-}
-```
-
-| Field | Type | Required | Notes |
-|---|---|---|---|
-| `name` | string | Yes | Entity name/id that was looked up |
-| `found` | bool | Yes | Always `false` for not-found |
-| `error.kind` | enum | Yes | One of: `command_not_found`, `tool_not_found`, `session_not_found` |
-| `error.message` | string | Yes | User-visible explanation |
-| `error.retryable` | bool | Yes | Usually `false` (entity will not magically appear) |
-
----
-
-## Per-Command Success Schemas
-
-### `list-sessions`
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "list-sessions",
-  "exit_code": 0,
-  "output_format": "json",
-  "schema_version": "1.0",
-  "directory": ".claw/sessions",
-  "sessions_count": 2,
-  "sessions": [
-    {
-      "session_id": "sess_abc123",
-      "created_at": "2026-04-21T15:30:00Z",
-      "last_modified": "2026-04-22T09:45:00Z",
-      "prompt_count": 5,
-      "stopped": false
-    }
-  ]
-}
-```
-
-### `delete-session`
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "delete-session",
-  "exit_code": 0,
-  "session_id": "sess_abc123",
-  "deleted": true,
-  "directory": ".claw/sessions"
-}
-```
-
-### `load-session`
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "load-session",
-  "exit_code": 0,
-  "session_id": "sess_abc123",
-  "loaded": true,
-  "directory": ".claw/sessions",
-  "path": ".claw/sessions/sess_abc123.jsonl"
-}
-```
-
-### `flush-transcript`
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "flush-transcript",
-  "exit_code": 0,
-  "session_id": "sess_abc123",
-  "path": ".claw/sessions/sess_abc123.jsonl",
-  "flushed": true,
-  "messages_count": 12,
-  "input_tokens": 4500,
-  "output_tokens": 1200
-}
-```
-
-### `show-command`
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "show-command",
-  "exit_code": 0,
-  "name": "add-dir",
-  "found": true,
-  "source_hint": "commands/add-dir/add-dir.tsx",
-  "responsibility": "creates a new directory in the worktree"
-}
-```
-
-### `show-tool`
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "show-tool",
-  "exit_code": 0,
-  "name": "BashTool",
-  "found": true,
-  "source_hint": "tools/BashTool/BashTool.tsx"
-}
-```
-
-### `exec-command`
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "exec-command",
-  "exit_code": 0,
-  "name": "add-dir",
-  "prompt": "create src/util/",
-  "handled": true,
-  "message": "created directory",
-  "source_hint": "commands/add-dir/add-dir.tsx"
-}
-```
-
-### `exec-tool`
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "exec-tool",
-  "exit_code": 0,
-  "name": "BashTool",
-  "payload": "cargo build",
-  "handled": true,
-  "message": "exit code 0",
-  "source_hint": "tools/BashTool/BashTool.tsx"
-}
-```
-
-### `route`
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "route",
-  "exit_code": 0,
-  "prompt": "add a test",
-  "limit": 10,
-  "match_count": 3,
-  "matches": [
-    {
-      "kind": "command",
-      "name": "add-file",
-      "score": 0.92,
-      "source_hint": "commands/add-file/add-file.tsx"
-    }
-  ]
-}
-```
-
-### `bootstrap`
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "bootstrap",
-  "exit_code": 0,
-  "prompt": "hello",
-  "setup": {
-    "python_version": "3.13.12",
-    "implementation": "CPython",
-    "platform_name": "darwin",
-    "test_command": "pytest"
-  },
-  "routed_matches": [
-    {"kind": "command", "name": "init", "score": 0.85, "source_hint": "..."}
-  ],
-  "turn": {
-    "prompt": "hello",
-    "output": "...",
-    "stop_reason": "completed"
-  },
-  "persisted_session_path": ".claw/sessions/sess_abc.jsonl"
-}
-```
-
-### `command-graph`
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "command-graph",
-  "exit_code": 0,
-  "builtins_count": 185,
-  "plugin_like_count": 20,
-  "skill_like_count": 2,
-  "total_count": 207,
-  "builtins": [
-    {"name": "add-dir", "source_hint": "commands/add-dir/add-dir.tsx"}
-  ],
-  "plugin_like": [],
-  "skill_like": []
-}
-```
-
-### `tool-pool`
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "tool-pool",
-  "exit_code": 0,
-  "simple_mode": false,
-  "include_mcp": true,
-  "tool_count": 184,
-  "tools": [
-    {"name": "BashTool", "source_hint": "tools/BashTool/BashTool.tsx"}
-  ]
-}
-```
-
-### `bootstrap-graph`
-
-```json
-{
-  "timestamp": "2026-04-22T10:10:00Z",
-  "command": "bootstrap-graph",
-  "exit_code": 0,
-  "stages": ["stage 1", "stage 2", "..."],
-  "note": "bootstrap-graph is markdown-only in this version"
-}
-```
-
----
-
-## Versioning & Compatibility
-
-- **schema_version = "1.0":** Current as of 2026-04-22. Covers all 13 clawable commands.
-- **Breaking changes** (e.g. renaming a field) bump schema_version to "2.0".
-- **Additive changes** (e.g. new optional field) stay at "1.0" and are backward compatible.
-- Downstream claws **must** check `schema_version` before relying on field presence.
-
----
-
-## Regression Testing
-
-Each command is covered by:
-1. **Fixture file** (golden JSON snapshot under `tests/fixtures/json/<command>.json`)
-2. **Parametrised test** in `test_cli_parity_audit.py::TestJsonOutputContractEndToEnd`
-3. **Field consistency test** (new, tracked as ROADMAP #172)
-
-To update a fixture after a intentional schema change:
-```bash
-claw <command> --output-format json <args> > tests/fixtures/json/<command>.json
-# Review the diff, commit
-git add tests/fixtures/json/<command>.json
-```
-
-To verify no regressions:
-```bash
-cargo test --release test_json_envelope_field_consistency
-```
-
----
-
-## Design Notes
-
-**Why common fields on every response?**
-- Downstream claws can build one error handler that works for all commands
-- Timestamp + command + exit_code give context without scraping argv or timestamps from command output
-- `schema_version` signals compatibility for future upgrades
-
-**Why both "found" and "error" on not-found?**
-- Exit code 1 covers both "entity missing" and "operation failed"
-- `found=false` distinguishes not-found from error without string matching
-- `error.kind` and `error.retryable` let automation decide: retry a temporary miss vs escalate a permanent refusal
-
-**Why "operation" and "target" in error?**
-- Claws can aggregate failures by operation type (e.g. "how many `write` ops failed?")
-- Claws can implement per-target retry policy (e.g. "skip missing files, retry networking")
-- Pure text errors ("No such file") do not provide enough structure for pattern matching
-
-**Why "handled" vs "found"?**
-- `show-command` reports `found: bool` (inventory signal: "does this exist?")
-- `exec-command` reports `handled: bool` (operational signal: "was this work performed?")
-- The names matter: a command can be found but not handled (e.g. too large for context window), or handled silently (no output message)

USAGE.md

@@ -2,9 +2,6 @@
 
 This guide covers the current Rust workspace under `rust/` and the `claw` CLI binary. If you are brand new, make the doctor health check your first run: start `claw`, then run `/doctor`.
 
-> [!TIP]
-> **Building orchestration code that calls `claw` as a subprocess?** See [`ERROR_HANDLING.md`](./ERROR_HANDLING.md) for the unified error-handling pattern (one handler for all 14 clawable commands, exit codes, JSON envelope contract, and recovery strategies).
-
 ## Quick-start health check
 
 Run this before prompts, sessions, or automation:
@@ -24,7 +21,7 @@ cargo build --workspace
 - Rust toolchain with `cargo`
 - One of:
   - `ANTHROPIC_API_KEY` for direct API access
-  - `ANTHROPIC_AUTH_TOKEN` for bearer-token auth
+  - `claw login` for OAuth-based auth
 - Optional: `ANTHROPIC_BASE_URL` when targeting a proxy or local service
 
 ## Install / build the workspace
@@ -46,35 +43,6 @@ cd rust
 /doctor
 ```
 
-Or run doctor directly with JSON output for scripting:
-
-```bash
-cd rust
-./target/debug/claw doctor --output-format json
-```
-
-**Note:** Diagnostic verbs (`doctor`, `status`, `sandbox`, `version`) support `--output-format json` for machine-readable output. Invalid suffix arguments (e.g., `--json`) are now rejected at parse time rather than falling through to prompt dispatch.
-
-### Initialize a repository
-
-Set up a new repository with `.claw` config, `.claw.json`, `.gitignore` entries, and a `CLAUDE.md` guidance file:
-
-```bash
-cd /path/to/your/repo
-./target/debug/claw init
-```
-
-Text mode (human-readable) shows artifact creation summary with project path and next steps. Idempotent — running multiple times in the same repo marks already-created files as "skipped".
-
-JSON mode for scripting:
-```bash
-./target/debug/claw init --output-format json
-```
-
-Returns structured output with `project_path`, `created[]`, `updated[]`, `skipped[]` arrays (one per artifact), and `artifacts[]` carrying each file's `name` and machine-stable `status` tag. The legacy `message` field preserves backward compatibility.
-
-**Why structured fields matter:** Claws can detect per-artifact state (`created` vs `updated` vs `skipped`) without substring-matching human prose. Use the `created[]`, `updated[]`, and `skipped[]` arrays for conditional follow-up logic (e.g., only commit if files were actually created, not just updated).
-
 ### Interactive REPL
 
 ```bash
@@ -98,96 +66,11 @@ cd rust
 
 ### JSON output for scripting
 
-All clawable commands support `--output-format json` for machine-readable output. Every invocation returns a consistent JSON envelope with `exit_code`, `command`, `timestamp`, and either `{success fields}` or `{error: {kind, message, ...}}`.
-
 ```bash
 cd rust
 ./target/debug/claw --output-format json prompt "status"
-./target/debug/claw --output-format json load-session my-session-id
-./target/debug/claw --output-format json turn-loop "analyze logs" --max-turns 1
 ```
 
-**Building a dispatcher or orchestration script?** See [`ERROR_HANDLING.md`](./ERROR_HANDLING.md) for the unified error-handling pattern. One code example works for all 14 clawable commands: parse the exit code, classify by `error.kind`, apply recovery strategies (retry, timeout recovery, validation, logging). Use that pattern instead of reimplementing error handling per command.
-
-### Inspect worker state
-
-The `claw state` command reads `.claw/worker-state.json`, which is written by the interactive REPL or a one-shot prompt when a worker executes a task. This file contains the worker ID, session reference, model, and permission mode.
-
-Prerequisite: You must run `claw` (interactive REPL) or `claw prompt <text>` at least once in the repository to produce the worker state file.
-
-```bash
-cd rust
-./target/debug/claw state
-```
-
-JSON mode:
-```bash
-./target/debug/claw state --output-format json
-```
-
-If you run `claw state` before any worker has executed, you will see a helpful error:
-```
-error: no worker state file found at .claw/worker-state.json
-  Hint: worker state is written by the interactive REPL or a non-interactive prompt.
-  Run:   claw               # start the REPL (writes state on first turn)
-  Or:    claw prompt <text> # run one non-interactive turn
-  Then rerun: claw state [--output-format json]
-```
-
-## Advanced slash commands (Interactive REPL only)
-
-These commands are available inside the interactive REPL (`claw` with no args). They extend the assistant with workspace analysis, planning, and navigation features.
-
-### `/ultraplan` — Deep planning with multi-step reasoning
-
-**Purpose:** Break down a complex task into steps using extended reasoning.
-
-```bash
-# Start the REPL
-claw
-
-# Inside the REPL
-/ultraplan refactor the auth module to use async/await
-/ultraplan design a caching layer for database queries
-/ultraplan analyze this module for performance bottlenecks
-```
-
-Output: A structured plan with numbered steps, reasoning for each step, and expected outcomes. Use this when you want the assistant to think through a problem in detail before coding.
-
-### `/teleport` — Jump to a file or symbol
-
-**Purpose:** Quickly navigate to a file, function, class, or struct by name.
-
-```bash
-# Jump to a symbol
-/teleport UserService
-/teleport authenticate_user
-/teleport RequestHandler
-
-# Jump to a file
-/teleport src/auth.rs
-/teleport crates/runtime/lib.rs
-/teleport ./ARCHITECTURE.md
-```
-
-Output: The file content, with the requested symbol highlighted or the file fully loaded. Useful for exploring the codebase without manually navigating directories. If multiple matches exist, the assistant shows the top candidates.
-
-### `/bughunter` — Scan for likely bugs and issues
-
-**Purpose:** Analyze code for common pitfalls, anti-patterns, and potential bugs.
-
-```bash
-# Scan the entire workspace
-/bughunter
-
-# Scan a specific directory or file
-/bughunter src/handlers
-/bughunter rust/crates/runtime
-/bughunter src/auth.rs
-```
-
-Output: A list of suspicious patterns with explanations (e.g., "unchecked unwrap()", "potential race condition", "missing error handling"). Each finding includes the file, line number, and suggested fix. Use this as a first pass before a full code review.
-
 ## Model and permission controls
 
 ```bash
@@ -222,7 +105,8 @@ export ANTHROPIC_API_KEY="sk-ant-..."
 
 ```bash
 cd rust
-export ANTHROPIC_AUTH_TOKEN="anthropic-oauth-or-proxy-bearer-token"
+./target/debug/claw login
+./target/debug/claw logout
 ```
 
 ### Which env var goes where
@@ -232,7 +116,7 @@ export ANTHROPIC_AUTH_TOKEN="anthropic-oauth-or-proxy-bearer-token"
 | Credential shape | Env var | HTTP header | Typical source |
 |---|---|---|---|
 | `sk-ant-*` API key | `ANTHROPIC_API_KEY` | `x-api-key: sk-ant-...` | [console.anthropic.com](https://console.anthropic.com) |
-| OAuth access token (opaque) | `ANTHROPIC_AUTH_TOKEN` | `Authorization: Bearer ...` | an Anthropic-compatible proxy or OAuth flow that mints bearer tokens |
+| OAuth access token (opaque) | `ANTHROPIC_AUTH_TOKEN` | `Authorization: Bearer ...` | `claw login` or an Anthropic-compatible proxy that mints Bearer tokens |
 | OpenRouter key (`sk-or-v1-*`) | `OPENAI_API_KEY` + `OPENAI_BASE_URL=https://openrouter.ai/api/v1` | `Authorization: Bearer ...` | [openrouter.ai/keys](https://openrouter.ai/keys) |
 
 **Why this matters:** if you paste an `sk-ant-*` key into `ANTHROPIC_AUTH_TOKEN`, Anthropic's API will return `401 Invalid bearer token` because `sk-ant-*` keys are rejected over the Bearer header. The fix is a one-line env var swap — move the key to `ANTHROPIC_API_KEY`. Recent `claw` builds detect this exact shape (401 + `sk-ant-*` in the Bearer slot) and append a hint to the error message pointing at the fix.
@@ -241,7 +125,7 @@ export ANTHROPIC_AUTH_TOKEN="anthropic-oauth-or-proxy-bearer-token"
 
 ## Local Models
 
-`claw` can talk to local servers and provider gateways through either Anthropic-compatible or OpenAI-compatible endpoints. Use `ANTHROPIC_BASE_URL` with `ANTHROPIC_AUTH_TOKEN` for Anthropic-compatible services, or `OPENAI_BASE_URL` with `OPENAI_API_KEY` for OpenAI-compatible services.
+`claw` can talk to local servers and provider gateways through either Anthropic-compatible or OpenAI-compatible endpoints. Use `ANTHROPIC_BASE_URL` with `ANTHROPIC_AUTH_TOKEN` for Anthropic-compatible services, or `OPENAI_BASE_URL` with `OPENAI_API_KEY` for OpenAI-compatible services. OAuth is Anthropic-only, so when `OPENAI_BASE_URL` is set you should use API-key style auth instead of `claw login`.
 
 ### Anthropic-compatible endpoint
 
@@ -308,7 +192,7 @@ Reasoning variants (`qwen-qwq-*`, `qwq-*`, `*-thinking`) automatically strip `te
 
 | Provider | Protocol | Auth env var(s) | Base URL env var | Default base URL |
 |---|---|---|---|---|
-| **Anthropic** (direct) | Anthropic Messages API | `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` | `ANTHROPIC_BASE_URL` | `https://api.anthropic.com` |
+| **Anthropic** (direct) | Anthropic Messages API | `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` or OAuth (`claw login`) | `ANTHROPIC_BASE_URL` | `https://api.anthropic.com` |
 | **xAI** | OpenAI-compatible | `XAI_API_KEY` | `XAI_BASE_URL` | `https://api.x.ai/v1` |
 | **OpenAI-compatible** | OpenAI Chat Completions | `OPENAI_API_KEY` | `OPENAI_BASE_URL` | `https://api.openai.com/v1` |
 | **DashScope** (Alibaba) | OpenAI-compatible | `DASHSCOPE_API_KEY` | `DASHSCOPE_BASE_URL` | `https://dashscope.aliyuncs.com/compatible-mode/v1` |

docs/MODEL_COMPATIBILITY.md

@@ -1,236 +0,0 @@
-# Model Compatibility Guide
-
-This document describes model-specific handling in the OpenAI-compatible provider. When adding new models or providers, review this guide to ensure proper compatibility.
-
-## Table of Contents
-
-- [Overview](#overview)
-- [Model-Specific Handling](#model-specific-handling)
-  - [Kimi Models (is_error Exclusion)](#kimi-models-is_error-exclusion)
-  - [Reasoning Models (Tuning Parameter Stripping)](#reasoning-models-tuning-parameter-stripping)
-  - [GPT-5 (max_completion_tokens)](#gpt-5-max_completion_tokens)
-  - [Qwen Models (DashScope Routing)](#qwen-models-dashscope-routing)
-- [Implementation Details](#implementation-details)
-- [Adding New Models](#adding-new-models)
-- [Testing](#testing)
-
-## Overview
-
-The `openai_compat.rs` provider translates Claude Code's internal message format to OpenAI-compatible chat completion requests. Different models have varying requirements for:
-
-- Tool result message fields (`is_error`)
-- Sampling parameters (temperature, top_p, etc.)
-- Token limit fields (`max_tokens` vs `max_completion_tokens`)
-- Base URL routing
-
-## Model-Specific Handling
-
-### Kimi Models (is_error Exclusion)
-
-**Affected models:** `kimi-k2.5`, `kimi-k1.5`, `kimi-moonshot`, and any model with `kimi` in the name (case-insensitive)
-
-**Behavior:** The `is_error` field is **excluded** from tool result messages.
-
-**Rationale:** Kimi models (via Moonshot AI and DashScope) reject the `is_error` field with a 400 Bad Request error:
-```json
-{
-  "error": {
-    "type": "invalid_request_error",
-    "message": "Unknown field: is_error"
-  }
-}
-```
-
-**Detection:**
-```rust
-fn model_rejects_is_error_field(model: &str) -> bool {
-    let lowered = model.to_ascii_lowercase();
-    let canonical = lowered.rsplit('/').next().unwrap_or(lowered.as_str());
-    canonical.starts_with("kimi-")
-}
-```
-
-**Testing:** See `model_rejects_is_error_field_detects_kimi_models` and related tests in `openai_compat.rs`.
-
----
-
-### Reasoning Models (Tuning Parameter Stripping)
-
-**Affected models:**
-- OpenAI: `o1`, `o1-*`, `o3`, `o3-*`, `o4`, `o4-*`
-- xAI: `grok-3-mini`
-- Alibaba DashScope: `qwen-qwq-*`, `qwq-*`, `qwen3-*-thinking`
-
-**Behavior:** The following tuning parameters are **stripped** from requests:
-- `temperature`
-- `top_p`
-- `frequency_penalty`
-- `presence_penalty`
-
-**Rationale:** Reasoning/chain-of-thought models use fixed sampling strategies and reject these parameters with 400 errors.
-
-**Exception:** `reasoning_effort` is included for compatible models when explicitly set.
-
-**Detection:**
-```rust
-fn is_reasoning_model(model: &str) -> bool {
-    let canonical = model.to_ascii_lowercase()
-        .rsplit('/')
-        .next()
-        .unwrap_or(model);
-    canonical.starts_with("o1")
-        || canonical.starts_with("o3")
-        || canonical.starts_with("o4")
-        || canonical == "grok-3-mini"
-        || canonical.starts_with("qwen-qwq")
-        || canonical.starts_with("qwq")
-        || (canonical.starts_with("qwen3") && canonical.contains("-thinking"))
-}
-```
-
-**Testing:** See `reasoning_model_strips_tuning_params`, `grok_3_mini_is_reasoning_model`, and `qwen_reasoning_variants_are_detected` tests.
-
----
-
-### GPT-5 (max_completion_tokens)
-
-**Affected models:** All models starting with `gpt-5`
-
-**Behavior:** Uses `max_completion_tokens` instead of `max_tokens` in the request payload.
-
-**Rationale:** GPT-5 models require the `max_completion_tokens` field. Legacy `max_tokens` causes request validation failures:
-```json
-{
-  "error": {
-    "message": "Unknown field: max_tokens"
-  }
-}
-```
-
-**Implementation:**
-```rust
-let max_tokens_key = if wire_model.starts_with("gpt-5") {
-    "max_completion_tokens"
-} else {
-    "max_tokens"
-};
-```
-
-**Testing:** See `gpt5_uses_max_completion_tokens_not_max_tokens` and `non_gpt5_uses_max_tokens` tests.
-
----
-
-### Qwen Models (DashScope Routing)
-
-**Affected models:** All models with `qwen` prefix
-
-**Behavior:** Routed to DashScope (`https://dashscope.aliyuncs.com/compatible-mode/v1`) rather than default providers.
-
-**Rationale:** Qwen models are hosted by Alibaba Cloud's DashScope service, not OpenAI or Anthropic.
-
-**Configuration:**
-```rust
-pub const DEFAULT_DASHSCOPE_BASE_URL: &str = "https://dashscope.aliyuncs.com/compatible-mode/v1";
-```
-
-**Authentication:** Uses `DASHSCOPE_API_KEY` environment variable.
-
-**Note:** Some Qwen models are also reasoning models (see [Reasoning Models](#reasoning-models-tuning-parameter-stripping) above) and receive both treatments.
-
-## Implementation Details
-
-### File Location
-All model-specific logic is in:
-```
-rust/crates/api/src/providers/openai_compat.rs
-```
-
-### Key Functions
-
-| Function | Purpose |
-|----------|---------|
-| `model_rejects_is_error_field()` | Detects models that don't support `is_error` in tool results |
-| `is_reasoning_model()` | Detects reasoning models that need tuning param stripping |
-| `translate_message()` | Converts internal messages to OpenAI format (applies `is_error` logic) |
-| `build_chat_completion_request()` | Constructs full request payload (applies all model-specific logic) |
-
-### Provider Prefix Handling
-
-All model detection functions strip provider prefixes (e.g., `dashscope/kimi-k2.5` → `kimi-k2.5`) before matching:
-
-```rust
-let canonical = model.to_ascii_lowercase()
-    .rsplit('/')
-    .next()
-    .unwrap_or(model);
-```
-
-This ensures consistent detection regardless of whether models are referenced with or without provider prefixes.
-
-## Adding New Models
-
-When adding support for new models:
-
-1. **Check if the model is a reasoning model**
-   - Does it reject temperature/top_p parameters?
-   - Add to `is_reasoning_model()` detection
-
-2. **Check tool result compatibility**
-   - Does it reject the `is_error` field?
-   - Add to `model_rejects_is_error_field()` detection
-
-3. **Check token limit field**
-   - Does it require `max_completion_tokens` instead of `max_tokens`?
-   - Update the `max_tokens_key` logic
-
-4. **Add tests**
-   - Unit test for detection function
-   - Integration test in `build_chat_completion_request`
-
-5. **Update this documentation**
-   - Add the model to the affected lists
-   - Document any special behavior
-
-## Testing
-
-### Running Model-Specific Tests
-
-```bash
-# All OpenAI compatibility tests
-cargo test --package api providers::openai_compat
-
-# Specific test categories
-cargo test --package api model_rejects_is_error_field
-cargo test --package api reasoning_model
-cargo test --package api gpt5
-cargo test --package api qwen
-```
-
-### Test Files
-
-- Unit tests: `rust/crates/api/src/providers/openai_compat.rs` (in `mod tests`)
-- Integration tests: `rust/crates/api/tests/openai_compat_integration.rs`
-
-### Verifying Model Detection
-
-To verify a model is detected correctly without making API calls:
-
-```rust
-#[test]
-fn my_new_model_is_detected() {
-    // is_error handling
-    assert!(model_rejects_is_error_field("my-model"));
-    
-    // Reasoning model detection
-    assert!(is_reasoning_model("my-model"));
-    
-    // Provider prefix handling
-    assert!(model_rejects_is_error_field("provider/my-model"));
-}
-```
-
----
-
-*Last updated: 2026-04-16*
-
-For questions or updates, see the implementation in `rust/crates/api/src/providers/openai_compat.rs`.

prd.json

@@ -1,356 +0,0 @@
-{
-  "version": "1.0",
-  "description": "Clawable Coding Harness - Clear roadmap stories and commit each",
-  "stories": [
-    {
-      "id": "US-001",
-      "title": "Phase 1.6 - startup-no-evidence evidence bundle + classifier",
-      "description": "When startup times out, emit typed worker.startup_no_evidence event with evidence bundle including last known worker lifecycle state, pane command, prompt-send timestamp, prompt-acceptance state, trust-prompt detection result, and transport/MCP health summary. Classifier should down-rank into specific failure classes.",
-      "acceptanceCriteria": [
-        "worker.startup_no_evidence event emitted on startup timeout with evidence bundle",
-        "Evidence bundle includes: last lifecycle state, pane command, prompt-send timestamp, prompt-acceptance state, trust-prompt detection, transport/MCP health",
-        "Classifier attempts to categorize into: trust_required, prompt_misdelivery, prompt_acceptance_timeout, transport_dead, worker_crashed, or unknown",
-        "Tests verify evidence bundle structure and classifier behavior"
-      ],
-      "passes": true,
-      "priority": "P0"
-    },
-    {
-      "id": "US-002",
-      "title": "Phase 2 - Canonical lane event schema (4.x series)",
-      "description": "Define typed events for lane lifecycle: lane.started, lane.ready, lane.prompt_misdelivery, lane.blocked, lane.red, lane.green, lane.commit.created, lane.pr.opened, lane.merge.ready, lane.finished, lane.failed, branch.stale_against_main. Also implement event ordering, reconciliation, provenance, deduplication, and projection contracts.",
-      "acceptanceCriteria": [
-        "LaneEvent enum with all required variants defined",
-        "Event ordering with monotonic sequence metadata attached",
-        "Event provenance labels (live_lane, test, healthcheck, replay, transport)",
-        "Session identity completeness at creation (title, workspace, purpose)",
-        "Duplicate terminal-event suppression with fingerprinting",
-        "Lane ownership/scope binding in events",
-        "Nudge acknowledgment with dedupe contract",
-        "clawhip consumes typed lane events instead of pane scraping"
-      ],
-      "passes": true,
-      "priority": "P0"
-    },
-    {
-      "id": "US-003",
-      "title": "Phase 3 - Stale-branch detection before broad verification",
-      "description": "Before broad test runs, compare current branch to main and detect if known fixes are missing. Emit branch.stale_against_main event and suggest/auto-run rebase/merge-forward.",
-      "acceptanceCriteria": [
-        "Branch freshness comparison against main implemented",
-        "branch.stale_against_main event emitted when behind",
-        "Auto-rebase/merge-forward policy integration",
-        "Avoid misclassifying stale-branch failures as new regressions"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-004",
-      "title": "Phase 3 - Recovery recipes with ledger",
-      "description": "Encode automatic recoveries for common failures (trust prompt, prompt misdelivery, stale branch, compile red, MCP startup). Expose recovery attempt ledger with recipe id, attempt count, state, timestamps, failure summary.",
-      "acceptanceCriteria": [
-        "Recovery recipes defined for: trust_prompt_unresolved, prompt_delivered_to_shell, stale_branch, compile_red_after_refactor, MCP_handshake_failure, partial_plugin_startup",
-        "Recovery attempt ledger with: recipe id, attempt count, state, timestamps, failure summary, escalation reason",
-        "One automatic recovery attempt before escalation",
-        "Ledger emitted as structured event data"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-005",
-      "title": "Phase 4 - Typed task packet format",
-      "description": "Define structured task packet with fields: objective, scope, repo/worktree, branch policy, acceptance tests, commit policy, reporting contract, escalation policy.",
-      "acceptanceCriteria": [
-        "TaskPacket struct with all required fields",
-        "TaskScope resolution (workspace/module/single-file/custom)",
-        "Validation and serialization support",
-        "Integration into tools/src/lib.rs"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-006",
-      "title": "Phase 4 - Policy engine for autonomous coding",
-      "description": "Encode automation rules: if green + scoped diff + review passed -> merge to dev; if stale branch -> merge-forward before broad tests; if startup blocked -> recover once, then escalate; if lane completed -> emit closeout and cleanup session.",
-      "acceptanceCriteria": [
-        "Policy rules engine implemented",
-        "Rules: green + scoped diff + review -> merge",
-        "Rules: stale branch -> merge-forward before tests",
-        "Rules: startup blocked -> recover once, then escalate",
-        "Rules: lane completed -> closeout and cleanup"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-007",
-      "title": "Phase 5 - Plugin/MCP lifecycle maturity",
-      "description": "First-class plugin/MCP lifecycle contract: config validation, startup healthcheck, discovery result, degraded-mode behavior, shutdown/cleanup. Close gaps in end-to-end lifecycle.",
-      "acceptanceCriteria": [
-        "Plugin/MCP config validation contract",
-        "Startup healthcheck with structured results",
-        "Discovery result reporting",
-        "Degraded-mode behavior documented and implemented",
-        "Shutdown/cleanup contract",
-        "Partial startup and per-server failures reported structurally"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-008",
-      "title": "Fix kimi-k2.5 model API compatibility",
-      "description": "The kimi-k2.5 model (and other kimi models) reject API requests containing the is_error field in tool result messages. The OpenAI-compatible provider currently always includes is_error for all models. Need to make this field conditional based on model support.",
-      "acceptanceCriteria": [
-        "translate_message function accepts model parameter",
-        "is_error field excluded for kimi models (kimi-k2.5, kimi-k1.5, etc.)",
-        "is_error field included for models that support it (openai, grok, xai, etc.)",
-        "build_chat_completion_request passes model to translate_message",
-        "Tests verify is_error presence/absence based on model",
-        "cargo test passes",
-        "cargo clippy passes",
-        "cargo fmt passes"
-      ],
-      "passes": true,
-      "priority": "P0"
-    },
-    {
-      "id": "US-009",
-      "title": "Add unit tests for kimi model compatibility fix",
-      "description": "During dogfooding we discovered the existing test coverage for model-specific is_error handling is insufficient. Need to add dedicated tests for model_rejects_is_error_field function and translate_message behavior with different models.",
-      "acceptanceCriteria": [
-        "Test model_rejects_is_error_field identifies kimi-k2.5, kimi-k1.5, dashscope/kimi-k2.5",
-        "Test translate_message includes is_error for gpt-4, grok-3, claude models",
-        "Test translate_message excludes is_error for kimi models",
-        "Test build_chat_completion_request produces correct payload for kimi vs non-kimi",
-        "All new tests pass",
-        "cargo test --package api passes"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-010",
-      "title": "Add model compatibility documentation",
-      "description": "Document which models require special handling (is_error exclusion, reasoning model tuning param stripping, etc.) in a MODEL_COMPATIBILITY.md file for operators and contributors.",
-      "acceptanceCriteria": [
-        "MODEL_COMPATIBILITY.md created in docs/ or repo root",
-        "Document kimi models is_error exclusion",
-        "Document reasoning models (o1, o3, grok-3-mini) tuning param stripping",
-        "Document gpt-5 max_completion_tokens requirement",
-        "Document qwen model routing through dashscope",
-        "Cross-reference with existing code comments"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-011",
-      "title": "Performance optimization: reduce API request serialization overhead",
-      "description": "The translate_message function creates intermediate JSON Value objects that could be optimized. Profile and optimize the hot path for API request building, especially for conversations with many tool results.",
-      "acceptanceCriteria": [
-        "Profile current request building with criterion or similar",
-        "Identify bottlenecks in translate_message and build_chat_completion_request",
-        "Implement optimizations (Vec pre-allocation, reduced cloning, etc.)",
-        "Benchmark before/after showing improvement",
-        "No functional changes or API breakage"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-012",
-      "title": "Trust prompt resolver with allowlist auto-trust",
-      "description": "Add allowlisted auto-trust behavior for known repos/worktrees. Trust prompts currently block TUI startup and require manual intervention. Implement automatic trust resolution for pre-approved repositories.",
-      "acceptanceCriteria": [
-        "TrustAllowlist config structure with repo patterns",
-        "Auto-trust behavior for allowlisted repos/worktrees",
-        "trust_required event emitted when trust prompt detected",
-        "trust_resolved event emitted when trust is granted",
-        "Non-allowlisted repos remain gated (manual trust required)",
-        "Integration with worker boot lifecycle",
-        "Tests for allowlist matching and event emission"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-013",
-      "title": "Phase 2 - Session event ordering + terminal-state reconciliation",
-      "description": "When the same session emits contradictory lifecycle events (idle, error, completed, transport/server-down) in close succession, expose deterministic final truth. Attach monotonic sequence/causal ordering metadata, classify terminal vs advisory events, reconcile duplicate/out-of-order terminal events into one canonical lane outcome.",
-      "acceptanceCriteria": [
-        "Monotonic sequence / causal ordering metadata attached to session lifecycle events",
-        "Terminal vs advisory event classification implemented",
-        "Reconcile duplicate or out-of-order terminal events into one canonical outcome",
-        "Distinguish 'session terminal state unknown because transport died' from real 'completed'",
-        "Tests verify reconciliation behavior with out-of-order event bursts"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-014",
-      "title": "Phase 2 - Event provenance / environment labeling",
-      "description": "Every emitted event should declare its source (live_lane, test, healthcheck, replay, transport) so claws do not mistake test noise for production truth. Include environment/channel label, emitter identity, and confidence/trust level.",
-      "acceptanceCriteria": [
-        "EventProvenance enum with live_lane, test, healthcheck, replay, transport variants",
-        "Environment/channel label attached to all events",
-        "Emitter identity field on events",
-        "Confidence/trust level field for downstream automation",
-        "Tests verify provenance labeling and filtering"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-015",
-      "title": "Phase 2 - Session identity completeness at creation time",
-      "description": "A newly created session should emit stable title, workspace/worktree path, and lane/session purpose at creation time. If any field is not yet known, emit explicit typed placeholder reason rather than bare unknown string.",
-      "acceptanceCriteria": [
-        "Session creation emits stable title, workspace/worktree path, purpose immediately",
-        "Explicit typed placeholder when fields unknown (not bare 'unknown' strings)",
-        "Later-enriched metadata reconciles onto same session identity without ambiguity",
-        "Tests verify session identity completeness and placeholder handling"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-016",
-      "title": "Phase 2 - Duplicate terminal-event suppression",
-      "description": "When the same session emits repeated completed/failed/terminal notifications, collapse duplicates before they trigger repeated downstream reactions. Attach canonical terminal-event fingerprint per lane/session outcome.",
-      "acceptanceCriteria": [
-        "Canonical terminal-event fingerprint attached per lane/session outcome",
-        "Suppress/coalesce repeated terminal notifications within reconciliation window",
-        "Preserve raw event history for audit while exposing one actionable outcome downstream",
-        "Surface when later duplicate materially differs from original terminal payload",
-        "Tests verify deduplication and material difference detection"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-017",
-      "title": "Phase 2 - Lane ownership / scope binding",
-      "description": "Each session and lane event should declare who owns it and what workflow scope it belongs to. Attach owner/assignee identity, workflow scope (claw-code-dogfood, external-git-maintenance, infra-health, manual-operator), and mark whether watcher is expected to act, observe only, or ignore.",
-      "acceptanceCriteria": [
-        "Owner/assignee identity attached to sessions and lane events",
-        "Workflow scope field (claw-code-dogfood, external-git-maintenance, etc.)",
-        "Watcher action expectation field (act, observe-only, ignore)",
-        "Preserve scope through session restarts, resumes, and late terminal events",
-        "Tests verify ownership and scope binding"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-018",
-      "title": "Phase 2 - Nudge acknowledgment / dedupe contract",
-      "description": "Periodic clawhip nudges should carry nudge id/cycle id and delivery timestamp. Expose whether claw has already acknowledged or responded for that cycle. Distinguish new nudge, retry nudge, and stale duplicate.",
-      "acceptanceCriteria": [
-        "Nudge id / cycle id and delivery timestamp attached",
-        "Acknowledgment state exposed (already acknowledged or not)",
-        "Distinguish new nudge vs retry nudge vs stale duplicate",
-        "Allow downstream summaries to bind reported pinpoint back to triggering nudge id",
-        "Tests verify nudge deduplication and acknowledgment tracking"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-019",
-      "title": "Phase 2 - Stable roadmap-id assignment for newly filed pinpoints",
-      "description": "When a claw records a new pinpoint/follow-up, assign or expose a stable tracking id immediately. Expose that id in structured event/report payload and preserve across edits, reorderings, and summary compression.",
-      "acceptanceCriteria": [
-        "Canonical roadmap id assigned at filing time",
-        "Roadmap id exposed in structured event/report payload",
-        "Same id preserved across edits, reorderings, summary compression",
-        "Distinguish 'new roadmap filing' from 'update to existing roadmap item'",
-        "Tests verify stable id assignment and update detection"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-020",
-      "title": "Phase 2 - Roadmap item lifecycle state contract",
-      "description": "Each roadmap pinpoint should carry machine-readable lifecycle state (filed, acknowledged, in_progress, blocked, done, superseded). Attach last state-change timestamp and preserve lineage when one pinpoint supersedes or merges into another.",
-      "acceptanceCriteria": [
-        "Lifecycle state enum with filed, acknowledged, in_progress, blocked, done, superseded",
-        "Last state-change timestamp attached",
-        "New report can declare first filing, status update, or closure",
-        "Preserve lineage when one pinpoint supersedes or merges into another",
-        "Tests verify lifecycle state transitions"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-021",
-      "title": "Request body size pre-flight check for OpenAI-compatible provider",
-      "description": "Implement pre-flight request body size estimation to prevent 400 Bad Request errors from API gateways with size limits. Based on dogfood findings with kimi-k2.5 testing, DashScope API has a 6MB request body limit that was exceeded by large system prompts.",
-      "acceptanceCriteria": [
-        "Pre-flight size estimation before sending requests to OpenAI-compatible providers",
-        "Clear error message when request exceeds provider-specific size limit",
-        "Configuration for different provider limits (6MB DashScope, 100MB OpenAI, etc.)",
-        "Unit tests for size estimation and limit checking",
-        "Integration with existing error handling for actionable user messages"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-022",
-      "title": "Enhanced error context for API failures",
-      "description": "Add structured error context to API failures including request ID tracking across retries, provider-specific error code mapping, and suggested user actions based on error type (e.g., 'Reduce prompt size' for 413, 'Check API key' for 401).",
-      "acceptanceCriteria": [
-        "Request ID tracking across retries with full context in error messages",
-        "Provider-specific error code mapping with actionable suggestions",
-        "Suggested user actions for common error types (401, 403, 413, 429, 500, 502-504)",
-        "Unit tests for error context extraction",
-        "All existing tests pass and clippy is clean"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-023",
-      "title": "Add automatic routing for kimi models to DashScope",
-      "description": "Based on dogfood findings with kimi-k2.5 testing, users must manually prefix with dashscope/kimi-k2.5 instead of just using kimi-k2.5. Add automatic routing for kimi/ and kimi- prefixed models to DashScope (similar to qwen models), and add a 'kimi' alias to the model registry.",
-      "acceptanceCriteria": [
-        "kimi/ and kimi- prefix routing to DashScope in metadata_for_model()",
-        "'kimi' alias in MODEL_REGISTRY that resolves to 'kimi-k2.5'",
-        "resolve_model_alias() handles the kimi alias correctly",
-        "Unit tests for kimi routing (similar to qwen routing tests)",
-        "All tests pass and clippy is clean"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-024",
-      "title": "Add token limit metadata for kimi models",
-      "description": "The model_token_limit() function has no entries for kimi-k2.5 or kimi-k1.5, causing preflight context window validation to skip these models. Add token limit metadata to enable preflight checks and accurate max token defaults. Per Moonshot AI documentation, kimi-k2.5 supports 256K context window and 16K max output tokens.",
-      "acceptanceCriteria": [
-        "model_token_limit('kimi-k2.5') returns Some(ModelTokenLimit { max_output_tokens: 16384, context_window_tokens: 256000 })",
-        "model_token_limit('kimi-k1.5') returns appropriate limits",
-        "model_token_limit('kimi') follows alias chain (kimi → kimi-k2.5) and returns k2.5 limits",
-        "preflight_message_request() validates context window for kimi models (via generic preflight, no provider-specific code needed)",
-        "Unit tests verify limits and preflight behavior for kimi models",
-        "All tests pass and clippy is clean"
-      ],
-      "passes": true,
-      "priority": "P1"
-    }
-  ],
-  "metadata": {
-    "lastUpdated": "2026-04-17",
-    "completedStories": ["US-001", "US-002", "US-003", "US-004", "US-005", "US-006", "US-007", "US-008", "US-009", "US-010", "US-011", "US-012", "US-013", "US-014", "US-015", "US-016", "US-017", "US-018", "US-019", "US-020", "US-021", "US-022", "US-023", "US-024"],
-    "inProgressStories": [],
-    "totalStories": 24,
-    "status": "completed"
-  }
-}

progress.txt

@@ -1,133 +0,0 @@
-Ralph Iteration Summary - claw-code Roadmap Implementation
-===========================================================
-
-Iteration 1: 2026-04-16
-------------------------
-
-US-001 COMPLETED (Phase 1.6 - startup-no-evidence evidence bundle + classifier)
-- Files: rust/crates/runtime/src/worker_boot.rs
-- Added StartupFailureClassification enum with 6 variants
-- Added StartupEvidenceBundle with 8 fields
-- Implemented classify_startup_failure() logic
-- Added observe_startup_timeout() method to Worker
-- Tests: 6 new tests verifying classification logic
-
-US-002 COMPLETED (Phase 2 - Canonical lane event schema)
-- Files: rust/crates/runtime/src/lane_events.rs
-- Added EventProvenance enum with 5 labels
-- Added SessionIdentity, LaneOwnership structs
-- Added LaneEventMetadata with sequence/ordering
-- Added LaneEventBuilder for construction
-- Implemented is_terminal_event(), dedupe_terminal_events()
-- Tests: 10 new tests for events and deduplication
-
-US-005 COMPLETED (Phase 4 - Typed task packet format)
-- Files:
-  - rust/crates/runtime/src/task_packet.rs
-  - rust/crates/runtime/src/task_registry.rs
-  - rust/crates/tools/src/lib.rs
-- Added TaskScope enum (Workspace, Module, SingleFile, Custom)
-- Updated TaskPacket with scope_path and worktree fields
-- Added validate_scope_requirements() validation logic
-- Fixed all test compilation errors in dependent modules
-- Tests: Updated existing tests to use new types
-
-PRE-EXISTING IMPLEMENTATIONS (verified working):
-------------------------------------------------
-
-US-003 COMPLETE (Phase 3 - Stale-branch detection)
-- Files: rust/crates/runtime/src/stale_branch.rs
-- BranchFreshness enum (Fresh, Stale, Diverged)
-- StaleBranchPolicy (AutoRebase, AutoMergeForward, WarnOnly, Block)
-- StaleBranchEvent with structured events
-- check_freshness() with git integration
-- apply_policy() with policy resolution
-- Tests: 12 unit tests + 5 integration tests passing
-
-US-004 COMPLETE (Phase 3 - Recovery recipes with ledger)
-- Files: rust/crates/runtime/src/recovery_recipes.rs
-- FailureScenario enum with 7 scenarios
-- RecoveryStep enum with actionable steps
-- RecoveryRecipe with step sequences
-- RecoveryLedger for attempt tracking
-- RecoveryEvent for structured emission
-- attempt_recovery() with escalation logic
-- Tests: 15 unit tests + 1 integration test passing
-
-US-006 COMPLETE (Phase 4 - Policy engine for autonomous coding)
-- Files: rust/crates/runtime/src/policy_engine.rs
-- PolicyRule with condition/action/priority
-- PolicyCondition (And, Or, GreenAt, StaleBranch, etc.)
-- PolicyAction (MergeToDev, RecoverOnce, Escalate, etc.)
-- LaneContext for evaluation context
-- evaluate() for rule matching
-- Tests: 18 unit tests + 6 integration tests passing
-
-US-007 COMPLETE (Phase 5 - Plugin/MCP lifecycle maturity)
-- Files: rust/crates/runtime/src/plugin_lifecycle.rs
-- ServerStatus enum (Healthy, Degraded, Failed)
-- ServerHealth with capabilities tracking
-- PluginState with full lifecycle states
-- PluginLifecycle event tracking
-- PluginHealthcheck structured results
-- DiscoveryResult for capability discovery
-- DegradedMode behavior
-- Tests: 11 unit tests passing
-
-VERIFICATION STATUS:
-------------------
-- cargo build --workspace: PASSED
-- cargo test --workspace: PASSED (476+ unit tests, 12 integration tests)
-- cargo clippy --workspace: PASSED
-
-All 7 stories from prd.json now have passes: true
-
-Iteration 2: 2026-04-16
-------------------------
-
-US-009 COMPLETED (Add unit tests for kimi model compatibility fix)
-- Files: rust/crates/api/src/providers/openai_compat.rs
-- Added 4 comprehensive unit tests:
-  1. model_rejects_is_error_field_detects_kimi_models - verifies detection of kimi-k2.5, kimi-k1.5, dashscope/kimi-k2.5, case insensitivity
-  2. translate_message_includes_is_error_for_non_kimi_models - verifies gpt-4o, grok-3, claude include is_error
-  3. translate_message_excludes_is_error_for_kimi_models - verifies kimi models exclude is_error (prevents 400 Bad Request)
-  4. build_chat_completion_request_kimi_vs_non_kimi_tool_results - full integration test for request building
-- Tests: 4 new tests, 119 unit tests total in api crate (+4), all passing
-- Integration tests: 29 passing (no regressions)
-
-US-010 COMPLETED (Add model compatibility documentation)
-- Files: docs/MODEL_COMPATIBILITY.md
-- Created comprehensive documentation covering:
-  1. Kimi Models (is_error Exclusion) - documents the 400 Bad Request issue and solution
-  2. Reasoning Models (Tuning Parameter Stripping) - covers o1, o3, o4, grok-3-mini, qwen-qwq, qwen3-thinking
-  3. GPT-5 (max_completion_tokens) - documents max_tokens vs max_completion_tokens requirement
-  4. Qwen Models (DashScope Routing) - explains routing and authentication
-- Added implementation details section with key functions
-- Added "Adding New Models" guide for future contributors
-- Added testing section with example commands
-- Cross-referenced with existing code comments in openai_compat.rs
-- cargo clippy passes
-
-US-011 COMPLETED (Performance optimization: reduce API request serialization overhead)
-- Files:
-  - rust/crates/api/Cargo.toml (added criterion dev-dependency and bench config)
-  - rust/crates/api/benches/request_building.rs (new benchmark suite)
-  - rust/crates/api/src/providers/openai_compat.rs (optimizations)
-  - rust/crates/api/src/lib.rs (public exports for benchmarks)
-- Optimizations implemented:
-  1. flatten_tool_result_content: Pre-allocate String capacity and avoid intermediate Vec
-     - Before: collected to Vec<String> then joined
-     - After: single String with pre-calculated capacity, push directly
-  2. Made key functions public for benchmarking: translate_message, build_chat_completion_request,
-     flatten_tool_result_content, is_reasoning_model, model_rejects_is_error_field
-- Benchmark results:
-  - flatten_tool_result_content/single_text: ~17ns
-  - flatten_tool_result_content/multi_text (10 blocks): ~46ns
-  - flatten_tool_result_content/large_content (50 blocks): ~11.7µs
-  - translate_message/text_only: ~200ns
-  - translate_message/tool_result: ~348ns
-  - build_chat_completion_request/10 messages: ~16.4µs
-  - build_chat_completion_request/100 messages: ~209µs
-  - is_reasoning_model detection: ~26-42ns depending on model
-- All tests pass (119 unit tests + 29 integration tests)
-- cargo clippy passes

rust/.claw.json

@@ -1,5 +0,0 @@
-{
-  "permissions": {
-    "defaultMode": "dontAsk"
-  }
-}

rust/.claw/sessions/session-1775386832313-0.jsonl

@@ -1 +1,2 @@
-{"created_at_ms":1775777421902,"session_id":"session-1775777421902-1","type":"session_meta","updated_at_ms":1775777421902,"version":1}
+{"created_at_ms":1775386832313,"session_id":"session-1775386832313-0","type":"session_meta","updated_at_ms":1775386832313,"version":1}
+{"message":{"blocks":[{"text":"status --help","type":"text"}],"role":"user"},"type":"message"}

rust/.gitignore

@@ -1,7 +1,3 @@
 target/
 .omx/
 .clawd-agents/
-# Claw Code local artifacts
-.claw/settings.local.json
-.claw/sessions/
-.clawhip/

rust/CLAUDE.md

@@ -1,15 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claw Code (clawcode.dev) when working with code in this repository.
-
-## Detected stack
-- Languages: Rust.
-- Frameworks: none detected from the supported starter markers.
-
-## Verification
-- Run Rust verification from the repo root: `cargo fmt`, `cargo clippy --workspace --all-targets -- -D warnings`, `cargo test --workspace`
-
-## Working agreement
-- Prefer small, reviewable changes and keep generated bootstrap files aligned with actual repo workflows.
-- Keep shared defaults in `.claw.json`; reserve `.claw/settings.local.json` for machine-local overrides.
-- Do not overwrite existing `CLAUDE.md` content automatically; update it intentionally when repo workflows change.

rust/Cargo.lock

@@ -17,23 +17,10 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "anes"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
-
-[[package]]
-name = "anstyle"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
-
 [[package]]
 name = "api"
 version = "0.1.0"
 dependencies = [
- "criterion",
  "reqwest",
  "runtime",
  "serde",
@@ -48,12 +35,6 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
-[[package]]
-name = "autocfg"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
-
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -96,12 +77,6 @@ version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
-[[package]]
-name = "cast"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
-
 [[package]]
 name = "cc"
 version = "1.2.58"
@@ -124,58 +99,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
-[[package]]
-name = "ciborium"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"
-dependencies = [
- "ciborium-io",
- "ciborium-ll",
- "serde",
-]
-
-[[package]]
-name = "ciborium-io"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"
-
-[[package]]
-name = "ciborium-ll"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"
-dependencies = [
- "ciborium-io",
- "half",
-]
-
-[[package]]
-name = "clap"
-version = "4.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
-dependencies = [
- "clap_builder",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
-dependencies = [
- "anstyle",
- "clap_lex",
-]
-
-[[package]]
-name = "clap_lex"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
-
 [[package]]
 name = "clipboard-win"
 version = "5.4.1"
@@ -221,67 +144,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "criterion"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2b12d017a929603d80db1831cd3a24082f8137ce19c69e6447f54f5fc8d692f"
-dependencies = [
- "anes",
- "cast",
- "ciborium",
- "clap",
- "criterion-plot",
- "is-terminal",
- "itertools",
- "num-traits",
- "once_cell",
- "oorandom",
- "plotters",
- "rayon",
- "regex",
- "serde",
- "serde_derive",
- "serde_json",
- "tinytemplate",
- "walkdir",
-]
-
-[[package]]
-name = "criterion-plot"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b50826342786a51a89e2da3a28f1c32b06e387201bc2d19791f622c673706b1"
-dependencies = [
- "cast",
- "itertools",
-]
-
-[[package]]
-name = "crossbeam-deque"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
-dependencies = [
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
-
 [[package]]
 name = "crossterm"
 version = "0.28.1"
@@ -307,12 +169,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "crunchy"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
-
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -353,12 +209,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "either"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
-
 [[package]]
 name = "endian-type"
 version = "0.1.2"
@@ -395,7 +245,7 @@ checksum = "0ce92ff622d6dadf7349484f42c93271a0d49b7cc4d466a936405bacbe10aa78"
 dependencies = [
  "cfg-if",
  "rustix 1.1.4",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -530,29 +380,12 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
-[[package]]
-name = "half"
-version = "2.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
-dependencies = [
- "cfg-if",
- "crunchy",
- "zerocopy",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 
-[[package]]
-name = "hermit-abi"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
-
 [[package]]
 name = "home"
 version = "0.5.12"
@@ -789,26 +622,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "is-terminal"
-version = "0.4.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
-dependencies = [
- "hermit-abi",
- "libc",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "itertools"
-version = "0.10.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "itoa"
 version = "1.0.18"
@@ -942,15 +755,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
 
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
-]
-
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -979,12 +783,6 @@ dependencies = [
  "pkg-config",
 ]
 
-[[package]]
-name = "oorandom"
-version = "11.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
-
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -1039,34 +837,6 @@ dependencies = [
  "time",
 ]
 
-[[package]]
-name = "plotters"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aeb6f403d7a4911efb1e33402027fc44f29b5bf6def3effcc22d7bb75f2b747"
-dependencies = [
- "num-traits",
- "plotters-backend",
- "plotters-svg",
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
-name = "plotters-backend"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df42e13c12958a16b3f7f4386b9ab1f3e7933914ecea48da7139435263a4172a"
-
-[[package]]
-name = "plotters-svg"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51bae2ac328883f7acdfea3d66a7c35751187f870bc81f94563733a154d7a670"
-dependencies = [
- "plotters-backend",
-]
-
 [[package]]
 name = "plugins"
 version = "0.1.0"
@@ -1245,26 +1015,6 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
-[[package]]
-name = "rayon"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
-dependencies = [
- "either",
- "rayon-core",
-]
-
-[[package]]
-name = "rayon-core"
-version = "1.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
-dependencies = [
- "crossbeam-deque",
- "crossbeam-utils",
-]
-
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -1388,7 +1138,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1772,16 +1522,6 @@ dependencies = [
  "zerovec",
 ]
 
-[[package]]
-name = "tinytemplate"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4d6b5f19ff7664e8c98d03e2139cb510db9b0a60b55f8e8709b689d939b6bc"
-dependencies = [
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "tinyvec"
 version = "1.11.0"

rust/README.md

@@ -34,10 +34,10 @@ export ANTHROPIC_API_KEY="sk-ant-..."
 export ANTHROPIC_BASE_URL="https://your-proxy.com"
 ```
 
-Or provide an OAuth bearer token directly:
+Or authenticate via OAuth and let the CLI persist credentials locally:
 
 ```bash
-export ANTHROPIC_AUTH_TOKEN="anthropic-oauth-or-proxy-bearer-token"
+cargo run -p rusty-claude-cli -- login
 ```
 
 ## Mock parity harness
@@ -80,7 +80,7 @@ Primary artifacts:
 | Feature | Status |
 |---------|--------|
 | Anthropic / OpenAI-compatible provider flows + streaming | ✅ |
-| Direct bearer-token auth via `ANTHROPIC_AUTH_TOKEN` | ✅ |
+| OAuth login/logout | ✅ |
 | Interactive REPL (rustyline) | ✅ |
 | Tool system (bash, read, write, edit, grep, glob) | ✅ |
 | Web tools (search, fetch) | ✅ |
@@ -135,18 +135,17 @@ Top-level commands:
   version
   status
   sandbox
-  acp [serve]
   dump-manifests
   bootstrap-plan
   agents
   mcp
   skills
   system-prompt
+  login
+  logout
   init
 ```
 
-`claw acp` is a local discoverability surface for editor-first users: it reports the current ACP/Zed status without starting the runtime. As of April 16, 2026, claw-code does **not** ship an ACP/Zed daemon entrypoint yet, and `claw acp serve` is only a status alias until the real protocol surface lands.
-
 The command surface is moving quickly. For the canonical live help text, run:
 
 ```bash
@@ -160,8 +159,8 @@ Tab completion expands slash commands, model aliases, permission modes, and rece
 The REPL now exposes a much broader surface than the original minimal shell:
 
 - session / visibility: `/help`, `/status`, `/sandbox`, `/cost`, `/resume`, `/session`, `/version`, `/usage`, `/stats`
-- workspace / git: `/compact`, `/clear`, `/config`, `/memory`, `/init`, `/diff`, `/commit`, `/pr`, `/issue`, `/export`, `/hooks`, `/files`, `/release-notes`
-- discovery / debugging: `/mcp`, `/agents`, `/skills`, `/doctor`, `/tasks`, `/context`, `/desktop`
+- workspace / git: `/compact`, `/clear`, `/config`, `/memory`, `/init`, `/diff`, `/commit`, `/pr`, `/issue`, `/export`, `/hooks`, `/files`, `/branch`, `/release-notes`, `/add-dir`
+- discovery / debugging: `/mcp`, `/agents`, `/skills`, `/doctor`, `/tasks`, `/context`, `/desktop`, `/ide`
 - automation / analysis: `/review`, `/advisor`, `/insights`, `/security-review`, `/subagent`, `/team`, `/telemetry`, `/providers`, `/cron`, and more
 - plugin management: `/plugin` (with aliases `/plugins`, `/marketplace`)
 
@@ -195,7 +194,7 @@ rust/
 
 ### Crate Responsibilities
 
-- **api** — provider clients, SSE streaming, request/response types, auth (`ANTHROPIC_API_KEY` + bearer-token support), request-size/context-window preflight
+- **api** — provider clients, SSE streaming, request/response types, auth (API key + OAuth bearer), request-size/context-window preflight
 - **commands** — slash command definitions, parsing, help text generation, JSON/text command rendering
 - **compat-harness** — extracts tool/prompt manifests from upstream TS source
 - **mock-anthropic-service** — deterministic `/v1/messages` mock for CLI parity tests and local harness runs

rust/crates/api/Cargo.toml

@@ -13,12 +13,5 @@ serde_json.workspace = true
 telemetry = { path = "../telemetry" }
 tokio = { version = "1", features = ["io-util", "macros", "net", "rt-multi-thread", "time"] }
 
-[dev-dependencies]
-criterion = { version = "0.5", features = ["html_reports"] }
-
 [lints]
 workspace = true
-
-[[bench]]
-name = "request_building"
-harness = false

rust/crates/api/benches/request_building.rs

@@ -1,329 +0,0 @@
-// Benchmarks for API request building performance
-// Benchmarks are exempt from strict linting as they are test/performance code
-#![allow(
-    clippy::cognitive_complexity,
-    clippy::doc_markdown,
-    clippy::explicit_iter_loop,
-    clippy::format_in_format_args,
-    clippy::missing_docs_in_private_items,
-    clippy::must_use_candidate,
-    clippy::needless_pass_by_value,
-    clippy::clone_on_copy,
-    clippy::too_many_lines,
-    clippy::uninlined_format_args
-)]
-
-use api::{
-    build_chat_completion_request, flatten_tool_result_content, is_reasoning_model,
-    translate_message, InputContentBlock, InputMessage, MessageRequest, OpenAiCompatConfig,
-    ToolResultContentBlock,
-};
-use criterion::{black_box, criterion_group, criterion_main, BenchmarkId, Criterion};
-use serde_json::json;
-
-/// Create a sample message request with various content types
-fn create_sample_request(message_count: usize) -> MessageRequest {
-    let mut messages = Vec::with_capacity(message_count);
-
-    for i in 0..message_count {
-        match i % 4 {
-            0 => messages.push(InputMessage::user_text(format!("Message {}", i))),
-            1 => messages.push(InputMessage {
-                role: "assistant".to_string(),
-                content: vec![
-                    InputContentBlock::Text {
-                        text: format!("Assistant response {}", i),
-                    },
-                    InputContentBlock::ToolUse {
-                        id: format!("call_{}", i),
-                        name: "read_file".to_string(),
-                        input: json!({"path": format!("/tmp/file{}", i)}),
-                    },
-                ],
-            }),
-            2 => messages.push(InputMessage {
-                role: "user".to_string(),
-                content: vec![InputContentBlock::ToolResult {
-                    tool_use_id: format!("call_{}", i - 1),
-                    content: vec![ToolResultContentBlock::Text {
-                        text: format!("Tool result content {}", i),
-                    }],
-                    is_error: false,
-                }],
-            }),
-            _ => messages.push(InputMessage {
-                role: "assistant".to_string(),
-                content: vec![InputContentBlock::ToolUse {
-                    id: format!("call_{}", i),
-                    name: "write_file".to_string(),
-                    input: json!({"path": format!("/tmp/out{}", i), "content": "data"}),
-                }],
-            }),
-        }
-    }
-
-    MessageRequest {
-        model: "gpt-4o".to_string(),
-        max_tokens: 1024,
-        messages,
-        stream: false,
-        system: Some("You are a helpful assistant.".to_string()),
-        temperature: Some(0.7),
-        top_p: None,
-        tools: None,
-        tool_choice: None,
-        frequency_penalty: None,
-        presence_penalty: None,
-        stop: None,
-        reasoning_effort: None,
-    }
-}
-
-/// Benchmark translate_message with various message types
-fn bench_translate_message(c: &mut Criterion) {
-    let mut group = c.benchmark_group("translate_message");
-
-    // Text-only message
-    let text_message = InputMessage::user_text("Simple text message".to_string());
-    group.bench_with_input(
-        BenchmarkId::new("text_only", "single"),
-        &text_message,
-        |b, msg| {
-            b.iter(|| translate_message(black_box(msg), black_box("gpt-4o")));
-        },
-    );
-
-    // Assistant message with tool calls
-    let assistant_message = InputMessage {
-        role: "assistant".to_string(),
-        content: vec![
-            InputContentBlock::Text {
-                text: "I'll help you with that.".to_string(),
-            },
-            InputContentBlock::ToolUse {
-                id: "call_1".to_string(),
-                name: "read_file".to_string(),
-                input: json!({"path": "/tmp/test"}),
-            },
-            InputContentBlock::ToolUse {
-                id: "call_2".to_string(),
-                name: "write_file".to_string(),
-                input: json!({"path": "/tmp/out", "content": "data"}),
-            },
-        ],
-    };
-    group.bench_with_input(
-        BenchmarkId::new("assistant_with_tools", "2_tools"),
-        &assistant_message,
-        |b, msg| {
-            b.iter(|| translate_message(black_box(msg), black_box("gpt-4o")));
-        },
-    );
-
-    // Tool result message
-    let tool_result_message = InputMessage {
-        role: "user".to_string(),
-        content: vec![InputContentBlock::ToolResult {
-            tool_use_id: "call_1".to_string(),
-            content: vec![ToolResultContentBlock::Text {
-                text: "File contents here".to_string(),
-            }],
-            is_error: false,
-        }],
-    };
-    group.bench_with_input(
-        BenchmarkId::new("tool_result", "single"),
-        &tool_result_message,
-        |b, msg| {
-            b.iter(|| translate_message(black_box(msg), black_box("gpt-4o")));
-        },
-    );
-
-    // Tool result for kimi model (is_error excluded)
-    group.bench_with_input(
-        BenchmarkId::new("tool_result_kimi", "kimi-k2.5"),
-        &tool_result_message,
-        |b, msg| {
-            b.iter(|| translate_message(black_box(msg), black_box("kimi-k2.5")));
-        },
-    );
-
-    // Large content message
-    let large_content = "x".repeat(10000);
-    let large_message = InputMessage::user_text(large_content);
-    group.bench_with_input(
-        BenchmarkId::new("large_text", "10kb"),
-        &large_message,
-        |b, msg| {
-            b.iter(|| translate_message(black_box(msg), black_box("gpt-4o")));
-        },
-    );
-
-    group.finish();
-}
-
-/// Benchmark build_chat_completion_request with various message counts
-fn bench_build_request(c: &mut Criterion) {
-    let mut group = c.benchmark_group("build_chat_completion_request");
-    let config = OpenAiCompatConfig::openai();
-
-    for message_count in [10, 50, 100].iter() {
-        let request = create_sample_request(*message_count);
-        group.bench_with_input(
-            BenchmarkId::new("message_count", message_count),
-            &request,
-            |b, req| {
-                b.iter(|| build_chat_completion_request(black_box(req), config.clone()));
-            },
-        );
-    }
-
-    // Benchmark with reasoning model (tuning params stripped)
-    let mut reasoning_request = create_sample_request(50);
-    reasoning_request.model = "o1-mini".to_string();
-    group.bench_with_input(
-        BenchmarkId::new("reasoning_model", "o1-mini"),
-        &reasoning_request,
-        |b, req| {
-            b.iter(|| build_chat_completion_request(black_box(req), config.clone()));
-        },
-    );
-
-    // Benchmark with gpt-5 (max_completion_tokens)
-    let mut gpt5_request = create_sample_request(50);
-    gpt5_request.model = "gpt-5".to_string();
-    group.bench_with_input(
-        BenchmarkId::new("gpt5", "gpt-5"),
-        &gpt5_request,
-        |b, req| {
-            b.iter(|| build_chat_completion_request(black_box(req), config.clone()));
-        },
-    );
-
-    group.finish();
-}
-
-/// Benchmark flatten_tool_result_content
-fn bench_flatten_tool_result(c: &mut Criterion) {
-    let mut group = c.benchmark_group("flatten_tool_result_content");
-
-    // Single text block
-    let single_text = vec![ToolResultContentBlock::Text {
-        text: "Simple result".to_string(),
-    }];
-    group.bench_with_input(
-        BenchmarkId::new("single_text", "1_block"),
-        &single_text,
-        |b, content| {
-            b.iter(|| flatten_tool_result_content(black_box(content)));
-        },
-    );
-
-    // Multiple text blocks
-    let multi_text: Vec<ToolResultContentBlock> = (0..10)
-        .map(|i| ToolResultContentBlock::Text {
-            text: format!("Line {}: some content here\n", i),
-        })
-        .collect();
-    group.bench_with_input(
-        BenchmarkId::new("multi_text", "10_blocks"),
-        &multi_text,
-        |b, content| {
-            b.iter(|| flatten_tool_result_content(black_box(content)));
-        },
-    );
-
-    // JSON content blocks
-    let json_content: Vec<ToolResultContentBlock> = (0..5)
-        .map(|i| ToolResultContentBlock::Json {
-            value: json!({"index": i, "data": "test content", "nested": {"key": "value"}}),
-        })
-        .collect();
-    group.bench_with_input(
-        BenchmarkId::new("json_content", "5_blocks"),
-        &json_content,
-        |b, content| {
-            b.iter(|| flatten_tool_result_content(black_box(content)));
-        },
-    );
-
-    // Mixed content
-    let mixed_content = vec![
-        ToolResultContentBlock::Text {
-            text: "Here's the result:".to_string(),
-        },
-        ToolResultContentBlock::Json {
-            value: json!({"status": "success", "count": 42}),
-        },
-        ToolResultContentBlock::Text {
-            text: "Processing complete.".to_string(),
-        },
-    ];
-    group.bench_with_input(
-        BenchmarkId::new("mixed_content", "text+json"),
-        &mixed_content,
-        |b, content| {
-            b.iter(|| flatten_tool_result_content(black_box(content)));
-        },
-    );
-
-    // Large content - simulating typical tool output
-    let large_content: Vec<ToolResultContentBlock> = (0..50)
-        .map(|i| {
-            if i % 3 == 0 {
-                ToolResultContentBlock::Json {
-                    value: json!({"line": i, "content": "x".repeat(100)}),
-                }
-            } else {
-                ToolResultContentBlock::Text {
-                    text: format!("Line {}: {}", i, "some output content here"),
-                }
-            }
-        })
-        .collect();
-    group.bench_with_input(
-        BenchmarkId::new("large_content", "50_blocks"),
-        &large_content,
-        |b, content| {
-            b.iter(|| flatten_tool_result_content(black_box(content)));
-        },
-    );
-
-    group.finish();
-}
-
-/// Benchmark is_reasoning_model detection
-fn bench_is_reasoning_model(c: &mut Criterion) {
-    let mut group = c.benchmark_group("is_reasoning_model");
-
-    let models = vec![
-        ("gpt-4o", false),
-        ("o1-mini", true),
-        ("o3", true),
-        ("grok-3", false),
-        ("grok-3-mini", true),
-        ("qwen/qwen-qwq-32b", true),
-        ("qwen/qwen-plus", false),
-    ];
-
-    for (model, expected) in models {
-        group.bench_with_input(
-            BenchmarkId::new(model, if expected { "reasoning" } else { "normal" }),
-            model,
-            |b, m| {
-                b.iter(|| is_reasoning_model(black_box(m)));
-            },
-        );
-    }
-
-    group.finish();
-}
-
-criterion_group!(
-    benches,
-    bench_translate_message,
-    bench_build_request,
-    bench_flatten_tool_result,
-    bench_is_reasoning_model
-);
-criterion_main!(benches);

rust/crates/api/src/client.rs

@@ -232,7 +232,10 @@ mod tests {
                     openai_client.base_url()
                 );
             }
-            other => panic!("Expected ProviderClient::OpenAi for qwen-plus, got: {other:?}"),
+            other => panic!(
+                "Expected ProviderClient::OpenAi for qwen-plus, got: {:?}",
+                other
+            ),
         }
     }
 }

rust/crates/api/src/error.rs

@@ -24,7 +24,7 @@ pub enum ApiError {
         env_vars: &'static [&'static str],
         /// Optional, runtime-computed hint appended to the error Display
         /// output. Populated when the provider resolver can infer what the
-        /// user probably intended (e.g. an `OpenAI` key is set but Anthropic
+        /// user probably intended (e.g. an OpenAI key is set but Anthropic
         /// was selected because no Anthropic credentials exist).
         hint: Option<String>,
     },
@@ -53,8 +53,6 @@ pub enum ApiError {
         request_id: Option<String>,
         body: String,
         retryable: bool,
-        /// Suggested user action based on error type (e.g., "Reduce prompt size" for 413)
-        suggested_action: Option<String>,
     },
     RetriesExhausted {
         attempts: u32,
@@ -65,11 +63,6 @@ pub enum ApiError {
         attempt: u32,
         base_delay: Duration,
     },
-    RequestBodySizeExceeded {
-        estimated_bytes: usize,
-        max_bytes: usize,
-        provider: &'static str,
-    },
 }
 
 impl ApiError {
@@ -136,8 +129,7 @@ impl ApiError {
             | Self::Io(_)
             | Self::Json { .. }
             | Self::InvalidSseFrame(_)
-            | Self::BackoffOverflow { .. }
-            | Self::RequestBodySizeExceeded { .. } => false,
+            | Self::BackoffOverflow { .. } => false,
         }
     }
 
@@ -155,8 +147,7 @@ impl ApiError {
             | Self::Io(_)
             | Self::Json { .. }
             | Self::InvalidSseFrame(_)
-            | Self::BackoffOverflow { .. }
-            | Self::RequestBodySizeExceeded { .. } => None,
+            | Self::BackoffOverflow { .. } => None,
         }
     }
 
@@ -181,7 +172,6 @@ impl ApiError {
                 "provider_transport"
             }
             Self::InvalidApiKeyEnv(_) | Self::Io(_) | Self::Json { .. } => "runtime_io",
-            Self::RequestBodySizeExceeded { .. } => "request_size",
         }
     }
 
@@ -204,8 +194,7 @@ impl ApiError {
             | Self::Io(_)
             | Self::Json { .. }
             | Self::InvalidSseFrame(_)
-            | Self::BackoffOverflow { .. }
-            | Self::RequestBodySizeExceeded { .. } => false,
+            | Self::BackoffOverflow { .. } => false,
         }
     }
 
@@ -234,14 +223,12 @@ impl ApiError {
             | Self::Io(_)
             | Self::Json { .. }
             | Self::InvalidSseFrame(_)
-            | Self::BackoffOverflow { .. }
-            | Self::RequestBodySizeExceeded { .. } => false,
+            | Self::BackoffOverflow { .. } => false,
         }
     }
 }
 
 impl Display for ApiError {
-    #[allow(clippy::too_many_lines)]
     fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
         match self {
             Self::MissingCredentials {
@@ -337,14 +324,6 @@ impl Display for ApiError {
                 f,
                 "retry backoff overflowed on attempt {attempt} with base delay {base_delay:?}"
             ),
-            Self::RequestBodySizeExceeded {
-                estimated_bytes,
-                max_bytes,
-                provider,
-            } => write!(
-                f,
-                "request body size ({estimated_bytes} bytes) exceeds {provider} limit ({max_bytes} bytes); reduce prompt length or context before retrying"
-            ),
         }
     }
 }
@@ -490,7 +469,6 @@ mod tests {
             request_id: Some("req_jobdori_123".to_string()),
             body: String::new(),
             retryable: true,
-            suggested_action: None,
         };
 
         assert!(error.is_generic_fatal_wrapper());
@@ -513,7 +491,6 @@ mod tests {
                 request_id: Some("req_nested_456".to_string()),
                 body: String::new(),
                 retryable: true,
-                suggested_action: None,
             }),
         };
 
@@ -534,7 +511,6 @@ mod tests {
             request_id: Some("req_ctx_123".to_string()),
             body: String::new(),
             retryable: false,
-            suggested_action: None,
         };
 
         assert!(error.is_context_window_failure());

rust/crates/api/src/http_client.rs

@@ -88,12 +88,12 @@ pub fn build_http_client_with(config: &ProxyConfig) -> Result<reqwest::Client, A
         .as_deref()
         .and_then(reqwest::NoProxy::from_string);
 
-    let (http_proxy_url, https_url) = match config.proxy_url.as_deref() {
+    let (http_proxy_url, https_proxy_url) = match config.proxy_url.as_deref() {
         Some(unified) => (Some(unified), Some(unified)),
         None => (config.http_proxy.as_deref(), config.https_proxy.as_deref()),
     };
 
-    if let Some(url) = https_url {
+    if let Some(url) = https_proxy_url {
         let mut proxy = reqwest::Proxy::https(url)?;
         if let Some(filter) = no_proxy.clone() {
             proxy = proxy.no_proxy(Some(filter));

rust/crates/api/src/lib.rs

@@ -19,10 +19,7 @@ pub use prompt_cache::{
     PromptCacheStats,
 };
 pub use providers::anthropic::{AnthropicClient, AnthropicClient as ApiClient, AuthSource};
-pub use providers::openai_compat::{
-    build_chat_completion_request, flatten_tool_result_content, is_reasoning_model,
-    model_rejects_is_error_field, translate_message, OpenAiCompatClient, OpenAiCompatConfig,
-};
+pub use providers::openai_compat::{OpenAiCompatClient, OpenAiCompatConfig};
 pub use providers::{
     detect_provider_kind, max_tokens_for_model, max_tokens_for_model_with_override,
     resolve_model_alias, ProviderKind,

rust/crates/api/src/providers/anthropic.rs

@@ -502,8 +502,9 @@ impl AnthropicClient {
         // Best-effort refinement using the Anthropic count_tokens endpoint.
         // On any failure (network, parse, auth), fall back to the local
         // byte-estimate result which already passed above.
-        let Ok(counted_input_tokens) = self.count_tokens(request).await else {
-            return Ok(());
+        let counted_input_tokens = match self.count_tokens(request).await {
+            Ok(count) => count,
+            Err(_) => return Ok(()),
         };
         let estimated_total_tokens = counted_input_tokens.saturating_add(request.max_tokens);
         if estimated_total_tokens > limit.context_window_tokens {
@@ -630,7 +631,21 @@ impl AuthSource {
         if let Some(bearer_token) = read_env_non_empty("ANTHROPIC_AUTH_TOKEN")? {
             return Ok(Self::BearerToken(bearer_token));
         }
-        Err(anthropic_missing_credentials())
+        match load_saved_oauth_token() {
+            Ok(Some(token_set)) if oauth_token_is_expired(&token_set) => {
+                if token_set.refresh_token.is_some() {
+                    Err(ApiError::Auth(
+                        "saved OAuth token is expired; load runtime OAuth config to refresh it"
+                            .to_string(),
+                    ))
+                } else {
+                    Err(ApiError::ExpiredOAuthToken)
+                }
+            }
+            Ok(Some(token_set)) => Ok(Self::BearerToken(token_set.access_token)),
+            Ok(None) => Err(anthropic_missing_credentials()),
+            Err(error) => Err(error),
+        }
     }
 }
 
@@ -650,14 +665,14 @@ pub fn resolve_saved_oauth_token(config: &OAuthConfig) -> Result<Option<OAuthTok
 
 pub fn has_auth_from_env_or_saved() -> Result<bool, ApiError> {
     Ok(read_env_non_empty("ANTHROPIC_API_KEY")?.is_some()
-        || read_env_non_empty("ANTHROPIC_AUTH_TOKEN")?.is_some())
+        || read_env_non_empty("ANTHROPIC_AUTH_TOKEN")?.is_some()
+        || load_saved_oauth_token()?.is_some())
 }
 
 pub fn resolve_startup_auth_source<F>(load_oauth_config: F) -> Result<AuthSource, ApiError>
 where
     F: FnOnce() -> Result<Option<OAuthConfig>, ApiError>,
 {
-    let _ = load_oauth_config;
     if let Some(api_key) = read_env_non_empty("ANTHROPIC_API_KEY")? {
         return match read_env_non_empty("ANTHROPIC_AUTH_TOKEN")? {
             Some(bearer_token) => Ok(AuthSource::ApiKeyAndBearer {
@@ -670,7 +685,25 @@ where
     if let Some(bearer_token) = read_env_non_empty("ANTHROPIC_AUTH_TOKEN")? {
         return Ok(AuthSource::BearerToken(bearer_token));
     }
-    Err(anthropic_missing_credentials())
+
+    let Some(token_set) = load_saved_oauth_token()? else {
+        return Err(anthropic_missing_credentials());
+    };
+    if !oauth_token_is_expired(&token_set) {
+        return Ok(AuthSource::BearerToken(token_set.access_token));
+    }
+    if token_set.refresh_token.is_none() {
+        return Err(ApiError::ExpiredOAuthToken);
+    }
+
+    let Some(config) = load_oauth_config()? else {
+        return Err(ApiError::Auth(
+            "saved OAuth token is expired; runtime OAuth config is missing".to_string(),
+        ));
+    };
+    Ok(AuthSource::from(resolve_saved_oauth_token_set(
+        &config, token_set,
+    )?))
 }
 
 fn resolve_saved_oauth_token_set(
@@ -885,7 +918,6 @@ async fn expect_success(response: reqwest::Response) -> Result<reqwest::Response
         request_id,
         body,
         retryable,
-        suggested_action: None,
     })
 }
 
@@ -910,7 +942,6 @@ fn enrich_bearer_auth_error(error: ApiError, auth: &AuthSource) -> ApiError {
         request_id,
         body,
         retryable,
-        suggested_action,
     } = error
     else {
         return error;
@@ -923,7 +954,6 @@ fn enrich_bearer_auth_error(error: ApiError, auth: &AuthSource) -> ApiError {
             request_id,
             body,
             retryable,
-            suggested_action,
         };
     }
     let Some(bearer_token) = auth.bearer_token() else {
@@ -934,7 +964,6 @@ fn enrich_bearer_auth_error(error: ApiError, auth: &AuthSource) -> ApiError {
             request_id,
             body,
             retryable,
-            suggested_action,
         };
     };
     if !bearer_token.starts_with("sk-ant-") {
@@ -945,7 +974,6 @@ fn enrich_bearer_auth_error(error: ApiError, auth: &AuthSource) -> ApiError {
             request_id,
             body,
             retryable,
-            suggested_action,
         };
     }
     // Only append the hint when the AuthSource is pure BearerToken. If both
@@ -960,7 +988,6 @@ fn enrich_bearer_auth_error(error: ApiError, auth: &AuthSource) -> ApiError {
             request_id,
             body,
             retryable,
-            suggested_action,
         };
     }
     let enriched_message = match message {
@@ -974,7 +1001,6 @@ fn enrich_bearer_auth_error(error: ApiError, auth: &AuthSource) -> ApiError {
         request_id,
         body,
         retryable,
-        suggested_action,
     }
 }
 
@@ -990,7 +1016,7 @@ fn strip_unsupported_beta_body_fields(body: &mut Value) {
         object.remove("presence_penalty");
         // Anthropic uses "stop_sequences" not "stop". Convert if present.
         if let Some(stop_val) = object.remove("stop") {
-            if stop_val.as_array().is_some_and(|a| !a.is_empty()) {
+            if stop_val.as_array().map_or(false, |a| !a.is_empty()) {
                 object.insert("stop_sequences".to_string(), stop_val);
             }
         }
@@ -1154,7 +1180,7 @@ mod tests {
     }
 
     #[test]
-    fn auth_source_from_env_or_saved_ignores_saved_oauth_when_env_absent() {
+    fn auth_source_from_saved_oauth_when_env_absent() {
         let _guard = env_lock();
         let config_home = temp_config_home();
         std::env::set_var("CLAW_CONFIG_HOME", &config_home);
@@ -1168,8 +1194,8 @@ mod tests {
         })
         .expect("save oauth credentials");
 
-        let error = AuthSource::from_env_or_saved().expect_err("saved oauth should be ignored");
-        assert!(error.to_string().contains("ANTHROPIC_API_KEY"));
+        let auth = AuthSource::from_env_or_saved().expect("saved auth");
+        assert_eq!(auth.bearer_token(), Some("saved-access-token"));
 
         clear_oauth_credentials().expect("clear credentials");
         std::env::remove_var("CLAW_CONFIG_HOME");
@@ -1225,7 +1251,7 @@ mod tests {
     }
 
     #[test]
-    fn resolve_startup_auth_source_ignores_saved_oauth_without_loading_config() {
+    fn resolve_startup_auth_source_uses_saved_oauth_without_loading_config() {
         let _guard = env_lock();
         let config_home = temp_config_home();
         std::env::set_var("CLAW_CONFIG_HOME", &config_home);
@@ -1239,9 +1265,41 @@ mod tests {
         })
         .expect("save oauth credentials");
 
-        let error = resolve_startup_auth_source(|| panic!("config should not be loaded"))
-            .expect_err("saved oauth should be ignored");
-        assert!(error.to_string().contains("ANTHROPIC_API_KEY"));
+        let auth = resolve_startup_auth_source(|| panic!("config should not be loaded"))
+            .expect("startup auth");
+        assert_eq!(auth.bearer_token(), Some("saved-access-token"));
+
+        clear_oauth_credentials().expect("clear credentials");
+        std::env::remove_var("CLAW_CONFIG_HOME");
+        cleanup_temp_config_home(&config_home);
+    }
+
+    #[test]
+    fn resolve_startup_auth_source_errors_when_refreshable_token_lacks_config() {
+        let _guard = env_lock();
+        let config_home = temp_config_home();
+        std::env::set_var("CLAW_CONFIG_HOME", &config_home);
+        std::env::remove_var("ANTHROPIC_AUTH_TOKEN");
+        std::env::remove_var("ANTHROPIC_API_KEY");
+        save_oauth_credentials(&runtime::OAuthTokenSet {
+            access_token: "expired-access-token".to_string(),
+            refresh_token: Some("refresh-token".to_string()),
+            expires_at: Some(1),
+            scopes: vec!["scope:a".to_string()],
+        })
+        .expect("save expired oauth credentials");
+
+        let error =
+            resolve_startup_auth_source(|| Ok(None)).expect_err("missing config should error");
+        assert!(
+            matches!(error, crate::error::ApiError::Auth(message) if message.contains("runtime OAuth config is missing"))
+        );
+
+        let stored = runtime::load_oauth_credentials()
+            .expect("load stored credentials")
+            .expect("stored token set");
+        assert_eq!(stored.access_token, "expired-access-token");
+        assert_eq!(stored.refresh_token.as_deref(), Some("refresh-token"));
 
         clear_oauth_credentials().expect("clear credentials");
         std::env::remove_var("CLAW_CONFIG_HOME");
@@ -1562,7 +1620,6 @@ mod tests {
             request_id: Some("req_varleg_001".to_string()),
             body: String::new(),
             retryable: false,
-            suggested_action: None,
         };
 
         // when
@@ -1603,7 +1660,6 @@ mod tests {
             request_id: None,
             body: String::new(),
             retryable: true,
-            suggested_action: None,
         };
 
         // when
@@ -1632,7 +1688,6 @@ mod tests {
             request_id: None,
             body: String::new(),
             retryable: false,
-            suggested_action: None,
         };
 
         // when
@@ -1660,7 +1715,6 @@ mod tests {
             request_id: None,
             body: String::new(),
             retryable: false,
-            suggested_action: None,
         };
 
         // when
@@ -1685,7 +1739,6 @@ mod tests {
             request_id: None,
             body: String::new(),
             retryable: false,
-            suggested_action: None,
         };
 
         // when

rust/crates/api/src/providers/mod.rs

@@ -122,15 +122,6 @@ const MODEL_REGISTRY: &[(&str, ProviderMetadata)] = &[
             default_base_url: openai_compat::DEFAULT_XAI_BASE_URL,
         },
     ),
-    (
-        "kimi",
-        ProviderMetadata {
-            provider: ProviderKind::OpenAi,
-            auth_env: "DASHSCOPE_API_KEY",
-            base_url_env: "DASHSCOPE_BASE_URL",
-            default_base_url: openai_compat::DEFAULT_DASHSCOPE_BASE_URL,
-        },
-    ),
 ];
 
 #[must_use]
@@ -153,10 +144,7 @@ pub fn resolve_model_alias(model: &str) -> String {
                     "grok-2" => "grok-2",
                     _ => trimmed,
                 },
-                ProviderKind::OpenAi => match *alias {
-                    "kimi" => "kimi-k2.5",
-                    _ => trimmed,
-                },
+                ProviderKind::OpenAi => trimmed,
             })
         })
         .map_or_else(|| trimmed.to_string(), ToOwned::to_owned)
@@ -206,16 +194,6 @@ pub fn metadata_for_model(model: &str) -> Option<ProviderMetadata> {
             default_base_url: openai_compat::DEFAULT_DASHSCOPE_BASE_URL,
         });
     }
-    // Kimi models (kimi-k2.5, kimi-k1.5, etc.) via DashScope compatible-mode.
-    // Routes kimi/* and kimi-* model names to DashScope endpoint.
-    if canonical.starts_with("kimi/") || canonical.starts_with("kimi-") {
-        return Some(ProviderMetadata {
-            provider: ProviderKind::OpenAi,
-            auth_env: "DASHSCOPE_API_KEY",
-            base_url_env: "DASHSCOPE_BASE_URL",
-            default_base_url: openai_compat::DEFAULT_DASHSCOPE_BASE_URL,
-        });
-    }
     None
 }
 
@@ -224,15 +202,6 @@ pub fn detect_provider_kind(model: &str) -> ProviderKind {
     if let Some(metadata) = metadata_for_model(model) {
         return metadata.provider;
     }
-    // When OPENAI_BASE_URL is set, the user explicitly configured an
-    // OpenAI-compatible endpoint. Prefer it over the Anthropic fallback
-    // even when the model name has no recognized prefix — this is the
-    // common case for local providers (Ollama, LM Studio, vLLM, etc.)
-    // where model names like "qwen2.5-coder:7b" don't match any prefix.
-    if std::env::var_os("OPENAI_BASE_URL").is_some() && openai_compat::has_api_key("OPENAI_API_KEY")
-    {
-        return ProviderKind::OpenAi;
-    }
     if anthropic::has_auth_from_env_or_saved().unwrap_or(false) {
         return ProviderKind::Anthropic;
     }
@@ -242,11 +211,6 @@ pub fn detect_provider_kind(model: &str) -> ProviderKind {
     if openai_compat::has_api_key("XAI_API_KEY") {
         return ProviderKind::Xai;
     }
-    // Last resort: if OPENAI_BASE_URL is set without OPENAI_API_KEY (some
-    // local providers like Ollama don't require auth), still route there.
-    if std::env::var_os("OPENAI_BASE_URL").is_some() {
-        return ProviderKind::OpenAi;
-    }
     ProviderKind::Anthropic
 }
 
@@ -289,12 +253,6 @@ pub fn model_token_limit(model: &str) -> Option<ModelTokenLimit> {
             max_output_tokens: 64_000,
             context_window_tokens: 131_072,
         }),
-        // Kimi models via DashScope (Moonshot AI)
-        // Source: https://platform.moonshot.cn/docs/intro
-        "kimi-k2.5" | "kimi-k1.5" => Some(ModelTokenLimit {
-            max_output_tokens: 16_384,
-            context_window_tokens: 256_000,
-        }),
         _ => None,
     }
 }
@@ -536,10 +494,9 @@ mod tests {
         // ANTHROPIC_API_KEY was set because metadata_for_model returned None
         // and detect_provider_kind fell through to auth-sniffer order.
         // The model prefix must win over env-var presence.
-        let kind = super::metadata_for_model("openai/gpt-4.1-mini").map_or_else(
-            || detect_provider_kind("openai/gpt-4.1-mini"),
-            |m| m.provider,
-        );
+        let kind = super::metadata_for_model("openai/gpt-4.1-mini")
+            .map(|m| m.provider)
+            .unwrap_or_else(|| detect_provider_kind("openai/gpt-4.1-mini"));
         assert_eq!(
             kind,
             ProviderKind::OpenAi,
@@ -548,7 +505,8 @@ mod tests {
 
         // Also cover bare gpt- prefix
         let kind2 = super::metadata_for_model("gpt-4o")
-            .map_or_else(|| detect_provider_kind("gpt-4o"), |m| m.provider);
+            .map(|m| m.provider)
+            .unwrap_or_else(|| detect_provider_kind("gpt-4o"));
         assert_eq!(kind2, ProviderKind::OpenAi);
     }
 
@@ -582,34 +540,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn kimi_prefix_routes_to_dashscope() {
-        // Kimi models via DashScope (kimi-k2.5, kimi-k1.5, etc.)
-        let meta = super::metadata_for_model("kimi-k2.5")
-            .expect("kimi-k2.5 must resolve to DashScope metadata");
-        assert_eq!(meta.auth_env, "DASHSCOPE_API_KEY");
-        assert_eq!(meta.base_url_env, "DASHSCOPE_BASE_URL");
-        assert!(meta.default_base_url.contains("dashscope.aliyuncs.com"));
-        assert_eq!(meta.provider, ProviderKind::OpenAi);
-
-        // With provider prefix
-        let meta2 = super::metadata_for_model("kimi/kimi-k2.5")
-            .expect("kimi/kimi-k2.5 must resolve to DashScope metadata");
-        assert_eq!(meta2.auth_env, "DASHSCOPE_API_KEY");
-        assert_eq!(meta2.provider, ProviderKind::OpenAi);
-
-        // Different kimi variants
-        let meta3 = super::metadata_for_model("kimi-k1.5")
-            .expect("kimi-k1.5 must resolve to DashScope metadata");
-        assert_eq!(meta3.auth_env, "DASHSCOPE_API_KEY");
-    }
-
-    #[test]
-    fn kimi_alias_resolves_to_kimi_k2_5() {
-        assert_eq!(super::resolve_model_alias("kimi"), "kimi-k2.5");
-        assert_eq!(super::resolve_model_alias("KIMI"), "kimi-k2.5"); // case insensitive
-    }
-
     #[test]
     fn keeps_existing_max_token_heuristic() {
         assert_eq!(max_tokens_for_model("opus"), 32_000);
@@ -750,69 +680,6 @@ mod tests {
             .expect("models without context metadata should skip the guarded preflight");
     }
 
-    #[test]
-    fn returns_context_window_metadata_for_kimi_models() {
-        // kimi-k2.5
-        let k25_limit = model_token_limit("kimi-k2.5")
-            .expect("kimi-k2.5 should have token limit metadata");
-        assert_eq!(k25_limit.max_output_tokens, 16_384);
-        assert_eq!(k25_limit.context_window_tokens, 256_000);
-
-        // kimi-k1.5
-        let k15_limit = model_token_limit("kimi-k1.5")
-            .expect("kimi-k1.5 should have token limit metadata");
-        assert_eq!(k15_limit.max_output_tokens, 16_384);
-        assert_eq!(k15_limit.context_window_tokens, 256_000);
-    }
-
-    #[test]
-    fn kimi_alias_resolves_to_kimi_k25_token_limits() {
-        // The "kimi" alias resolves to "kimi-k2.5" via resolve_model_alias()
-        let alias_limit = model_token_limit("kimi")
-            .expect("kimi alias should resolve to kimi-k2.5 limits");
-        let direct_limit = model_token_limit("kimi-k2.5")
-            .expect("kimi-k2.5 should have limits");
-        assert_eq!(alias_limit.max_output_tokens, direct_limit.max_output_tokens);
-        assert_eq!(
-            alias_limit.context_window_tokens,
-            direct_limit.context_window_tokens
-        );
-    }
-
-    #[test]
-    fn preflight_blocks_oversized_requests_for_kimi_models() {
-        let request = MessageRequest {
-            model: "kimi-k2.5".to_string(),
-            max_tokens: 16_384,
-            messages: vec![InputMessage {
-                role: "user".to_string(),
-                content: vec![InputContentBlock::Text {
-                    text: "x".repeat(1_000_000), // Large input to exceed context window
-                }],
-            }],
-            system: Some("Keep the answer short.".to_string()),
-            tools: None,
-            tool_choice: None,
-            stream: true,
-            ..Default::default()
-        };
-
-        let error = preflight_message_request(&request)
-            .expect_err("oversized request should be rejected for kimi models");
-
-        match error {
-            ApiError::ContextWindowExceeded {
-                model,
-                context_window_tokens,
-                ..
-            } => {
-                assert_eq!(model, "kimi-k2.5");
-                assert_eq!(context_window_tokens, 256_000);
-            }
-            other => panic!("expected context-window preflight failure, got {other:?}"),
-        }
-    }
-
     #[test]
     fn parse_dotenv_extracts_keys_handles_comments_quotes_and_export_prefix() {
         // given
@@ -1114,31 +981,4 @@ NO_EQUALS_LINE
             "empty env var should not trigger the hint sniffer, got {hint:?}"
         );
     }
-
-    #[test]
-    fn openai_base_url_overrides_anthropic_fallback_for_unknown_model() {
-        // given — user has OPENAI_BASE_URL + OPENAI_API_KEY but no Anthropic
-        // creds, and a model name with no recognized prefix.
-        let _lock = env_lock();
-        let _base_url = EnvVarGuard::set("OPENAI_BASE_URL", Some("http://127.0.0.1:11434/v1"));
-        let _api_key = EnvVarGuard::set("OPENAI_API_KEY", Some("dummy"));
-        let _anthropic_key = EnvVarGuard::set("ANTHROPIC_API_KEY", None);
-        let _anthropic_token = EnvVarGuard::set("ANTHROPIC_AUTH_TOKEN", None);
-
-        // when
-        let provider = detect_provider_kind("qwen2.5-coder:7b");
-
-        // then — should route to OpenAI, not Anthropic
-        assert_eq!(
-            provider,
-            ProviderKind::OpenAi,
-            "OPENAI_BASE_URL should win over Anthropic fallback for unknown models"
-        );
-    }
-
-    // NOTE: a "OPENAI_BASE_URL without OPENAI_API_KEY" test is omitted
-    // because workspace-parallel test binaries can race on process env
-    // (env_lock only protects within a single binary). The detection logic
-    // is covered: OPENAI_BASE_URL alone routes to OpenAi as a last-resort
-    // fallback in detect_provider_kind().
 }

rust/crates/api/src/types.rs

@@ -26,11 +26,6 @@ pub struct MessageRequest {
     pub presence_penalty: Option<f64>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub stop: Option<Vec<String>>,
-    /// Reasoning effort level for OpenAI-compatible reasoning models (e.g. `o4-mini`).
-    /// Accepted values: `"low"`, `"medium"`, `"high"`. Omitted when `None`.
-    /// Silently ignored by backends that do not support it.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_effort: Option<String>,
 }
 
 impl MessageRequest {

rust/crates/commands/src/lib.rs

@@ -4,7 +4,7 @@ use std::fmt;
 use std::fs;
 use std::path::{Path, PathBuf};
 
-use plugins::{PluginError, PluginLoadFailure, PluginManager, PluginSummary};
+use plugins::{PluginError, PluginManager, PluginSummary};
 use runtime::{
     compact_session, CompactionConfig, ConfigLoader, ConfigSource, McpOAuthConfig, McpServerConfig,
     ScopedMcpServerConfig, Session,
@@ -257,6 +257,20 @@ const SLASH_COMMAND_SPECS: &[SlashCommandSpec] = &[
         argument_hint: None,
         resume_supported: true,
     },
+    SlashCommandSpec {
+        name: "login",
+        aliases: &[],
+        summary: "Log in to the service",
+        argument_hint: None,
+        resume_supported: false,
+    },
+    SlashCommandSpec {
+        name: "logout",
+        aliases: &[],
+        summary: "Log out of the current session",
+        argument_hint: None,
+        resume_supported: false,
+    },
     SlashCommandSpec {
         name: "plan",
         aliases: &[],
@@ -1207,83 +1221,6 @@ impl SlashCommand {
     pub fn parse(input: &str) -> Result<Option<Self>, SlashCommandParseError> {
         validate_slash_command_input(input)
     }
-
-    /// Returns the canonical slash-command name (e.g. `"/branch"`) for use in
-    /// error messages and logging. Derived from the spec table so it always
-    /// matches what the user would have typed.
-    #[must_use]
-    pub fn slash_name(&self) -> &'static str {
-        match self {
-            Self::Help => "/help",
-            Self::Clear { .. } => "/clear",
-            Self::Compact { .. } => "/compact",
-            Self::Cost => "/cost",
-            Self::Doctor => "/doctor",
-            Self::Config { .. } => "/config",
-            Self::Memory { .. } => "/memory",
-            Self::History { .. } => "/history",
-            Self::Diff => "/diff",
-            Self::Status => "/status",
-            Self::Stats => "/stats",
-            Self::Version => "/version",
-            Self::Commit { .. } => "/commit",
-            Self::Pr { .. } => "/pr",
-            Self::Issue { .. } => "/issue",
-            Self::Init => "/init",
-            Self::Bughunter { .. } => "/bughunter",
-            Self::Ultraplan { .. } => "/ultraplan",
-            Self::Teleport { .. } => "/teleport",
-            Self::DebugToolCall { .. } => "/debug-tool-call",
-            Self::Resume { .. } => "/resume",
-            Self::Model { .. } => "/model",
-            Self::Permissions { .. } => "/permissions",
-            Self::Session { .. } => "/session",
-            Self::Plugins { .. } => "/plugins",
-            Self::Login => "/login",
-            Self::Logout => "/logout",
-            Self::Vim => "/vim",
-            Self::Upgrade => "/upgrade",
-            Self::Share => "/share",
-            Self::Feedback => "/feedback",
-            Self::Files => "/files",
-            Self::Fast => "/fast",
-            Self::Exit => "/exit",
-            Self::Summary => "/summary",
-            Self::Desktop => "/desktop",
-            Self::Brief => "/brief",
-            Self::Advisor => "/advisor",
-            Self::Stickers => "/stickers",
-            Self::Insights => "/insights",
-            Self::Thinkback => "/thinkback",
-            Self::ReleaseNotes => "/release-notes",
-            Self::SecurityReview => "/security-review",
-            Self::Keybindings => "/keybindings",
-            Self::PrivacySettings => "/privacy-settings",
-            Self::Plan { .. } => "/plan",
-            Self::Review { .. } => "/review",
-            Self::Tasks { .. } => "/tasks",
-            Self::Theme { .. } => "/theme",
-            Self::Voice { .. } => "/voice",
-            Self::Usage { .. } => "/usage",
-            Self::Rename { .. } => "/rename",
-            Self::Copy { .. } => "/copy",
-            Self::Hooks { .. } => "/hooks",
-            Self::Context { .. } => "/context",
-            Self::Color { .. } => "/color",
-            Self::Effort { .. } => "/effort",
-            Self::Branch { .. } => "/branch",
-            Self::Rewind { .. } => "/rewind",
-            Self::Ide { .. } => "/ide",
-            Self::Tag { .. } => "/tag",
-            Self::OutputStyle { .. } => "/output-style",
-            Self::AddDir { .. } => "/add-dir",
-            Self::Sandbox => "/sandbox",
-            Self::Mcp { .. } => "/mcp",
-            Self::Export { .. } => "/export",
-            #[allow(unreachable_patterns)]
-            _ => "/unknown",
-        }
-    }
 }
 
 #[allow(clippy::too_many_lines)]
@@ -1383,16 +1320,17 @@ pub fn validate_slash_command_input(
         "skills" | "skill" => SlashCommand::Skills {
             args: parse_skills_args(remainder.as_deref())?,
         },
-        "doctor" | "providers" => {
+        "doctor" => {
             validate_no_args(command, &args)?;
             SlashCommand::Doctor
         }
-        "login" | "logout" => {
-            return Err(command_error(
-                "This auth flow was removed. Set ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN instead.",
-                command,
-                "",
-            ));
+        "login" => {
+            validate_no_args(command, &args)?;
+            SlashCommand::Login
+        }
+        "logout" => {
+            validate_no_args(command, &args)?;
+            SlashCommand::Logout
         }
         "vim" => {
             validate_no_args(command, &args)?;
@@ -1402,7 +1340,7 @@ pub fn validate_slash_command_input(
             validate_no_args(command, &args)?;
             SlashCommand::Upgrade
         }
-        "stats" | "tokens" | "cache" => {
+        "stats" => {
             validate_no_args(command, &args)?;
             SlashCommand::Stats
         }
@@ -1877,12 +1815,20 @@ pub fn resume_supported_slash_commands() -> Vec<&'static SlashCommandSpec> {
 
 fn slash_command_category(name: &str) -> &'static str {
     match name {
-        "help" | "status" | "cost" | "resume" | "session" | "version" | "usage" | "stats"
-        | "rename" | "clear" | "compact" | "history" | "tokens" | "cache" | "exit" | "summary"
-        | "tag" | "thinkback" | "copy" | "share" | "feedback" | "rewind" | "pin" | "unpin"
-        | "bookmarks" | "context" | "files" | "focus" | "unfocus" | "retry" | "stop" | "undo" => {
-            "Session"
-        }
+        "help" | "status" | "cost" | "resume" | "session" | "version" | "login" | "logout"
+        | "usage" | "stats" | "rename" | "clear" | "compact" | "history" | "tokens" | "cache"
+        | "exit" | "summary" | "tag" | "thinkback" | "copy" | "share" | "feedback" | "rewind"
+        | "pin" | "unpin" | "bookmarks" | "context" | "files" | "focus" | "unfocus" | "retry"
+        | "stop" | "undo" => "Session",
+        "diff" | "commit" | "pr" | "issue" | "branch" | "blame" | "log" | "git" | "stash"
+        | "init" | "export" | "plan" | "review" | "security-review" | "bughunter" | "ultraplan"
+        | "teleport" | "refactor" | "fix" | "autofix" | "explain" | "docs" | "perf" | "search"
+        | "references" | "definition" | "hover" | "symbols" | "map" | "web" | "image"
+        | "screenshot" | "paste" | "listen" | "speak" | "test" | "lint" | "build" | "run"
+        | "format" | "parallel" | "multi" | "macro" | "alias" | "templates" | "migrate"
+        | "benchmark" | "cron" | "agent" | "subagent" | "agents" | "skills" | "team" | "plugin"
+        | "mcp" | "hooks" | "tasks" | "advisor" | "insights" | "release-notes" | "chat"
+        | "approve" | "deny" | "allowed-tools" | "add-dir" => "Tools",
         "model" | "permissions" | "config" | "memory" | "theme" | "vim" | "voice" | "color"
         | "effort" | "fast" | "brief" | "output-style" | "keybindings" | "privacy-settings"
         | "stickers" | "language" | "profile" | "max-tokens" | "temperature" | "system-prompt"
@@ -1992,42 +1938,6 @@ pub fn suggest_slash_commands(input: &str, limit: usize) -> Vec<String> {
 }
 
 #[must_use]
-/// Render the slash-command help section, optionally excluding stub commands
-/// (commands that are registered in the spec list but not yet implemented).
-/// Pass an empty slice to include all commands.
-pub fn render_slash_command_help_filtered(exclude: &[&str]) -> String {
-    let mut lines = vec![
-        "Slash commands".to_string(),
-        "  Start here        /status, /diff, /agents, /skills, /commit".to_string(),
-        "  [resume]          also works with --resume SESSION.jsonl".to_string(),
-        String::new(),
-    ];
-
-    let categories = ["Session", "Tools", "Config", "Debug"];
-
-    for category in categories {
-        lines.push(category.to_string());
-        for spec in slash_command_specs()
-            .iter()
-            .filter(|spec| slash_command_category(spec.name) == category)
-            .filter(|spec| !exclude.contains(&spec.name))
-        {
-            lines.push(format_slash_command_help_line(spec));
-        }
-        lines.push(String::new());
-    }
-
-    lines
-        .into_iter()
-        .rev()
-        .skip_while(String::is_empty)
-        .collect::<Vec<_>>()
-        .into_iter()
-        .rev()
-        .collect::<Vec<_>>()
-        .join("\n")
-}
-
 pub fn render_slash_command_help() -> String {
     let mut lines = vec![
         "Slash commands".to_string(),
@@ -2186,15 +2096,10 @@ pub fn handle_plugins_slash_command(
     manager: &mut PluginManager,
 ) -> Result<PluginsCommandResult, PluginError> {
     match action {
-        None | Some("list") => {
-            let report = manager.installed_plugin_registry_report()?;
-            let plugins = report.summaries();
-            let failures = report.failures();
-            Ok(PluginsCommandResult {
-                message: render_plugins_report_with_failures(&plugins, failures),
-                reload_runtime: false,
-            })
-        }
+        None | Some("list") => Ok(PluginsCommandResult {
+            message: render_plugins_report(&manager.list_installed_plugins()?),
+            reload_runtime: false,
+        }),
         Some("install") => {
             let Some(target) = target else {
                 return Ok(PluginsCommandResult {
@@ -2453,8 +2358,7 @@ pub fn resolve_skill_invocation(
                         .map(|s| s.name.clone())
                         .collect();
                     if !names.is_empty() {
-                        message.push_str("\n  Available skills: ");
-                        message.push_str(&names.join(", "));
+                        message.push_str(&format!("\n  Available skills: {}", names.join(", ")));
                     }
                 }
                 message.push_str("\n  Usage: /skills [list|install <path>|help|<skill> [args]]");
@@ -2554,22 +2458,11 @@ fn render_mcp_report_for(
 
     match normalize_optional_args(args) {
         None | Some("list") => {
-            // #144: degrade gracefully on config parse failure (same contract
-            // as #143 for `status`). Text mode prepends a "Config load error"
-            // block before the MCP list; the list falls back to empty.
-            match loader.load() {
-                Ok(runtime_config) => Ok(render_mcp_summary_report(
-                    cwd,
-                    runtime_config.mcp().servers(),
-                )),
-                Err(err) => {
-                    let empty = std::collections::BTreeMap::new();
-                    Ok(format!(
-                        "Config load error\n  Status           fail\n  Summary          runtime config failed to load; reporting partial MCP view\n  Details          {err}\n  Hint             `claw doctor` classifies config parse errors; fix the listed field and rerun\n\n{}",
-                        render_mcp_summary_report(cwd, &empty)
-                    ))
-                }
-            }
+            let runtime_config = loader.load()?;
+            Ok(render_mcp_summary_report(
+                cwd,
+                runtime_config.mcp().servers(),
+            ))
         }
         Some(args) if is_help_arg(args) => Ok(render_mcp_usage(None)),
         Some("show") => Ok(render_mcp_usage(Some("show"))),
@@ -2582,19 +2475,12 @@ fn render_mcp_report_for(
             if parts.next().is_some() {
                 return Ok(render_mcp_usage(Some(args)));
             }
-            // #144: same degradation for `mcp show`; if config won't parse,
-            // the specific server lookup can't succeed, so report the parse
-            // error with context.
-            match loader.load() {
-                Ok(runtime_config) => Ok(render_mcp_server_report(
-                    cwd,
-                    server_name,
-                    runtime_config.mcp().get(server_name),
-                )),
-                Err(err) => Ok(format!(
-                    "Config load error\n  Status           fail\n  Summary          runtime config failed to load; cannot resolve `{server_name}`\n  Details          {err}\n  Hint             `claw doctor` classifies config parse errors; fix the listed field and rerun"
-                )),
-            }
+            let runtime_config = loader.load()?;
+            Ok(render_mcp_server_report(
+                cwd,
+                server_name,
+                runtime_config.mcp().get(server_name),
+            ))
         }
         Some(args) => Ok(render_mcp_usage(Some(args))),
     }
@@ -2617,35 +2503,11 @@ fn render_mcp_report_json_for(
 
     match normalize_optional_args(args) {
         None | Some("list") => {
-            // #144: match #143's degraded envelope contract. On config parse
-            // failure, emit top-level `status: "degraded"` with
-            // `config_load_error`, empty servers[], and exit 0. On clean
-            // runs, the existing serializer adds `status: "ok"` below.
-            match loader.load() {
-                Ok(runtime_config) => {
-                    let mut value = render_mcp_summary_report_json(
-                        cwd,
-                        runtime_config.mcp().servers(),
-                    );
-                    if let Some(map) = value.as_object_mut() {
-                        map.insert("status".to_string(), Value::String("ok".to_string()));
-                        map.insert("config_load_error".to_string(), Value::Null);
-                    }
-                    Ok(value)
-                }
-                Err(err) => {
-                    let empty = std::collections::BTreeMap::new();
-                    let mut value = render_mcp_summary_report_json(cwd, &empty);
-                    if let Some(map) = value.as_object_mut() {
-                        map.insert("status".to_string(), Value::String("degraded".to_string()));
-                        map.insert(
-                            "config_load_error".to_string(),
-                            Value::String(err.to_string()),
-                        );
-                    }
-                    Ok(value)
-                }
-            }
+            let runtime_config = loader.load()?;
+            Ok(render_mcp_summary_report_json(
+                cwd,
+                runtime_config.mcp().servers(),
+            ))
         }
         Some(args) if is_help_arg(args) => Ok(render_mcp_usage_json(None)),
         Some("show") => Ok(render_mcp_usage_json(Some("show"))),
@@ -2658,29 +2520,12 @@ fn render_mcp_report_json_for(
             if parts.next().is_some() {
                 return Ok(render_mcp_usage_json(Some(args)));
             }
-            // #144: same degradation pattern for show action.
-            match loader.load() {
-                Ok(runtime_config) => {
-                    let mut value = render_mcp_server_report_json(
-                        cwd,
-                        server_name,
-                        runtime_config.mcp().get(server_name),
-                    );
-                    if let Some(map) = value.as_object_mut() {
-                        map.insert("status".to_string(), Value::String("ok".to_string()));
-                        map.insert("config_load_error".to_string(), Value::Null);
-                    }
-                    Ok(value)
-                }
-                Err(err) => Ok(serde_json::json!({
-                    "kind": "mcp",
-                    "action": "show",
-                    "server": server_name,
-                    "status": "degraded",
-                    "config_load_error": err.to_string(),
-                    "working_directory": cwd.display().to_string(),
-                })),
-            }
+            let runtime_config = loader.load()?;
+            Ok(render_mcp_server_report_json(
+                cwd,
+                server_name,
+                runtime_config.mcp().get(server_name),
+            ))
         }
         Some(args) => Ok(render_mcp_usage_json(Some(args))),
     }
@@ -2708,48 +2553,6 @@ pub fn render_plugins_report(plugins: &[PluginSummary]) -> String {
     lines.join("\n")
 }
 
-#[must_use]
-pub fn render_plugins_report_with_failures(
-    plugins: &[PluginSummary],
-    failures: &[PluginLoadFailure],
-) -> String {
-    let mut lines = vec!["Plugins".to_string()];
-
-    // Show successfully loaded plugins
-    if plugins.is_empty() {
-        lines.push("  No plugins installed.".to_string());
-    } else {
-        for plugin in plugins {
-            let enabled = if plugin.enabled {
-                "enabled"
-            } else {
-                "disabled"
-            };
-            lines.push(format!(
-                "  {name:<20} v{version:<10} {enabled}",
-                name = plugin.metadata.name,
-                version = plugin.metadata.version,
-            ));
-        }
-    }
-
-    // Show warnings for broken plugins
-    if !failures.is_empty() {
-        lines.push(String::new());
-        lines.push("Warnings:".to_string());
-        for failure in failures {
-            lines.push(format!(
-                "  ⚠️  Failed to load {} plugin from `{}`",
-                failure.kind,
-                failure.plugin_root.display()
-            ));
-            lines.push(format!("      Error: {}", failure.error()));
-        }
-    }
-
-    lines.join("\n")
-}
-
 fn render_plugin_install_report(plugin_id: &str, plugin: Option<&PluginSummary>) -> String {
     let name = plugin.map_or(plugin_id, |plugin| plugin.metadata.name.as_str());
     let version = plugin.map_or("unknown", |plugin| plugin.metadata.version.as_str());
@@ -4180,15 +3983,12 @@ mod tests {
         handle_plugins_slash_command, handle_skills_slash_command_json, handle_slash_command,
         load_agents_from_roots, load_skills_from_roots, render_agents_report,
         render_agents_report_json, render_mcp_report_json_for, render_plugins_report,
-        render_plugins_report_with_failures, render_skills_report, render_slash_command_help,
-        render_slash_command_help_detail, resolve_skill_path, resume_supported_slash_commands,
-        slash_command_specs, suggest_slash_commands, validate_slash_command_input,
-        DefinitionSource, SkillOrigin, SkillRoot, SkillSlashDispatch, SlashCommand,
-    };
-    use plugins::{
-        PluginError, PluginKind, PluginLoadFailure, PluginManager, PluginManagerConfig,
-        PluginMetadata, PluginSummary,
+        render_skills_report, render_slash_command_help, render_slash_command_help_detail,
+        resolve_skill_path, resume_supported_slash_commands, slash_command_specs,
+        suggest_slash_commands, validate_slash_command_input, DefinitionSource, SkillOrigin,
+        SkillRoot, SkillSlashDispatch, SlashCommand,
     };
+    use plugins::{PluginKind, PluginManager, PluginManagerConfig, PluginMetadata, PluginSummary};
     use runtime::{
         CompactionConfig, ConfigLoader, ContentBlock, ConversationMessage, MessageRole, Session,
     };
@@ -4211,24 +4011,6 @@ mod tests {
         LOCK.get_or_init(|| Mutex::new(()))
     }
 
-    fn env_guard() -> std::sync::MutexGuard<'static, ()> {
-        env_lock()
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner)
-    }
-
-    #[test]
-    fn env_guard_recovers_after_poisoning() {
-        let poisoned = std::thread::spawn(|| {
-            let _guard = env_guard();
-            panic!("poison env lock");
-        })
-        .join();
-        assert!(poisoned.is_err(), "poisoning thread should panic");
-
-        let _guard = env_guard();
-    }
-
     fn restore_env_var(key: &str, original: Option<OsString>) {
         match original {
             Some(value) => std::env::set_var(key, value),
@@ -4655,14 +4437,6 @@ mod tests {
         assert!(action_error.contains("  Usage            /mcp [list|show <server>|help]"));
     }
 
-    #[test]
-    fn removed_login_and_logout_commands_report_env_auth_guidance() {
-        let login_error = parse_error_message("/login");
-        assert!(login_error.contains("ANTHROPIC_API_KEY"));
-        let logout_error = parse_error_message("/logout");
-        assert!(logout_error.contains("ANTHROPIC_AUTH_TOKEN"));
-    }
-
     #[test]
     fn renders_help_from_shared_specs() {
         let help = render_slash_command_help();
@@ -4704,9 +4478,7 @@ mod tests {
         assert!(help.contains("/agents [list|help]"));
         assert!(help.contains("/skills [list|install <path>|help|<skill> [args]]"));
         assert!(help.contains("aliases: /skill"));
-        assert!(!help.contains("/login"));
-        assert!(!help.contains("/logout"));
-        assert_eq!(slash_command_specs().len(), 139);
+        assert_eq!(slash_command_specs().len(), 141);
         assert!(resume_supported_slash_commands().len() >= 39);
     }
 
@@ -4837,14 +4609,7 @@ mod tests {
         )
         .expect("slash command should be handled");
 
-        // With the tool-use/tool-result boundary guard the compaction may
-        // preserve one extra message, so 1 or 2 messages may be removed.
-        assert!(
-            result.message.contains("Compacted 1 messages")
-                || result.message.contains("Compacted 2 messages"),
-            "unexpected compaction message: {}",
-            result.message
-        );
+        assert!(result.message.contains("Compacted 2 messages"));
         assert_eq!(result.session.messages[0].role, MessageRole::System);
     }
 
@@ -4964,36 +4729,6 @@ mod tests {
         assert!(rendered.contains("disabled"));
     }
 
-    #[test]
-    fn renders_plugins_report_with_broken_plugin_warnings() {
-        let rendered = render_plugins_report_with_failures(
-            &[PluginSummary {
-                metadata: PluginMetadata {
-                    id: "demo@external".to_string(),
-                    name: "demo".to_string(),
-                    version: "1.2.3".to_string(),
-                    description: "demo plugin".to_string(),
-                    kind: PluginKind::External,
-                    source: "demo".to_string(),
-                    default_enabled: false,
-                    root: None,
-                },
-                enabled: true,
-            }],
-            &[PluginLoadFailure::new(
-                PathBuf::from("/tmp/broken-plugin"),
-                PluginKind::External,
-                "broken".to_string(),
-                PluginError::InvalidManifest("hook path `hooks/pre.sh` does not exist".to_string()),
-            )],
-        );
-
-        assert!(rendered.contains("Warnings:"));
-        assert!(rendered.contains("Failed to load external plugin"));
-        assert!(rendered.contains("/tmp/broken-plugin"));
-        assert!(rendered.contains("does not exist"));
-    }
-
     #[test]
     fn lists_agents_from_project_and_user_roots() {
         let workspace = temp_dir("agents-workspace");
@@ -5291,7 +5026,7 @@ mod tests {
 
     #[test]
     fn discovers_omc_skills_from_project_and_user_compatibility_roots() {
-        let _guard = env_guard();
+        let _guard = env_lock().lock().expect("env lock");
         let workspace = temp_dir("skills-omc-workspace");
         let user_home = temp_dir("skills-omc-home");
         let claude_config_dir = temp_dir("skills-omc-claude-config");
@@ -5538,82 +5273,6 @@ mod tests {
         let _ = fs::remove_dir_all(config_home);
     }
 
-    #[test]
-    fn mcp_degrades_gracefully_on_malformed_mcp_config_144() {
-        // #144: mirror of #143's partial-success contract for `claw mcp`.
-        // Previously `mcp` hard-failed on any config parse error, hiding
-        // well-formed servers and forcing claws to fall back to `doctor`.
-        // Now `mcp` emits a degraded envelope instead: exit 0, status:
-        // "degraded", config_load_error populated, servers[] empty.
-        let _guard = env_guard();
-        let workspace = temp_dir("mcp-degrades-144");
-        let config_home = temp_dir("mcp-degrades-144-cfg");
-        fs::create_dir_all(workspace.join(".claw")).expect("create workspace .claw dir");
-        fs::create_dir_all(&config_home).expect("create config home");
-        // One valid server + one malformed entry missing `command`.
-        fs::write(
-            workspace.join(".claw.json"),
-            r#"{
-  "mcpServers": {
-    "everything": {"command": "npx", "args": ["-y", "@modelcontextprotocol/server-everything"]},
-    "missing-command": {"args": ["arg-only-no-command"]}
-  }
-}
-"#,
-        )
-        .expect("write malformed .claw.json");
-
-        let loader = ConfigLoader::new(&workspace, &config_home);
-        // list action: must return Ok (not Err) with degraded envelope.
-        let list = render_mcp_report_json_for(&loader, &workspace, None)
-            .expect("mcp list should not hard-fail on config parse errors (#144)");
-        assert_eq!(list["kind"], "mcp");
-        assert_eq!(list["action"], "list");
-        assert_eq!(
-            list["status"].as_str(),
-            Some("degraded"),
-            "top-level status should be 'degraded': {list}"
-        );
-        let err = list["config_load_error"]
-            .as_str()
-            .expect("config_load_error must be a string on degraded runs");
-        assert!(
-            err.contains("mcpServers.missing-command"),
-            "config_load_error should name the malformed field path: {err}"
-        );
-        assert_eq!(list["configured_servers"], 0);
-        assert!(list["servers"].as_array().unwrap().is_empty());
-
-        // show action: should also degrade (not hard-fail).
-        let show = render_mcp_report_json_for(&loader, &workspace, Some("show everything"))
-            .expect("mcp show should not hard-fail on config parse errors (#144)");
-        assert_eq!(show["kind"], "mcp");
-        assert_eq!(show["action"], "show");
-        assert_eq!(
-            show["status"].as_str(),
-            Some("degraded"),
-            "show action should also report status: 'degraded': {show}"
-        );
-        assert!(show["config_load_error"].is_string());
-
-        // Clean path: status: "ok", config_load_error: null.
-        let clean_ws = temp_dir("mcp-degrades-144-clean");
-        fs::create_dir_all(&clean_ws).expect("clean ws");
-        let clean_loader = ConfigLoader::new(&clean_ws, &config_home);
-        let clean_list = render_mcp_report_json_for(&clean_loader, &clean_ws, None)
-            .expect("clean mcp list should succeed");
-        assert_eq!(
-            clean_list["status"].as_str(),
-            Some("ok"),
-            "clean run should report status: 'ok'"
-        );
-        assert!(clean_list["config_load_error"].is_null());
-
-        let _ = fs::remove_dir_all(workspace);
-        let _ = fs::remove_dir_all(config_home);
-        let _ = fs::remove_dir_all(clean_ws);
-    }
-
     #[test]
     fn parses_quoted_skill_frontmatter_values() {
         let contents = "---\nname: \"hud\"\ndescription: 'Quoted description'\n---\n";

rust/crates/compat-harness/src/lib.rs

@@ -18,12 +18,6 @@ impl UpstreamPaths {
         }
     }
 
-    /// Returns the repository root path.
-    #[must_use]
-    pub fn repo_root(&self) -> &Path {
-        &self.repo_root
-    }
-
     #[must_use]
     pub fn from_workspace_dir(workspace_dir: impl AsRef<Path>) -> Self {
         let workspace_dir = workspace_dir

rust/crates/plugins/src/hooks.rs

@@ -561,4 +561,43 @@ mod tests {
             );
         }
     }
+
+    #[test]
+    fn output_with_stdin_tolerates_broken_pipe_when_child_closes_stdin_early() {
+        // given: a hook that immediately closes stdin without consuming the
+        // JSON payload. Use an oversized payload so the parent keeps writing
+        // long enough for Linux to surface EPIPE on the old implementation.
+        let root = temp_dir("stdin-close");
+        let script = root.join("close-stdin.sh");
+        fs::create_dir_all(&root).expect("temp hook dir");
+        fs::write(
+            &script,
+            "#!/bin/sh\nexec 0<&-\nprintf 'stdin closed early\\n'\nsleep 0.05\n",
+        )
+        .expect("write stdin-closing hook");
+        make_executable(&script);
+
+        let mut child = super::shell_command(script.to_str().expect("utf8 path"));
+        child.stdin(std::process::Stdio::piped());
+        child.stdout(std::process::Stdio::piped());
+        child.stderr(std::process::Stdio::piped());
+        let large_input = vec![b'x'; 2 * 1024 * 1024];
+
+        // when
+        let output = child
+            .output_with_stdin(&large_input)
+            .expect("broken pipe should be tolerated");
+
+        // then
+        assert!(
+            output.status.success(),
+            "child should still exit cleanly: {output:?}"
+        );
+        assert_eq!(
+            String::from_utf8_lossy(&output.stdout).trim(),
+            "stdin closed early"
+        );
+
+        let _ = fs::remove_dir_all(root);
+    }
 }

rust/crates/plugins/src/lib.rs

@@ -1,13 +1,10 @@
 mod hooks;
-#[cfg(test)]
-pub mod test_isolation;
 
 use std::collections::{BTreeMap, BTreeSet};
 use std::fmt::{Display, Formatter};
 use std::fs;
 use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
-use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use serde::{Deserialize, Serialize};
@@ -2163,13 +2160,7 @@ fn materialize_source(
     match source {
         PluginInstallSource::LocalPath { path } => Ok(path.clone()),
         PluginInstallSource::GitUrl { url } => {
-            static MATERIALIZE_COUNTER: AtomicU64 = AtomicU64::new(0);
-            let unique = MATERIALIZE_COUNTER.fetch_add(1, Ordering::Relaxed);
-            let nanos = SystemTime::now()
-                .duration_since(UNIX_EPOCH)
-                .unwrap()
-                .as_nanos();
-            let destination = temp_root.join(format!("plugin-{nanos}-{unique}"));
+            let destination = temp_root.join(format!("plugin-{}", unix_time_ms()));
             let output = Command::new("git")
                 .arg("clone")
                 .arg("--depth")
@@ -2282,24 +2273,10 @@ fn ensure_object<'a>(root: &'a mut Map<String, Value>, key: &str) -> &'a mut Map
         .expect("object should exist")
 }
 
-/// Environment variable lock for test isolation.
-/// Guards against concurrent modification of `CLAW_CONFIG_HOME`.
-#[cfg(test)]
-fn env_lock() -> &'static std::sync::Mutex<()> {
-    static ENV_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
-    &ENV_LOCK
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    fn env_guard() -> std::sync::MutexGuard<'static, ()> {
-        env_lock()
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner)
-    }
-
     fn temp_dir(label: &str) -> PathBuf {
         let nanos = std::time::SystemTime::now()
             .duration_since(std::time::UNIX_EPOCH)
@@ -2308,18 +2285,6 @@ mod tests {
         std::env::temp_dir().join(format!("plugins-{label}-{nanos}"))
     }
 
-    #[test]
-    fn env_guard_recovers_after_poisoning() {
-        let poisoned = std::thread::spawn(|| {
-            let _guard = env_guard();
-            panic!("poison env lock");
-        })
-        .join();
-        assert!(poisoned.is_err(), "poisoning thread should panic");
-
-        let _guard = env_guard();
-    }
-
     fn write_file(path: &Path, contents: &str) {
         if let Some(parent) = path.parent() {
             fs::create_dir_all(parent).expect("parent dir");
@@ -2503,7 +2468,6 @@ mod tests {
 
     #[test]
     fn load_plugin_from_directory_validates_required_fields() {
-        let _guard = env_guard();
         let root = temp_dir("manifest-required");
         write_file(
             root.join(MANIFEST_FILE_NAME).as_path(),
@@ -2518,7 +2482,6 @@ mod tests {
 
     #[test]
     fn load_plugin_from_directory_reads_root_manifest_and_validates_entries() {
-        let _guard = env_guard();
         let root = temp_dir("manifest-root");
         write_loader_plugin(&root);
 
@@ -2548,7 +2511,6 @@ mod tests {
 
     #[test]
     fn load_plugin_from_directory_supports_packaged_manifest_path() {
-        let _guard = env_guard();
         let root = temp_dir("manifest-packaged");
         write_external_plugin(&root, "packaged-demo", "1.0.0");
 
@@ -2562,7 +2524,6 @@ mod tests {
 
     #[test]
     fn load_plugin_from_directory_defaults_optional_fields() {
-        let _guard = env_guard();
         let root = temp_dir("manifest-defaults");
         write_file(
             root.join(MANIFEST_FILE_NAME).as_path(),
@@ -2584,7 +2545,6 @@ mod tests {
 
     #[test]
     fn load_plugin_from_directory_rejects_duplicate_permissions_and_commands() {
-        let _guard = env_guard();
         let root = temp_dir("manifest-duplicates");
         write_file(
             root.join("commands").join("sync.sh").as_path(),
@@ -2880,7 +2840,6 @@ mod tests {
 
     #[test]
     fn discovers_builtin_and_bundled_plugins() {
-        let _guard = env_guard();
         let manager = PluginManager::new(PluginManagerConfig::new(temp_dir("discover")));
         let plugins = manager.list_plugins().expect("plugins should list");
         assert!(plugins
@@ -2893,7 +2852,6 @@ mod tests {
 
     #[test]
     fn installs_enables_updates_and_uninstalls_external_plugins() {
-        let _guard = env_guard();
         let config_home = temp_dir("home");
         let source_root = temp_dir("source");
         write_external_plugin(&source_root, "demo", "1.0.0");
@@ -2942,7 +2900,6 @@ mod tests {
 
     #[test]
     fn auto_installs_bundled_plugins_into_the_registry() {
-        let _guard = env_guard();
         let config_home = temp_dir("bundled-home");
         let bundled_root = temp_dir("bundled-root");
         write_bundled_plugin(&bundled_root.join("starter"), "starter", "0.1.0", false);
@@ -2974,7 +2931,6 @@ mod tests {
 
     #[test]
     fn default_bundled_root_loads_repo_bundles_as_installed_plugins() {
-        let _guard = env_guard();
         let config_home = temp_dir("default-bundled-home");
         let manager = PluginManager::new(PluginManagerConfig::new(&config_home));
 
@@ -2993,7 +2949,6 @@ mod tests {
 
     #[test]
     fn bundled_sync_prunes_removed_bundled_registry_entries() {
-        let _guard = env_guard();
         let config_home = temp_dir("bundled-prune-home");
         let bundled_root = temp_dir("bundled-prune-root");
         let stale_install_path = config_home
@@ -3057,7 +3012,6 @@ mod tests {
 
     #[test]
     fn installed_plugin_discovery_keeps_registry_entries_outside_install_root() {
-        let _guard = env_guard();
         let config_home = temp_dir("registry-fallback-home");
         let bundled_root = temp_dir("registry-fallback-bundled");
         let install_root = config_home.join("plugins").join("installed");
@@ -3112,7 +3066,6 @@ mod tests {
 
     #[test]
     fn installed_plugin_discovery_prunes_stale_registry_entries() {
-        let _guard = env_guard();
         let config_home = temp_dir("registry-prune-home");
         let bundled_root = temp_dir("registry-prune-bundled");
         let install_root = config_home.join("plugins").join("installed");
@@ -3158,7 +3111,6 @@ mod tests {
 
     #[test]
     fn persists_bundled_plugin_enable_state_across_reloads() {
-        let _guard = env_guard();
         let config_home = temp_dir("bundled-state-home");
         let bundled_root = temp_dir("bundled-state-root");
         write_bundled_plugin(&bundled_root.join("starter"), "starter", "0.1.0", false);
@@ -3192,7 +3144,6 @@ mod tests {
 
     #[test]
     fn persists_bundled_plugin_disable_state_across_reloads() {
-        let _guard = env_guard();
         let config_home = temp_dir("bundled-disabled-home");
         let bundled_root = temp_dir("bundled-disabled-root");
         write_bundled_plugin(&bundled_root.join("starter"), "starter", "0.1.0", true);
@@ -3226,7 +3177,6 @@ mod tests {
 
     #[test]
     fn validates_plugin_source_before_install() {
-        let _guard = env_guard();
         let config_home = temp_dir("validate-home");
         let source_root = temp_dir("validate-source");
         write_external_plugin(&source_root, "validator", "1.0.0");
@@ -3241,7 +3191,6 @@ mod tests {
 
     #[test]
     fn plugin_registry_tracks_enabled_state_and_lookup() {
-        let _guard = env_guard();
         let config_home = temp_dir("registry-home");
         let source_root = temp_dir("registry-source");
         write_external_plugin(&source_root, "registry-demo", "1.0.0");
@@ -3269,7 +3218,6 @@ mod tests {
 
     #[test]
     fn plugin_registry_report_collects_load_failures_without_dropping_valid_plugins() {
-        let _guard = env_guard();
         // given
         let config_home = temp_dir("report-home");
         let external_root = temp_dir("report-external");
@@ -3314,7 +3262,6 @@ mod tests {
 
     #[test]
     fn installed_plugin_registry_report_collects_load_failures_from_install_root() {
-        let _guard = env_guard();
         // given
         let config_home = temp_dir("installed-report-home");
         let bundled_root = temp_dir("installed-report-bundled");
@@ -3345,7 +3292,6 @@ mod tests {
 
     #[test]
     fn rejects_plugin_sources_with_missing_hook_paths() {
-        let _guard = env_guard();
         // given
         let config_home = temp_dir("broken-home");
         let source_root = temp_dir("broken-source");
@@ -3373,7 +3319,6 @@ mod tests {
 
     #[test]
     fn rejects_plugin_sources_with_missing_failure_hook_paths() {
-        let _guard = env_guard();
         // given
         let config_home = temp_dir("broken-failure-home");
         let source_root = temp_dir("broken-failure-source");
@@ -3401,7 +3346,6 @@ mod tests {
 
     #[test]
     fn plugin_registry_runs_initialize_and_shutdown_for_enabled_plugins() {
-        let _guard = env_guard();
         let config_home = temp_dir("lifecycle-home");
         let source_root = temp_dir("lifecycle-source");
         let _ = write_lifecycle_plugin(&source_root, "lifecycle-demo", "1.0.0");
@@ -3425,7 +3369,6 @@ mod tests {
 
     #[test]
     fn aggregates_and_executes_plugin_tools() {
-        let _guard = env_guard();
         let config_home = temp_dir("tool-home");
         let source_root = temp_dir("tool-source");
         write_tool_plugin(&source_root, "tool-demo", "1.0.0");
@@ -3454,7 +3397,6 @@ mod tests {
 
     #[test]
     fn list_installed_plugins_scans_install_root_without_registry_entries() {
-        let _guard = env_guard();
         let config_home = temp_dir("installed-scan-home");
         let bundled_root = temp_dir("installed-scan-bundled");
         let install_root = config_home.join("plugins").join("installed");
@@ -3486,7 +3428,6 @@ mod tests {
 
     #[test]
     fn list_installed_plugins_scans_packaged_manifests_in_install_root() {
-        let _guard = env_guard();
         let config_home = temp_dir("installed-packaged-scan-home");
         let bundled_root = temp_dir("installed-packaged-scan-bundled");
         let install_root = config_home.join("plugins").join("installed");
@@ -3515,143 +3456,4 @@ mod tests {
         let _ = fs::remove_dir_all(config_home);
         let _ = fs::remove_dir_all(bundled_root);
     }
-
-    /// Regression test for ROADMAP #41: verify that `CLAW_CONFIG_HOME` isolation prevents
-    /// host `~/.claw/plugins/` from bleeding into test runs.
-    #[test]
-    fn claw_config_home_isolation_prevents_host_plugin_leakage() {
-        let _guard = env_guard();
-
-        // Create a temp directory to act as our isolated CLAW_CONFIG_HOME
-        let config_home = temp_dir("isolated-home");
-        let bundled_root = temp_dir("isolated-bundled");
-
-        // Set CLAW_CONFIG_HOME to our temp directory
-        std::env::set_var("CLAW_CONFIG_HOME", &config_home);
-
-        // Create a test fixture plugin in the isolated config home
-        let install_root = config_home.join("plugins").join("installed");
-        let fixture_plugin_root = install_root.join("isolated-test-plugin");
-        write_file(
-            fixture_plugin_root.join(MANIFEST_RELATIVE_PATH).as_path(),
-            r#"{
-  "name": "isolated-test-plugin",
-  "version": "1.0.0",
-  "description": "Test fixture plugin in isolated config home"
-}"#,
-        );
-
-        // Create PluginManager with isolated bundled_root - it should use the temp config_home, not host ~/.claw/
-        let mut config = PluginManagerConfig::new(&config_home);
-        config.bundled_root = Some(bundled_root.clone());
-        let manager = PluginManager::new(config);
-
-        // List installed plugins - should only see the test fixture, not host plugins
-        let installed = manager
-            .list_installed_plugins()
-            .expect("installed plugins should list");
-
-        // Verify we only see the test fixture plugin
-        assert_eq!(
-            installed.len(),
-            1,
-            "should only see the test fixture plugin, not host ~/.claw/plugins/"
-        );
-        assert_eq!(
-            installed[0].metadata.id, "isolated-test-plugin@external",
-            "should see the test fixture plugin"
-        );
-
-        // Cleanup
-        std::env::remove_var("CLAW_CONFIG_HOME");
-        let _ = fs::remove_dir_all(config_home);
-        let _ = fs::remove_dir_all(bundled_root);
-    }
-
-    #[test]
-    fn plugin_lifecycle_handles_parallel_execution() {
-        use std::sync::atomic::{AtomicUsize, Ordering as AtomicOrdering};
-        use std::sync::Arc;
-        use std::thread;
-
-        let _guard = env_guard();
-
-        // Shared base directory for all threads
-        let base_dir = temp_dir("parallel-base");
-
-        // Track successful installations and any errors
-        let success_count = Arc::new(AtomicUsize::new(0));
-        let error_count = Arc::new(AtomicUsize::new(0));
-
-        // Spawn multiple threads to install plugins simultaneously
-        let mut handles = Vec::new();
-        for thread_id in 0..5 {
-            let base_dir = base_dir.clone();
-            let success_count = Arc::clone(&success_count);
-            let error_count = Arc::clone(&error_count);
-
-            let handle = thread::spawn(move || {
-                // Create unique directories for this thread
-                let config_home = base_dir.join(format!("config-{thread_id}"));
-                let source_root = base_dir.join(format!("source-{thread_id}"));
-
-                // Write lifecycle plugin for this thread
-                let _log_path =
-                    write_lifecycle_plugin(&source_root, &format!("parallel-{thread_id}"), "1.0.0");
-
-                // Create PluginManager and install
-                let mut manager = PluginManager::new(PluginManagerConfig::new(&config_home));
-                let install_result = manager.install(source_root.to_str().expect("utf8 path"));
-
-                match install_result {
-                    Ok(install) => {
-                        let log_path = install.install_path.join("lifecycle.log");
-
-                        // Initialize and shutdown the registry to trigger lifecycle hooks
-                        let registry = manager.plugin_registry();
-                        match registry {
-                            Ok(registry) => {
-                                if registry.initialize().is_ok() && registry.shutdown().is_ok() {
-                                    // Verify lifecycle.log exists and has expected content
-                                    if let Ok(log) = fs::read_to_string(&log_path) {
-                                        if log == "init\nshutdown\n" {
-                                            success_count.fetch_add(1, AtomicOrdering::Relaxed);
-                                        }
-                                    }
-                                }
-                            }
-                            Err(_) => {
-                                error_count.fetch_add(1, AtomicOrdering::Relaxed);
-                            }
-                        }
-                    }
-                    Err(_) => {
-                        error_count.fetch_add(1, AtomicOrdering::Relaxed);
-                    }
-                }
-            });
-            handles.push(handle);
-        }
-
-        // Wait for all threads to complete
-        for handle in handles {
-            handle.join().expect("thread should complete");
-        }
-
-        // Verify all threads succeeded without collisions
-        let successes = success_count.load(AtomicOrdering::Relaxed);
-        let errors = error_count.load(AtomicOrdering::Relaxed);
-
-        assert_eq!(
-            successes, 5,
-            "all 5 parallel plugin installations should succeed"
-        );
-        assert_eq!(
-            errors, 0,
-            "no errors should occur during parallel execution"
-        );
-
-        // Cleanup
-        let _ = fs::remove_dir_all(base_dir);
-    }
 }

rust/crates/plugins/src/test_isolation.rs

@@ -1,73 +0,0 @@
-// Test isolation utilities for plugin tests
-// ROADMAP #41: Stop ambient plugin state from skewing CLI regression checks
-
-use std::env;
-use std::path::PathBuf;
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::sync::Mutex;
-
-static TEST_COUNTER: AtomicU64 = AtomicU64::new(0);
-static ENV_LOCK: Mutex<()> = Mutex::new(());
-
-/// Lock for test environment isolation
-pub struct EnvLock {
-    _guard: std::sync::MutexGuard<'static, ()>,
-    temp_home: PathBuf,
-}
-
-impl EnvLock {
-    /// Acquire environment lock for test isolation
-    pub fn lock() -> Self {
-        let guard = ENV_LOCK.lock().unwrap();
-        let count = TEST_COUNTER.fetch_add(1, Ordering::SeqCst);
-        let temp_home = std::env::temp_dir().join(format!("plugin-test-{count}"));
-
-        // Set up isolated environment
-        std::fs::create_dir_all(&temp_home).ok();
-        std::fs::create_dir_all(temp_home.join(".claude/plugins/installed")).ok();
-        std::fs::create_dir_all(temp_home.join(".config")).ok();
-
-        // Redirect HOME and XDG_CONFIG_HOME to temp directory
-        env::set_var("HOME", &temp_home);
-        env::set_var("XDG_CONFIG_HOME", temp_home.join(".config"));
-        env::set_var("XDG_DATA_HOME", temp_home.join(".local/share"));
-
-        EnvLock {
-            _guard: guard,
-            temp_home,
-        }
-    }
-
-    /// Get the temporary home directory for this test
-    #[must_use]
-    pub fn temp_home(&self) -> &PathBuf {
-        &self.temp_home
-    }
-}
-
-impl Drop for EnvLock {
-    fn drop(&mut self) {
-        // Cleanup temp directory
-        std::fs::remove_dir_all(&self.temp_home).ok();
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_env_lock_creates_isolated_home() {
-        let lock = EnvLock::lock();
-        let home = env::var("HOME").unwrap();
-        assert!(home.contains("plugin-test-"));
-        assert_eq!(home, lock.temp_home().to_str().unwrap());
-    }
-
-    #[test]
-    fn test_env_lock_creates_plugin_directories() {
-        let lock = EnvLock::lock();
-        let plugins_dir = lock.temp_home().join(".claude/plugins/installed");
-        assert!(plugins_dir.exists());
-    }
-}

rust/crates/runtime/src/bash.rs

@@ -8,7 +8,6 @@ use tokio::process::Command as TokioCommand;
 use tokio::runtime::Builder;
 use tokio::time::timeout;
 
-use crate::lane_events::{LaneEvent, ShipMergeMethod, ShipProvenance};
 use crate::sandbox::{
     build_linux_sandbox_command, resolve_sandbox_status_for_request, FilesystemIsolationMode,
     SandboxConfig, SandboxStatus,
@@ -103,76 +102,11 @@ pub fn execute_bash(input: BashCommandInput) -> io::Result<BashCommandOutput> {
     runtime.block_on(execute_bash_async(input, sandbox_status, cwd))
 }
 
-/// Detect git push to main and emit ship provenance event
-fn detect_and_emit_ship_prepared(command: &str) {
-    let trimmed = command.trim();
-    // Simple detection: git push with main/master
-    if trimmed.contains("git push") && (trimmed.contains("main") || trimmed.contains("master")) {
-        // Emit ship.prepared event
-        let now = std::time::SystemTime::now()
-            .duration_since(std::time::UNIX_EPOCH)
-            .unwrap_or_default()
-            .as_millis();
-        let provenance = ShipProvenance {
-            source_branch: get_current_branch().unwrap_or_else(|| "unknown".to_string()),
-            base_commit: get_head_commit().unwrap_or_default(),
-            commit_count: 0, // Would need to calculate from range
-            commit_range: "unknown..HEAD".to_string(),
-            merge_method: ShipMergeMethod::DirectPush,
-            actor: get_git_actor().unwrap_or_else(|| "unknown".to_string()),
-            pr_number: None,
-        };
-        let _event = LaneEvent::ship_prepared(format!("{}", now), &provenance);
-        // Log to stderr as interim routing before event stream integration
-        eprintln!(
-            "[ship.prepared] branch={} -> main, commits={}, actor={}",
-            provenance.source_branch, provenance.commit_count, provenance.actor
-        );
-    }
-}
-
-fn get_current_branch() -> Option<String> {
-    let output = Command::new("git")
-        .args(["branch", "--show-current"])
-        .output()
-        .ok()?;
-    if output.status.success() {
-        Some(String::from_utf8_lossy(&output.stdout).trim().to_string())
-    } else {
-        None
-    }
-}
-
-fn get_head_commit() -> Option<String> {
-    let output = Command::new("git")
-        .args(["rev-parse", "--short", "HEAD"])
-        .output()
-        .ok()?;
-    if output.status.success() {
-        Some(String::from_utf8_lossy(&output.stdout).trim().to_string())
-    } else {
-        None
-    }
-}
-
-fn get_git_actor() -> Option<String> {
-    let name = Command::new("git")
-        .args(["config", "user.name"])
-        .output()
-        .ok()
-        .filter(|o| o.status.success())
-        .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())?;
-    Some(name)
-}
-
 async fn execute_bash_async(
     input: BashCommandInput,
     sandbox_status: SandboxStatus,
     cwd: std::path::PathBuf,
 ) -> io::Result<BashCommandOutput> {
-    // Detect and emit ship provenance for git push operations
-    detect_and_emit_ship_prepared(&input.command);
-    
     let mut command = prepare_tokio_command(&input.command, &cwd, &sandbox_status, true);
 
     let output_result = if let Some(timeout_ms) = input.timeout {

rust/crates/runtime/src/compact.rs

@@ -108,54 +108,10 @@ pub fn compact_session(session: &Session, config: CompactionConfig) -> Compactio
         .first()
         .and_then(extract_existing_compacted_summary);
     let compacted_prefix_len = usize::from(existing_summary.is_some());
-    let raw_keep_from = session
+    let keep_from = session
         .messages
         .len()
         .saturating_sub(config.preserve_recent_messages);
-    // Ensure we do not split a tool-use / tool-result pair at the compaction
-    // boundary. If the first preserved message is a user message whose first
-    // block is a ToolResult, the assistant message with the matching ToolUse
-    // was slated for removal — that produces an orphaned tool role message on
-    // the OpenAI-compat path (400: tool message must follow assistant with
-    // tool_calls). Walk the boundary back until we start at a safe point.
-    let keep_from = {
-        let mut k = raw_keep_from;
-        // If the first preserved message is a tool-result turn, ensure its
-        // paired assistant tool-use turn is preserved too. Without this fix,
-        // the OpenAI-compat adapter sends an orphaned 'tool' role message
-        // with no preceding assistant 'tool_calls', which providers reject
-        // with a 400. We walk back only if the immediately preceding message
-        // is NOT an assistant message that contains a ToolUse block (i.e. the
-        // pair is actually broken at the boundary).
-        loop {
-            if k == 0 || k <= compacted_prefix_len {
-                break;
-            }
-            let first_preserved = &session.messages[k];
-            let starts_with_tool_result = first_preserved
-                .blocks
-                .first()
-                .is_some_and(|b| matches!(b, ContentBlock::ToolResult { .. }));
-            if !starts_with_tool_result {
-                break;
-            }
-            // Check the message just before the current boundary.
-            let preceding = &session.messages[k - 1];
-            let preceding_has_tool_use = preceding
-                .blocks
-                .iter()
-                .any(|b| matches!(b, ContentBlock::ToolUse { .. }));
-            if preceding_has_tool_use {
-                // Pair is intact — walk back one more to include the assistant turn.
-                k = k.saturating_sub(1);
-                break;
-            }
-            // Preceding message has no ToolUse but we have a ToolResult —
-            // this is already an orphaned pair; walk back to try to fix it.
-            k = k.saturating_sub(1);
-        }
-        k
-    };
     let removed = &session.messages[compacted_prefix_len..keep_from];
     let preserved = session.messages[keep_from..].to_vec();
     let summary =
@@ -554,7 +510,7 @@ fn extract_summary_timeline(summary: &str) -> Vec<String> {
 #[cfg(test)]
 mod tests {
     use super::{
-        collect_key_files, compact_session, format_compact_summary,
+        collect_key_files, compact_session, estimate_session_tokens, format_compact_summary,
         get_compact_continuation_message, infer_pending_work, should_compact, CompactionConfig,
     };
     use crate::session::{ContentBlock, ConversationMessage, MessageRole, Session};
@@ -603,14 +559,7 @@ mod tests {
             },
         );
 
-        // With the tool-use/tool-result boundary fix, the compaction preserves
-        // one extra message to avoid an orphaned tool result at the boundary.
-        // messages[1] (assistant) must be kept along with messages[2] (tool result).
-        assert!(
-            result.removed_message_count <= 2,
-            "expected at most 2 removed, got {}",
-            result.removed_message_count
-        );
+        assert_eq!(result.removed_message_count, 2);
         assert_eq!(
             result.compacted_session.messages[0].role,
             MessageRole::System
@@ -628,13 +577,8 @@ mod tests {
                 max_estimated_tokens: 1,
             }
         ));
-        // Note: with the tool-use/tool-result boundary guard the compacted session
-        // may preserve one extra message at the boundary, so token reduction is
-        // not guaranteed for small sessions. The invariant that matters is that
-        // the removed_message_count is non-zero (something was compacted).
         assert!(
-            result.removed_message_count > 0,
-            "compaction must remove at least one message"
+            estimate_session_tokens(&result.compacted_session) < estimate_session_tokens(&session)
         );
     }
 
@@ -738,79 +682,6 @@ mod tests {
         assert!(files.contains(&"rust/crates/rusty-claude-cli/src/main.rs".to_string()));
     }
 
-    /// Regression: compaction must not split an assistant(ToolUse) /
-    /// user(ToolResult) pair at the boundary. An orphaned tool-result message
-    /// without the preceding assistant `tool_calls` causes a 400 on the
-    /// OpenAI-compat path (gaebal-gajae repro 2026-04-09).
-    #[test]
-    fn compaction_does_not_split_tool_use_tool_result_pair() {
-        use crate::session::{ContentBlock, Session};
-
-        let tool_id = "call_abc";
-        let mut session = Session::default();
-        // Turn 1: user prompt
-        session
-            .push_message(ConversationMessage::user_text("Search for files"))
-            .unwrap();
-        // Turn 2: assistant calls a tool
-        session
-            .push_message(ConversationMessage::assistant(vec![
-                ContentBlock::ToolUse {
-                    id: tool_id.to_string(),
-                    name: "search".to_string(),
-                    input: "{\"q\":\"*.rs\"}".to_string(),
-                },
-            ]))
-            .unwrap();
-        // Turn 3: tool result
-        session
-            .push_message(ConversationMessage::tool_result(
-                tool_id,
-                "search",
-                "found 5 files",
-                false,
-            ))
-            .unwrap();
-        // Turn 4: assistant final response
-        session
-            .push_message(ConversationMessage::assistant(vec![ContentBlock::Text {
-                text: "Done.".to_string(),
-            }]))
-            .unwrap();
-
-        // Compact preserving only 1 recent message — without the fix this
-        // would cut the boundary so that the tool result (turn 3) is first,
-        // without its preceding assistant tool_calls (turn 2).
-        let config = CompactionConfig {
-            preserve_recent_messages: 1,
-            ..CompactionConfig::default()
-        };
-        let result = compact_session(&session, config);
-        // After compaction, no two consecutive messages should have the pattern
-        // tool_result immediately following a non-assistant message (i.e. an
-        // orphaned tool result without a preceding assistant ToolUse).
-        let messages = &result.compacted_session.messages;
-        for i in 1..messages.len() {
-            let curr_is_tool_result = messages[i]
-                .blocks
-                .first()
-                .is_some_and(|b| matches!(b, ContentBlock::ToolResult { .. }));
-            if curr_is_tool_result {
-                let prev_has_tool_use = messages[i - 1]
-                    .blocks
-                    .iter()
-                    .any(|b| matches!(b, ContentBlock::ToolUse { .. }));
-                assert!(
-                    prev_has_tool_use,
-                    "message[{}] is a ToolResult but message[{}] has no ToolUse: {:?}",
-                    i,
-                    i - 1,
-                    &messages[i - 1].blocks
-                );
-            }
-        }
-    }
-
     #[test]
     fn infers_pending_work_from_recent_messages() {
         let pending = infer_pending_work(&[

rust/crates/runtime/src/config.rs

@@ -1254,21 +1254,11 @@ mod tests {
     use std::time::{SystemTime, UNIX_EPOCH};
 
     fn temp_dir() -> std::path::PathBuf {
-        // #149: previously used `runtime-config-{nanos}` which collided
-        // under parallel `cargo test --workspace` when multiple tests
-        // started within the same nanosecond bucket on fast machines.
-        // Add process id + a monotonically-incrementing atomic counter
-        // so every callsite gets a provably-unique directory regardless
-        // of clock resolution or scheduling.
-        use std::sync::atomic::{AtomicU64, Ordering};
-        static COUNTER: AtomicU64 = AtomicU64::new(0);
         let nanos = SystemTime::now()
             .duration_since(UNIX_EPOCH)
             .expect("time should be after epoch")
             .as_nanos();
-        let pid = std::process::id();
-        let seq = COUNTER.fetch_add(1, Ordering::Relaxed);
-        std::env::temp_dir().join(format!("runtime-config-{pid}-{nanos}-{seq}"))
+        std::env::temp_dir().join(format!("runtime-config-{nanos}"))
     }
 
     #[test]

rust/crates/runtime/src/conversation.rs

@@ -292,24 +292,6 @@ where
         }
     }
 
-    /// Run a session health probe to verify the runtime is functional after compaction.
-    /// Returns Ok(()) if healthy, Err if the session appears broken.
-    fn run_session_health_probe(&mut self) -> Result<(), String> {
-        // Check if we have basic session integrity
-        if self.session.messages.is_empty() && self.session.compaction.is_some() {
-            // Freshly compacted with no messages - this is normal
-            return Ok(());
-        }
-
-        // Verify tool executor is responsive with a non-destructive probe
-        // Using glob_search with a pattern that won't match anything
-        let probe_input = r#"{"pattern": "*.health-check-probe-"}"#;
-        match self.tool_executor.execute("glob_search", probe_input) {
-            Ok(_) => Ok(()),
-            Err(e) => Err(format!("Tool executor probe failed: {e}")),
-        }
-    }
-
     #[allow(clippy::too_many_lines)]
     pub fn run_turn(
         &mut self,
@@ -317,18 +299,6 @@ where
         mut prompter: Option<&mut dyn PermissionPrompter>,
     ) -> Result<TurnSummary, RuntimeError> {
         let user_input = user_input.into();
-
-        // ROADMAP #38: Session-health canary - probe if context was compacted
-        if self.session.compaction.is_some() {
-            if let Err(error) = self.run_session_health_probe() {
-                return Err(RuntimeError::new(format!(
-                    "Session health probe failed after compaction: {error}. \
-                     The session may be in an inconsistent state. \
-                     Consider starting a fresh session with /session new."
-                )));
-            }
-        }
-
         self.record_turn_started(&user_input);
         self.session
             .push_user_text(user_input)
@@ -534,10 +504,6 @@ where
         &self.session
     }
 
-    pub fn api_client_mut(&mut self) -> &mut C {
-        &mut self.api_client
-    }
-
     pub fn session_mut(&mut self) -> &mut Session {
         &mut self.session
     }
@@ -1611,88 +1577,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn compaction_health_probe_blocks_turn_when_tool_executor_is_broken() {
-        struct SimpleApi;
-        impl ApiClient for SimpleApi {
-            fn stream(
-                &mut self,
-                _request: ApiRequest,
-            ) -> Result<Vec<AssistantEvent>, RuntimeError> {
-                panic!("API should not run when health probe fails");
-            }
-        }
-
-        let mut session = Session::new();
-        session.record_compaction("summarized earlier work", 4);
-        session
-            .push_user_text("previous message")
-            .expect("message should append");
-
-        let tool_executor = StaticToolExecutor::new().register("glob_search", |_input| {
-            Err(ToolError::new("transport unavailable"))
-        });
-        let mut runtime = ConversationRuntime::new(
-            session,
-            SimpleApi,
-            tool_executor,
-            PermissionPolicy::new(PermissionMode::DangerFullAccess),
-            vec!["system".to_string()],
-        );
-
-        let error = runtime
-            .run_turn("trigger", None)
-            .expect_err("health probe failure should abort the turn");
-        assert!(
-            error
-                .to_string()
-                .contains("Session health probe failed after compaction"),
-            "unexpected error: {error}"
-        );
-        assert!(
-            error.to_string().contains("transport unavailable"),
-            "expected underlying probe error: {error}"
-        );
-    }
-
-    #[test]
-    fn compaction_health_probe_skips_empty_compacted_session() {
-        struct SimpleApi;
-        impl ApiClient for SimpleApi {
-            fn stream(
-                &mut self,
-                _request: ApiRequest,
-            ) -> Result<Vec<AssistantEvent>, RuntimeError> {
-                Ok(vec![
-                    AssistantEvent::TextDelta("done".to_string()),
-                    AssistantEvent::MessageStop,
-                ])
-            }
-        }
-
-        let mut session = Session::new();
-        session.record_compaction("fresh summary", 2);
-
-        let tool_executor = StaticToolExecutor::new().register("glob_search", |_input| {
-            Err(ToolError::new(
-                "glob_search should not run for an empty compacted session",
-            ))
-        });
-        let mut runtime = ConversationRuntime::new(
-            session,
-            SimpleApi,
-            tool_executor,
-            PermissionPolicy::new(PermissionMode::DangerFullAccess),
-            vec!["system".to_string()],
-        );
-
-        let summary = runtime
-            .run_turn("trigger", None)
-            .expect("empty compacted session should not fail health probe");
-        assert_eq!(summary.auto_compaction, None);
-        assert_eq!(runtime.session().messages.len(), 2);
-    }
-
     #[test]
     fn build_assistant_message_requires_message_stop_event() {
         // given

rust/crates/runtime/src/file_ops.rs

@@ -308,20 +308,12 @@ pub fn glob_search(pattern: &str, path: Option<&str>) -> io::Result<GlobSearchOu
         base_dir.join(pattern).to_string_lossy().into_owned()
     };
 
-    // The `glob` crate does not support brace expansion ({a,b,c}).
-    // Expand braces into multiple patterns so patterns like
-    // `Assets/**/*.{cs,uxml,uss}` work correctly.
-    let expanded = expand_braces(&search_pattern);
-
-    let mut seen = std::collections::HashSet::new();
     let mut matches = Vec::new();
-    for pat in &expanded {
-        let entries = glob::glob(pat)
-            .map_err(|error| io::Error::new(io::ErrorKind::InvalidInput, error.to_string()))?;
-        for entry in entries.flatten() {
-            if entry.is_file() && seen.insert(entry.clone()) {
-                matches.push(entry);
-            }
+    let entries = glob::glob(&search_pattern)
+        .map_err(|error| io::Error::new(io::ErrorKind::InvalidInput, error.to_string()))?;
+    for entry in entries.flatten() {
+        if entry.is_file() {
+            matches.push(entry);
         }
     }
 
@@ -627,35 +619,13 @@ pub fn is_symlink_escape(path: &Path, workspace_root: &Path) -> io::Result<bool>
     Ok(!resolved.starts_with(&canonical_root))
 }
 
-/// Expand shell-style brace groups in a glob pattern.
-///
-/// Handles one level of braces: `foo.{a,b,c}` → `["foo.a", "foo.b", "foo.c"]`.
-/// Nested braces are not expanded (uncommon in practice).
-/// Patterns without braces pass through unchanged.
-fn expand_braces(pattern: &str) -> Vec<String> {
-    let Some(open) = pattern.find('{') else {
-        return vec![pattern.to_owned()];
-    };
-    let Some(close) = pattern[open..].find('}').map(|i| open + i) else {
-        // Unmatched brace — treat as literal.
-        return vec![pattern.to_owned()];
-    };
-    let prefix = &pattern[..open];
-    let suffix = &pattern[close + 1..];
-    let alternatives = &pattern[open + 1..close];
-    alternatives
-        .split(',')
-        .flat_map(|alt| expand_braces(&format!("{prefix}{alt}{suffix}")))
-        .collect()
-}
-
 #[cfg(test)]
 mod tests {
     use std::time::{SystemTime, UNIX_EPOCH};
 
     use super::{
-        edit_file, expand_braces, glob_search, grep_search, is_symlink_escape, read_file,
-        read_file_in_workspace, write_file, GrepSearchInput, MAX_WRITE_SIZE,
+        edit_file, glob_search, grep_search, is_symlink_escape, read_file, read_file_in_workspace,
+        write_file, GrepSearchInput, MAX_WRITE_SIZE,
     };
 
     fn temp_path(name: &str) -> std::path::PathBuf {
@@ -789,51 +759,4 @@ mod tests {
         .expect("grep should succeed");
         assert!(grep_output.content.unwrap_or_default().contains("hello"));
     }
-
-    #[test]
-    fn expand_braces_no_braces() {
-        assert_eq!(expand_braces("*.rs"), vec!["*.rs"]);
-    }
-
-    #[test]
-    fn expand_braces_single_group() {
-        let mut result = expand_braces("Assets/**/*.{cs,uxml,uss}");
-        result.sort();
-        assert_eq!(
-            result,
-            vec!["Assets/**/*.cs", "Assets/**/*.uss", "Assets/**/*.uxml",]
-        );
-    }
-
-    #[test]
-    fn expand_braces_nested() {
-        let mut result = expand_braces("src/{a,b}.{rs,toml}");
-        result.sort();
-        assert_eq!(
-            result,
-            vec!["src/a.rs", "src/a.toml", "src/b.rs", "src/b.toml"]
-        );
-    }
-
-    #[test]
-    fn expand_braces_unmatched() {
-        assert_eq!(expand_braces("foo.{bar"), vec!["foo.{bar"]);
-    }
-
-    #[test]
-    fn glob_search_with_braces_finds_files() {
-        let dir = temp_path("glob-braces");
-        std::fs::create_dir_all(&dir).unwrap();
-        std::fs::write(dir.join("a.rs"), "fn main() {}").unwrap();
-        std::fs::write(dir.join("b.toml"), "[package]").unwrap();
-        std::fs::write(dir.join("c.txt"), "hello").unwrap();
-
-        let result =
-            glob_search("*.{rs,toml}", Some(dir.to_str().unwrap())).expect("glob should succeed");
-        assert_eq!(
-            result.num_files, 2,
-            "should match .rs and .toml but not .txt"
-        );
-        let _ = std::fs::remove_dir_all(&dir);
-    }
 }

rust/crates/runtime/src/hooks.rs

@@ -1,5 +1,4 @@
 use std::ffi::OsStr;
-use std::fmt::Write as FmtWrite;
 use std::io::Write;
 use std::process::{Command, Stdio};
 use std::sync::{
@@ -14,8 +13,6 @@ use serde_json::{json, Value};
 use crate::config::{RuntimeFeatureConfig, RuntimeHookConfig};
 use crate::permissions::PermissionOverride;
 
-const HOOK_PREVIEW_CHAR_LIMIT: usize = 160;
-
 pub type HookPermissionDecision = PermissionOverride;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -440,7 +437,7 @@ impl HookRunner {
             Ok(CommandExecution::Finished(output)) => {
                 let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string();
                 let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
-                let parsed = parse_hook_output(event, tool_name, command, &stdout, &stderr);
+                let parsed = parse_hook_output(&stdout);
                 let primary_message = parsed.primary_message().map(ToOwned::to_owned);
                 match output.status.code() {
                     Some(0) => {
@@ -535,54 +532,16 @@ fn merge_parsed_hook_output(target: &mut HookRunResult, parsed: ParsedHookOutput
     }
 }
 
-fn parse_hook_output(
-    event: HookEvent,
-    tool_name: &str,
-    command: &str,
-    stdout: &str,
-    stderr: &str,
-) -> ParsedHookOutput {
+fn parse_hook_output(stdout: &str) -> ParsedHookOutput {
     if stdout.is_empty() {
         return ParsedHookOutput::default();
     }
 
-    let root = match serde_json::from_str::<Value>(stdout) {
-        Ok(Value::Object(root)) => root,
-        Ok(value) => {
-            return ParsedHookOutput {
-                messages: vec![format_invalid_hook_output(
-                    event,
-                    tool_name,
-                    command,
-                    &format!(
-                        "expected top-level JSON object, got {}",
-                        json_type_name(&value)
-                    ),
-                    stdout,
-                    stderr,
-                )],
-                ..ParsedHookOutput::default()
-            };
-        }
-        Err(error) if looks_like_json_attempt(stdout) => {
-            return ParsedHookOutput {
-                messages: vec![format_invalid_hook_output(
-                    event,
-                    tool_name,
-                    command,
-                    &error.to_string(),
-                    stdout,
-                    stderr,
-                )],
-                ..ParsedHookOutput::default()
-            };
-        }
-        Err(_) => {
-            return ParsedHookOutput {
-                messages: vec![stdout.to_string()],
-                ..ParsedHookOutput::default()
-            };
-        }
+    let Ok(Value::Object(root)) = serde_json::from_str::<Value>(stdout) else {
+        return ParsedHookOutput {
+            messages: vec![stdout.to_string()],
+            ..ParsedHookOutput::default()
+        };
     };
 
     let mut parsed = ParsedHookOutput::default();
@@ -660,69 +619,6 @@ fn parse_tool_input(tool_input: &str) -> Value {
     serde_json::from_str(tool_input).unwrap_or_else(|_| json!({ "raw": tool_input }))
 }
 
-fn format_invalid_hook_output(
-    event: HookEvent,
-    tool_name: &str,
-    command: &str,
-    detail: &str,
-    stdout: &str,
-    stderr: &str,
-) -> String {
-    let stdout_preview = bounded_hook_preview(stdout).unwrap_or_else(|| "<empty>".to_string());
-    let stderr_preview = bounded_hook_preview(stderr).unwrap_or_else(|| "<empty>".to_string());
-    let command_preview = bounded_hook_preview(command).unwrap_or_else(|| "<empty>".to_string());
-
-    format!(
-        "hook_invalid_json: phase={} tool={} command={} detail={} stdout_preview={} stderr_preview={}",
-        event.as_str(),
-        tool_name,
-        command_preview,
-        detail,
-        stdout_preview,
-        stderr_preview
-    )
-}
-
-fn bounded_hook_preview(value: &str) -> Option<String> {
-    let trimmed = value.trim();
-    if trimmed.is_empty() {
-        return None;
-    }
-
-    let mut preview = String::new();
-    for (count, ch) in trimmed.chars().enumerate() {
-        if count == HOOK_PREVIEW_CHAR_LIMIT {
-            preview.push('…');
-            break;
-        }
-        match ch {
-            '\n' => preview.push_str("\\n"),
-            '\r' => preview.push_str("\\r"),
-            '\t' => preview.push_str("\\t"),
-            control if control.is_control() => {
-                let _ = write!(&mut preview, "\\u{{{:x}}}", control as u32);
-            }
-            _ => preview.push(ch),
-        }
-    }
-    Some(preview)
-}
-
-fn json_type_name(value: &Value) -> &'static str {
-    match value {
-        Value::Null => "null",
-        Value::Bool(_) => "boolean",
-        Value::Number(_) => "number",
-        Value::String(_) => "string",
-        Value::Array(_) => "array",
-        Value::Object(_) => "object",
-    }
-}
-
-fn looks_like_json_attempt(value: &str) -> bool {
-    matches!(value.trim_start().chars().next(), Some('{' | '['))
-}
-
 fn format_hook_failure(command: &str, code: i32, stdout: Option<&str>, stderr: &str) -> String {
     let mut message = format!("Hook `{command}` exited with status {code}");
     if let Some(stdout) = stdout.filter(|stdout| !stdout.is_empty()) {
@@ -1039,31 +935,6 @@ mod tests {
         assert!(!result.messages().iter().any(|message| message == "later"));
     }
 
-    #[test]
-    fn malformed_nonempty_hook_output_reports_explicit_diagnostic_with_previews() {
-        let runner = HookRunner::new(RuntimeHookConfig::new(
-            vec![shell_snippet(
-                "printf '{not-json\nsecond line'; printf 'stderr warning' >&2; exit 1",
-            )],
-            Vec::new(),
-            Vec::new(),
-        ));
-
-        let result = runner.run_pre_tool_use("Edit", r#"{"file":"src/lib.rs"}"#);
-
-        assert!(result.is_failed());
-        let rendered = result.messages().join("\n");
-        assert!(rendered.contains("hook_invalid_json:"));
-        assert!(rendered.contains("phase=PreToolUse"));
-        assert!(rendered.contains("tool=Edit"));
-        assert!(rendered.contains("command=printf '{not-json"));
-        assert!(rendered.contains("printf 'stderr warning' >&2; exit 1"));
-        assert!(rendered.contains("detail=key must be a string"));
-        assert!(rendered.contains("stdout_preview={not-json"));
-        assert!(rendered.contains("second line stderr_preview=stderr warning"));
-        assert!(rendered.contains("stderr_preview=stderr warning"));
-    }
-
     #[test]
     fn abort_signal_cancels_long_running_hook_and_reports_progress() {
         let runner = HookRunner::new(RuntimeHookConfig::new(

rust/crates/runtime/src/lane_events.rs

@@ -1,4 +1,4 @@
-#![allow(clippy::similar_names, clippy::cast_possible_truncation)]
+#![allow(clippy::similar_names)]
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
@@ -36,17 +36,6 @@ pub enum LaneEventName {
     Closed,
     #[serde(rename = "branch.stale_against_main")]
     BranchStaleAgainstMain,
-    #[serde(rename = "branch.workspace_mismatch")]
-    BranchWorkspaceMismatch,
-    /// Ship/provenance events — §4.44.5
-    #[serde(rename = "ship.prepared")]
-    ShipPrepared,
-    #[serde(rename = "ship.commits_selected")]
-    ShipCommitsSelected,
-    #[serde(rename = "ship.merged")]
-    ShipMerged,
-    #[serde(rename = "ship.pushed_main")]
-    ShipPushedMain,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
@@ -78,345 +67,14 @@ pub enum LaneFailureClass {
     McpHandshake,
     GatewayRouting,
     ToolRuntime,
-    WorkspaceMismatch,
     Infra,
 }
 
-/// Provenance labels for event source classification.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum EventProvenance {
-    /// Event from a live, active lane
-    LiveLane,
-    /// Event from a synthetic test
-    Test,
-    /// Event from a healthcheck probe
-    Healthcheck,
-    /// Event from a replay/log replay
-    Replay,
-    /// Event from the transport layer itself
-    Transport,
-}
-
-/// Session identity metadata captured at creation time.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct SessionIdentity {
-    /// Stable title for the session
-    pub title: String,
-    /// Workspace/worktree path
-    pub workspace: String,
-    /// Lane/session purpose
-    pub purpose: String,
-    /// Placeholder reason if any field is unknown
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub placeholder_reason: Option<String>,
-}
-
-impl SessionIdentity {
-    /// Create complete session identity
-    #[must_use]
-    pub fn new(
-        title: impl Into<String>,
-        workspace: impl Into<String>,
-        purpose: impl Into<String>,
-    ) -> Self {
-        Self {
-            title: title.into(),
-            workspace: workspace.into(),
-            purpose: purpose.into(),
-            placeholder_reason: None,
-        }
-    }
-
-    /// Create session identity with placeholder for missing fields
-    #[must_use]
-    pub fn with_placeholder(
-        title: impl Into<String>,
-        workspace: impl Into<String>,
-        purpose: impl Into<String>,
-        reason: impl Into<String>,
-    ) -> Self {
-        Self {
-            title: title.into(),
-            workspace: workspace.into(),
-            purpose: purpose.into(),
-            placeholder_reason: Some(reason.into()),
-        }
-    }
-}
-
-/// Lane ownership and workflow scope binding.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct LaneOwnership {
-    /// Owner/assignee identity
-    pub owner: String,
-    /// Workflow scope (e.g., claw-code-dogfood, external-git-maintenance)
-    pub workflow_scope: String,
-    /// Whether the watcher is expected to act, observe, or ignore
-    pub watcher_action: WatcherAction,
-}
-
-/// Watcher action expectation for a lane event.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum WatcherAction {
-    /// Watcher should take action on this event
-    Act,
-    /// Watcher should only observe
-    Observe,
-    /// Watcher should ignore this event
-    Ignore,
-}
-
-/// Event metadata for ordering, provenance, deduplication, and ownership.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct LaneEventMetadata {
-    /// Monotonic sequence number for event ordering
-    pub seq: u64,
-    /// Event provenance source
-    pub provenance: EventProvenance,
-    /// Session identity at creation
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_identity: Option<SessionIdentity>,
-    /// Lane ownership and scope
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ownership: Option<LaneOwnership>,
-    /// Nudge ID for deduplication cycles
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub nudge_id: Option<String>,
-    /// Event fingerprint for terminal event deduplication
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub event_fingerprint: Option<String>,
-    /// Timestamp when event was observed/created
-    pub timestamp_ms: u64,
-}
-
-impl LaneEventMetadata {
-    /// Create new event metadata
-    #[must_use]
-    pub fn new(seq: u64, provenance: EventProvenance) -> Self {
-        Self {
-            seq,
-            provenance,
-            session_identity: None,
-            ownership: None,
-            nudge_id: None,
-            event_fingerprint: None,
-            timestamp_ms: std::time::SystemTime::now()
-                .duration_since(std::time::UNIX_EPOCH)
-                .unwrap_or_default()
-                .as_millis() as u64,
-        }
-    }
-
-    /// Add session identity
-    #[must_use]
-    pub fn with_session_identity(mut self, identity: SessionIdentity) -> Self {
-        self.session_identity = Some(identity);
-        self
-    }
-
-    /// Add ownership info
-    #[must_use]
-    pub fn with_ownership(mut self, ownership: LaneOwnership) -> Self {
-        self.ownership = Some(ownership);
-        self
-    }
-
-    /// Add nudge ID for dedupe
-    #[must_use]
-    pub fn with_nudge_id(mut self, nudge_id: impl Into<String>) -> Self {
-        self.nudge_id = Some(nudge_id.into());
-        self
-    }
-
-    /// Compute and add event fingerprint for terminal events
-    #[must_use]
-    pub fn with_fingerprint(mut self, fingerprint: impl Into<String>) -> Self {
-        self.event_fingerprint = Some(fingerprint.into());
-        self
-    }
-}
-
-/// Builder for constructing [`LaneEvent`]s with proper metadata.
-#[derive(Debug, Clone)]
-pub struct LaneEventBuilder {
-    event: LaneEventName,
-    status: LaneEventStatus,
-    emitted_at: String,
-    metadata: LaneEventMetadata,
-    detail: Option<String>,
-    failure_class: Option<LaneFailureClass>,
-    data: Option<serde_json::Value>,
-}
-
-impl LaneEventBuilder {
-    /// Start building a new lane event
-    #[must_use]
-    pub fn new(
-        event: LaneEventName,
-        status: LaneEventStatus,
-        emitted_at: impl Into<String>,
-        seq: u64,
-        provenance: EventProvenance,
-    ) -> Self {
-        Self {
-            event,
-            status,
-            emitted_at: emitted_at.into(),
-            metadata: LaneEventMetadata::new(seq, provenance),
-            detail: None,
-            failure_class: None,
-            data: None,
-        }
-    }
-
-    /// Add session identity
-    #[must_use]
-    pub fn with_session_identity(mut self, identity: SessionIdentity) -> Self {
-        self.metadata = self.metadata.with_session_identity(identity);
-        self
-    }
-
-    /// Add ownership info
-    #[must_use]
-    pub fn with_ownership(mut self, ownership: LaneOwnership) -> Self {
-        self.metadata = self.metadata.with_ownership(ownership);
-        self
-    }
-
-    /// Add nudge ID
-    #[must_use]
-    pub fn with_nudge_id(mut self, nudge_id: impl Into<String>) -> Self {
-        self.metadata = self.metadata.with_nudge_id(nudge_id);
-        self
-    }
-
-    /// Add detail
-    #[must_use]
-    pub fn with_detail(mut self, detail: impl Into<String>) -> Self {
-        self.detail = Some(detail.into());
-        self
-    }
-
-    /// Add failure class
-    #[must_use]
-    pub fn with_failure_class(mut self, failure_class: LaneFailureClass) -> Self {
-        self.failure_class = Some(failure_class);
-        self
-    }
-
-    /// Add data payload
-    #[must_use]
-    pub fn with_data(mut self, data: serde_json::Value) -> Self {
-        self.data = Some(data);
-        self
-    }
-
-    /// Compute fingerprint and build terminal event
-    #[must_use]
-    pub fn build_terminal(mut self) -> LaneEvent {
-        let fingerprint = compute_event_fingerprint(&self.event, &self.status, self.data.as_ref());
-        self.metadata = self.metadata.with_fingerprint(fingerprint);
-        self.build()
-    }
-
-    /// Build the event
-    #[must_use]
-    pub fn build(self) -> LaneEvent {
-        LaneEvent {
-            event: self.event,
-            status: self.status,
-            emitted_at: self.emitted_at,
-            failure_class: self.failure_class,
-            detail: self.detail,
-            data: self.data,
-            metadata: self.metadata,
-        }
-    }
-}
-
-/// Check if an event kind is terminal (completed, failed, superseded, closed).
-#[must_use]
-pub fn is_terminal_event(event: LaneEventName) -> bool {
-    matches!(
-        event,
-        LaneEventName::Finished
-            | LaneEventName::Failed
-            | LaneEventName::Superseded
-            | LaneEventName::Closed
-            | LaneEventName::Merged
-    )
-}
-
-/// Compute a fingerprint for terminal event deduplication.
-#[must_use]
-pub fn compute_event_fingerprint(
-    event: &LaneEventName,
-    status: &LaneEventStatus,
-    data: Option<&serde_json::Value>,
-) -> String {
-    use std::collections::hash_map::DefaultHasher;
-    use std::hash::{Hash, Hasher};
-
-    let mut hasher = DefaultHasher::new();
-    format!("{event:?}").hash(&mut hasher);
-    format!("{status:?}").hash(&mut hasher);
-    if let Some(d) = data {
-        serde_json::to_string(d)
-            .unwrap_or_default()
-            .hash(&mut hasher);
-    }
-    format!("{:016x}", hasher.finish())
-}
-
-/// Deduplicate terminal events within a reconciliation window.
-/// Returns only the first occurrence of each terminal fingerprint.
-#[must_use]
-pub fn dedupe_terminal_events(events: &[LaneEvent]) -> Vec<LaneEvent> {
-    let mut seen_fingerprints = std::collections::HashSet::new();
-    let mut result = Vec::new();
-
-    for event in events {
-        if is_terminal_event(event.event) {
-            if let Some(fp) = &event.metadata.event_fingerprint {
-                if seen_fingerprints.contains(fp) {
-                    continue; // Skip duplicate terminal event
-                }
-                seen_fingerprints.insert(fp.clone());
-            }
-        }
-        result.push(event.clone());
-    }
-
-    result
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub enum BlockedSubphase {
-    #[serde(rename = "blocked.trust_prompt")]
-    TrustPrompt { gate_repo: String },
-    #[serde(rename = "blocked.prompt_delivery")]
-    PromptDelivery { attempt: u32 },
-    #[serde(rename = "blocked.plugin_init")]
-    PluginInit { plugin_name: String },
-    #[serde(rename = "blocked.mcp_handshake")]
-    McpHandshake { server_name: String, attempt: u32 },
-    #[serde(rename = "blocked.branch_freshness")]
-    BranchFreshness { behind_main: u32 },
-    #[serde(rename = "blocked.test_hang")]
-    TestHang { elapsed_secs: u32, test_name: Option<String> },
-    #[serde(rename = "blocked.report_pending")]
-    ReportPending { since_secs: u32 },
-}
-
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct LaneEventBlocker {
     #[serde(rename = "failureClass")]
     pub failure_class: LaneFailureClass,
     pub detail: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub subphase: Option<BlockedSubphase>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
@@ -433,29 +91,6 @@ pub struct LaneCommitProvenance {
     pub lineage: Vec<String>,
 }
 
-/// Ship/provenance metadata — §4.44.5
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ShipProvenance {
-    pub source_branch: String,
-    pub base_commit: String,
-    pub commit_count: u32,
-    pub commit_range: String,
-    pub merge_method: ShipMergeMethod,
-    pub actor: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub pr_number: Option<u32>,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum ShipMergeMethod {
-    DirectPush,
-    FastForward,
-    MergeCommit,
-    SquashMerge,
-    RebaseMerge,
-}
-
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct LaneEvent {
     pub event: LaneEventName,
@@ -468,13 +103,9 @@ pub struct LaneEvent {
     pub detail: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub data: Option<Value>,
-    /// Event metadata for ordering, provenance, dedupe, and ownership
-    pub metadata: LaneEventMetadata,
 }
 
 impl LaneEvent {
-    /// Create a new lane event with minimal metadata (seq=0, provenance=LiveLane)
-    /// Use `LaneEventBuilder` for events requiring full metadata.
     #[must_use]
     pub fn new(
         event: LaneEventName,
@@ -488,7 +119,6 @@ impl LaneEvent {
             failure_class: None,
             detail: None,
             data: None,
-            metadata: LaneEventMetadata::new(0, EventProvenance::LiveLane),
         }
     }
 
@@ -539,56 +169,16 @@ impl LaneEvent {
 
     #[must_use]
     pub fn blocked(emitted_at: impl Into<String>, blocker: &LaneEventBlocker) -> Self {
-        let mut event = Self::new(LaneEventName::Blocked, LaneEventStatus::Blocked, emitted_at)
+        Self::new(LaneEventName::Blocked, LaneEventStatus::Blocked, emitted_at)
             .with_failure_class(blocker.failure_class)
-            .with_detail(blocker.detail.clone());
-        if let Some(ref subphase) = blocker.subphase {
-            event = event.with_data(serde_json::to_value(subphase).expect("subphase should serialize"));
-        }
-        event
+            .with_detail(blocker.detail.clone())
     }
 
     #[must_use]
     pub fn failed(emitted_at: impl Into<String>, blocker: &LaneEventBlocker) -> Self {
-        let mut event = Self::new(LaneEventName::Failed, LaneEventStatus::Failed, emitted_at)
+        Self::new(LaneEventName::Failed, LaneEventStatus::Failed, emitted_at)
             .with_failure_class(blocker.failure_class)
-            .with_detail(blocker.detail.clone());
-        if let Some(ref subphase) = blocker.subphase {
-            event = event.with_data(serde_json::to_value(subphase).expect("subphase should serialize"));
-        }
-        event
-    }
-
-    /// Ship prepared — §4.44.5
-    #[must_use]
-    pub fn ship_prepared(emitted_at: impl Into<String>, provenance: &ShipProvenance) -> Self {
-        Self::new(LaneEventName::ShipPrepared, LaneEventStatus::Ready, emitted_at)
-            .with_data(serde_json::to_value(provenance).expect("ship provenance should serialize"))
-    }
-
-    /// Ship commits selected — §4.44.5
-    #[must_use]
-    pub fn ship_commits_selected(
-        emitted_at: impl Into<String>,
-        commit_count: u32,
-        commit_range: impl Into<String>,
-    ) -> Self {
-        Self::new(LaneEventName::ShipCommitsSelected, LaneEventStatus::Ready, emitted_at)
-            .with_detail(format!("{} commits: {}", commit_count, commit_range.into()))
-    }
-
-    /// Ship merged — §4.44.5
-    #[must_use]
-    pub fn ship_merged(emitted_at: impl Into<String>, provenance: &ShipProvenance) -> Self {
-        Self::new(LaneEventName::ShipMerged, LaneEventStatus::Completed, emitted_at)
-            .with_data(serde_json::to_value(provenance).expect("ship provenance should serialize"))
-    }
-
-    /// Ship pushed to main — §4.44.5
-    #[must_use]
-    pub fn ship_pushed_main(emitted_at: impl Into<String>, provenance: &ShipProvenance) -> Self {
-        Self::new(LaneEventName::ShipPushedMain, LaneEventStatus::Completed, emitted_at)
-            .with_data(serde_json::to_value(provenance).expect("ship provenance should serialize"))
+            .with_detail(blocker.detail.clone())
     }
 
     #[must_use]
@@ -661,11 +251,8 @@ mod tests {
     use serde_json::json;
 
     use super::{
-        compute_event_fingerprint, dedupe_superseded_commit_events, dedupe_terminal_events,
-        is_terminal_event, BlockedSubphase, EventProvenance, LaneCommitProvenance, LaneEvent,
-        LaneEventBlocker, LaneEventBuilder, LaneEventMetadata, LaneEventName, LaneEventStatus,
-        LaneFailureClass, LaneOwnership, SessionIdentity, ShipMergeMethod, ShipProvenance,
-        WatcherAction,
+        dedupe_superseded_commit_events, LaneCommitProvenance, LaneEvent, LaneEventBlocker,
+        LaneEventName, LaneEventStatus, LaneFailureClass,
     };
 
     #[test]
@@ -690,14 +277,6 @@ mod tests {
                 LaneEventName::BranchStaleAgainstMain,
                 "branch.stale_against_main",
             ),
-            (
-                LaneEventName::BranchWorkspaceMismatch,
-                "branch.workspace_mismatch",
-            ),
-            (LaneEventName::ShipPrepared, "ship.prepared"),
-            (LaneEventName::ShipCommitsSelected, "ship.commits_selected"),
-            (LaneEventName::ShipMerged, "ship.merged"),
-            (LaneEventName::ShipPushedMain, "ship.pushed_main"),
         ];
 
         for (event, expected) in cases {
@@ -721,7 +300,6 @@ mod tests {
             (LaneFailureClass::McpHandshake, "mcp_handshake"),
             (LaneFailureClass::GatewayRouting, "gateway_routing"),
             (LaneFailureClass::ToolRuntime, "tool_runtime"),
-            (LaneFailureClass::WorkspaceMismatch, "workspace_mismatch"),
             (LaneFailureClass::Infra, "infra"),
         ];
 
@@ -738,10 +316,6 @@ mod tests {
         let blocker = LaneEventBlocker {
             failure_class: LaneFailureClass::McpStartup,
             detail: "broken server".to_string(),
-            subphase: Some(BlockedSubphase::McpHandshake {
-                server_name: "test-server".to_string(),
-                attempt: 1,
-            }),
         };
 
         let blocked = LaneEvent::blocked("2026-04-04T00:00:00Z", &blocker);
@@ -755,66 +329,6 @@ mod tests {
         assert_eq!(failed.detail.as_deref(), Some("broken server"));
     }
 
-    #[test]
-    fn workspace_mismatch_failure_class_round_trips_in_branch_event_payloads() {
-        let mismatch = LaneEvent::new(
-            LaneEventName::BranchWorkspaceMismatch,
-            LaneEventStatus::Blocked,
-            "2026-04-04T00:00:02Z",
-        )
-        .with_failure_class(LaneFailureClass::WorkspaceMismatch)
-        .with_detail("session belongs to /tmp/repo-a but current workspace is /tmp/repo-b")
-        .with_data(json!({
-            "expectedWorkspaceRoot": "/tmp/repo-a",
-            "actualWorkspaceRoot": "/tmp/repo-b",
-            "sessionId": "sess-123",
-        }));
-
-        let mismatch_json = serde_json::to_value(&mismatch).expect("lane event should serialize");
-        assert_eq!(mismatch_json["event"], "branch.workspace_mismatch");
-        assert_eq!(mismatch_json["failureClass"], "workspace_mismatch");
-        assert_eq!(
-            mismatch_json["data"]["expectedWorkspaceRoot"],
-            "/tmp/repo-a"
-        );
-
-        let round_trip: LaneEvent =
-            serde_json::from_value(mismatch_json).expect("lane event should deserialize");
-        assert_eq!(round_trip.event, LaneEventName::BranchWorkspaceMismatch);
-        assert_eq!(
-            round_trip.failure_class,
-            Some(LaneFailureClass::WorkspaceMismatch)
-        );
-    }
-
-    #[test]
-    fn ship_provenance_events_serialize_to_expected_wire_values() {
-        let provenance = ShipProvenance {
-            source_branch: "feature/provenance".to_string(),
-            base_commit: "dd73962".to_string(),
-            commit_count: 6,
-            commit_range: "dd73962..c956f78".to_string(),
-            merge_method: ShipMergeMethod::DirectPush,
-            actor: "Jobdori".to_string(),
-            pr_number: None,
-        };
-
-        let prepared = LaneEvent::ship_prepared("2026-04-20T14:30:00Z", &provenance);
-        let prepared_json = serde_json::to_value(&prepared).expect("ship event should serialize");
-        assert_eq!(prepared_json["event"], "ship.prepared");
-        assert_eq!(prepared_json["data"]["commit_count"], 6);
-        assert_eq!(prepared_json["data"]["source_branch"], "feature/provenance");
-
-        let pushed = LaneEvent::ship_pushed_main("2026-04-20T14:35:00Z", &provenance);
-        let pushed_json = serde_json::to_value(&pushed).expect("ship event should serialize");
-        assert_eq!(pushed_json["event"], "ship.pushed_main");
-        assert_eq!(pushed_json["data"]["merge_method"], "direct_push");
-
-        let round_trip: LaneEvent =
-            serde_json::from_value(pushed_json).expect("ship event should deserialize");
-        assert_eq!(round_trip.event, LaneEventName::ShipPushedMain);
-    }
-
     #[test]
     fn commit_events_can_carry_worktree_and_supersession_metadata() {
         let event = LaneEvent::commit_created(
@@ -866,222 +380,4 @@ mod tests {
         assert_eq!(retained.len(), 1);
         assert_eq!(retained[0].detail.as_deref(), Some("new"));
     }
-
-    #[test]
-    fn lane_event_metadata_includes_monotonic_sequence() {
-        let meta1 = LaneEventMetadata::new(0, EventProvenance::LiveLane);
-        let meta2 = LaneEventMetadata::new(1, EventProvenance::LiveLane);
-        let meta3 = LaneEventMetadata::new(2, EventProvenance::Test);
-
-        assert_eq!(meta1.seq, 0);
-        assert_eq!(meta2.seq, 1);
-        assert_eq!(meta3.seq, 2);
-        assert!(meta1.timestamp_ms <= meta2.timestamp_ms);
-    }
-
-    #[test]
-    fn event_provenance_round_trips_through_serialization() {
-        let cases = [
-            (EventProvenance::LiveLane, "live_lane"),
-            (EventProvenance::Test, "test"),
-            (EventProvenance::Healthcheck, "healthcheck"),
-            (EventProvenance::Replay, "replay"),
-            (EventProvenance::Transport, "transport"),
-        ];
-
-        for (provenance, expected) in cases {
-            let json = serde_json::to_value(provenance).expect("should serialize");
-            assert_eq!(json, serde_json::json!(expected));
-
-            let round_trip: EventProvenance =
-                serde_json::from_value(json).expect("should deserialize");
-            assert_eq!(round_trip, provenance);
-        }
-    }
-
-    #[test]
-    fn session_identity_is_complete_at_creation() {
-        let identity = SessionIdentity::new("my-lane", "/tmp/repo", "implement feature X");
-
-        assert_eq!(identity.title, "my-lane");
-        assert_eq!(identity.workspace, "/tmp/repo");
-        assert_eq!(identity.purpose, "implement feature X");
-        assert!(identity.placeholder_reason.is_none());
-
-        // Test with placeholder
-        let with_placeholder = SessionIdentity::with_placeholder(
-            "untitled",
-            "/tmp/unknown",
-            "unknown",
-            "session created before title was known",
-        );
-        assert_eq!(
-            with_placeholder.placeholder_reason,
-            Some("session created before title was known".to_string())
-        );
-    }
-
-    #[test]
-    fn lane_ownership_binding_includes_workflow_scope() {
-        let ownership = LaneOwnership {
-            owner: "claw-1".to_string(),
-            workflow_scope: "claw-code-dogfood".to_string(),
-            watcher_action: WatcherAction::Act,
-        };
-
-        assert_eq!(ownership.owner, "claw-1");
-        assert_eq!(ownership.workflow_scope, "claw-code-dogfood");
-        assert_eq!(ownership.watcher_action, WatcherAction::Act);
-    }
-
-    #[test]
-    fn watcher_action_round_trips_through_serialization() {
-        let cases = [
-            (WatcherAction::Act, "act"),
-            (WatcherAction::Observe, "observe"),
-            (WatcherAction::Ignore, "ignore"),
-        ];
-
-        for (action, expected) in cases {
-            let json = serde_json::to_value(action).expect("should serialize");
-            assert_eq!(json, serde_json::json!(expected));
-
-            let round_trip: WatcherAction =
-                serde_json::from_value(json).expect("should deserialize");
-            assert_eq!(round_trip, action);
-        }
-    }
-
-    #[test]
-    fn is_terminal_event_detects_terminal_states() {
-        assert!(is_terminal_event(LaneEventName::Finished));
-        assert!(is_terminal_event(LaneEventName::Failed));
-        assert!(is_terminal_event(LaneEventName::Superseded));
-        assert!(is_terminal_event(LaneEventName::Closed));
-        assert!(is_terminal_event(LaneEventName::Merged));
-
-        assert!(!is_terminal_event(LaneEventName::Started));
-        assert!(!is_terminal_event(LaneEventName::Ready));
-        assert!(!is_terminal_event(LaneEventName::Blocked));
-    }
-
-    #[test]
-    fn compute_event_fingerprint_is_deterministic() {
-        let fp1 = compute_event_fingerprint(
-            &LaneEventName::Finished,
-            &LaneEventStatus::Completed,
-            Some(&json!({"commit": "abc123"})),
-        );
-        let fp2 = compute_event_fingerprint(
-            &LaneEventName::Finished,
-            &LaneEventStatus::Completed,
-            Some(&json!({"commit": "abc123"})),
-        );
-
-        assert_eq!(fp1, fp2, "same inputs should produce same fingerprint");
-        assert!(!fp1.is_empty());
-        assert_eq!(fp1.len(), 16, "fingerprint should be 16 hex chars");
-    }
-
-    #[test]
-    fn compute_event_fingerprint_differs_for_different_inputs() {
-        let fp1 =
-            compute_event_fingerprint(&LaneEventName::Finished, &LaneEventStatus::Completed, None);
-        let fp2 = compute_event_fingerprint(&LaneEventName::Failed, &LaneEventStatus::Failed, None);
-        let fp3 = compute_event_fingerprint(
-            &LaneEventName::Finished,
-            &LaneEventStatus::Completed,
-            Some(&json!({"commit": "abc123"})),
-        );
-
-        assert_ne!(fp1, fp2, "different event/status should differ");
-        assert_ne!(fp1, fp3, "different data should differ");
-    }
-
-    #[test]
-    fn dedupe_terminal_events_suppresses_duplicates() {
-        let event1 = LaneEventBuilder::new(
-            LaneEventName::Finished,
-            LaneEventStatus::Completed,
-            "2026-04-04T00:00:00Z",
-            0,
-            EventProvenance::LiveLane,
-        )
-        .build_terminal();
-
-        let event2 = LaneEventBuilder::new(
-            LaneEventName::Started,
-            LaneEventStatus::Running,
-            "2026-04-04T00:00:01Z",
-            1,
-            EventProvenance::LiveLane,
-        )
-        .build();
-
-        let event3 = LaneEventBuilder::new(
-            LaneEventName::Finished,
-            LaneEventStatus::Completed,
-            "2026-04-04T00:00:02Z",
-            2,
-            EventProvenance::LiveLane,
-        )
-        .build_terminal(); // Same fingerprint as event1
-
-        let deduped = dedupe_terminal_events(&[event1.clone(), event2.clone(), event3.clone()]);
-
-        assert_eq!(deduped.len(), 2, "should have 2 events after dedupe");
-        assert_eq!(deduped[0].event, LaneEventName::Finished);
-        assert_eq!(deduped[1].event, LaneEventName::Started);
-        // event3 should be suppressed as duplicate of event1
-    }
-
-    #[test]
-    fn lane_event_builder_constructs_event_with_metadata() {
-        let event = LaneEventBuilder::new(
-            LaneEventName::Started,
-            LaneEventStatus::Running,
-            "2026-04-04T00:00:00Z",
-            42,
-            EventProvenance::Test,
-        )
-        .with_session_identity(SessionIdentity::new("test-lane", "/tmp", "test"))
-        .with_ownership(LaneOwnership {
-            owner: "bot-1".to_string(),
-            workflow_scope: "test-suite".to_string(),
-            watcher_action: WatcherAction::Observe,
-        })
-        .with_nudge_id("nudge-123")
-        .with_detail("starting test run")
-        .build();
-
-        assert_eq!(event.event, LaneEventName::Started);
-        assert_eq!(event.metadata.seq, 42);
-        assert_eq!(event.metadata.provenance, EventProvenance::Test);
-        assert_eq!(
-            event.metadata.session_identity.as_ref().unwrap().title,
-            "test-lane"
-        );
-        assert_eq!(event.metadata.ownership.as_ref().unwrap().owner, "bot-1");
-        assert_eq!(event.metadata.nudge_id, Some("nudge-123".to_string()));
-        assert_eq!(event.detail, Some("starting test run".to_string()));
-    }
-
-    #[test]
-    fn lane_event_metadata_round_trips_through_serialization() {
-        let meta = LaneEventMetadata::new(5, EventProvenance::Healthcheck)
-            .with_session_identity(SessionIdentity::new("lane-1", "/tmp", "purpose"))
-            .with_nudge_id("nudge-abc");
-
-        let json = serde_json::to_value(&meta).expect("should serialize");
-        assert_eq!(json["seq"], 5);
-        assert_eq!(json["provenance"], "healthcheck");
-        assert_eq!(json["nudge_id"], "nudge-abc");
-        assert!(json["timestamp_ms"].as_u64().is_some());
-
-        let round_trip: LaneEventMetadata =
-            serde_json::from_value(json).expect("should deserialize");
-        assert_eq!(round_trip.seq, 5);
-        assert_eq!(round_trip.provenance, EventProvenance::Healthcheck);
-        assert_eq!(round_trip.nudge_id, Some("nudge-abc".to_string()));
-    }
 }

rust/crates/runtime/src/lib.rs

@@ -83,11 +83,8 @@ pub use hooks::{
     HookAbortSignal, HookEvent, HookProgressEvent, HookProgressReporter, HookRunResult, HookRunner,
 };
 pub use lane_events::{
-    compute_event_fingerprint, dedupe_superseded_commit_events, dedupe_terminal_events,
-    is_terminal_event, BlockedSubphase, EventProvenance, LaneCommitProvenance, LaneEvent,
-    LaneEventBlocker, LaneEventBuilder, LaneEventMetadata, LaneEventName, LaneEventStatus,
-    LaneFailureClass, LaneOwnership, SessionIdentity, ShipMergeMethod, ShipProvenance,
-    WatcherAction,
+    dedupe_superseded_commit_events, LaneCommitProvenance, LaneEvent, LaneEventBlocker,
+    LaneEventName, LaneEventStatus, LaneFailureClass,
 };
 pub use mcp::{
     mcp_server_signature, mcp_tool_name, mcp_tool_prefix, normalize_name_for_mcp,

rust/crates/runtime/src/oauth.rs

@@ -335,14 +335,7 @@ fn credentials_home_dir() -> io::Result<PathBuf> {
         return Ok(PathBuf::from(path));
     }
     let home = std::env::var_os("HOME")
-        .or_else(|| std::env::var_os("USERPROFILE"))
-        .ok_or_else(|| {
-            io::Error::new(
-                io::ErrorKind::NotFound,
-                "HOME is not set (on Windows, set USERPROFILE or HOME, \
-                 or use CLAW_CONFIG_HOME to point directly at the config directory)",
-            )
-        })?;
+        .ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, "HOME is not set"))?;
     Ok(PathBuf::from(home).join(".claw"))
 }
 

rust/crates/runtime/src/permission_enforcer.rs

@@ -65,40 +65,6 @@ impl PermissionEnforcer {
         matches!(self.check(tool_name, input), EnforcementResult::Allowed)
     }
 
-    /// Check permission with an explicitly provided required mode.
-    /// Used when the required mode is determined dynamically (e.g., bash command classification).
-    pub fn check_with_required_mode(
-        &self,
-        tool_name: &str,
-        input: &str,
-        required_mode: PermissionMode,
-    ) -> EnforcementResult {
-        // When the active mode is Prompt, defer to the caller's interactive
-        // prompt flow rather than hard-denying.
-        if self.policy.active_mode() == PermissionMode::Prompt {
-            return EnforcementResult::Allowed;
-        }
-
-        let active_mode = self.policy.active_mode();
-
-        // Check if active mode meets the dynamically determined required mode
-        if active_mode >= required_mode {
-            return EnforcementResult::Allowed;
-        }
-
-        // Permission denied - active mode is insufficient
-        EnforcementResult::Denied {
-            tool: tool_name.to_owned(),
-            active_mode: active_mode.as_str().to_owned(),
-            required_mode: required_mode.as_str().to_owned(),
-            reason: format!(
-                "'{tool_name}' with input '{input}' requires '{}' permission, but current mode is '{}'",
-                required_mode.as_str(),
-                active_mode.as_str()
-            ),
-        }
-    }
-
     #[must_use]
     pub fn active_mode(&self) -> PermissionMode {
         self.policy.active_mode()

rust/crates/runtime/src/recovery_recipes.rs

@@ -48,9 +48,7 @@ impl FailureScenario {
             WorkerFailureKind::TrustGate => Self::TrustPromptUnresolved,
             WorkerFailureKind::PromptDelivery => Self::PromptMisdelivery,
             WorkerFailureKind::Protocol => Self::McpHandshakeFailure,
-            WorkerFailureKind::Provider | WorkerFailureKind::StartupNoEvidence => {
-                Self::ProviderFailure
-            }
+            WorkerFailureKind::Provider => Self::ProviderFailure,
         }
     }
 }

rust/crates/runtime/src/session.rs

@@ -13,7 +13,6 @@ const SESSION_VERSION: u32 = 1;
 const ROTATE_AFTER_BYTES: u64 = 256 * 1024;
 const MAX_ROTATED_FILES: usize = 3;
 static SESSION_ID_COUNTER: AtomicU64 = AtomicU64::new(0);
-static LAST_TIMESTAMP_MS: AtomicU64 = AtomicU64::new(0);
 
 /// Speaker role associated with a persisted conversation message.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -97,11 +96,6 @@ pub struct Session {
     pub fork: Option<SessionFork>,
     pub workspace_root: Option<PathBuf>,
     pub prompt_history: Vec<SessionPromptEntry>,
-    /// The model used in this session, persisted so resumed sessions can
-    /// report which model was originally used.
-    /// Timestamp of last successful health check (ROADMAP #38)
-    pub last_health_check_ms: Option<u64>,
-    pub model: Option<String>,
     persistence: Option<SessionPersistence>,
 }
 
@@ -116,7 +110,6 @@ impl PartialEq for Session {
             && self.fork == other.fork
             && self.workspace_root == other.workspace_root
             && self.prompt_history == other.prompt_history
-            && self.last_health_check_ms == other.last_health_check_ms
     }
 }
 
@@ -168,8 +161,6 @@ impl Session {
             fork: None,
             workspace_root: None,
             prompt_history: Vec::new(),
-            last_health_check_ms: None,
-            model: None,
             persistence: None,
         }
     }
@@ -272,8 +263,6 @@ impl Session {
             }),
             workspace_root: self.workspace_root.clone(),
             prompt_history: self.prompt_history.clone(),
-            last_health_check_ms: self.last_health_check_ms,
-            model: self.model.clone(),
             persistence: None,
         }
     }
@@ -382,10 +371,6 @@ impl Session {
                     .collect()
             })
             .unwrap_or_default();
-        let model = object
-            .get("model")
-            .and_then(JsonValue::as_str)
-            .map(String::from);
         Ok(Self {
             version,
             session_id,
@@ -396,8 +381,6 @@ impl Session {
             fork,
             workspace_root,
             prompt_history,
-            last_health_check_ms: None,
-            model,
             persistence: None,
         })
     }
@@ -411,7 +394,6 @@ impl Session {
         let mut compaction = None;
         let mut fork = None;
         let mut workspace_root = None;
-        let mut model = None;
         let mut prompt_history = Vec::new();
 
         for (line_number, raw_line) in contents.lines().enumerate() {
@@ -451,10 +433,6 @@ impl Session {
                         .get("workspace_root")
                         .and_then(JsonValue::as_str)
                         .map(PathBuf::from);
-                    model = object
-                        .get("model")
-                        .and_then(JsonValue::as_str)
-                        .map(String::from);
                 }
                 "message" => {
                     let message_value = object.get("message").ok_or_else(|| {
@@ -497,8 +475,6 @@ impl Session {
             fork,
             workspace_root,
             prompt_history,
-            last_health_check_ms: None,
-            model,
             persistence: None,
         })
     }
@@ -604,9 +580,6 @@ impl Session {
                 JsonValue::String(workspace_root_to_string(workspace_root)?),
             );
         }
-        if let Some(model) = &self.model {
-            object.insert("model".to_string(), JsonValue::String(model.clone()));
-        }
         Ok(JsonValue::Object(object))
     }
 
@@ -1031,27 +1004,10 @@ fn normalize_optional_string(value: Option<String>) -> Option<String> {
 }
 
 fn current_time_millis() -> u64 {
-    let wall_clock = SystemTime::now()
+    SystemTime::now()
         .duration_since(UNIX_EPOCH)
         .map(|duration| u64::try_from(duration.as_millis()).unwrap_or(u64::MAX))
-        .unwrap_or_default();
-
-    let mut candidate = wall_clock;
-    loop {
-        let previous = LAST_TIMESTAMP_MS.load(Ordering::Relaxed);
-        if candidate <= previous {
-            candidate = previous.saturating_add(1);
-        }
-        match LAST_TIMESTAMP_MS.compare_exchange(
-            previous,
-            candidate,
-            Ordering::SeqCst,
-            Ordering::SeqCst,
-        ) {
-            Ok(_) => return candidate,
-            Err(actual) => candidate = actual.saturating_add(1),
-        }
-    }
+        .unwrap_or_default()
 }
 
 fn generate_session_id() -> String {
@@ -1143,8 +1099,8 @@ fn cleanup_rotated_logs(path: &Path) -> Result<(), SessionError> {
 #[cfg(test)]
 mod tests {
     use super::{
-        cleanup_rotated_logs, current_time_millis, rotate_session_file_if_needed, ContentBlock,
-        ConversationMessage, MessageRole, Session, SessionFork,
+        cleanup_rotated_logs, rotate_session_file_if_needed, ContentBlock, ConversationMessage,
+        MessageRole, Session, SessionFork,
     };
     use crate::json::JsonValue;
     use crate::usage::TokenUsage;
@@ -1152,16 +1108,6 @@ mod tests {
     use std::path::{Path, PathBuf};
     use std::time::{SystemTime, UNIX_EPOCH};
 
-    #[test]
-    fn session_timestamps_are_monotonic_under_tight_loops() {
-        let first = current_time_millis();
-        let second = current_time_millis();
-        let third = current_time_millis();
-
-        assert!(first < second);
-        assert!(second < third);
-    }
-
     #[test]
     fn persists_and_restores_session_jsonl() {
         let mut session = Session::new();
@@ -1495,8 +1441,12 @@ mod tests {
 /// Called by external consumers (e.g. clawhip) to enumerate sessions for a CWD.
 #[allow(dead_code)]
 pub fn workspace_sessions_dir(cwd: &std::path::Path) -> Result<std::path::PathBuf, SessionError> {
-    let store = crate::session_control::SessionStore::from_cwd(cwd)
-        .map_err(|e| SessionError::Io(std::io::Error::other(e.to_string())))?;
+    let store = crate::session_control::SessionStore::from_cwd(cwd).map_err(|e| {
+        SessionError::Io(std::io::Error::new(
+            std::io::ErrorKind::Other,
+            e.to_string(),
+        ))
+    })?;
     Ok(store.sessions_dir().to_path_buf())
 }
 
@@ -1513,7 +1463,8 @@ mod workspace_sessions_dir_tests {
         let result = workspace_sessions_dir(&tmp);
         assert!(
             result.is_ok(),
-            "workspace_sessions_dir should succeed for a valid CWD, got: {result:?}"
+            "workspace_sessions_dir should succeed for a valid CWD, got: {:?}",
+            result
         );
         let dir = result.unwrap();
         // The returned path should be non-empty and end with a hash component

rust/crates/runtime/src/session_control.rs

@@ -31,19 +31,14 @@ impl SessionStore {
     /// The on-disk layout becomes `<cwd>/.claw/sessions/<workspace_hash>/`.
     pub fn from_cwd(cwd: impl AsRef<Path>) -> Result<Self, SessionControlError> {
         let cwd = cwd.as_ref();
-        // #151: canonicalize so equivalent paths (symlinks, relative vs
-        // absolute, /tmp vs /private/tmp on macOS) produce the same
-        // workspace_fingerprint. Falls back to the raw path if canonicalize
-        // fails (e.g. the directory doesn't exist yet).
-        let canonical_cwd = fs::canonicalize(cwd).unwrap_or_else(|_| cwd.to_path_buf());
-        let sessions_root = canonical_cwd
+        let sessions_root = cwd
             .join(".claw")
             .join("sessions")
-            .join(workspace_fingerprint(&canonical_cwd));
+            .join(workspace_fingerprint(cwd));
         fs::create_dir_all(&sessions_root)?;
         Ok(Self {
             sessions_root,
-            workspace_root: canonical_cwd,
+            workspace_root: cwd.to_path_buf(),
         })
     }
 
@@ -56,18 +51,14 @@ impl SessionStore {
         workspace_root: impl AsRef<Path>,
     ) -> Result<Self, SessionControlError> {
         let workspace_root = workspace_root.as_ref();
-        // #151: canonicalize workspace_root for consistent fingerprinting
-        // across equivalent path representations.
-        let canonical_workspace = fs::canonicalize(workspace_root)
-            .unwrap_or_else(|_| workspace_root.to_path_buf());
         let sessions_root = data_dir
             .as_ref()
             .join("sessions")
-            .join(workspace_fingerprint(&canonical_workspace));
+            .join(workspace_fingerprint(workspace_root));
         fs::create_dir_all(&sessions_root)?;
         Ok(Self {
             sessions_root,
-            workspace_root: canonical_workspace,
+            workspace_root: workspace_root.to_path_buf(),
         })
     }
 
@@ -83,7 +74,6 @@ impl SessionStore {
         &self.workspace_root
     }
 
-    #[must_use]
     pub fn create_handle(&self, session_id: &str) -> SessionHandle {
         let id = session_id.to_string();
         let path = self
@@ -112,7 +102,7 @@ impl SessionStore {
             candidate
         } else if looks_like_path {
             return Err(SessionControlError::Format(
-                format_missing_session_reference(reference, &self.sessions_root),
+                format_missing_session_reference(reference),
             ));
         } else {
             self.resolve_managed_path(reference)?
@@ -131,116 +121,17 @@ impl SessionStore {
                 return Ok(path);
             }
         }
-        if let Some(legacy_root) = self.legacy_sessions_root() {
-            for extension in [PRIMARY_SESSION_EXTENSION, LEGACY_SESSION_EXTENSION] {
-                let path = legacy_root.join(format!("{session_id}.{extension}"));
-                if !path.exists() {
-                    continue;
-                }
-                let session = Session::load_from_path(&path)?;
-                self.validate_loaded_session(&path, &session)?;
-                return Ok(path);
-            }
-        }
         Err(SessionControlError::Format(
-            format_missing_session_reference(session_id, &self.sessions_root),
+            format_missing_session_reference(session_id),
         ))
     }
 
     pub fn list_sessions(&self) -> Result<Vec<ManagedSessionSummary>, SessionControlError> {
         let mut sessions = Vec::new();
-        self.collect_sessions_from_dir(&self.sessions_root, &mut sessions)?;
-        if let Some(legacy_root) = self.legacy_sessions_root() {
-            self.collect_sessions_from_dir(&legacy_root, &mut sessions)?;
-        }
-        sort_managed_sessions(&mut sessions);
-        Ok(sessions)
-    }
-
-    pub fn latest_session(&self) -> Result<ManagedSessionSummary, SessionControlError> {
-        self.list_sessions()?
-            .into_iter()
-            .next()
-            .ok_or_else(|| SessionControlError::Format(format_no_managed_sessions(&self.sessions_root)))
-    }
-
-    pub fn load_session(
-        &self,
-        reference: &str,
-    ) -> Result<LoadedManagedSession, SessionControlError> {
-        let handle = self.resolve_reference(reference)?;
-        let session = Session::load_from_path(&handle.path)?;
-        self.validate_loaded_session(&handle.path, &session)?;
-        Ok(LoadedManagedSession {
-            handle: SessionHandle {
-                id: session.session_id.clone(),
-                path: handle.path,
-            },
-            session,
-        })
-    }
-
-    pub fn fork_session(
-        &self,
-        session: &Session,
-        branch_name: Option<String>,
-    ) -> Result<ForkedManagedSession, SessionControlError> {
-        let parent_session_id = session.session_id.clone();
-        let forked = session
-            .fork(branch_name)
-            .with_workspace_root(self.workspace_root.clone());
-        let handle = self.create_handle(&forked.session_id);
-        let branch_name = forked
-            .fork
-            .as_ref()
-            .and_then(|fork| fork.branch_name.clone());
-        let forked = forked.with_persistence_path(handle.path.clone());
-        forked.save_to_path(&handle.path)?;
-        Ok(ForkedManagedSession {
-            parent_session_id,
-            handle,
-            session: forked,
-            branch_name,
-        })
-    }
-
-    fn legacy_sessions_root(&self) -> Option<PathBuf> {
-        self.sessions_root
-            .parent()
-            .filter(|parent| parent.file_name().is_some_and(|name| name == "sessions"))
-            .map(Path::to_path_buf)
-    }
-
-    fn validate_loaded_session(
-        &self,
-        session_path: &Path,
-        session: &Session,
-    ) -> Result<(), SessionControlError> {
-        let Some(actual) = session.workspace_root() else {
-            if path_is_within_workspace(session_path, &self.workspace_root) {
-                return Ok(());
-            }
-            return Err(SessionControlError::Format(
-                format_legacy_session_missing_workspace_root(session_path, &self.workspace_root),
-            ));
-        };
-        if workspace_roots_match(actual, &self.workspace_root) {
-            return Ok(());
-        }
-        Err(SessionControlError::WorkspaceMismatch {
-            expected: self.workspace_root.clone(),
-            actual: actual.to_path_buf(),
-        })
-    }
-
-    fn collect_sessions_from_dir(
-        &self,
-        directory: &Path,
-        sessions: &mut Vec<ManagedSessionSummary>,
-    ) -> Result<(), SessionControlError> {
-        let entries = match fs::read_dir(directory) {
+        let read_result = fs::read_dir(&self.sessions_root);
+        let entries = match read_result {
             Ok(entries) => entries,
-            Err(err) if err.kind() == std::io::ErrorKind::NotFound => return Ok(()),
+            Err(err) if err.kind() == std::io::ErrorKind::NotFound => return Ok(sessions),
             Err(err) => return Err(err.into()),
         };
         for entry in entries {
@@ -256,44 +147,94 @@ impl SessionStore {
                 .and_then(|time| time.duration_since(UNIX_EPOCH).ok())
                 .map(|duration| duration.as_millis())
                 .unwrap_or_default();
-            let summary = match Session::load_from_path(&path) {
-                Ok(session) => {
-                    if self.validate_loaded_session(&path, &session).is_err() {
-                        continue;
-                    }
-                    ManagedSessionSummary {
-                        id: session.session_id,
-                        path,
-                        updated_at_ms: session.updated_at_ms,
-                        modified_epoch_millis,
-                        message_count: session.messages.len(),
-                        parent_session_id: session
+            let (id, message_count, parent_session_id, branch_name) =
+                match Session::load_from_path(&path) {
+                    Ok(session) => {
+                        let parent_session_id = session
                             .fork
                             .as_ref()
-                            .map(|fork| fork.parent_session_id.clone()),
-                        branch_name: session
+                            .map(|fork| fork.parent_session_id.clone());
+                        let branch_name = session
                             .fork
                             .as_ref()
-                            .and_then(|fork| fork.branch_name.clone()),
+                            .and_then(|fork| fork.branch_name.clone());
+                        (
+                            session.session_id,
+                            session.messages.len(),
+                            parent_session_id,
+                            branch_name,
+                        )
                     }
-                }
-                Err(_) => ManagedSessionSummary {
-                    id: path
-                        .file_stem()
-                        .and_then(|value| value.to_str())
-                        .unwrap_or("unknown")
-                        .to_string(),
-                    path,
-                    updated_at_ms: 0,
-                    modified_epoch_millis,
-                    message_count: 0,
-                    parent_session_id: None,
-                    branch_name: None,
-                },
-            };
-            sessions.push(summary);
+                    Err(_) => (
+                        path.file_stem()
+                            .and_then(|value| value.to_str())
+                            .unwrap_or("unknown")
+                            .to_string(),
+                        0,
+                        None,
+                        None,
+                    ),
+                };
+            sessions.push(ManagedSessionSummary {
+                id,
+                path,
+                modified_epoch_millis,
+                message_count,
+                parent_session_id,
+                branch_name,
+            });
         }
-        Ok(())
+        sessions.sort_by(|left, right| {
+            right
+                .modified_epoch_millis
+                .cmp(&left.modified_epoch_millis)
+                .then_with(|| right.id.cmp(&left.id))
+        });
+        Ok(sessions)
+    }
+
+    pub fn latest_session(&self) -> Result<ManagedSessionSummary, SessionControlError> {
+        self.list_sessions()?
+            .into_iter()
+            .next()
+            .ok_or_else(|| SessionControlError::Format(format_no_managed_sessions()))
+    }
+
+    pub fn load_session(
+        &self,
+        reference: &str,
+    ) -> Result<LoadedManagedSession, SessionControlError> {
+        let handle = self.resolve_reference(reference)?;
+        let session = Session::load_from_path(&handle.path)?;
+        Ok(LoadedManagedSession {
+            handle: SessionHandle {
+                id: session.session_id.clone(),
+                path: handle.path,
+            },
+            session,
+        })
+    }
+
+    pub fn fork_session(
+        &self,
+        session: &Session,
+        branch_name: Option<String>,
+    ) -> Result<ForkedManagedSession, SessionControlError> {
+        let parent_session_id = session.session_id.clone();
+        let forked = session.fork(branch_name);
+        let handle = self.create_handle(&forked.session_id);
+        let branch_name = forked
+            .fork
+            .as_ref()
+            .and_then(|fork| fork.branch_name.clone());
+        let forked = forked.with_persistence_path(handle.path.clone());
+        forked.save_to_path(&handle.path)?;
+        Ok(ForkedManagedSession {
+            parent_session_id,
+            handle,
+            session: forked,
+            branch_name,
+        })
     }
 }
 
@@ -328,23 +269,12 @@ pub struct SessionHandle {
 pub struct ManagedSessionSummary {
     pub id: String,
     pub path: PathBuf,
-    pub updated_at_ms: u64,
     pub modified_epoch_millis: u128,
     pub message_count: usize,
     pub parent_session_id: Option<String>,
     pub branch_name: Option<String>,
 }
 
-fn sort_managed_sessions(sessions: &mut [ManagedSessionSummary]) {
-    sessions.sort_by(|left, right| {
-        right
-            .updated_at_ms
-            .cmp(&left.updated_at_ms)
-            .then_with(|| right.modified_epoch_millis.cmp(&left.modified_epoch_millis))
-            .then_with(|| right.id.cmp(&left.id))
-    });
-}
-
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct LoadedManagedSession {
     pub handle: SessionHandle,
@@ -364,7 +294,6 @@ pub enum SessionControlError {
     Io(std::io::Error),
     Session(SessionError),
     Format(String),
-    WorkspaceMismatch { expected: PathBuf, actual: PathBuf },
 }
 
 impl Display for SessionControlError {
@@ -373,12 +302,6 @@ impl Display for SessionControlError {
             Self::Io(error) => write!(f, "{error}"),
             Self::Session(error) => write!(f, "{error}"),
             Self::Format(error) => write!(f, "{error}"),
-            Self::WorkspaceMismatch { expected, actual } => write!(
-                f,
-                "session workspace mismatch: expected {}, found {}",
-                expected.display(),
-                actual.display()
-            ),
         }
     }
 }
@@ -404,8 +327,9 @@ pub fn sessions_dir() -> Result<PathBuf, SessionControlError> {
 pub fn managed_sessions_dir_for(
     base_dir: impl AsRef<Path>,
 ) -> Result<PathBuf, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    Ok(store.sessions_dir().to_path_buf())
+    let path = base_dir.as_ref().join(".claw").join("sessions");
+    fs::create_dir_all(&path)?;
+    Ok(path)
 }
 
 pub fn create_managed_session_handle(
@@ -418,8 +342,10 @@ pub fn create_managed_session_handle_for(
     base_dir: impl AsRef<Path>,
     session_id: &str,
 ) -> Result<SessionHandle, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    Ok(store.create_handle(session_id))
+    let id = session_id.to_string();
+    let path =
+        managed_sessions_dir_for(base_dir)?.join(format!("{id}.{PRIMARY_SESSION_EXTENSION}"));
+    Ok(SessionHandle { id, path })
 }
 
 pub fn resolve_session_reference(reference: &str) -> Result<SessionHandle, SessionControlError> {
@@ -430,8 +356,36 @@ pub fn resolve_session_reference_for(
     base_dir: impl AsRef<Path>,
     reference: &str,
 ) -> Result<SessionHandle, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    store.resolve_reference(reference)
+    let base_dir = base_dir.as_ref();
+    if is_session_reference_alias(reference) {
+        let latest = latest_managed_session_for(base_dir)?;
+        return Ok(SessionHandle {
+            id: latest.id,
+            path: latest.path,
+        });
+    }
+
+    let direct = PathBuf::from(reference);
+    let candidate = if direct.is_absolute() {
+        direct.clone()
+    } else {
+        base_dir.join(&direct)
+    };
+    let looks_like_path = direct.extension().is_some() || direct.components().count() > 1;
+    let path = if candidate.exists() {
+        candidate
+    } else if looks_like_path {
+        return Err(SessionControlError::Format(
+            format_missing_session_reference(reference),
+        ));
+    } else {
+        resolve_managed_session_path_for(base_dir, reference)?
+    };
+
+    Ok(SessionHandle {
+        id: session_id_from_path(&path).unwrap_or_else(|| reference.to_string()),
+        path,
+    })
 }
 
 pub fn resolve_managed_session_path(session_id: &str) -> Result<PathBuf, SessionControlError> {
@@ -442,8 +396,16 @@ pub fn resolve_managed_session_path_for(
     base_dir: impl AsRef<Path>,
     session_id: &str,
 ) -> Result<PathBuf, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    store.resolve_managed_path(session_id)
+    let directory = managed_sessions_dir_for(base_dir)?;
+    for extension in [PRIMARY_SESSION_EXTENSION, LEGACY_SESSION_EXTENSION] {
+        let path = directory.join(format!("{session_id}.{extension}"));
+        if path.exists() {
+            return Ok(path);
+        }
+    }
+    Err(SessionControlError::Format(
+        format_missing_session_reference(session_id),
+    ))
 }
 
 #[must_use]
@@ -462,8 +424,64 @@ pub fn list_managed_sessions() -> Result<Vec<ManagedSessionSummary>, SessionCont
 pub fn list_managed_sessions_for(
     base_dir: impl AsRef<Path>,
 ) -> Result<Vec<ManagedSessionSummary>, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    store.list_sessions()
+    let mut sessions = Vec::new();
+    for entry in fs::read_dir(managed_sessions_dir_for(base_dir)?)? {
+        let entry = entry?;
+        let path = entry.path();
+        if !is_managed_session_file(&path) {
+            continue;
+        }
+        let metadata = entry.metadata()?;
+        let modified_epoch_millis = metadata
+            .modified()
+            .ok()
+            .and_then(|time| time.duration_since(UNIX_EPOCH).ok())
+            .map(|duration| duration.as_millis())
+            .unwrap_or_default();
+        let (id, message_count, parent_session_id, branch_name) =
+            match Session::load_from_path(&path) {
+                Ok(session) => {
+                    let parent_session_id = session
+                        .fork
+                        .as_ref()
+                        .map(|fork| fork.parent_session_id.clone());
+                    let branch_name = session
+                        .fork
+                        .as_ref()
+                        .and_then(|fork| fork.branch_name.clone());
+                    (
+                        session.session_id,
+                        session.messages.len(),
+                        parent_session_id,
+                        branch_name,
+                    )
+                }
+                Err(_) => (
+                    path.file_stem()
+                        .and_then(|value| value.to_str())
+                        .unwrap_or("unknown")
+                        .to_string(),
+                    0,
+                    None,
+                    None,
+                ),
+            };
+        sessions.push(ManagedSessionSummary {
+            id,
+            path,
+            modified_epoch_millis,
+            message_count,
+            parent_session_id,
+            branch_name,
+        });
+    }
+    sessions.sort_by(|left, right| {
+        right
+            .modified_epoch_millis
+            .cmp(&left.modified_epoch_millis)
+            .then_with(|| right.id.cmp(&left.id))
+    });
+    Ok(sessions)
 }
 
 pub fn latest_managed_session() -> Result<ManagedSessionSummary, SessionControlError> {
@@ -473,8 +491,10 @@ pub fn latest_managed_session() -> Result<ManagedSessionSummary, SessionControlE
 pub fn latest_managed_session_for(
     base_dir: impl AsRef<Path>,
 ) -> Result<ManagedSessionSummary, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    store.latest_session()
+    list_managed_sessions_for(base_dir)?
+        .into_iter()
+        .next()
+        .ok_or_else(|| SessionControlError::Format(format_no_managed_sessions()))
 }
 
 pub fn load_managed_session(reference: &str) -> Result<LoadedManagedSession, SessionControlError> {
@@ -485,8 +505,15 @@ pub fn load_managed_session_for(
     base_dir: impl AsRef<Path>,
     reference: &str,
 ) -> Result<LoadedManagedSession, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    store.load_session(reference)
+    let handle = resolve_session_reference_for(base_dir, reference)?;
+    let session = Session::load_from_path(&handle.path)?;
+    Ok(LoadedManagedSession {
+        handle: SessionHandle {
+            id: session.session_id.clone(),
+            path: handle.path,
+        },
+        session,
+    })
 }
 
 pub fn fork_managed_session(
@@ -501,8 +528,21 @@ pub fn fork_managed_session_for(
     session: &Session,
     branch_name: Option<String>,
 ) -> Result<ForkedManagedSession, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    store.fork_session(session, branch_name)
+    let parent_session_id = session.session_id.clone();
+    let forked = session.fork(branch_name);
+    let handle = create_managed_session_handle_for(base_dir, &forked.session_id)?;
+    let branch_name = forked
+        .fork
+        .as_ref()
+        .and_then(|fork| fork.branch_name.clone());
+    let forked = forked.with_persistence_path(handle.path.clone());
+    forked.save_to_path(&handle.path)?;
+    Ok(ForkedManagedSession {
+        parent_session_id,
+        handle,
+        session: forked,
+        branch_name,
+    })
 }
 
 #[must_use]
@@ -522,58 +562,24 @@ fn session_id_from_path(path: &Path) -> Option<String> {
         .map(ToOwned::to_owned)
 }
 
-fn format_missing_session_reference(reference: &str, sessions_root: &Path) -> String {
-    // #80: show the actual workspace-fingerprint directory instead of lying about .claw/sessions/
-    let fingerprint_dir = sessions_root
-        .file_name()
-        .and_then(|f| f.to_str())
-        .unwrap_or("<unknown>");
+fn format_missing_session_reference(reference: &str) -> String {
     format!(
-        "session not found: {reference}\nHint: managed sessions live in .claw/sessions/{fingerprint_dir}/ (workspace-specific partition).\nTry `{LATEST_SESSION_REFERENCE}` for the most recent session or `/session list` in the REPL."
+        "session not found: {reference}\nHint: managed sessions live in .claw/sessions/. Try `{LATEST_SESSION_REFERENCE}` for the most recent session or `/session list` in the REPL."
     )
 }
 
-fn format_no_managed_sessions(sessions_root: &Path) -> String {
-    // #80: show the actual workspace-fingerprint directory instead of lying about .claw/sessions/
-    let fingerprint_dir = sessions_root
-        .file_name()
-        .and_then(|f| f.to_str())
-        .unwrap_or("<unknown>");
+fn format_no_managed_sessions() -> String {
     format!(
-        "no managed sessions found in .claw/sessions/{fingerprint_dir}/\nStart `claw` to create a session, then rerun with `--resume {LATEST_SESSION_REFERENCE}`.\nNote: claw partitions sessions per workspace fingerprint; sessions from other CWDs are invisible."
+        "no managed sessions found in .claw/sessions/\nStart `claw` to create a session, then rerun with `--resume {LATEST_SESSION_REFERENCE}`."
     )
 }
 
-fn format_legacy_session_missing_workspace_root(
-    session_path: &Path,
-    workspace_root: &Path,
-) -> String {
-    format!(
-        "legacy session is missing workspace binding: {}\nOpen it from its original workspace or re-save it from {}.",
-        session_path.display(),
-        workspace_root.display()
-    )
-}
-
-fn workspace_roots_match(left: &Path, right: &Path) -> bool {
-    canonicalize_for_compare(left) == canonicalize_for_compare(right)
-}
-
-fn canonicalize_for_compare(path: &Path) -> PathBuf {
-    fs::canonicalize(path).unwrap_or_else(|_| path.to_path_buf())
-}
-
-fn path_is_within_workspace(path: &Path, workspace_root: &Path) -> bool {
-    canonicalize_for_compare(path).starts_with(canonicalize_for_compare(workspace_root))
-}
-
 #[cfg(test)]
 mod tests {
     use super::{
         create_managed_session_handle_for, fork_managed_session_for, is_session_reference_alias,
         list_managed_sessions_for, load_managed_session_for, resolve_session_reference_for,
-        workspace_fingerprint, ManagedSessionSummary, SessionControlError, SessionStore,
-        LATEST_SESSION_REFERENCE,
+        workspace_fingerprint, ManagedSessionSummary, SessionStore, LATEST_SESSION_REFERENCE,
     };
     use crate::session::Session;
     use std::fs;
@@ -589,7 +595,7 @@ mod tests {
     }
 
     fn persist_session(root: &Path, text: &str) -> Session {
-        let mut session = Session::new().with_workspace_root(root.to_path_buf());
+        let mut session = Session::new();
         session
             .push_user_text(text)
             .expect("session message should save");
@@ -625,35 +631,6 @@ mod tests {
             .expect("session summary should exist")
     }
 
-    #[test]
-    fn latest_session_prefers_semantic_updated_at_over_file_mtime() {
-        let mut sessions = vec![
-            ManagedSessionSummary {
-                id: "older-file-newer-session".to_string(),
-                path: PathBuf::from("/tmp/older"),
-                updated_at_ms: 200,
-                modified_epoch_millis: 100,
-                message_count: 2,
-                parent_session_id: None,
-                branch_name: None,
-            },
-            ManagedSessionSummary {
-                id: "newer-file-older-session".to_string(),
-                path: PathBuf::from("/tmp/newer"),
-                updated_at_ms: 100,
-                modified_epoch_millis: 200,
-                message_count: 1,
-                parent_session_id: None,
-                branch_name: None,
-            },
-        ];
-
-        crate::session_control::sort_managed_sessions(&mut sessions);
-
-        assert_eq!(sessions[0].id, "older-file-newer-session");
-        assert_eq!(sessions[1].id, "newer-file-older-session");
-    }
-
     #[test]
     fn creates_and_lists_managed_sessions() {
         // given
@@ -731,7 +708,7 @@ mod tests {
     // ------------------------------------------------------------------
 
     fn persist_session_via_store(store: &SessionStore, text: &str) -> Session {
-        let mut session = Session::new().with_workspace_root(store.workspace_root().to_path_buf());
+        let mut session = Session::new();
         session
             .push_user_text(text)
             .expect("session message should save");
@@ -763,40 +740,6 @@ mod tests {
         assert_eq!(fp_a1.len(), 16, "fingerprint must be a 16-char hex string");
     }
 
-    /// #151 regression: equivalent paths (e.g. `/tmp/foo` vs `/private/tmp/foo`
-    /// on macOS where `/tmp` is a symlink to `/private/tmp`) must resolve to
-    /// the same session store. Previously they diverged because
-    /// `workspace_fingerprint()` hashed the raw path string. Now
-    /// `SessionStore::from_cwd()` canonicalizes first.
-    #[test]
-    fn session_store_from_cwd_canonicalizes_equivalent_paths() {
-        let base = temp_dir();
-        let real_dir = base.join("real-workspace");
-        fs::create_dir_all(&real_dir).expect("real workspace should exist");
-
-        // Build two stores via different but equivalent path representations:
-        // the raw path and the canonicalized path.
-        let raw_path = real_dir.clone();
-        let canonical_path = fs::canonicalize(&real_dir).expect("canonicalize ok");
-
-        let store_from_raw =
-            SessionStore::from_cwd(&raw_path).expect("store from raw should build");
-        let store_from_canonical =
-            SessionStore::from_cwd(&canonical_path).expect("store from canonical should build");
-
-        assert_eq!(
-            store_from_raw.sessions_dir(),
-            store_from_canonical.sessions_dir(),
-            "equivalent paths must produce the same sessions dir (raw={} canonical={})",
-            raw_path.display(),
-            canonical_path.display()
-        );
-
-        if base.exists() {
-            fs::remove_dir_all(base).expect("cleanup ok");
-        }
-    }
-
     #[test]
     fn session_store_from_cwd_isolates_sessions_by_workspace() {
         // given
@@ -877,104 +820,6 @@ mod tests {
         fs::remove_dir_all(base).expect("temp dir should clean up");
     }
 
-    #[test]
-    fn session_store_rejects_legacy_session_from_other_workspace() {
-        // given
-        let base = temp_dir();
-        let workspace_a = base.join("repo-alpha");
-        let workspace_b = base.join("repo-beta");
-        fs::create_dir_all(&workspace_a).expect("workspace a should exist");
-        fs::create_dir_all(&workspace_b).expect("workspace b should exist");
-        // #151: canonicalize so test expectations match the store's canonical
-        // workspace_root. Without this, the test builds sessions with a raw
-        // path but the store resolves to the canonical form.
-        let workspace_a = fs::canonicalize(&workspace_a).unwrap_or(workspace_a);
-        let workspace_b = fs::canonicalize(&workspace_b).unwrap_or(workspace_b);
-
-        let store_b = SessionStore::from_cwd(&workspace_b).expect("store b should build");
-        let legacy_root = workspace_b.join(".claw").join("sessions");
-        fs::create_dir_all(&legacy_root).expect("legacy root should exist");
-        let legacy_path = legacy_root.join("legacy-cross.jsonl");
-        let session = Session::new()
-            .with_workspace_root(workspace_a.clone())
-            .with_persistence_path(legacy_path.clone());
-        session
-            .save_to_path(&legacy_path)
-            .expect("legacy session should persist");
-
-        // when
-        let err = store_b
-            .load_session("legacy-cross")
-            .expect_err("workspace mismatch should be rejected");
-
-        // then
-        match err {
-            SessionControlError::WorkspaceMismatch { expected, actual } => {
-                assert_eq!(expected, workspace_b);
-                assert_eq!(actual, workspace_a);
-            }
-            other => panic!("expected workspace mismatch, got {other:?}"),
-        }
-        fs::remove_dir_all(base).expect("temp dir should clean up");
-    }
-
-    #[test]
-    fn session_store_loads_safe_legacy_session_from_same_workspace() {
-        // given
-        let base = temp_dir();
-        fs::create_dir_all(&base).expect("base dir should exist");
-        // #151: canonicalize for path-representation consistency with store.
-        let base = fs::canonicalize(&base).unwrap_or(base);
-        let store = SessionStore::from_cwd(&base).expect("store should build");
-        let legacy_root = base.join(".claw").join("sessions");
-        let legacy_path = legacy_root.join("legacy-safe.jsonl");
-        fs::create_dir_all(&legacy_root).expect("legacy root should exist");
-        let session = Session::new()
-            .with_workspace_root(base.clone())
-            .with_persistence_path(legacy_path.clone());
-        session
-            .save_to_path(&legacy_path)
-            .expect("legacy session should persist");
-
-        // when
-        let loaded = store
-            .load_session("legacy-safe")
-            .expect("same-workspace legacy session should load");
-
-        // then
-        assert_eq!(loaded.handle.id, session.session_id);
-        assert_eq!(loaded.handle.path, legacy_path);
-        assert_eq!(loaded.session.workspace_root(), Some(base.as_path()));
-        fs::remove_dir_all(base).expect("temp dir should clean up");
-    }
-
-    #[test]
-    fn session_store_loads_unbound_legacy_session_from_same_workspace() {
-        // given
-        let base = temp_dir();
-        fs::create_dir_all(&base).expect("base dir should exist");
-        // #151: canonicalize for path-representation consistency with store.
-        let base = fs::canonicalize(&base).unwrap_or(base);
-        let store = SessionStore::from_cwd(&base).expect("store should build");
-        let legacy_root = base.join(".claw").join("sessions");
-        let legacy_path = legacy_root.join("legacy-unbound.json");
-        fs::create_dir_all(&legacy_root).expect("legacy root should exist");
-        let session = Session::new().with_persistence_path(legacy_path.clone());
-        session
-            .save_to_path(&legacy_path)
-            .expect("legacy session should persist");
-
-        // when
-        let loaded = store
-            .load_session("legacy-unbound")
-            .expect("same-workspace legacy session without workspace binding should load");
-
-        // then
-        assert_eq!(loaded.handle.path, legacy_path);
-        assert_eq!(loaded.session.workspace_root(), None);
-        fs::remove_dir_all(base).expect("temp dir should clean up");
-    }
-
     #[test]
     fn session_store_latest_and_resolve_reference() {
         // given

rust/crates/runtime/src/task_packet.rs

@@ -1,42 +1,11 @@
 use serde::{Deserialize, Serialize};
 use std::fmt::{Display, Formatter};
 
-/// Task scope resolution for defining the granularity of work.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum TaskScope {
-    /// Work across the entire workspace
-    Workspace,
-    /// Work within a specific module/crate
-    Module,
-    /// Work on a single file
-    SingleFile,
-    /// Custom scope defined by the user
-    Custom,
-}
-
-impl std::fmt::Display for TaskScope {
-    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Workspace => write!(f, "workspace"),
-            Self::Module => write!(f, "module"),
-            Self::SingleFile => write!(f, "single-file"),
-            Self::Custom => write!(f, "custom"),
-        }
-    }
-}
-
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct TaskPacket {
     pub objective: String,
-    pub scope: TaskScope,
-    /// Optional scope path when scope is `Module`, `SingleFile`, or `Custom`
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub scope_path: Option<String>,
+    pub scope: String,
     pub repo: String,
-    /// Worktree path for the task
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub worktree: Option<String>,
     pub branch_policy: String,
     pub acceptance_tests: Vec<String>,
     pub commit_policy: String,
@@ -88,6 +57,7 @@ pub fn validate_packet(packet: TaskPacket) -> Result<ValidatedPacket, TaskPacket
     let mut errors = Vec::new();
 
     validate_required("objective", &packet.objective, &mut errors);
+    validate_required("scope", &packet.scope, &mut errors);
     validate_required("repo", &packet.repo, &mut errors);
     validate_required("branch_policy", &packet.branch_policy, &mut errors);
     validate_required("commit_policy", &packet.commit_policy, &mut errors);
@@ -98,9 +68,6 @@ pub fn validate_packet(packet: TaskPacket) -> Result<ValidatedPacket, TaskPacket
     );
     validate_required("escalation_policy", &packet.escalation_policy, &mut errors);
 
-    // Validate scope-specific requirements
-    validate_scope_requirements(&packet, &mut errors);
-
     for (index, test) in packet.acceptance_tests.iter().enumerate() {
         if test.trim().is_empty() {
             errors.push(format!(
@@ -116,26 +83,6 @@ pub fn validate_packet(packet: TaskPacket) -> Result<ValidatedPacket, TaskPacket
     }
 }
 
-fn validate_scope_requirements(packet: &TaskPacket, errors: &mut Vec<String>) {
-    // Scope path is required for Module, SingleFile, and Custom scopes
-    let needs_scope_path = matches!(
-        packet.scope,
-        TaskScope::Module | TaskScope::SingleFile | TaskScope::Custom
-    );
-
-    if needs_scope_path
-        && packet
-            .scope_path
-            .as_ref()
-            .is_none_or(|p| p.trim().is_empty())
-    {
-        errors.push(format!(
-            "scope_path is required for scope '{}'",
-            packet.scope
-        ));
-    }
-}
-
 fn validate_required(field: &str, value: &str, errors: &mut Vec<String>) {
     if value.trim().is_empty() {
         errors.push(format!("{field} must not be empty"));
@@ -149,10 +96,8 @@ mod tests {
     fn sample_packet() -> TaskPacket {
         TaskPacket {
             objective: "Implement typed task packet format".to_string(),
-            scope: TaskScope::Module,
-            scope_path: Some("runtime/task system".to_string()),
+            scope: "runtime/task system".to_string(),
             repo: "claw-code-parity".to_string(),
-            worktree: Some("/tmp/wt-1".to_string()),
             branch_policy: "origin/main only".to_string(),
             acceptance_tests: vec![
                 "cargo build --workspace".to_string(),
@@ -174,12 +119,9 @@ mod tests {
 
     #[test]
     fn invalid_packet_accumulates_errors() {
-        use super::TaskScope;
         let packet = TaskPacket {
             objective: " ".to_string(),
-            scope: TaskScope::Workspace,
-            scope_path: None,
-            worktree: None,
+            scope: String::new(),
             repo: String::new(),
             branch_policy: "\t".to_string(),
             acceptance_tests: vec!["ok".to_string(), " ".to_string()],
@@ -194,6 +136,9 @@ mod tests {
         assert!(error
             .errors()
             .contains(&"objective must not be empty".to_string()));
+        assert!(error
+            .errors()
+            .contains(&"scope must not be empty".to_string()));
         assert!(error
             .errors()
             .contains(&"repo must not be empty".to_string()));

rust/crates/runtime/src/task_registry.rs

@@ -85,12 +85,11 @@ impl TaskRegistry {
         packet: TaskPacket,
     ) -> Result<Task, TaskPacketValidationError> {
         let packet = validate_packet(packet)?.into_inner();
-        // Use scope_path as description if available, otherwise use scope as string
-        let description = packet
-            .scope_path
-            .clone()
-            .or_else(|| Some(packet.scope.to_string()));
-        Ok(self.create_task(packet.objective.clone(), description, Some(packet)))
+        Ok(self.create_task(
+            packet.objective.clone(),
+            Some(packet.scope.clone()),
+            Some(packet),
+        ))
     }
 
     fn create_task(
@@ -250,13 +249,10 @@ mod tests {
 
     #[test]
     fn creates_task_from_packet() {
-        use crate::task_packet::TaskScope;
         let registry = TaskRegistry::new();
         let packet = TaskPacket {
             objective: "Ship task packet support".to_string(),
-            scope: TaskScope::Module,
-            scope_path: Some("runtime/task system".to_string()),
-            worktree: Some("/tmp/wt-task".to_string()),
+            scope: "runtime/task system".to_string(),
             repo: "claw-code-parity".to_string(),
             branch_policy: "origin/main only".to_string(),
             acceptance_tests: vec!["cargo test --workspace".to_string()],

rust/crates/runtime/src/worker_boot.rs

@@ -56,7 +56,6 @@ pub enum WorkerFailureKind {
     PromptDelivery,
     Protocol,
     Provider,
-    StartupNoEvidence,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
@@ -79,7 +78,6 @@ pub enum WorkerEventKind {
     Restarted,
     Finished,
     Failed,
-    StartupNoEvidence,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
@@ -94,50 +92,9 @@ pub enum WorkerTrustResolution {
 pub enum WorkerPromptTarget {
     Shell,
     WrongTarget,
-    WrongTask,
     Unknown,
 }
 
-/// Classification of startup failure when no evidence is available.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum StartupFailureClassification {
-    /// Trust prompt is required but not detected/resolved
-    TrustRequired,
-    /// Prompt was delivered to wrong target (shell misdelivery)
-    PromptMisdelivery,
-    /// Prompt was sent but acceptance timed out
-    PromptAcceptanceTimeout,
-    /// Transport layer is dead/unresponsive
-    TransportDead,
-    /// Worker process crashed during startup
-    WorkerCrashed,
-    /// Cannot determine specific cause
-    Unknown,
-}
-
-/// Evidence bundle collected when worker startup times out without clear evidence.
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct StartupEvidenceBundle {
-    /// Last known worker lifecycle state before timeout
-    pub last_lifecycle_state: WorkerStatus,
-    /// The pane/command that was being executed
-    pub pane_command: String,
-    /// Timestamp when prompt was sent (if any), unix epoch seconds
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub prompt_sent_at: Option<u64>,
-    /// Whether prompt acceptance was detected
-    pub prompt_acceptance_state: bool,
-    /// Result of trust prompt detection at timeout
-    pub trust_prompt_detected: bool,
-    /// Transport health summary (true = healthy/responsive)
-    pub transport_healthy: bool,
-    /// MCP health summary (true = all servers healthy)
-    pub mcp_healthy: bool,
-    /// Seconds since worker creation
-    pub elapsed_seconds: u64,
-}
-
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(tag = "type", rename_all = "snake_case")]
 pub enum WorkerEventPayload {
@@ -151,26 +108,8 @@ pub enum WorkerEventPayload {
         observed_target: WorkerPromptTarget,
         #[serde(skip_serializing_if = "Option::is_none")]
         observed_cwd: Option<String>,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        observed_prompt_preview: Option<String>,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        task_receipt: Option<WorkerTaskReceipt>,
         recovery_armed: bool,
     },
-    StartupNoEvidence {
-        evidence: StartupEvidenceBundle,
-        classification: StartupFailureClassification,
-    },
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct WorkerTaskReceipt {
-    pub repo: String,
-    pub task_kind: String,
-    pub source_surface: String,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub expected_artifacts: Vec<String>,
-    pub objective_preview: String,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
@@ -195,7 +134,6 @@ pub struct Worker {
     pub prompt_delivery_attempts: u32,
     pub prompt_in_flight: bool,
     pub last_prompt: Option<String>,
-    pub expected_receipt: Option<WorkerTaskReceipt>,
     pub replay_prompt: Option<String>,
     pub last_error: Option<WorkerFailure>,
     pub created_at: u64,
@@ -244,7 +182,6 @@ impl WorkerRegistry {
             prompt_delivery_attempts: 0,
             prompt_in_flight: false,
             last_prompt: None,
-            expected_receipt: None,
             replay_prompt: None,
             last_error: None,
             created_at: ts,
@@ -320,7 +257,6 @@ impl WorkerRegistry {
                     &lowered,
                     worker.last_prompt.as_deref(),
                     &worker.cwd,
-                    worker.expected_receipt.as_ref(),
                 )
             })
             .flatten()
@@ -336,10 +272,6 @@ impl WorkerRegistry {
                     "worker prompt landed in the wrong target instead of {}: {}",
                     worker.cwd, prompt_preview
                 ),
-                WorkerPromptTarget::WrongTask => format!(
-                    "worker prompt receipt mismatched the expected task context for {}: {}",
-                    worker.cwd, prompt_preview
-                ),
                 WorkerPromptTarget::Unknown => format!(
                     "worker prompt delivery failed before reaching coding agent: {prompt_preview}"
                 ),
@@ -359,8 +291,6 @@ impl WorkerRegistry {
                     prompt_preview: prompt_preview.clone(),
                     observed_target: observation.target,
                     observed_cwd: observation.observed_cwd.clone(),
-                    observed_prompt_preview: observation.observed_prompt_preview.clone(),
-                    task_receipt: worker.expected_receipt.clone(),
                     recovery_armed: false,
                 }),
             );
@@ -376,8 +306,6 @@ impl WorkerRegistry {
                         prompt_preview,
                         observed_target: observation.target,
                         observed_cwd: observation.observed_cwd,
-                        observed_prompt_preview: observation.observed_prompt_preview,
-                        task_receipt: worker.expected_receipt.clone(),
                         recovery_armed: true,
                     }),
                 );
@@ -446,12 +374,7 @@ impl WorkerRegistry {
         Ok(worker.clone())
     }
 
-    pub fn send_prompt(
-        &self,
-        worker_id: &str,
-        prompt: Option<&str>,
-        task_receipt: Option<WorkerTaskReceipt>,
-    ) -> Result<Worker, String> {
+    pub fn send_prompt(&self, worker_id: &str, prompt: Option<&str>) -> Result<Worker, String> {
         let mut inner = self.inner.lock().expect("worker registry lock poisoned");
         let worker = inner
             .workers
@@ -475,7 +398,6 @@ impl WorkerRegistry {
         worker.prompt_delivery_attempts += 1;
         worker.prompt_in_flight = true;
         worker.last_prompt = Some(next_prompt.clone());
-        worker.expected_receipt = task_receipt;
         worker.replay_prompt = None;
         worker.last_error = None;
         worker.status = WorkerStatus::Running;
@@ -606,117 +528,6 @@ impl WorkerRegistry {
 
         Ok(worker.clone())
     }
-
-    /// Handle startup timeout by emitting typed `worker.startup_no_evidence` event with evidence bundle.
-    /// Classifier attempts to down-rank the vague bucket into a specific failure classification.
-    pub fn observe_startup_timeout(
-        &self,
-        worker_id: &str,
-        pane_command: &str,
-        transport_healthy: bool,
-        mcp_healthy: bool,
-    ) -> Result<Worker, String> {
-        let mut inner = self.inner.lock().expect("worker registry lock poisoned");
-        let worker = inner
-            .workers
-            .get_mut(worker_id)
-            .ok_or_else(|| format!("worker not found: {worker_id}"))?;
-
-        let now = now_secs();
-        let elapsed = now.saturating_sub(worker.created_at);
-
-        // Build evidence bundle
-        let evidence = StartupEvidenceBundle {
-            last_lifecycle_state: worker.status,
-            pane_command: pane_command.to_string(),
-            prompt_sent_at: if worker.prompt_delivery_attempts > 0 {
-                Some(worker.updated_at)
-            } else {
-                None
-            },
-            prompt_acceptance_state: worker.status == WorkerStatus::Running
-                && !worker.prompt_in_flight,
-            trust_prompt_detected: worker
-                .events
-                .iter()
-                .any(|e| e.kind == WorkerEventKind::TrustRequired),
-            transport_healthy,
-            mcp_healthy,
-            elapsed_seconds: elapsed,
-        };
-
-        // Classify the failure
-        let classification = classify_startup_failure(&evidence);
-
-        // Emit failure with evidence
-        worker.last_error = Some(WorkerFailure {
-            kind: WorkerFailureKind::StartupNoEvidence,
-            message: format!(
-                "worker startup stalled after {elapsed}s — classified as {classification:?}"
-            ),
-            created_at: now,
-        });
-        worker.status = WorkerStatus::Failed;
-        worker.prompt_in_flight = false;
-
-        push_event(
-            worker,
-            WorkerEventKind::StartupNoEvidence,
-            WorkerStatus::Failed,
-            Some(format!(
-                "startup timeout with evidence: last_state={:?}, trust_detected={}, prompt_accepted={}",
-                evidence.last_lifecycle_state,
-                evidence.trust_prompt_detected,
-                evidence.prompt_acceptance_state
-            )),
-            Some(WorkerEventPayload::StartupNoEvidence {
-                evidence,
-                classification,
-            }),
-        );
-
-        Ok(worker.clone())
-    }
-}
-
-/// Classify startup failure based on evidence bundle.
-/// Attempts to down-rank the vague `startup-no-evidence` bucket into a specific failure class.
-fn classify_startup_failure(evidence: &StartupEvidenceBundle) -> StartupFailureClassification {
-    // Check for transport death first
-    if !evidence.transport_healthy {
-        return StartupFailureClassification::TransportDead;
-    }
-
-    // Check for trust prompt that wasn't resolved
-    if evidence.trust_prompt_detected
-        && evidence.last_lifecycle_state == WorkerStatus::TrustRequired
-    {
-        return StartupFailureClassification::TrustRequired;
-    }
-
-    // Check for prompt acceptance timeout
-    if evidence.prompt_sent_at.is_some()
-        && !evidence.prompt_acceptance_state
-        && evidence.last_lifecycle_state == WorkerStatus::Running
-    {
-        return StartupFailureClassification::PromptAcceptanceTimeout;
-    }
-
-    // Check for misdelivery when prompt was sent but not accepted
-    if evidence.prompt_sent_at.is_some()
-        && !evidence.prompt_acceptance_state
-        && evidence.elapsed_seconds > 30
-    {
-        return StartupFailureClassification::PromptMisdelivery;
-    }
-
-    // If MCP is unhealthy but transport is fine, worker may have crashed
-    if !evidence.mcp_healthy && evidence.transport_healthy {
-        return StartupFailureClassification::WorkerCrashed;
-    }
-
-    // Default to unknown if no stronger classification exists
-    StartupFailureClassification::Unknown
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
@@ -737,7 +548,6 @@ fn prompt_misdelivery_is_relevant(worker: &Worker) -> bool {
 struct PromptDeliveryObservation {
     target: WorkerPromptTarget,
     observed_cwd: Option<String>,
-    observed_prompt_preview: Option<String>,
 }
 
 fn push_event(
@@ -765,28 +575,28 @@ fn push_event(
 /// Write current worker state to `.claw/worker-state.json` under the worker's cwd.
 /// This is the file-based observability surface: external observers (clawhip, orchestrators)
 /// poll this file instead of requiring an HTTP route on the opencode binary.
-#[derive(serde::Serialize)]
-struct StateSnapshot<'a> {
-    worker_id: &'a str,
-    status: WorkerStatus,
-    is_ready: bool,
-    trust_gate_cleared: bool,
-    prompt_in_flight: bool,
-    last_event: Option<&'a WorkerEvent>,
-    updated_at: u64,
-    /// Seconds since last state transition. Clawhip uses this to detect
-    /// stalled workers without computing epoch deltas.
-    seconds_since_update: u64,
-}
-
 fn emit_state_file(worker: &Worker) {
     let state_dir = std::path::Path::new(&worker.cwd).join(".claw");
-    if std::fs::create_dir_all(&state_dir).is_err() {
+    if let Err(_) = std::fs::create_dir_all(&state_dir) {
         return;
     }
     let state_path = state_dir.join("worker-state.json");
     let tmp_path = state_dir.join("worker-state.json.tmp");
 
+    #[derive(serde::Serialize)]
+    struct StateSnapshot<'a> {
+        worker_id: &'a str,
+        status: WorkerStatus,
+        is_ready: bool,
+        trust_gate_cleared: bool,
+        prompt_in_flight: bool,
+        last_event: Option<&'a WorkerEvent>,
+        updated_at: u64,
+        /// Seconds since last state transition. Clawhip uses this to detect
+        /// stalled workers without computing epoch deltas.
+        seconds_since_update: u64,
+    }
+
     let now = now_secs();
     let snapshot = StateSnapshot {
         worker_id: &worker.worker_id,
@@ -889,7 +699,6 @@ fn detect_prompt_misdelivery(
     lowered: &str,
     prompt: Option<&str>,
     expected_cwd: &str,
-    expected_receipt: Option<&WorkerTaskReceipt>,
 ) -> Option<PromptDeliveryObservation> {
     let Some(prompt) = prompt else {
         return None;
@@ -904,30 +713,12 @@ fn detect_prompt_misdelivery(
         return None;
     }
     let prompt_visible = lowered.contains(&prompt_snippet);
-    let observed_prompt_preview = detect_prompt_echo(screen_text);
-
-    if let Some(receipt) = expected_receipt {
-        let receipt_visible = task_receipt_visible(lowered, receipt);
-        let mismatched_prompt_visible = observed_prompt_preview
-            .as_deref()
-            .map(str::to_ascii_lowercase)
-            .is_some_and(|preview| !preview.contains(&prompt_snippet));
-
-        if (prompt_visible || mismatched_prompt_visible) && !receipt_visible {
-            return Some(PromptDeliveryObservation {
-                target: WorkerPromptTarget::WrongTask,
-                observed_cwd: detect_observed_shell_cwd(screen_text),
-                observed_prompt_preview,
-            });
-        }
-    }
 
     if let Some(observed_cwd) = detect_observed_shell_cwd(screen_text) {
         if prompt_visible && !cwd_matches_observed_target(expected_cwd, &observed_cwd) {
             return Some(PromptDeliveryObservation {
                 target: WorkerPromptTarget::WrongTarget,
                 observed_cwd: Some(observed_cwd),
-                observed_prompt_preview,
             });
         }
     }
@@ -945,7 +736,6 @@ fn detect_prompt_misdelivery(
     (shell_error && prompt_visible).then_some(PromptDeliveryObservation {
         target: WorkerPromptTarget::Shell,
         observed_cwd: None,
-        observed_prompt_preview,
     })
 }
 
@@ -958,38 +748,10 @@ fn prompt_preview(prompt: &str) -> String {
     format!("{}…", preview.trim_end())
 }
 
-fn detect_prompt_echo(screen_text: &str) -> Option<String> {
-    screen_text.lines().find_map(|line| {
-        line.trim_start()
-            .strip_prefix('›')
-            .map(str::trim)
-            .filter(|value| !value.is_empty())
-            .map(str::to_string)
-    })
-}
-
-fn task_receipt_visible(lowered_screen_text: &str, receipt: &WorkerTaskReceipt) -> bool {
-    let expected_tokens = [
-        receipt.repo.to_ascii_lowercase(),
-        receipt.task_kind.to_ascii_lowercase(),
-        receipt.source_surface.to_ascii_lowercase(),
-        receipt.objective_preview.to_ascii_lowercase(),
-    ];
-
-    expected_tokens
-        .iter()
-        .all(|token| lowered_screen_text.contains(token))
-        && receipt
-            .expected_artifacts
-            .iter()
-            .all(|artifact| lowered_screen_text.contains(&artifact.to_ascii_lowercase()))
-}
-
 fn prompt_misdelivery_detail(observation: &PromptDeliveryObservation) -> &'static str {
     match observation.target {
         WorkerPromptTarget::Shell => "shell misdelivery detected",
         WorkerPromptTarget::WrongTarget => "prompt landed in wrong target",
-        WorkerPromptTarget::WrongTask => "prompt receipt mismatched expected task context",
         WorkerPromptTarget::Unknown => "prompt delivery failure detected",
     }
 }
@@ -1103,7 +865,7 @@ mod tests {
             WorkerFailureKind::TrustGate
         );
 
-        let send_before_resolve = registry.send_prompt(&worker.worker_id, Some("ship it"), None);
+        let send_before_resolve = registry.send_prompt(&worker.worker_id, Some("ship it"));
         assert!(send_before_resolve
             .expect_err("prompt delivery should be gated")
             .contains("not ready for prompt delivery"));
@@ -1143,7 +905,7 @@ mod tests {
             .expect("ready observe should succeed");
 
         let running = registry
-            .send_prompt(&worker.worker_id, Some("Implement worker handshake"), None)
+            .send_prompt(&worker.worker_id, Some("Implement worker handshake"))
             .expect("prompt send should succeed");
         assert_eq!(running.status, WorkerStatus::Running);
         assert_eq!(running.prompt_delivery_attempts, 1);
@@ -1179,8 +941,6 @@ mod tests {
                 prompt_preview: "Implement worker handshake".to_string(),
                 observed_target: WorkerPromptTarget::Shell,
                 observed_cwd: None,
-                observed_prompt_preview: None,
-                task_receipt: None,
                 recovery_armed: false,
             })
         );
@@ -1196,14 +956,12 @@ mod tests {
                 prompt_preview: "Implement worker handshake".to_string(),
                 observed_target: WorkerPromptTarget::Shell,
                 observed_cwd: None,
-                observed_prompt_preview: None,
-                task_receipt: None,
                 recovery_armed: true,
             })
         );
 
         let replayed = registry
-            .send_prompt(&worker.worker_id, None, None)
+            .send_prompt(&worker.worker_id, None)
             .expect("replay send should succeed");
         assert_eq!(replayed.status, WorkerStatus::Running);
         assert!(replayed.replay_prompt.is_none());
@@ -1218,11 +976,7 @@ mod tests {
             .observe(&worker.worker_id, "Ready for input\n>")
             .expect("ready observe should succeed");
         registry
-            .send_prompt(
-                &worker.worker_id,
-                Some("Run the worker bootstrap tests"),
-                None,
-            )
+            .send_prompt(&worker.worker_id, Some("Run the worker bootstrap tests"))
             .expect("prompt send should succeed");
 
         let recovered = registry
@@ -1253,8 +1007,6 @@ mod tests {
                 prompt_preview: "Run the worker bootstrap tests".to_string(),
                 observed_target: WorkerPromptTarget::WrongTarget,
                 observed_cwd: Some("/tmp/repo-target-b".to_string()),
-                observed_prompt_preview: None,
-                task_receipt: None,
                 recovery_armed: false,
             })
         );
@@ -1297,75 +1049,6 @@ mod tests {
         assert!(ready.last_error.is_none());
     }
 
-    #[test]
-    fn wrong_task_receipt_mismatch_is_detected_before_execution_continues() {
-        let registry = WorkerRegistry::new();
-        let worker = registry.create("/tmp/repo-task", &[], true);
-        registry
-            .observe(&worker.worker_id, "Ready for input\n>")
-            .expect("ready observe should succeed");
-        registry
-            .send_prompt(
-                &worker.worker_id,
-                Some("Implement worker handshake"),
-                Some(WorkerTaskReceipt {
-                    repo: "claw-code".to_string(),
-                    task_kind: "repo_code".to_string(),
-                    source_surface: "omx_team".to_string(),
-                    expected_artifacts: vec!["patch".to_string(), "tests".to_string()],
-                    objective_preview: "Implement worker handshake".to_string(),
-                }),
-            )
-            .expect("prompt send should succeed");
-
-        let recovered = registry
-            .observe(
-                &worker.worker_id,
-                "› Explain this KakaoTalk screenshot for a friend\nI can help analyze the screenshot…",
-            )
-            .expect("mismatch observe should succeed");
-
-        assert_eq!(recovered.status, WorkerStatus::ReadyForPrompt);
-        assert_eq!(
-            recovered
-                .last_error
-                .expect("mismatch error should exist")
-                .kind,
-            WorkerFailureKind::PromptDelivery
-        );
-        let mismatch = recovered
-            .events
-            .iter()
-            .find(|event| event.kind == WorkerEventKind::PromptMisdelivery)
-            .expect("wrong-task event should exist");
-        assert_eq!(mismatch.status, WorkerStatus::Failed);
-        assert_eq!(
-            mismatch.payload,
-            Some(WorkerEventPayload::PromptDelivery {
-                prompt_preview: "Implement worker handshake".to_string(),
-                observed_target: WorkerPromptTarget::WrongTask,
-                observed_cwd: None,
-                observed_prompt_preview: Some(
-                    "Explain this KakaoTalk screenshot for a friend".to_string()
-                ),
-                task_receipt: Some(WorkerTaskReceipt {
-                    repo: "claw-code".to_string(),
-                    task_kind: "repo_code".to_string(),
-                    source_surface: "omx_team".to_string(),
-                    expected_artifacts: vec!["patch".to_string(), "tests".to_string()],
-                    objective_preview: "Implement worker handshake".to_string(),
-                }),
-                recovery_armed: false,
-            })
-        );
-        let replay = recovered
-            .events
-            .iter()
-            .find(|event| event.kind == WorkerEventKind::PromptReplayArmed)
-            .expect("replay event should exist");
-        assert_eq!(replay.status, WorkerStatus::ReadyForPrompt);
-    }
-
     #[test]
     fn restart_and_terminate_reset_or_finish_worker() {
         let registry = WorkerRegistry::new();
@@ -1374,7 +1057,7 @@ mod tests {
             .observe(&worker.worker_id, "Ready for input\n>")
             .expect("ready observe should succeed");
         registry
-            .send_prompt(&worker.worker_id, Some("Run tests"), None)
+            .send_prompt(&worker.worker_id, Some("Run tests"))
             .expect("prompt send should succeed");
 
         let restarted = registry
@@ -1403,7 +1086,7 @@ mod tests {
             .observe(&worker.worker_id, "Ready for input\n>")
             .expect("ready observe should succeed");
         registry
-            .send_prompt(&worker.worker_id, Some("Run tests"), None)
+            .send_prompt(&worker.worker_id, Some("Run tests"))
             .expect("prompt send should succeed");
 
         let failed = registry
@@ -1480,7 +1163,7 @@ mod tests {
             .observe(&worker.worker_id, "Ready for input\n>")
             .expect("ready observe should succeed");
         registry
-            .send_prompt(&worker.worker_id, Some("Run tests"), None)
+            .send_prompt(&worker.worker_id, Some("Run tests"))
             .expect("prompt send should succeed");
 
         let finished = registry
@@ -1494,215 +1177,4 @@ mod tests {
             .iter()
             .any(|event| event.kind == WorkerEventKind::Finished));
     }
-
-    #[test]
-    fn startup_timeout_emits_evidence_bundle_with_classification() {
-        let registry = WorkerRegistry::new();
-        let worker = registry.create("/tmp/repo-timeout", &[], true);
-
-        // Simulate startup timeout with transport dead
-        let timed_out = registry
-            .observe_startup_timeout(&worker.worker_id, "cargo test", false, true)
-            .expect("startup timeout observe should succeed");
-
-        assert_eq!(timed_out.status, WorkerStatus::Failed);
-        let error = timed_out
-            .last_error
-            .expect("startup timeout error should exist");
-        assert_eq!(error.kind, WorkerFailureKind::StartupNoEvidence);
-        // Check for "TransportDead" (the Debug representation of the enum variant)
-        assert!(
-            error.message.contains("TransportDead"),
-            "expected TransportDead in: {}",
-            error.message
-        );
-
-        let event = timed_out
-            .events
-            .iter()
-            .find(|e| e.kind == WorkerEventKind::StartupNoEvidence)
-            .expect("startup no evidence event should exist");
-
-        match event.payload.as_ref() {
-            Some(WorkerEventPayload::StartupNoEvidence {
-                evidence,
-                classification,
-            }) => {
-                assert_eq!(
-                    evidence.last_lifecycle_state,
-                    WorkerStatus::Spawning,
-                    "last state should be spawning"
-                );
-                assert_eq!(evidence.pane_command, "cargo test");
-                assert!(!evidence.transport_healthy);
-                assert!(evidence.mcp_healthy);
-                assert_eq!(*classification, StartupFailureClassification::TransportDead);
-            }
-            _ => panic!(
-                "expected StartupNoEvidence payload, got {:?}",
-                event.payload
-            ),
-        }
-    }
-
-    #[test]
-    fn startup_timeout_classifies_trust_required_when_prompt_blocked() {
-        let registry = WorkerRegistry::new();
-        let worker = registry.create("/tmp/repo-trust", &[], false);
-
-        // Simulate trust prompt detected but not resolved
-        registry
-            .observe(
-                &worker.worker_id,
-                "Do you trust the files in this folder?\n1. Yes, proceed\n2. No",
-            )
-            .expect("trust observe should succeed");
-
-        // Now simulate startup timeout
-        let timed_out = registry
-            .observe_startup_timeout(&worker.worker_id, "claw prompt", true, true)
-            .expect("startup timeout observe should succeed");
-
-        let event = timed_out
-            .events
-            .iter()
-            .find(|e| e.kind == WorkerEventKind::StartupNoEvidence)
-            .expect("startup no evidence event should exist");
-
-        match event.payload.as_ref() {
-            Some(WorkerEventPayload::StartupNoEvidence { classification, .. }) => {
-                assert_eq!(
-                    *classification,
-                    StartupFailureClassification::TrustRequired,
-                    "should classify as trust_required when trust prompt detected"
-                );
-            }
-            _ => panic!("expected StartupNoEvidence payload"),
-        }
-    }
-
-    #[test]
-    fn startup_timeout_classifies_prompt_acceptance_timeout() {
-        let registry = WorkerRegistry::new();
-        let worker = registry.create("/tmp/repo-accept", &[], true);
-
-        // Get worker to ReadyForPrompt
-        registry
-            .observe(&worker.worker_id, "Ready for your input\n>")
-            .expect("ready observe should succeed");
-
-        // Send prompt but don't get acceptance
-        registry
-            .send_prompt(&worker.worker_id, Some("Run tests"), None)
-            .expect("prompt send should succeed");
-
-        // Simulate startup timeout while prompt is still in flight
-        let timed_out = registry
-            .observe_startup_timeout(&worker.worker_id, "claw prompt", true, true)
-            .expect("startup timeout observe should succeed");
-
-        let event = timed_out
-            .events
-            .iter()
-            .find(|e| e.kind == WorkerEventKind::StartupNoEvidence)
-            .expect("startup no evidence event should exist");
-
-        match event.payload.as_ref() {
-            Some(WorkerEventPayload::StartupNoEvidence {
-                evidence,
-                classification,
-            }) => {
-                assert!(
-                    evidence.prompt_sent_at.is_some(),
-                    "should have prompt_sent_at"
-                );
-                assert!(!evidence.prompt_acceptance_state, "prompt not yet accepted");
-                assert_eq!(
-                    *classification,
-                    StartupFailureClassification::PromptAcceptanceTimeout
-                );
-            }
-            _ => panic!("expected StartupNoEvidence payload"),
-        }
-    }
-
-    #[test]
-    fn startup_evidence_bundle_serializes_correctly() {
-        let bundle = StartupEvidenceBundle {
-            last_lifecycle_state: WorkerStatus::Running,
-            pane_command: "test command".to_string(),
-            prompt_sent_at: Some(1_234_567_890),
-            prompt_acceptance_state: false,
-            trust_prompt_detected: true,
-            transport_healthy: true,
-            mcp_healthy: false,
-            elapsed_seconds: 60,
-        };
-
-        let json = serde_json::to_string(&bundle).expect("should serialize");
-        assert!(json.contains("\"last_lifecycle_state\""));
-        assert!(json.contains("\"pane_command\""));
-        assert!(json.contains("\"prompt_sent_at\":1234567890"));
-        assert!(json.contains("\"trust_prompt_detected\":true"));
-        assert!(json.contains("\"transport_healthy\":true"));
-        assert!(json.contains("\"mcp_healthy\":false"));
-
-        let deserialized: StartupEvidenceBundle =
-            serde_json::from_str(&json).expect("should deserialize");
-        assert_eq!(deserialized.last_lifecycle_state, WorkerStatus::Running);
-        assert_eq!(deserialized.prompt_sent_at, Some(1_234_567_890));
-    }
-
-    #[test]
-    fn classify_startup_failure_detects_transport_dead() {
-        let evidence = StartupEvidenceBundle {
-            last_lifecycle_state: WorkerStatus::Spawning,
-            pane_command: "test".to_string(),
-            prompt_sent_at: None,
-            prompt_acceptance_state: false,
-            trust_prompt_detected: false,
-            transport_healthy: false,
-            mcp_healthy: true,
-            elapsed_seconds: 30,
-        };
-
-        let classification = classify_startup_failure(&evidence);
-        assert_eq!(classification, StartupFailureClassification::TransportDead);
-    }
-
-    #[test]
-    fn classify_startup_failure_defaults_to_unknown() {
-        let evidence = StartupEvidenceBundle {
-            last_lifecycle_state: WorkerStatus::Spawning,
-            pane_command: "test".to_string(),
-            prompt_sent_at: None,
-            prompt_acceptance_state: false,
-            trust_prompt_detected: false,
-            transport_healthy: true,
-            mcp_healthy: true,
-            elapsed_seconds: 10,
-        };
-
-        let classification = classify_startup_failure(&evidence);
-        assert_eq!(classification, StartupFailureClassification::Unknown);
-    }
-
-    #[test]
-    fn classify_startup_failure_detects_worker_crashed() {
-        // Worker crashed scenario: transport healthy but MCP unhealthy
-        // Don't have prompt in flight (no prompt_sent_at) to avoid matching PromptAcceptanceTimeout
-        let evidence = StartupEvidenceBundle {
-            last_lifecycle_state: WorkerStatus::Spawning,
-            pane_command: "test".to_string(),
-            prompt_sent_at: None, // No prompt sent yet
-            prompt_acceptance_state: false,
-            trust_prompt_detected: false,
-            transport_healthy: true,
-            mcp_healthy: false, // MCP unhealthy but transport healthy suggests crash
-            elapsed_seconds: 45,
-        };
-
-        let classification = classify_startup_failure(&evidence);
-        assert_eq!(classification, StartupFailureClassification::WorkerCrashed);
-    }
 }

rust/crates/runtime/tests/integration_tests.rs

@@ -304,7 +304,7 @@ fn worker_provider_failure_flows_through_recovery_to_policy() {
         .observe(&worker.worker_id, "Ready for your input\n>")
         .expect("ready observe should succeed");
     registry
-        .send_prompt(&worker.worker_id, Some("Run analysis"), None)
+        .send_prompt(&worker.worker_id, Some("Run analysis"))
         .expect("prompt send should succeed");
 
     // Session completes with provider failure (finish="unknown", tokens=0)

rust/crates/rusty-claude-cli/build.rs

@@ -14,13 +14,14 @@ fn main() {
                 None
             }
         })
-        .map_or_else(|| "unknown".to_string(), |s| s.trim().to_string());
+        .map(|s| s.trim().to_string())
+        .unwrap_or_else(|| "unknown".to_string());
 
-    println!("cargo:rustc-env=GIT_SHA={git_sha}");
+    println!("cargo:rustc-env=GIT_SHA={}", git_sha);
 
     // TARGET is always set by Cargo during build
     let target = env::var("TARGET").unwrap_or_else(|_| "unknown".to_string());
-    println!("cargo:rustc-env=TARGET={target}");
+    println!("cargo:rustc-env=TARGET={}", target);
 
     // Build date from SOURCE_DATE_EPOCH (reproducible builds) or current UTC date.
     // Intentionally ignoring time component to keep output deterministic within a day.
@@ -47,7 +48,8 @@ fn main() {
                         None
                     }
                 })
-                .map_or_else(|| "unknown".to_string(), |s| s.trim().to_string())
+                .map(|s| s.trim().to_string())
+                .unwrap_or_else(|| "unknown".to_string())
         });
     println!("cargo:rustc-env=BUILD_DATE={build_date}");
 

rust/crates/rusty-claude-cli/src/init.rs

@@ -9,7 +9,7 @@ const STARTER_CLAW_JSON: &str = concat!(
     "}\n",
 );
 const GITIGNORE_COMMENT: &str = "# Claw Code local artifacts";
-const GITIGNORE_ENTRIES: [&str; 3] = [".claw/settings.local.json", ".claw/sessions/", ".clawhip/"];
+const GITIGNORE_ENTRIES: [&str; 2] = [".claw/settings.local.json", ".claw/sessions/"];
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(crate) enum InitStatus {
@@ -27,18 +27,6 @@ impl InitStatus {
             Self::Skipped => "skipped (already exists)",
         }
     }
-
-    /// Machine-stable identifier for structured output (#142).
-    /// Unlike `label()`, this never changes wording: claws can switch on
-    /// these values without brittle substring matching.
-    #[must_use]
-    pub(crate) fn json_tag(self) -> &'static str {
-        match self {
-            Self::Created => "created",
-            Self::Updated => "updated",
-            Self::Skipped => "skipped",
-        }
-    }
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -70,36 +58,6 @@ impl InitReport {
         lines.push("  Next step        Review and tailor the generated guidance".to_string());
         lines.join("\n")
     }
-
-    /// Summary constant that claws can embed in JSON output without having
-    /// to read it out of the human-formatted `message` string (#142).
-    pub(crate) const NEXT_STEP: &'static str = "Review and tailor the generated guidance";
-
-    /// Artifact names that ended in the given status. Used to build the
-    /// structured `created[]`/`updated[]`/`skipped[]` arrays for #142.
-    #[must_use]
-    pub(crate) fn artifacts_with_status(&self, status: InitStatus) -> Vec<String> {
-        self.artifacts
-            .iter()
-            .filter(|artifact| artifact.status == status)
-            .map(|artifact| artifact.name.to_string())
-            .collect()
-    }
-
-    /// Structured artifact list for JSON output (#142). Each entry carries
-    /// `name` and machine-stable `status` tag.
-    #[must_use]
-    pub(crate) fn artifact_json_entries(&self) -> Vec<serde_json::Value> {
-        self.artifacts
-            .iter()
-            .map(|artifact| {
-                serde_json::json!({
-                    "name": artifact.name,
-                    "status": artifact.status.json_tag(),
-                })
-            })
-            .collect()
-    }
 }
 
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
@@ -375,7 +333,7 @@ fn framework_notes(detection: &RepoDetection) -> Vec<String> {
 
 #[cfg(test)]
 mod tests {
-    use super::{initialize_repo, render_init_claude_md, InitStatus};
+    use super::{initialize_repo, render_init_claude_md};
     use std::fs;
     use std::path::Path;
     use std::time::{SystemTime, UNIX_EPOCH};
@@ -417,7 +375,6 @@ mod tests {
         let gitignore = fs::read_to_string(root.join(".gitignore")).expect("read gitignore");
         assert!(gitignore.contains(".claw/settings.local.json"));
         assert!(gitignore.contains(".claw/sessions/"));
-        assert!(gitignore.contains(".clawhip/"));
         let claude_md = fs::read_to_string(root.join("CLAUDE.md")).expect("read claude md");
         assert!(claude_md.contains("Languages: Rust."));
         assert!(claude_md.contains("cargo clippy --workspace --all-targets -- -D warnings"));
@@ -450,64 +407,6 @@ mod tests {
         let gitignore = fs::read_to_string(root.join(".gitignore")).expect("read gitignore");
         assert_eq!(gitignore.matches(".claw/settings.local.json").count(), 1);
         assert_eq!(gitignore.matches(".claw/sessions/").count(), 1);
-        assert_eq!(gitignore.matches(".clawhip/").count(), 1);
-
-        fs::remove_dir_all(root).expect("cleanup temp dir");
-    }
-
-    #[test]
-    fn artifacts_with_status_partitions_fresh_and_idempotent_runs() {
-        // #142: the structured JSON output needs to be able to partition
-        // artifacts into created/updated/skipped without substring matching
-        // the human-formatted `message` string.
-        let root = temp_dir();
-        fs::create_dir_all(&root).expect("create root");
-
-        let fresh = initialize_repo(&root).expect("fresh init should succeed");
-        let created_names = fresh.artifacts_with_status(InitStatus::Created);
-        assert_eq!(
-            created_names,
-            vec![
-                ".claw/".to_string(),
-                ".claw.json".to_string(),
-                ".gitignore".to_string(),
-                "CLAUDE.md".to_string(),
-            ],
-            "fresh init should place all four artifacts in created[]"
-        );
-        assert!(
-            fresh.artifacts_with_status(InitStatus::Skipped).is_empty(),
-            "fresh init should have no skipped artifacts"
-        );
-
-        let second = initialize_repo(&root).expect("second init should succeed");
-        let skipped_names = second.artifacts_with_status(InitStatus::Skipped);
-        assert_eq!(
-            skipped_names,
-            vec![
-                ".claw/".to_string(),
-                ".claw.json".to_string(),
-                ".gitignore".to_string(),
-                "CLAUDE.md".to_string(),
-            ],
-            "idempotent init should place all four artifacts in skipped[]"
-        );
-        assert!(
-            second.artifacts_with_status(InitStatus::Created).is_empty(),
-            "idempotent init should have no created artifacts"
-        );
-
-        // artifact_json_entries() uses the machine-stable `json_tag()` which
-        // never changes wording (unlike `label()` which says "skipped (already exists)").
-        let entries = second.artifact_json_entries();
-        assert_eq!(entries.len(), 4);
-        for entry in &entries {
-            let status = entry.get("status").and_then(|v| v.as_str()).unwrap();
-            assert_eq!(
-                status, "skipped",
-                "machine status tag should be the bare word 'skipped', not label()'s 'skipped (already exists)'"
-            );
-        }
 
         fs::remove_dir_all(root).expect("cleanup temp dir");
     }

rust/crates/rusty-claude-cli/src/render.rs

@@ -639,16 +639,10 @@ fn apply_code_block_background(line: &str) -> String {
 /// fence markers of equal or greater length are wrapped with a longer fence.
 ///
 /// LLMs frequently emit triple-backtick code blocks that contain triple-backtick
-/// examples.  `CommonMark` (and pulldown-cmark) treats the inner marker as the
+/// examples.  CommonMark (and pulldown-cmark) treats the inner marker as the
 /// closing fence, breaking the render.  This function detects the situation and
 /// upgrades the outer fence to use enough backticks (or tildes) that the inner
 /// markers become ordinary content.
-#[allow(
-    clippy::too_many_lines,
-    clippy::items_after_statements,
-    clippy::manual_repeat_n,
-    clippy::manual_str_repeat
-)]
 fn normalize_nested_fences(markdown: &str) -> String {
     // A fence line is either "labeled" (has an info string ⇒ always an opener)
     // or "bare" (no info string ⇒ could be opener or closer).

rust/crates/rusty-claude-cli/tests/cli_flags_and_config_defaults.rs

@@ -266,7 +266,7 @@ fn command_in(cwd: &Path) -> Command {
 
 fn write_session(root: &Path, label: &str) -> PathBuf {
     let session_path = root.join(format!("{label}.jsonl"));
-    let mut session = Session::new().with_workspace_root(root.to_path_buf());
+    let mut session = Session::new();
     session
         .push_user_text(format!("session fixture for {label}"))
         .expect("session write should succeed");

rust/crates/rusty-claude-cli/tests/compact_output.rs

@@ -5,7 +5,6 @@ use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use mock_anthropic_service::{MockAnthropicService, SCENARIO_PREFIX};
-use serde_json::Value;
 
 static TEMP_COUNTER: AtomicU64 = AtomicU64::new(0);
 
@@ -126,60 +125,6 @@ fn compact_flag_streaming_text_only_emits_final_message_text() {
     fs::remove_dir_all(&workspace).expect("workspace cleanup should succeed");
 }
 
-#[test]
-fn compact_flag_with_json_output_emits_structured_json() {
-    let runtime = tokio::runtime::Runtime::new().expect("tokio runtime should build");
-    let server = runtime
-        .block_on(MockAnthropicService::spawn())
-        .expect("mock service should start");
-    let base_url = server.base_url();
-
-    let workspace = unique_temp_dir("compact-json");
-    let config_home = workspace.join("config-home");
-    let home = workspace.join("home");
-    fs::create_dir_all(&workspace).expect("workspace should exist");
-    fs::create_dir_all(&config_home).expect("config home should exist");
-    fs::create_dir_all(&home).expect("home should exist");
-
-    let prompt = format!("{SCENARIO_PREFIX}streaming_text");
-    let output = run_claw(
-        &workspace,
-        &config_home,
-        &home,
-        &base_url,
-        &[
-            "--model",
-            "sonnet",
-            "--permission-mode",
-            "read-only",
-            "--output-format",
-            "json",
-            "--compact",
-            &prompt,
-        ],
-    );
-
-    assert!(
-        output.status.success(),
-        "compact json run should succeed
-stdout:
-{}
-
-stderr:
-{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr),
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout should be utf8");
-    let parsed: Value = serde_json::from_str(&stdout).expect("compact json stdout should parse");
-    assert_eq!(parsed["message"], "Mock streaming says hello from the parity harness.");
-    assert_eq!(parsed["compact"], true);
-    assert_eq!(parsed["model"], "claude-sonnet-4-6");
-    assert!(parsed["usage"].is_object());
-
-    fs::remove_dir_all(&workspace).expect("workspace cleanup should succeed");
-}
-
 fn run_claw(
     cwd: &std::path::Path,
     config_home: &std::path::Path,

rust/crates/rusty-claude-cli/tests/output_format_contract.rs

@@ -4,7 +4,6 @@ use std::process::{Command, Output};
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use runtime::Session;
 use serde_json::Value;
 
 static TEMP_COUNTER: AtomicU64 = AtomicU64::new(0);
@@ -46,24 +45,6 @@ fn status_and_sandbox_emit_json_when_requested() {
     assert!(sandbox["filesystem_mode"].as_str().is_some());
 }
 
-#[test]
-fn acp_guidance_emits_json_when_requested() {
-    let root = unique_temp_dir("acp-json");
-    fs::create_dir_all(&root).expect("temp dir should exist");
-
-    let acp = assert_json_command(&root, &["--output-format", "json", "acp"]);
-    assert_eq!(acp["kind"], "acp");
-    assert_eq!(acp["status"], "discoverability_only");
-    assert_eq!(acp["supported"], false);
-    assert_eq!(acp["serve_alias_only"], true);
-    assert_eq!(acp["discoverability_tracking"], "ROADMAP #64a");
-    assert_eq!(acp["tracking"], "ROADMAP #76");
-    assert!(acp["message"]
-        .as_str()
-        .expect("acp message")
-        .contains("discoverability alias"));
-}
-
 #[test]
 fn inventory_commands_emit_structured_json_when_requested() {
     let root = unique_temp_dir("inventory-json");
@@ -192,15 +173,13 @@ fn dump_manifests_and_init_emit_json_when_requested() {
     fs::create_dir_all(&root).expect("temp dir should exist");
 
     let upstream = write_upstream_fixture(&root);
-    let manifests = assert_json_command(
+    let manifests = assert_json_command_with_env(
         &root,
-        &[
-            "--output-format",
-            "json",
-            "dump-manifests",
-            "--manifests-dir",
+        &["--output-format", "json", "dump-manifests"],
+        &[(
+            "CLAUDE_CODE_UPSTREAM",
             upstream.to_str().expect("utf8 upstream"),
-        ],
+        )],
     );
     assert_eq!(manifests["kind"], "dump-manifests");
     assert_eq!(manifests["commands"], 1);
@@ -227,7 +206,7 @@ fn doctor_and_resume_status_emit_json_when_requested() {
     assert!(summary["failures"].as_u64().is_some());
 
     let checks = doctor["checks"].as_array().expect("doctor checks");
-    assert_eq!(checks.len(), 6);
+    assert_eq!(checks.len(), 5);
     let check_names = checks
         .iter()
         .map(|check| {
@@ -239,27 +218,7 @@ fn doctor_and_resume_status_emit_json_when_requested() {
         .collect::<Vec<_>>();
     assert_eq!(
         check_names,
-        vec![
-            "auth",
-            "config",
-            "install source",
-            "workspace",
-            "sandbox",
-            "system"
-        ]
-    );
-
-    let install_source = checks
-        .iter()
-        .find(|check| check["name"] == "install source")
-        .expect("install source check");
-    assert_eq!(
-        install_source["official_repo"],
-        "https://github.com/ultraworkers/claw-code"
-    );
-    assert_eq!(
-        install_source["deprecated_install"],
-        "cargo install claw-code"
+        vec!["auth", "config", "workspace", "sandbox", "system"]
     );
 
     let workspace = checks
@@ -277,7 +236,12 @@ fn doctor_and_resume_status_emit_json_when_requested() {
     assert!(sandbox["enabled"].is_boolean());
     assert!(sandbox["fallback_reason"].is_null() || sandbox["fallback_reason"].is_string());
 
-    let session_path = write_session_fixture(&root, "resume-json", Some("hello"));
+    let session_path = root.join("session.jsonl");
+    fs::write(
+        &session_path,
+        "{\"type\":\"session_meta\",\"version\":3,\"session_id\":\"resume-json\",\"created_at_ms\":0,\"updated_at_ms\":0}\n{\"type\":\"message\",\"message\":{\"role\":\"user\",\"blocks\":[{\"type\":\"text\",\"text\":\"hello\"}]}}\n",
+    )
+    .expect("session should write");
     let resumed = assert_json_command(
         &root,
         &[
@@ -289,8 +253,7 @@ fn doctor_and_resume_status_emit_json_when_requested() {
         ],
     );
     assert_eq!(resumed["kind"], "status");
-    // model is null in resume mode (not known without --model flag)
-    assert!(resumed["model"].is_null());
+    assert_eq!(resumed["model"], "restored-session");
     assert_eq!(resumed["usage"]["messages"], 1);
     assert!(resumed["workspace"]["cwd"].as_str().is_some());
     assert!(resumed["sandbox"]["filesystem_mode"].as_str().is_some());
@@ -304,7 +267,12 @@ fn resumed_inventory_commands_emit_structured_json_when_requested() {
     fs::create_dir_all(&config_home).expect("config home should exist");
     fs::create_dir_all(&home).expect("home should exist");
 
-    let session_path = write_session_fixture(&root, "resume-inventory-json", Some("inventory"));
+    let session_path = root.join("session.jsonl");
+    fs::write(
+        &session_path,
+        "{\"type\":\"session_meta\",\"version\":3,\"session_id\":\"resume-inventory-json\",\"created_at_ms\":0,\"updated_at_ms\":0}\n{\"type\":\"message\",\"message\":{\"role\":\"user\",\"blocks\":[{\"type\":\"text\",\"text\":\"inventory\"}]}}\n",
+    )
+    .expect("session should write");
 
     let mcp = assert_json_command_with_env(
         &root,
@@ -355,7 +323,12 @@ fn resumed_version_and_init_emit_structured_json_when_requested() {
     let root = unique_temp_dir("resume-version-init-json");
     fs::create_dir_all(&root).expect("temp dir should exist");
 
-    let session_path = write_session_fixture(&root, "resume-version-init-json", None);
+    let session_path = root.join("session.jsonl");
+    fs::write(
+        &session_path,
+        "{\"type\":\"session_meta\",\"version\":3,\"session_id\":\"resume-version-init-json\",\"created_at_ms\":0,\"updated_at_ms\":0}\n",
+    )
+    .expect("session should write");
 
     let version = assert_json_command(
         &root,
@@ -388,114 +361,6 @@ fn assert_json_command(current_dir: &Path, args: &[&str]) -> Value {
     assert_json_command_with_env(current_dir, args, &[])
 }
 
-/// #247 regression helper: run claw expecting a non-zero exit and return
-/// the JSON error envelope parsed from stderr. Asserts exit != 0 and that
-/// the envelope includes `type: "error"` at the very least.
-fn assert_json_error_envelope(current_dir: &Path, args: &[&str]) -> Value {
-    let output = run_claw(current_dir, args, &[]);
-    assert!(
-        !output.status.success(),
-        "command unexpectedly succeeded; stdout:\n{}\nstderr:\n{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    // The JSON envelope is written to stderr for error cases (see main.rs).
-    let envelope: Value = serde_json::from_slice(&output.stderr).unwrap_or_else(|err| {
-        panic!(
-            "stderr should be a JSON error envelope but failed to parse: {err}\nstderr bytes:\n{}",
-            String::from_utf8_lossy(&output.stderr)
-        )
-    });
-    assert_eq!(
-        envelope["type"], "error",
-        "envelope should carry type=error"
-    );
-    envelope
-}
-
-#[test]
-fn prompt_subcommand_without_arg_emits_cli_parse_envelope_with_hint_247() {
-    // #247: `claw prompt` with no argument must classify as `cli_parse`
-    // (not `unknown`) and the JSON envelope must carry the same actionable
-    // `Run claw --help for usage.` hint that text-mode stderr appends.
-    let root = unique_temp_dir("247-prompt-no-arg");
-    fs::create_dir_all(&root).expect("temp dir should exist");
-
-    let envelope = assert_json_error_envelope(&root, &["--output-format", "json", "prompt"]);
-    assert_eq!(
-        envelope["kind"], "cli_parse",
-        "prompt subcommand without arg should classify as cli_parse, envelope: {envelope}"
-    );
-    assert_eq!(
-        envelope["error"], "prompt subcommand requires a prompt string",
-        "short reason should match the raw error, envelope: {envelope}"
-    );
-    assert_eq!(
-        envelope["hint"],
-        "Run `claw --help` for usage.",
-        "JSON envelope must carry the same help-runbook hint as text mode, envelope: {envelope}"
-    );
-}
-
-#[test]
-fn empty_positional_arg_emits_cli_parse_envelope_247() {
-    // #247: `claw ""` must classify as `cli_parse`, not `unknown`. The
-    // message itself embeds a ``run `claw --help`` pointer so the explicit
-    // hint field is allowed to remain null to avoid duplication — what
-    // matters for the typed-error contract is that `kind == cli_parse`.
-    let root = unique_temp_dir("247-empty-arg");
-    fs::create_dir_all(&root).expect("temp dir should exist");
-
-    let envelope = assert_json_error_envelope(&root, &["--output-format", "json", ""]);
-    assert_eq!(
-        envelope["kind"], "cli_parse",
-        "empty-prompt error should classify as cli_parse, envelope: {envelope}"
-    );
-    let short = envelope["error"]
-        .as_str()
-        .expect("error field should be a string");
-    assert!(
-        short.starts_with("empty prompt:"),
-        "short reason should preserve the original empty-prompt message, got: {short}"
-    );
-}
-
-#[test]
-fn whitespace_only_positional_arg_emits_cli_parse_envelope_247() {
-    // #247: same rule for `claw "   "` — any whitespace-only prompt must
-    // flow through the empty-prompt path and classify as `cli_parse`.
-    let root = unique_temp_dir("247-whitespace-arg");
-    fs::create_dir_all(&root).expect("temp dir should exist");
-
-    let envelope = assert_json_error_envelope(&root, &["--output-format", "json", "   "]);
-    assert_eq!(
-        envelope["kind"], "cli_parse",
-        "whitespace-only prompt should classify as cli_parse, envelope: {envelope}"
-    );
-}
-
-#[test]
-fn unrecognized_argument_still_classifies_as_cli_parse_247_regression_guard() {
-    // #247 regression guard: the new empty-prompt / prompt-subcommand
-    // patterns must NOT hijack the existing #77 unrecognized-argument
-    // classification. `claw doctor --foo` must still surface as cli_parse
-    // with the runbook hint present.
-    let root = unique_temp_dir("247-unrecognized-arg");
-    fs::create_dir_all(&root).expect("temp dir should exist");
-
-    let envelope =
-        assert_json_error_envelope(&root, &["--output-format", "json", "doctor", "--foo"]);
-    assert_eq!(
-        envelope["kind"], "cli_parse",
-        "unrecognized-argument must remain cli_parse, envelope: {envelope}"
-    );
-    assert_eq!(
-        envelope["hint"],
-        "Run `claw --help` for usage.",
-        "unrecognized-argument hint should stay intact, envelope: {envelope}"
-    );
-}
-
 fn assert_json_command_with_env(current_dir: &Path, args: &[&str], envs: &[(&str, &str)]) -> Value {
     let output = run_claw(current_dir, args, envs);
     assert!(
@@ -539,24 +404,6 @@ fn write_upstream_fixture(root: &Path) -> PathBuf {
     upstream
 }
 
-fn write_session_fixture(root: &Path, session_id: &str, user_text: Option<&str>) -> PathBuf {
-    let session_path = root.join("session.jsonl");
-    let mut session = Session::new()
-        .with_workspace_root(root.to_path_buf())
-        .with_persistence_path(session_path.clone());
-    session.session_id = session_id.to_string();
-    if let Some(text) = user_text {
-        session
-            .push_user_text(text)
-            .expect("session fixture message should persist");
-    } else {
-        session
-            .save_to_path(&session_path)
-            .expect("session fixture should persist");
-    }
-    session_path
-}
-
 fn write_agent(root: &Path, name: &str, description: &str, model: &str, reasoning: &str) {
     fs::create_dir_all(root).expect("agent root should exist");
     fs::write(

rust/crates/rusty-claude-cli/tests/resume_slash_commands.rs

@@ -20,7 +20,7 @@ fn resumed_binary_accepts_slash_commands_with_arguments() {
     let session_path = temp_dir.join("session.jsonl");
     let export_path = temp_dir.join("notes.txt");
 
-    let mut session = workspace_session(&temp_dir);
+    let mut session = Session::new();
     session
         .push_user_text("ship the slash command harness")
         .expect("session write should succeed");
@@ -122,7 +122,7 @@ fn resumed_config_command_loads_settings_files_end_to_end() {
     fs::create_dir_all(&config_home).expect("config home should exist");
 
     let session_path = project_dir.join("session.jsonl");
-    workspace_session(&project_dir)
+    Session::new()
         .with_persistence_path(&session_path)
         .save_to_path(&session_path)
         .expect("session should persist");
@@ -180,13 +180,13 @@ fn resume_latest_restores_the_most_recent_managed_session() {
     // given
     let temp_dir = unique_temp_dir("resume-latest");
     let project_dir = temp_dir.join("project");
-    fs::create_dir_all(&project_dir).expect("project dir should exist");
-    let project_dir = fs::canonicalize(&project_dir).unwrap_or(project_dir);
-    let store = runtime::SessionStore::from_cwd(&project_dir).expect("session store should build");
-    let older_path = store.create_handle("session-older").path;
-    let newer_path = store.create_handle("session-newer").path;
+    let sessions_dir = project_dir.join(".claw").join("sessions");
+    fs::create_dir_all(&sessions_dir).expect("sessions dir should exist");
 
-    let mut older = workspace_session(&project_dir).with_persistence_path(&older_path);
+    let older_path = sessions_dir.join("session-older.jsonl");
+    let newer_path = sessions_dir.join("session-newer.jsonl");
+
+    let mut older = Session::new().with_persistence_path(&older_path);
     older
         .push_user_text("older session")
         .expect("older session write should succeed");
@@ -194,7 +194,7 @@ fn resume_latest_restores_the_most_recent_managed_session() {
         .save_to_path(&older_path)
         .expect("older session should persist");
 
-    let mut newer = workspace_session(&project_dir).with_persistence_path(&newer_path);
+    let mut newer = Session::new().with_persistence_path(&newer_path);
     newer
         .push_user_text("newer session")
         .expect("newer session write should succeed");
@@ -229,7 +229,7 @@ fn resumed_status_command_emits_structured_json_when_requested() {
     fs::create_dir_all(&temp_dir).expect("temp dir should exist");
     let session_path = temp_dir.join("session.jsonl");
 
-    let mut session = workspace_session(&temp_dir);
+    let mut session = Session::new();
     session
         .push_user_text("resume status json fixture")
         .expect("session write should succeed");
@@ -261,8 +261,7 @@ fn resumed_status_command_emits_structured_json_when_requested() {
     let parsed: Value =
         serde_json::from_str(stdout.trim()).expect("resume status output should be json");
     assert_eq!(parsed["kind"], "status");
-    // model is null in resume mode (not known without --model flag)
-    assert!(parsed["model"].is_null());
+    assert_eq!(parsed["model"], "restored-session");
     assert_eq!(parsed["permission_mode"], "danger-full-access");
     assert_eq!(parsed["usage"]["messages"], 1);
     assert!(parsed["usage"]["turns"].is_number());
@@ -276,47 +275,6 @@ fn resumed_status_command_emits_structured_json_when_requested() {
     assert!(parsed["sandbox"]["filesystem_mode"].as_str().is_some());
 }
 
-#[test]
-fn resumed_status_surfaces_persisted_model() {
-    // given — create a session with model already set
-    let temp_dir = unique_temp_dir("resume-status-model");
-    fs::create_dir_all(&temp_dir).expect("temp dir should exist");
-    let session_path = temp_dir.join("session.jsonl");
-
-    let mut session = workspace_session(&temp_dir);
-    session.model = Some("claude-sonnet-4-6".to_string());
-    session
-        .push_user_text("model persistence fixture")
-        .expect("write ok");
-    session.save_to_path(&session_path).expect("persist ok");
-
-    // when
-    let output = run_claw(
-        &temp_dir,
-        &[
-            "--output-format",
-            "json",
-            "--resume",
-            session_path.to_str().expect("utf8 path"),
-            "/status",
-        ],
-    );
-
-    // then
-    assert!(
-        output.status.success(),
-        "stderr:\n{}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("utf8");
-    let parsed: Value = serde_json::from_str(stdout.trim()).expect("should be json");
-    assert_eq!(parsed["kind"], "status");
-    assert_eq!(
-        parsed["model"], "claude-sonnet-4-6",
-        "model should round-trip through session metadata"
-    );
-}
-
 #[test]
 fn resumed_sandbox_command_emits_structured_json_when_requested() {
     // given
@@ -324,7 +282,7 @@ fn resumed_sandbox_command_emits_structured_json_when_requested() {
     fs::create_dir_all(&temp_dir).expect("temp dir should exist");
     let session_path = temp_dir.join("session.jsonl");
 
-    workspace_session(&temp_dir)
+    Session::new()
         .save_to_path(&session_path)
         .expect("session should persist");
 
@@ -360,183 +318,10 @@ fn resumed_sandbox_command_emits_structured_json_when_requested() {
     assert!(parsed["markers"].is_array());
 }
 
-#[test]
-fn resumed_version_command_emits_structured_json() {
-    let temp_dir = unique_temp_dir("resume-version-json");
-    fs::create_dir_all(&temp_dir).expect("temp dir should exist");
-    let session_path = temp_dir.join("session.jsonl");
-    workspace_session(&temp_dir)
-        .save_to_path(&session_path)
-        .expect("session should persist");
-
-    let output = run_claw(
-        &temp_dir,
-        &[
-            "--output-format",
-            "json",
-            "--resume",
-            session_path.to_str().expect("utf8 path"),
-            "/version",
-        ],
-    );
-
-    assert!(
-        output.status.success(),
-        "stderr:\n{}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("utf8");
-    let parsed: Value = serde_json::from_str(stdout.trim()).expect("should be json");
-    assert_eq!(parsed["kind"], "version");
-    assert!(parsed["version"].as_str().is_some());
-    assert!(parsed["git_sha"].as_str().is_some());
-    assert!(parsed["target"].as_str().is_some());
-}
-
-#[test]
-fn resumed_export_command_emits_structured_json() {
-    let temp_dir = unique_temp_dir("resume-export-json");
-    fs::create_dir_all(&temp_dir).expect("temp dir should exist");
-    let session_path = temp_dir.join("session.jsonl");
-    let mut session = workspace_session(&temp_dir);
-    session
-        .push_user_text("export json fixture")
-        .expect("write ok");
-    session.save_to_path(&session_path).expect("persist ok");
-
-    let output = run_claw(
-        &temp_dir,
-        &[
-            "--output-format",
-            "json",
-            "--resume",
-            session_path.to_str().expect("utf8 path"),
-            "/export",
-        ],
-    );
-
-    assert!(
-        output.status.success(),
-        "stderr:\n{}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("utf8");
-    let parsed: Value = serde_json::from_str(stdout.trim()).expect("should be json");
-    assert_eq!(parsed["kind"], "export");
-    assert!(parsed["file"].as_str().is_some());
-    assert_eq!(parsed["message_count"], 1);
-}
-
-#[test]
-fn resumed_help_command_emits_structured_json() {
-    let temp_dir = unique_temp_dir("resume-help-json");
-    fs::create_dir_all(&temp_dir).expect("temp dir should exist");
-    let session_path = temp_dir.join("session.jsonl");
-    workspace_session(&temp_dir)
-        .save_to_path(&session_path)
-        .expect("persist ok");
-
-    let output = run_claw(
-        &temp_dir,
-        &[
-            "--output-format",
-            "json",
-            "--resume",
-            session_path.to_str().expect("utf8 path"),
-            "/help",
-        ],
-    );
-
-    assert!(
-        output.status.success(),
-        "stderr:\n{}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("utf8");
-    let parsed: Value = serde_json::from_str(stdout.trim()).expect("should be json");
-    assert_eq!(parsed["kind"], "help");
-    assert!(parsed["text"].as_str().is_some());
-    let text = parsed["text"].as_str().unwrap();
-    assert!(text.contains("/status"), "help text should list /status");
-}
-
-#[test]
-fn resumed_no_command_emits_restored_json() {
-    let temp_dir = unique_temp_dir("resume-no-cmd-json");
-    fs::create_dir_all(&temp_dir).expect("temp dir should exist");
-    let session_path = temp_dir.join("session.jsonl");
-    let mut session = workspace_session(&temp_dir);
-    session
-        .push_user_text("restored json fixture")
-        .expect("write ok");
-    session.save_to_path(&session_path).expect("persist ok");
-
-    let output = run_claw(
-        &temp_dir,
-        &[
-            "--output-format",
-            "json",
-            "--resume",
-            session_path.to_str().expect("utf8 path"),
-        ],
-    );
-
-    assert!(
-        output.status.success(),
-        "stderr:\n{}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("utf8");
-    let parsed: Value = serde_json::from_str(stdout.trim()).expect("should be json");
-    assert_eq!(parsed["kind"], "restored");
-    assert!(parsed["session_id"].as_str().is_some());
-    assert!(parsed["path"].as_str().is_some());
-    assert_eq!(parsed["message_count"], 1);
-}
-
-#[test]
-fn resumed_stub_command_emits_not_implemented_json() {
-    let temp_dir = unique_temp_dir("resume-stub-json");
-    fs::create_dir_all(&temp_dir).expect("temp dir should exist");
-    let session_path = temp_dir.join("session.jsonl");
-    workspace_session(&temp_dir)
-        .save_to_path(&session_path)
-        .expect("persist ok");
-
-    let output = run_claw(
-        &temp_dir,
-        &[
-            "--output-format",
-            "json",
-            "--resume",
-            session_path.to_str().expect("utf8 path"),
-            "/allowed-tools",
-        ],
-    );
-
-    // Stub commands exit with code 2
-    assert!(!output.status.success());
-    let stderr = String::from_utf8(output.stderr).expect("utf8");
-    let parsed: Value = serde_json::from_str(stderr.trim()).expect("should be json");
-    assert_eq!(parsed["type"], "error");
-    assert!(
-        parsed["error"]
-            .as_str()
-            .unwrap()
-            .contains("not yet implemented"),
-        "error should say not yet implemented: {:?}",
-        parsed["error"]
-    );
-}
-
 fn run_claw(current_dir: &Path, args: &[&str]) -> Output {
     run_claw_with_env(current_dir, args, &[])
 }
 
-fn workspace_session(root: &Path) -> Session {
-    Session::new().with_workspace_root(root.to_path_buf())
-}
-
 fn run_claw_with_env(current_dir: &Path, args: &[&str], envs: &[(&str, &str)]) -> Output {
     let mut command = Command::new(env!("CARGO_BIN_EXE_claw"));
     command.current_dir(current_dir).args(args);

src/__init__.py

@@ -5,16 +5,7 @@ from .parity_audit import ParityAuditResult, run_parity_audit
 from .port_manifest import PortManifest, build_port_manifest
 from .query_engine import QueryEnginePort, TurnResult
 from .runtime import PortRuntime, RuntimeSession
-from .session_store import (
-    SessionDeleteError,
-    SessionNotFoundError,
-    StoredSession,
-    delete_session,
-    list_sessions,
-    load_session,
-    save_session,
-    session_exists,
-)
+from .session_store import StoredSession, load_session, save_session
 from .system_init import build_system_init_message
 from .tools import PORTED_TOOLS, build_tool_backlog
 
@@ -24,8 +15,6 @@ __all__ = [
     'PortRuntime',
     'QueryEnginePort',
     'RuntimeSession',
-    'SessionDeleteError',
-    'SessionNotFoundError',
     'StoredSession',
     'TurnResult',
     'PORTED_COMMANDS',
@@ -34,10 +23,7 @@ __all__ = [
     'build_port_manifest',
     'build_system_init_message',
     'build_tool_backlog',
-    'delete_session',
-    'list_sessions',
     'load_session',
     'run_parity_audit',
     'save_session',
-    'session_exists',
 ]

src/main.py

@@ -12,48 +12,22 @@ from .port_manifest import build_port_manifest
 from .query_engine import QueryEnginePort
 from .remote_runtime import run_remote_mode, run_ssh_mode, run_teleport_mode
 from .runtime import PortRuntime
-from .session_store import (
-    SessionDeleteError,
-    SessionNotFoundError,
-    delete_session,
-    list_sessions,
-    load_session,
-    session_exists,
-)
+from .session_store import load_session
 from .setup import run_setup
 from .tool_pool import assemble_tool_pool
 from .tools import execute_tool, get_tool, get_tools, render_tool_index
 
 
-def wrap_json_envelope(data: dict, command: str, exit_code: int = 0) -> dict:
-    """Wrap command output in canonical JSON envelope per SCHEMAS.md."""
-    from datetime import datetime, timezone
-    now_utc = datetime.now(timezone.utc).isoformat(timespec='seconds').replace('+00:00', 'Z')
-    return {
-        'timestamp': now_utc,
-        'command': command,
-        'exit_code': exit_code,
-        'output_format': 'json',
-        'schema_version': '1.0',
-        **data,
-    }
-
-
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(description='Python porting workspace for the Claude Code rewrite effort')
-    # #180: Add --version flag to match canonical CLI contract
-    parser.add_argument('--version', action='version', version='claw-code 1.0.0 (Python harness)')
     subparsers = parser.add_subparsers(dest='command', required=True)
     subparsers.add_parser('summary', help='render a Markdown summary of the Python porting workspace')
     subparsers.add_parser('manifest', help='print the current Python workspace manifest')
     subparsers.add_parser('parity-audit', help='compare the Python workspace against the local ignored TypeScript archive when available')
     subparsers.add_parser('setup-report', help='render the startup/prefetch setup report')
-    command_graph_parser = subparsers.add_parser('command-graph', help='show command graph segmentation')
-    command_graph_parser.add_argument('--output-format', choices=['text', 'json'], default='text')
-    tool_pool_parser = subparsers.add_parser('tool-pool', help='show assembled tool pool with default settings')
-    tool_pool_parser.add_argument('--output-format', choices=['text', 'json'], default='text')
-    bootstrap_graph_parser = subparsers.add_parser('bootstrap-graph', help='show the mirrored bootstrap/runtime graph stages')
-    bootstrap_graph_parser.add_argument('--output-format', choices=['text', 'json'], default='text')
+    subparsers.add_parser('command-graph', help='show command graph segmentation')
+    subparsers.add_parser('tool-pool', help='show assembled tool pool with default settings')
+    subparsers.add_parser('bootstrap-graph', help='show the mirrored bootstrap/runtime graph stages')
     list_parser = subparsers.add_parser('subsystems', help='list the current Python modules in the workspace')
     list_parser.add_argument('--limit', type=int, default=32)
 
@@ -74,104 +48,22 @@ def build_parser() -> argparse.ArgumentParser:
     route_parser = subparsers.add_parser('route', help='route a prompt across mirrored command/tool inventories')
     route_parser.add_argument('prompt')
     route_parser.add_argument('--limit', type=int, default=5)
-    # #168: parity with show-command/show-tool/session-lifecycle CLI family
-    route_parser.add_argument('--output-format', choices=['text', 'json'], default='text')
 
     bootstrap_parser = subparsers.add_parser('bootstrap', help='build a runtime-style session report from the mirrored inventories')
     bootstrap_parser.add_argument('prompt')
     bootstrap_parser.add_argument('--limit', type=int, default=5)
-    # #168: parity with CLI family
-    bootstrap_parser.add_argument('--output-format', choices=['text', 'json'], default='text')
 
     loop_parser = subparsers.add_parser('turn-loop', help='run a small stateful turn loop for the mirrored runtime')
     loop_parser.add_argument('prompt')
     loop_parser.add_argument('--limit', type=int, default=5)
     loop_parser.add_argument('--max-turns', type=int, default=3)
     loop_parser.add_argument('--structured-output', action='store_true')
-    loop_parser.add_argument(
-        '--timeout-seconds',
-        type=float,
-        default=None,
-        help='total wall-clock budget across all turns (#161). Default: unbounded.',
-    )
-    loop_parser.add_argument(
-        '--continuation-prompt',
-        default=None,
-        help=(
-            'prompt to submit on turns after the first (#163). Default: None '
-            '(loop stops after turn 0). Replaces the deprecated implicit "[turn N]" '
-            'suffix that used to pollute the transcript.'
-        ),
-    )
-    loop_parser.add_argument(
-        '--output-format',
-        choices=['text', 'json'],
-        default='text',
-        help='output format (#164 Stage B: JSON includes cancel_observed per turn)',
-    )
 
-    flush_parser = subparsers.add_parser(
-        'flush-transcript',
-        help='persist and flush a temporary session transcript (#160/#166: claw-native session API)',
-    )
+    flush_parser = subparsers.add_parser('flush-transcript', help='persist and flush a temporary session transcript')
     flush_parser.add_argument('prompt')
-    flush_parser.add_argument(
-        '--directory', help='session storage directory (default: .port_sessions)'
-    )
-    flush_parser.add_argument(
-        '--output-format',
-        choices=['text', 'json'],
-        default='text',
-        help='output format',
-    )
-    flush_parser.add_argument(
-        '--session-id',
-        help='deterministic session ID (default: auto-generated UUID)',
-    )
 
-    load_session_parser = subparsers.add_parser(
-        'load-session',
-        help='load a previously persisted session (#160/#165: claw-native session API)',
-    )
+    load_session_parser = subparsers.add_parser('load-session', help='load a previously persisted session')
     load_session_parser.add_argument('session_id')
-    load_session_parser.add_argument(
-        '--directory', help='session storage directory (default: .port_sessions)'
-    )
-    load_session_parser.add_argument(
-        '--output-format',
-        choices=['text', 'json'],
-        default='text',
-        help='output format',
-    )
-
-    list_sessions_parser = subparsers.add_parser(
-        'list-sessions',
-        help='enumerate stored session IDs (#160: claw-native session API)',
-    )
-    list_sessions_parser.add_argument(
-        '--directory', help='session storage directory (default: .port_sessions)'
-    )
-    list_sessions_parser.add_argument(
-        '--output-format',
-        choices=['text', 'json'],
-        default='text',
-        help='output format',
-    )
-
-    delete_session_parser = subparsers.add_parser(
-        'delete-session',
-        help='delete a persisted session (#160: idempotent, race-safe)',
-    )
-    delete_session_parser.add_argument('session_id')
-    delete_session_parser.add_argument(
-        '--directory', help='session storage directory (default: .port_sessions)'
-    )
-    delete_session_parser.add_argument(
-        '--output-format',
-        choices=['text', 'json'],
-        default='text',
-        help='output format',
-    )
 
     remote_parser = subparsers.add_parser('remote-mode', help='simulate remote-control runtime branching')
     remote_parser.add_argument('target')
@@ -186,112 +78,22 @@ def build_parser() -> argparse.ArgumentParser:
 
     show_command = subparsers.add_parser('show-command', help='show one mirrored command entry by exact name')
     show_command.add_argument('name')
-    show_command.add_argument('--output-format', choices=['text', 'json'], default='text')
     show_tool = subparsers.add_parser('show-tool', help='show one mirrored tool entry by exact name')
     show_tool.add_argument('name')
-    show_tool.add_argument('--output-format', choices=['text', 'json'], default='text')
 
     exec_command_parser = subparsers.add_parser('exec-command', help='execute a mirrored command shim by exact name')
     exec_command_parser.add_argument('name')
     exec_command_parser.add_argument('prompt')
-    # #168: parity with CLI family
-    exec_command_parser.add_argument('--output-format', choices=['text', 'json'], default='text')
 
     exec_tool_parser = subparsers.add_parser('exec-tool', help='execute a mirrored tool shim by exact name')
     exec_tool_parser.add_argument('name')
     exec_tool_parser.add_argument('payload')
-    # #168: parity with CLI family
-    exec_tool_parser.add_argument('--output-format', choices=['text', 'json'], default='text')
     return parser
 
 
-class _ArgparseError(Exception):
-    """#179: internal exception capturing argparse's real error message.
-
-    Subclassed ArgumentParser raises this instead of printing + exiting,
-    so JSON mode can preserve the actual error (e.g. 'the following arguments
-    are required: session_id') in the envelope.
-    """
-    def __init__(self, message: str) -> None:
-        super().__init__(message)
-        self.message = message
-
-
-def _emit_parse_error_envelope(argv: list[str], message: str) -> None:
-    """#178/#179: emit JSON envelope for argparse-level errors when --output-format json is requested.
-
-    Pre-scans argv for --output-format json. If found, prints a parse-error envelope
-    to stdout (per SCHEMAS.md 'error' envelope shape) instead of letting argparse
-    dump help text to stderr. This preserves the JSON contract for claws that can't
-    parse argparse usage messages.
-
-    #179 update: `message` now carries argparse's actual error text, not a generic
-    rejection string. Stderr is fully suppressed in JSON mode.
-    """
-    import json
-    # Extract the attempted command (argv[0] is the first positional)
-    attempted = argv[0] if argv and not argv[0].startswith('-') else '<missing>'
-    envelope = wrap_json_envelope(
-        {
-            'error': {
-                'kind': 'parse',
-                'operation': 'argparse',
-                'target': attempted,
-                'retryable': False,
-                'message': message,
-                'hint': 'run with no arguments to see available subcommands',
-            },
-        },
-        command=attempted,
-        exit_code=1,
-    )
-    print(json.dumps(envelope))
-
-
-def _wants_json_output(argv: list[str]) -> bool:
-    """#178: check if argv contains --output-format json anywhere (for parse-error routing)."""
-    for i, arg in enumerate(argv):
-        if arg == '--output-format' and i + 1 < len(argv) and argv[i + 1] == 'json':
-            return True
-        if arg == '--output-format=json':
-            return True
-    return False
-
-
 def main(argv: list[str] | None = None) -> int:
-    import sys
-    if argv is None:
-        argv = sys.argv[1:]
     parser = build_parser()
-    json_mode = _wants_json_output(argv)
-    # #178/#179: capture argparse errors with real message and emit JSON envelope
-    # when --output-format json is requested. In JSON mode, stderr is silenced
-    # so claws only see the envelope on stdout.
-    if json_mode:
-        # Monkey-patch parser.error to raise instead of print+exit. This preserves
-        # the original error message text (e.g. 'argument X: invalid choice: ...').
-        original_error = parser.error
-        def _json_mode_error(message: str) -> None:
-            raise _ArgparseError(message)
-        parser.error = _json_mode_error  # type: ignore[method-assign]
-        # Also patch all subparsers
-        for action in parser._actions:
-            if hasattr(action, 'choices') and isinstance(action.choices, dict):
-                for subp in action.choices.values():
-                    subp.error = _json_mode_error  # type: ignore[method-assign]
-        try:
-            args = parser.parse_args(argv)
-        except _ArgparseError as err:
-            _emit_parse_error_envelope(argv, err.message)
-            return 1
-        except SystemExit as exc:
-            # Defensive: if argparse exits via some other path (e.g. --help in JSON mode)
-            if exc.code != 0:
-                _emit_parse_error_envelope(argv, 'argparse exited with non-zero code')
-                return 1
-            raise
-    else:
-        args = parser.parse_args(argv)
+    args = parser.parse_args(argv)
     manifest = build_port_manifest()
     if args.command == 'summary':
         print(QueryEnginePort(manifest).render_summary())
@@ -306,44 +108,13 @@ def main(argv: list[str] | None = None) -> int:
         print(run_setup().as_markdown())
         return 0
     if args.command == 'command-graph':
-        graph = build_command_graph()
-        if args.output_format == 'json':
-            import json
-            envelope = {
-                'builtins_count': len(graph.builtins),
-                'plugin_like_count': len(graph.plugin_like),
-                'skill_like_count': len(graph.skill_like),
-                'total_count': len(graph.flattened()),
-                'builtins': [{'name': m.name, 'source_hint': m.source_hint} for m in graph.builtins],
-                'plugin_like': [{'name': m.name, 'source_hint': m.source_hint} for m in graph.plugin_like],
-                'skill_like': [{'name': m.name, 'source_hint': m.source_hint} for m in graph.skill_like],
-            }
-            print(json.dumps(wrap_json_envelope(envelope, args.command)))
-        else:
-            print(graph.as_markdown())
+        print(build_command_graph().as_markdown())
         return 0
     if args.command == 'tool-pool':
-        pool = assemble_tool_pool()
-        if args.output_format == 'json':
-            import json
-            envelope = {
-                'simple_mode': pool.simple_mode,
-                'include_mcp': pool.include_mcp,
-                'tool_count': len(pool.tools),
-                'tools': [{'name': t.name, 'source_hint': t.source_hint} for t in pool.tools],
-            }
-            print(json.dumps(wrap_json_envelope(envelope, args.command)))
-        else:
-            print(pool.as_markdown())
+        print(assemble_tool_pool().as_markdown())
         return 0
     if args.command == 'bootstrap-graph':
-        graph = build_bootstrap_graph()
-        if args.output_format == 'json':
-            import json
-            envelope = {'stages': graph.as_markdown().split('\n'), 'note': 'bootstrap-graph is markdown-only in this version'}
-            print(json.dumps(wrap_json_envelope(envelope, args.command)))
-        else:
-            print(graph.as_markdown())
+        print(build_bootstrap_graph().as_markdown())
         return 0
     if args.command == 'subsystems':
         for subsystem in manifest.top_level_modules[: args.limit]:
@@ -370,25 +141,6 @@ def main(argv: list[str] | None = None) -> int:
         return 0
     if args.command == 'route':
         matches = PortRuntime().route_prompt(args.prompt, limit=args.limit)
-        # #168: JSON envelope for machine parsing
-        if args.output_format == 'json':
-            import json
-            envelope = {
-                'prompt': args.prompt,
-                'limit': args.limit,
-                'match_count': len(matches),
-                'matches': [
-                    {
-                        'kind': m.kind,
-                        'name': m.name,
-                        'score': m.score,
-                        'source_hint': m.source_hint,
-                    }
-                    for m in matches
-                ],
-            }
-            print(json.dumps(wrap_json_envelope(envelope, args.command)))
-            return 0
         if not matches:
             print('No mirrored command/tool matches found.')
             return 0
@@ -396,220 +148,25 @@ def main(argv: list[str] | None = None) -> int:
             print(f'{match.kind}\t{match.name}\t{match.score}\t{match.source_hint}')
         return 0
     if args.command == 'bootstrap':
-        session = PortRuntime().bootstrap_session(args.prompt, limit=args.limit)
-        # #168: JSON envelope for machine parsing
-        if args.output_format == 'json':
-            import json
-            envelope = {
-                'prompt': session.prompt,
-                'limit': args.limit,
-                'setup': {
-                    'python_version': session.setup.python_version,
-                    'implementation': session.setup.implementation,
-                    'platform_name': session.setup.platform_name,
-                    'test_command': session.setup.test_command,
-                },
-                'routed_matches': [
-                    {
-                        'kind': m.kind,
-                        'name': m.name,
-                        'score': m.score,
-                        'source_hint': m.source_hint,
-                    }
-                    for m in session.routed_matches
-                ],
-                'command_execution_messages': list(session.command_execution_messages),
-                'tool_execution_messages': list(session.tool_execution_messages),
-                'turn': {
-                    'prompt': session.turn_result.prompt,
-                    'output': session.turn_result.output,
-                    'stop_reason': session.turn_result.stop_reason,
-                    'cancel_observed': session.turn_result.cancel_observed,
-                },
-                'persisted_session_path': session.persisted_session_path,
-            }
-            print(json.dumps(wrap_json_envelope(envelope, args.command)))
-            return 0
-        print(session.as_markdown())
+        print(PortRuntime().bootstrap_session(args.prompt, limit=args.limit).as_markdown())
         return 0
     if args.command == 'turn-loop':
-        results = PortRuntime().run_turn_loop(
-            args.prompt,
-            limit=args.limit,
-            max_turns=args.max_turns,
-            structured_output=args.structured_output,
-            timeout_seconds=args.timeout_seconds,
-            continuation_prompt=args.continuation_prompt,
-        )
-        # Exit 2 when a timeout terminated the loop so claws can distinguish
-        # 'ran to completion' from 'hit wall-clock budget'.
-        loop_exit_code = 2 if results and results[-1].stop_reason == 'timeout' else 0
-        if args.output_format == 'json':
-            # #164 Stage B + #173: JSON envelope with per-turn cancel_observed
-            # Promotes turn-loop from OPT_OUT to CLAWABLE surface.
-            import json
-            envelope = {
-                'prompt': args.prompt,
-                'max_turns': args.max_turns,
-                'turns_completed': len(results),
-                'timeout_seconds': args.timeout_seconds,
-                'continuation_prompt': args.continuation_prompt,
-                'turns': [
-                    {
-                        'prompt': r.prompt,
-                        'output': r.output,
-                        'stop_reason': r.stop_reason,
-                        'cancel_observed': r.cancel_observed,
-                        'matched_commands': list(r.matched_commands),
-                        'matched_tools': list(r.matched_tools),
-                    }
-                    for r in results
-                ],
-                'final_stop_reason': results[-1].stop_reason if results else None,
-                'final_cancel_observed': results[-1].cancel_observed if results else False,
-            }
-            print(json.dumps(wrap_json_envelope(envelope, args.command, exit_code=loop_exit_code)))
-            return loop_exit_code
+        results = PortRuntime().run_turn_loop(args.prompt, limit=args.limit, max_turns=args.max_turns, structured_output=args.structured_output)
         for idx, result in enumerate(results, start=1):
             print(f'## Turn {idx}')
             print(result.output)
             print(f'stop_reason={result.stop_reason}')
-        return loop_exit_code
+        return 0
     if args.command == 'flush-transcript':
-        from pathlib import Path as _Path
         engine = QueryEnginePort.from_workspace()
-        # #166: allow deterministic session IDs for claw checkpointing/replay.
-        # When unset, the engine's auto-generated UUID is used (backward compat).
-        if args.session_id:
-            engine.session_id = args.session_id
         engine.submit_message(args.prompt)
-        directory = _Path(args.directory) if args.directory else None
-        path = engine.persist_session(directory)
-        if args.output_format == 'json':
-            import json as _json
-            _env = {
-                'session_id': engine.session_id,
-                'path': path,
-                'flushed': engine.transcript_store.flushed,
-                'messages_count': len(engine.mutable_messages),
-                'input_tokens': engine.total_usage.input_tokens,
-                'output_tokens': engine.total_usage.output_tokens,
-            }
-            print(_json.dumps(wrap_json_envelope(_env, args.command)))
-        else:
-            # #166: legacy text output preserved byte-for-byte for backward compat.
-            print(path)
-            print(f'flushed={engine.transcript_store.flushed}')
+        path = engine.persist_session()
+        print(path)
+        print(f'flushed={engine.transcript_store.flushed}')
         return 0
     if args.command == 'load-session':
-        from pathlib import Path as _Path
-        directory = _Path(args.directory) if args.directory else None
-        # #165: catch typed SessionNotFoundError + surface a JSON error envelope
-        # matching the delete-session contract shape. No more raw tracebacks.
-        try:
-            session = load_session(args.session_id, directory)
-        except SessionNotFoundError as exc:
-            if args.output_format == 'json':
-                import json as _json
-                resolved_dir = str(directory) if directory else '.port_sessions'
-                _env = {
-                    'session_id': args.session_id,
-                    'loaded': False,
-                    'error': {
-                        'kind': 'session_not_found',
-                        'message': str(exc),
-                        'directory': resolved_dir,
-                        'retryable': False,
-                    },
-                }
-                print(_json.dumps(wrap_json_envelope(_env, args.command, exit_code=1)))
-            else:
-                print(f'error: {exc}')
-            return 1
-        except (OSError, ValueError) as exc:
-            # Corrupted session file, IO error, JSON decode error — distinct
-            # from 'not found'. Callers may retry here (fs glitch).
-            if args.output_format == 'json':
-                import json as _json
-                resolved_dir = str(directory) if directory else '.port_sessions'
-                _env = {
-                    'session_id': args.session_id,
-                    'loaded': False,
-                    'error': {
-                        'kind': 'session_load_failed',
-                        'message': str(exc),
-                        'directory': resolved_dir,
-                        'retryable': True,
-                    },
-                }
-                print(_json.dumps(wrap_json_envelope(_env, args.command, exit_code=1)))
-            else:
-                print(f'error: {exc}')
-            return 1
-        if args.output_format == 'json':
-            import json as _json
-            _env = {
-                'session_id': session.session_id,
-                'loaded': True,
-                'messages_count': len(session.messages),
-                'input_tokens': session.input_tokens,
-                'output_tokens': session.output_tokens,
-            }
-            print(_json.dumps(wrap_json_envelope(_env, args.command)))
-        else:
-            print(f'{session.session_id}\n{len(session.messages)} messages\nin={session.input_tokens} out={session.output_tokens}')
-        return 0
-    if args.command == 'list-sessions':
-        from pathlib import Path as _Path
-        directory = _Path(args.directory) if args.directory else None
-        ids = list_sessions(directory)
-        if args.output_format == 'json':
-            import json as _json
-            _env = {'sessions': ids, 'count': len(ids)}
-            print(_json.dumps(wrap_json_envelope(_env, args.command)))
-        else:
-            if not ids:
-                print('(no sessions)')
-            else:
-                for sid in ids:
-                    print(sid)
-        return 0
-    if args.command == 'delete-session':
-        from pathlib import Path as _Path
-        directory = _Path(args.directory) if args.directory else None
-        try:
-            deleted = delete_session(args.session_id, directory)
-        except SessionDeleteError as exc:
-            if args.output_format == 'json':
-                import json as _json
-                _env = {
-                    'session_id': args.session_id,
-                    'deleted': False,
-                    'error': {
-                        'kind': 'session_delete_failed',
-                        'message': str(exc),
-                        'retryable': True,
-                    },
-                }
-                print(_json.dumps(wrap_json_envelope(_env, args.command, exit_code=1)))
-            else:
-                print(f'error: {exc}')
-            return 1
-        if args.output_format == 'json':
-            import json as _json
-            _env = {
-                'session_id': args.session_id,
-                'deleted': deleted,
-                'status': 'deleted' if deleted else 'not_found',
-            }
-            print(_json.dumps(wrap_json_envelope(_env, args.command)))
-        else:
-            if deleted:
-                print(f'deleted: {args.session_id}')
-            else:
-                print(f'not found: {args.session_id}')
-        # Exit 0 for both cases — delete_session is idempotent,
-        # not-found is success from a cleanup perspective
+        session = load_session(args.session_id)
+        print(f'{session.session_id}\n{len(session.messages)} messages\nin={session.input_tokens} out={session.output_tokens}')
         return 0
     if args.command == 'remote-mode':
         print(run_remote_mode(args.target).as_text())
@@ -629,123 +186,25 @@ def main(argv: list[str] | None = None) -> int:
     if args.command == 'show-command':
         module = get_command(args.name)
         if module is None:
-            if args.output_format == 'json':
-                import json
-                error_envelope = {
-                    'name': args.name,
-                    'found': False,
-                    'error': {
-                        'kind': 'command_not_found',
-                        'message': f'Unknown command: {args.name}',
-                        'retryable': False,
-                    },
-                }
-                print(json.dumps(wrap_json_envelope(error_envelope, args.command, exit_code=1)))
-            else:
-                print(f'Command not found: {args.name}')
+            print(f'Command not found: {args.name}')
             return 1
-        if args.output_format == 'json':
-            import json
-            output = {
-                'name': module.name,
-                'found': True,
-                'source_hint': module.source_hint,
-                'responsibility': module.responsibility,
-            }
-            print(json.dumps(wrap_json_envelope(output, args.command)))
-        else:
-            print('\n'.join([module.name, module.source_hint, module.responsibility]))
+        print('\n'.join([module.name, module.source_hint, module.responsibility]))
         return 0
     if args.command == 'show-tool':
         module = get_tool(args.name)
         if module is None:
-            if args.output_format == 'json':
-                import json
-                error_envelope = {
-                    'name': args.name,
-                    'found': False,
-                    'error': {
-                        'kind': 'tool_not_found',
-                        'message': f'Unknown tool: {args.name}',
-                        'retryable': False,
-                    },
-                }
-                print(json.dumps(wrap_json_envelope(error_envelope, args.command, exit_code=1)))
-            else:
-                print(f'Tool not found: {args.name}')
+            print(f'Tool not found: {args.name}')
             return 1
-        if args.output_format == 'json':
-            import json
-            output = {
-                'name': module.name,
-                'found': True,
-                'source_hint': module.source_hint,
-                'responsibility': module.responsibility,
-            }
-            print(json.dumps(wrap_json_envelope(output, args.command)))
-        else:
-            print('\n'.join([module.name, module.source_hint, module.responsibility]))
+        print('\n'.join([module.name, module.source_hint, module.responsibility]))
         return 0
     if args.command == 'exec-command':
         result = execute_command(args.name, args.prompt)
-        # #168: JSON envelope with typed not-found error
-        # #181: envelope exit_code must match process exit code
-        exit_code = 0 if result.handled else 1
-        if args.output_format == 'json':
-            import json
-            if not result.handled:
-                envelope = {
-                    'name': args.name,
-                    'prompt': args.prompt,
-                    'handled': False,
-                    'error': {
-                        'kind': 'command_not_found',
-                        'message': result.message,
-                        'retryable': False,
-                    },
-                }
-            else:
-                envelope = {
-                    'name': result.name,
-                    'prompt': result.prompt,
-                    'source_hint': result.source_hint,
-                    'handled': True,
-                    'message': result.message,
-                }
-            print(json.dumps(wrap_json_envelope(envelope, args.command, exit_code=exit_code)))
-        else:
-            print(result.message)
-        return exit_code
+        print(result.message)
+        return 0 if result.handled else 1
     if args.command == 'exec-tool':
         result = execute_tool(args.name, args.payload)
-        # #168: JSON envelope with typed not-found error
-        # #181: envelope exit_code must match process exit code
-        exit_code = 0 if result.handled else 1
-        if args.output_format == 'json':
-            import json
-            if not result.handled:
-                envelope = {
-                    'name': args.name,
-                    'payload': args.payload,
-                    'handled': False,
-                    'error': {
-                        'kind': 'tool_not_found',
-                        'message': result.message,
-                        'retryable': False,
-                    },
-                }
-            else:
-                envelope = {
-                    'name': result.name,
-                    'payload': result.payload,
-                    'source_hint': result.source_hint,
-                    'handled': True,
-                    'message': result.message,
-                }
-            print(json.dumps(wrap_json_envelope(envelope, args.command, exit_code=exit_code)))
-        else:
-            print(result.message)
-        return exit_code
+        print(result.message)
+        return 0 if result.handled else 1
     parser.error(f'unknown command: {args.command}')
     return 2
 

src/query_engine.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import json
-import threading
 from dataclasses import dataclass, field
 from uuid import uuid4
 
@@ -31,7 +30,6 @@ class TurnResult:
     permission_denials: tuple[PermissionDenial, ...]
     usage: UsageSummary
     stop_reason: str
-    cancel_observed: bool = False
 
 
 @dataclass
@@ -66,59 +64,7 @@ class QueryEnginePort:
         matched_commands: tuple[str, ...] = (),
         matched_tools: tuple[str, ...] = (),
         denied_tools: tuple[PermissionDenial, ...] = (),
-        cancel_event: threading.Event | None = None,
     ) -> TurnResult:
-        """Submit a prompt and return a TurnResult.
-
-        #164 Stage A: cooperative cancellation via cancel_event.
-
-        The cancel_event argument (added for #164) lets a caller request early
-        termination at a safe point. When set before the pre-mutation commit
-        stage, submit_message returns early with ``stop_reason='cancelled'``
-        and the engine's state (mutable_messages, transcript_store,
-        permission_denials, total_usage) is left **exactly as it was on
-        entry**. This closes the #161 follow-up gap: before this change, a
-        wedged provider thread could finish executing and silently mutate
-        state after the caller had already observed ``stop_reason='timeout'``,
-        giving the session a ghost turn the caller never acknowledged.
-
-        Contract:
-          - cancel_event is None (default) — legacy behaviour, no checks.
-          - cancel_event set **before** budget check — returns 'cancelled'
-            immediately; no output synthesis, no projection, no mutation.
-          - cancel_event set **between** budget check and commit — returns
-            'cancelled' with state intact.
-          - cancel_event set **after** commit — not observable; the turn is
-            already committed and the caller sees 'completed'. Cancellation
-            is a *safe point* mechanism, not preemption. This is the honest
-            limit of cooperative cancellation in Python threading land.
-
-        Stop reason taxonomy after #164 Stage A:
-          - 'completed'            — turn committed, state mutated exactly once
-          - 'max_budget_reached'   — overflow, state unchanged (#162)
-          - 'max_turns_reached'    — capacity exceeded, state unchanged
-          - 'cancelled'            — cancel_event observed, state unchanged
-          - 'timeout'              — synthesised by runtime, not engine (#161)
-
-        Callers that care about deadline-driven cancellation (run_turn_loop)
-        can now request cleanup by setting the event on timeout — the next
-        submit_message on the same engine will observe it at the start and
-        return 'cancelled' without touching state, even if the previous call
-        is still wedged in provider IO.
-        """
-        # #164 Stage A: earliest safe cancellation point. No output synthesis,
-        # no budget projection, no mutation — just an immediate clean return.
-        if cancel_event is not None and cancel_event.is_set():
-            return TurnResult(
-                prompt=prompt,
-                output='',
-                matched_commands=matched_commands,
-                matched_tools=matched_tools,
-                permission_denials=denied_tools,
-                usage=self.total_usage,  # unchanged
-                stop_reason='cancelled',
-            )
-
         if len(self.mutable_messages) >= self.config.max_turns:
             output = f'Max turns reached before processing prompt: {prompt}'
             return TurnResult(
@@ -139,40 +85,9 @@ class QueryEnginePort:
         ]
         output = self._format_output(summary_lines)
         projected_usage = self.total_usage.add_turn(prompt, output)
-
-        # #162: budget check must precede mutation. Previously this block set
-        # stop_reason='max_budget_reached' but still appended the overflow turn
-        # to mutable_messages / transcript_store / permission_denials, corrupting
-        # the session for any caller that persisted it afterwards. The overflow
-        # prompt was effectively committed even though the TurnResult signalled
-        # rejection. Now we early-return with pre-mutation state intact so
-        # callers can safely retry with a smaller prompt or a fresh budget.
+        stop_reason = 'completed'
         if projected_usage.input_tokens + projected_usage.output_tokens > self.config.max_budget_tokens:
-            return TurnResult(
-                prompt=prompt,
-                output=output,
-                matched_commands=matched_commands,
-                matched_tools=matched_tools,
-                permission_denials=denied_tools,
-                usage=self.total_usage,  # unchanged — overflow turn was rejected
-                stop_reason='max_budget_reached',
-            )
-
-        # #164 Stage A: second safe cancellation point. Projection is done
-        # but nothing has been committed yet. If the caller cancelled while
-        # we were building output / computing budget, honour it here — still
-        # no mutation.
-        if cancel_event is not None and cancel_event.is_set():
-            return TurnResult(
-                prompt=prompt,
-                output=output,
-                matched_commands=matched_commands,
-                matched_tools=matched_tools,
-                permission_denials=denied_tools,
-                usage=self.total_usage,  # unchanged
-                stop_reason='cancelled',
-            )
-
+            stop_reason = 'max_budget_reached'
         self.mutable_messages.append(prompt)
         self.transcript_store.append(prompt)
         self.permission_denials.extend(denied_tools)
@@ -185,7 +100,7 @@ class QueryEnginePort:
             matched_tools=matched_tools,
             permission_denials=denied_tools,
             usage=self.total_usage,
-            stop_reason='completed',
+            stop_reason=stop_reason,
         )
 
     def stream_submit_message(
@@ -222,19 +137,7 @@ class QueryEnginePort:
     def flush_transcript(self) -> None:
         self.transcript_store.flush()
 
-    def persist_session(self, directory: 'Path | None' = None) -> str:
-        """Flush the transcript and save the session to disk.
-
-        Args:
-            directory: Optional override for the storage directory. When None
-                (default, for backward compat), uses the default location
-                (``.port_sessions`` in CWD). When set, passes through to
-                ``save_session`` which already supports directory overrides.
-
-        #166: added directory parameter to match the session-lifecycle CLI
-        surface established by #160/#165. Claws running out-of-tree can now
-        redirect session creation to a workspace-specific dir without chdir.
-        """
+    def persist_session(self) -> str:
         self.flush_transcript()
         path = save_session(
             StoredSession(
@@ -242,8 +145,7 @@ class QueryEnginePort:
                 messages=tuple(self.mutable_messages),
                 input_tokens=self.total_usage.input_tokens,
                 output_tokens=self.total_usage.output_tokens,
-            ),
-            directory,
+            )
         )
         return str(path)
 

src/runtime.py

@@ -1,14 +1,11 @@
 from __future__ import annotations
 
-import threading
-import time
-from concurrent.futures import ThreadPoolExecutor, TimeoutError as FuturesTimeoutError
 from dataclasses import dataclass
 
 from .commands import PORTED_COMMANDS
 from .context import PortContext, build_port_context, render_context
 from .history import HistoryLog
-from .models import PermissionDenial, PortingModule, UsageSummary
+from .models import PermissionDenial, PortingModule
 from .query_engine import QueryEngineConfig, QueryEnginePort, TurnResult
 from .setup import SetupReport, WorkspaceSetup, run_setup
 from .system_init import build_system_init_message
@@ -154,161 +151,21 @@ class PortRuntime:
             persisted_session_path=persisted_session_path,
         )
 
-    def run_turn_loop(
-        self,
-        prompt: str,
-        limit: int = 5,
-        max_turns: int = 3,
-        structured_output: bool = False,
-        timeout_seconds: float | None = None,
-        continuation_prompt: str | None = None,
-    ) -> list[TurnResult]:
-        """Run a multi-turn engine loop with optional wall-clock deadline.
-
-        Args:
-            prompt: The initial prompt to submit.
-            limit: Match routing limit.
-            max_turns: Maximum number of turns before stopping.
-            structured_output: Whether to request structured output.
-            timeout_seconds: Total wall-clock budget across all turns. When the
-                budget is exhausted mid-turn, a synthetic TurnResult with
-                ``stop_reason='timeout'`` is appended and the loop exits.
-                ``None`` (default) preserves legacy unbounded behaviour.
-            continuation_prompt: What to send on turns after the first. When
-                ``None`` (default, #163), the loop stops after turn 0 and the
-                caller decides how to continue. When set, the same text is
-                submitted for every turn after the first, giving claws a clean
-                hook for structured follow-ups (e.g. ``"Continue."``, a
-                routing-planner instruction, or a tool-output cue). Previously
-                the loop silently appended ``" [turn N]"`` to the original
-                prompt, polluting the transcript with harness-generated
-                annotation the model had no way to interpret.
-
-        Returns:
-            A list of TurnResult objects. The final entry's ``stop_reason``
-            distinguishes ``'completed'``, ``'max_turns_reached'``,
-            ``'max_budget_reached'``, or ``'timeout'``.
-
-        #161: prior to this change a hung ``engine.submit_message`` call would
-        block the loop indefinitely with no cancellation path, forcing claws to
-        rely on external watchdogs or OS-level kills. Callers can now enforce a
-        deadline and receive a typed timeout signal instead.
-
-        #163: the old ``f'{prompt} [turn {turn + 1}]'`` suffix was never
-        interpreted by the engine or any system prompt. It looked like a real
-        user turn in ``mutable_messages`` and the transcript, making replay and
-        analysis fragile. Removed entirely; callers supply ``continuation_prompt``
-        for meaningful follow-ups or let the loop stop after turn 0.
-        """
+    def run_turn_loop(self, prompt: str, limit: int = 5, max_turns: int = 3, structured_output: bool = False) -> list[TurnResult]:
         engine = QueryEnginePort.from_workspace()
         engine.config = QueryEngineConfig(max_turns=max_turns, structured_output=structured_output)
         matches = self.route_prompt(prompt, limit=limit)
         command_names = tuple(match.name for match in matches if match.kind == 'command')
         tool_names = tuple(match.name for match in matches if match.kind == 'tool')
-        # #159: infer permission denials from the routed matches, not hardcoded empty tuple.
-        # Multi-turn sessions must have the same security posture as bootstrap_session.
-        denied_tools = tuple(self._infer_permission_denials(matches))
         results: list[TurnResult] = []
-        deadline = time.monotonic() + timeout_seconds if timeout_seconds is not None else None
-        # #164 Stage A: shared cancel_event signals cooperative cancellation
-        # across turns. On timeout we set() it so any still-running
-        # submit_message call (or the next one on the same engine) observes
-        # the cancel at a safe checkpoint and returns stop_reason='cancelled'
-        # without mutating state. This closes the window where a wedged
-        # provider thread could commit a ghost turn after the caller saw
-        # 'timeout'.
-        cancel_event = threading.Event() if deadline is not None else None
-
-        # ThreadPoolExecutor is reused across turns so we cancel cleanly on exit.
-        executor = ThreadPoolExecutor(max_workers=1) if deadline is not None else None
-        try:
-            for turn in range(max_turns):
-                # #163: no more f'{prompt} [turn N]' suffix injection.
-                # On turn 0 submit the original prompt.
-                # On turn > 0, submit the caller-supplied continuation prompt;
-                # if the caller did not supply one, stop the loop cleanly instead
-                # of fabricating a fake user turn.
-                if turn == 0:
-                    turn_prompt = prompt
-                elif continuation_prompt is not None:
-                    turn_prompt = continuation_prompt
-                else:
-                    break
-
-                if deadline is None:
-                    # Legacy path: unbounded call, preserves existing behaviour exactly.
-                    # #159: pass inferred denied_tools (no longer hardcoded empty tuple)
-                    # #164: cancel_event is None on this path; submit_message skips
-                    # cancellation checks entirely (legacy zero-overhead behaviour).
-                    result = engine.submit_message(turn_prompt, command_names, tool_names, denied_tools)
-                else:
-                    remaining = deadline - time.monotonic()
-                    if remaining <= 0:
-                        # #164: signal cancel for any in-flight/future submit_message
-                        # calls that share this engine. Safe because nothing has been
-                        # submitted yet this turn.
-                        assert cancel_event is not None
-                        cancel_event.set()
-                        results.append(self._build_timeout_result(
-                            turn_prompt, command_names, tool_names,
-                            cancel_observed=cancel_event.is_set()
-                        ))
-                        break
-                    assert executor is not None
-                    future = executor.submit(
-                        engine.submit_message, turn_prompt, command_names, tool_names,
-                        denied_tools, cancel_event,
-                    )
-                    try:
-                        result = future.result(timeout=remaining)
-                    except FuturesTimeoutError:
-                        # #164 Stage A: explicitly signal cancel to the still-running
-                        # submit_message thread. The next time it hits a checkpoint
-                        # (entry or post-budget), it returns 'cancelled' without
-                        # mutating state instead of committing a ghost turn. This
-                        # upgrades #161's best-effort future.cancel() (which only
-                        # cancels pre-start futures) to cooperative mid-flight cancel.
-                        assert cancel_event is not None
-                        cancel_event.set()
-                        future.cancel()
-                        results.append(self._build_timeout_result(
-                            turn_prompt, command_names, tool_names,
-                            cancel_observed=cancel_event.is_set()
-                        ))
-                        break
-
-                results.append(result)
-                if result.stop_reason != 'completed':
-                    break
-        finally:
-            if executor is not None:
-                # wait=False: don't let a hung thread block loop exit indefinitely.
-                # The thread will be reaped when the interpreter shuts down or when
-                # the engine call eventually returns.
-                executor.shutdown(wait=False)
+        for turn in range(max_turns):
+            turn_prompt = prompt if turn == 0 else f'{prompt} [turn {turn + 1}]'
+            result = engine.submit_message(turn_prompt, command_names, tool_names, ())
+            results.append(result)
+            if result.stop_reason != 'completed':
+                break
         return results
 
-    @staticmethod
-    def _build_timeout_result(
-        prompt: str,
-        command_names: tuple[str, ...],
-        tool_names: tuple[str, ...],
-        cancel_observed: bool = False,
-    ) -> TurnResult:
-        """Synthesize a TurnResult representing a wall-clock timeout (#161).
-        #164 Stage B: cancel_observed signals cancellation event was set.
-        """
-        return TurnResult(
-            prompt=prompt,
-            output='Wall-clock timeout exceeded before turn completed.',
-            matched_commands=command_names,
-            matched_tools=tool_names,
-            permission_denials=(),
-            usage=UsageSummary(),
-            stop_reason='timeout',
-            cancel_observed=cancel_observed,
-        )
-
     def _infer_permission_denials(self, matches: list[RoutedMatch]) -> list[PermissionDenial]:
         denials: list[PermissionDenial] = []
         for match in matches:

src/session_store.py

@@ -26,96 +26,10 @@ def save_session(session: StoredSession, directory: Path | None = None) -> Path:
 
 def load_session(session_id: str, directory: Path | None = None) -> StoredSession:
     target_dir = directory or DEFAULT_SESSION_DIR
-    try:
-        data = json.loads((target_dir / f'{session_id}.json').read_text())
-    except FileNotFoundError:
-        raise SessionNotFoundError(f'session {session_id!r} not found in {target_dir}') from None
+    data = json.loads((target_dir / f'{session_id}.json').read_text())
     return StoredSession(
         session_id=data['session_id'],
         messages=tuple(data['messages']),
         input_tokens=data['input_tokens'],
         output_tokens=data['output_tokens'],
     )
-
-
-class SessionNotFoundError(KeyError):
-    """Raised when a session does not exist in the store."""
-    pass
-
-
-def list_sessions(directory: Path | None = None) -> list[str]:
-    """List all stored session IDs in the target directory.
-    
-    Args:
-        directory: Target session directory. Defaults to DEFAULT_SESSION_DIR.
-    
-    Returns:
-        Sorted list of session IDs (JSON filenames without .json extension).
-    """
-    target_dir = directory or DEFAULT_SESSION_DIR
-    if not target_dir.exists():
-        return []
-    return sorted(p.stem for p in target_dir.glob('*.json'))
-
-
-def session_exists(session_id: str, directory: Path | None = None) -> bool:
-    """Check if a session exists without raising an error.
-    
-    Args:
-        session_id: The session ID to check.
-        directory: Target session directory. Defaults to DEFAULT_SESSION_DIR.
-    
-    Returns:
-        True if the session file exists, False otherwise.
-    """
-    target_dir = directory or DEFAULT_SESSION_DIR
-    return (target_dir / f'{session_id}.json').exists()
-
-
-class SessionDeleteError(OSError):
-    """Raised when a session file exists but cannot be removed (permission, IO error).
-    
-    Distinct from SessionNotFoundError: this means the session was present but
-    deletion failed mid-operation. Callers can retry or escalate.
-    """
-    pass
-
-
-def delete_session(session_id: str, directory: Path | None = None) -> bool:
-    """Delete a session file from the store.
-    
-    Contract:
-    - **Idempotent**: `delete_session(x)` followed by `delete_session(x)` is safe.
-      Second call returns False (not found), does not raise.
-    - **Race-safe**: Uses `missing_ok=True` on unlink to avoid TOCTOU between
-      exists-check and unlink. Concurrent deletion by another process is
-      treated as a no-op success (returns False for the losing caller).
-    - **Partial-failure surfaced**: If the file exists but cannot be removed
-      (permission denied, filesystem error, directory instead of file), raises
-      `SessionDeleteError` wrapping the underlying OSError. The session store
-      may be in an inconsistent state; caller should retry or escalate.
-    
-    Args:
-        session_id: The session ID to delete.
-        directory: Target session directory. Defaults to DEFAULT_SESSION_DIR.
-    
-    Returns:
-        True if this call deleted the session file.
-        False if the session did not exist (either never existed or was already deleted).
-    
-    Raises:
-        SessionDeleteError: if the session existed but deletion failed.
-    """
-    target_dir = directory or DEFAULT_SESSION_DIR
-    path = target_dir / f'{session_id}.json'
-    try:
-        # Python 3.8+: missing_ok=True avoids TOCTOU race
-        path.unlink(missing_ok=False)
-        return True
-    except FileNotFoundError:
-        # Either never existed or was concurrently deleted — both are no-ops
-        return False
-    except (PermissionError, IsADirectoryError, OSError) as exc:
-        raise SessionDeleteError(
-            f'session {session_id!r} exists in {target_dir} but could not be deleted: {exc}'
-        ) from exc

tests/test_cancel_observed_field.py

@@ -1,199 +0,0 @@
-"""#164 Stage B — cancel_observed field coverage.
-
-Validates that the TurnResult.cancel_observed field correctly signals
-whether cancellation was observed during turn execution.
-
-Test coverage:
-1. Normal completion: cancel_observed=False (no timeout occurred)
-2. Timeout with cancel signaled: cancel_observed=True
-3. bootstrap JSON output exposes the field
-4. turn-loop JSON output exposes cancel_observed per turn
-5. Safe-to-reuse: after timeout with cancel_observed=True,
-   engine can accept fresh messages without state corruption
-"""
-
-from __future__ import annotations
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-from src.query_engine import QueryEnginePort, TurnResult
-from src.runtime import PortRuntime
-
-
-CLI = [sys.executable, '-m', 'src.main']
-REPO_ROOT = Path(__file__).resolve().parent.parent
-
-
-class TestCancelObservedField:
-    """TurnResult.cancel_observed correctly signals cancellation observation."""
-
-    def test_default_value_is_false(self) -> None:
-        """New TurnResult defaults to cancel_observed=False (backward compat)."""
-        from src.models import UsageSummary
-        result = TurnResult(
-            prompt='test',
-            output='ok',
-            matched_commands=(),
-            matched_tools=(),
-            permission_denials=(),
-            usage=UsageSummary(),
-            stop_reason='completed',
-        )
-        assert result.cancel_observed is False
-
-    def test_explicit_true_preserved(self) -> None:
-        """cancel_observed=True is preserved through construction."""
-        from src.models import UsageSummary
-        result = TurnResult(
-            prompt='test',
-            output='timed out',
-            matched_commands=(),
-            matched_tools=(),
-            permission_denials=(),
-            usage=UsageSummary(),
-            stop_reason='timeout',
-            cancel_observed=True,
-        )
-        assert result.cancel_observed is True
-
-    def test_normal_completion_cancel_observed_false(self) -> None:
-        """Normal turn completion → cancel_observed=False."""
-        runtime = PortRuntime()
-        results = runtime.run_turn_loop('hello', max_turns=1)
-        assert len(results) >= 1
-        assert results[0].cancel_observed is False
-
-    def test_bootstrap_json_includes_cancel_observed(self) -> None:
-        """bootstrap JSON envelope includes cancel_observed in turn result."""
-        result = subprocess.run(
-            CLI + ['bootstrap', 'hello', '--output-format', 'json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        assert result.returncode == 0
-        envelope = json.loads(result.stdout)
-        assert 'turn' in envelope
-        assert 'cancel_observed' in envelope['turn'], (
-            f"bootstrap turn must include cancel_observed (SCHEMAS.md contract). "
-            f"Got keys: {list(envelope['turn'].keys())}"
-        )
-        # Normal completion → False
-        assert envelope['turn']['cancel_observed'] is False
-
-    def test_turn_loop_json_per_turn_cancel_observed(self) -> None:
-        """turn-loop JSON envelope includes cancel_observed per turn (#164 Stage B closure)."""
-        result = subprocess.run(
-            CLI + ['turn-loop', 'hello', '--max-turns', '1', '--output-format', 'json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        assert result.returncode == 0, f"stderr: {result.stderr}"
-        envelope = json.loads(result.stdout)
-        # Common fields from wrap_json_envelope
-        assert envelope['command'] == 'turn-loop'
-        assert envelope['schema_version'] == '1.0'
-        # Turn-loop-specific fields
-        assert 'turns' in envelope
-        assert len(envelope['turns']) >= 1
-        for idx, turn in enumerate(envelope['turns']):
-            assert 'cancel_observed' in turn, (
-                f"Turn {idx} missing cancel_observed: {list(turn.keys())}"
-            )
-        # final_cancel_observed convenience field
-        assert 'final_cancel_observed' in envelope
-        assert isinstance(envelope['final_cancel_observed'], bool)
-
-
-class TestCancelObservedSafeReuseSemantics:
-    """After timeout with cancel_observed=True, engine state is safe to reuse."""
-
-    def test_timeout_result_cancel_observed_true_when_signaled(self) -> None:
-        """#164 Stage B: timeout path passes cancel_event.is_set() to result."""
-        # Force a timeout with max_turns=3 and timeout=0.0001 (instant)
-        runtime = PortRuntime()
-        results = runtime.run_turn_loop(
-            'hello', max_turns=3, timeout_seconds=0.0001,
-            continuation_prompt='keep going',
-        )
-        # Last result should be timeout (pre-start path since timeout is instant)
-        assert results, 'timeout path should still produce a result'
-        last = results[-1]
-        assert last.stop_reason == 'timeout'
-        # cancel_observed=True because the timeout path explicitly sets cancel_event
-        assert last.cancel_observed is True, (
-            f"timeout path must signal cancel_observed=True; got {last.cancel_observed}. "
-            f"stop_reason={last.stop_reason}"
-        )
-
-    def test_engine_messages_not_corrupted_by_timeout(self) -> None:
-        """After timeout with cancel_observed, engine.mutable_messages is consistent.
-
-        #164 Stage B contract: safe-to-reuse means after a timeout-with-cancel,
-        the engine has not committed a ghost turn and can accept fresh input.
-        """
-        engine = QueryEnginePort.from_workspace()
-        # Track initial state
-        initial_message_count = len(engine.mutable_messages)
-
-        # Simulate a direct submit_message call with cancellation
-        import threading
-        cancel_event = threading.Event()
-        cancel_event.set()  # Pre-set: first checkpoint fires
-        result = engine.submit_message(
-            'test', ('cmd1',), ('tool1',),
-            denied_tools=(), cancel_event=cancel_event,
-        )
-
-        # Cancelled turn should not commit mutation
-        assert result.stop_reason == 'cancelled', (
-            f"expected cancelled; got {result.stop_reason}"
-        )
-        # mutable_messages should not have grown
-        assert len(engine.mutable_messages) == initial_message_count, (
-            f"engine.mutable_messages grew after cancelled turn "
-            f"(was {initial_message_count}, now {len(engine.mutable_messages)})"
-        )
-
-        # Engine should accept a fresh message now
-        fresh = engine.submit_message('fresh prompt', ('cmd1',), ('tool1',))
-        assert fresh.stop_reason in ('completed', 'max_budget_reached'), (
-            f"expected engine reusable; got {fresh.stop_reason}"
-        )
-
-
-class TestCancelObservedSchemaCompliance:
-    """SCHEMAS.md contract for cancel_observed field."""
-
-    def test_cancel_observed_is_bool_not_nullable(self) -> None:
-        """cancel_observed is always bool (never null/missing) per SCHEMAS.md."""
-        result = subprocess.run(
-            CLI + ['bootstrap', 'test', '--output-format', 'json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        envelope = json.loads(result.stdout)
-        cancel_observed = envelope['turn']['cancel_observed']
-        assert isinstance(cancel_observed, bool), (
-            f"cancel_observed must be bool; got {type(cancel_observed)}"
-        )
-
-    def test_turn_loop_envelope_has_final_cancel_observed(self) -> None:
-        """turn-loop JSON exposes final_cancel_observed convenience field."""
-        result = subprocess.run(
-            CLI + ['turn-loop', 'test', '--max-turns', '1', '--output-format', 'json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        assert result.returncode == 0
-        envelope = json.loads(result.stdout)
-        assert 'final_cancel_observed' in envelope
-        assert isinstance(envelope['final_cancel_observed'], bool)

tests/test_cli_parity_audit.py

@@ -1,333 +0,0 @@
-"""Cross-surface CLI parity audit (ROADMAP #171).
-
-Prevents future drift of the unified JSON envelope contract across
-claw-code's CLI surface. Instead of requiring humans to notice when
-a new command skips --output-format, this test introspects the parser
-at runtime and verifies every command in the declared clawable-surface
-list supports --output-format {text,json}.
-
-When a new clawable-surface command is added:
-  1. Implement --output-format on the subparser (normal feature work).
-  2. Add the command name to CLAWABLE_SURFACES below.
-  3. This test passes automatically.
-
-When a developer adds a new clawable-surface command but forgets
---output-format, the test fails with a concrete message pointing at
-the missing flag. Claws no longer need to eyeball parity; the contract
-is enforced at test time.
-
-Three classes of commands:
-  - CLAWABLE_SURFACES: MUST accept --output-format (inspect/lifecycle/exec/diagnostic)
-  - OPT_OUT_SURFACES: explicitly exempt (simulation/mode commands, human-first diagnostic)
-  - Any command in parser not listed in either: test FAILS with classification request
-
-This is operationalised parity — a machine-first CLI enforced by a
-machine-first test.
-"""
-
-from __future__ import annotations
-
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from src.main import build_parser  # noqa: E402
-
-
-# Commands that MUST accept --output-format {text,json}.
-# These are the machine-first surfaces — session lifecycle, execution,
-# inspect, diagnostic inventory.
-CLAWABLE_SURFACES = frozenset({
-    # Session lifecycle (#160, #165, #166)
-    'list-sessions',
-    'delete-session',
-    'load-session',
-    'flush-transcript',
-    # Inspect (#167)
-    'show-command',
-    'show-tool',
-    # Execution/work-verb (#168)
-    'exec-command',
-    'exec-tool',
-    'route',
-    'bootstrap',
-    # Diagnostic inventory (#169, #170)
-    'command-graph',
-    'tool-pool',
-    'bootstrap-graph',
-    # Turn-loop with JSON output (#164 Stage B, #174)
-    'turn-loop',
-})
-
-# Commands explicitly exempt from --output-format requirement.
-# Rationale must be explicit — either the command is human-first
-# (rich Markdown docs/reports), simulation-only, or has a dedicated
-# JSON mode flag under a different name.
-OPT_OUT_SURFACES = frozenset({
-    # Rich-Markdown report commands (planned future: JSON schema)
-    'summary',            # full workspace summary (Markdown)
-    'manifest',           # workspace manifest (Markdown)
-    'parity-audit',       # TypeScript archive comparison (Markdown)
-    'setup-report',       # startup/prefetch report (Markdown)
-    # List commands with their own query/filter surface (not JSON yet)
-    'subsystems',         # use --limit
-    'commands',           # use --query / --limit / --no-plugin-commands
-    'tools',              # use --query / --limit / --simple-mode
-    # Simulation/debug surfaces (not claw-orchestrated)
-    'remote-mode',
-    'ssh-mode',
-    'teleport-mode',
-    'direct-connect-mode',
-    'deep-link-mode',
-})
-
-
-def _discover_subcommands_and_flags() -> dict[str, frozenset[str]]:
-    """Introspect the argparse tree to discover every subcommand and its flags.
-
-    Returns:
-      {subcommand_name: frozenset of option strings including --output-format
-       if registered}
-    """
-    parser = build_parser()
-    subcommand_flags: dict[str, frozenset[str]] = {}
-    for action in parser._actions:
-        if not hasattr(action, 'choices') or not action.choices:
-            continue
-        if action.dest != 'command':
-            continue
-        for name, subp in action.choices.items():
-            flags: set[str] = set()
-            for a in subp._actions:
-                if a.option_strings:
-                    flags.update(a.option_strings)
-            subcommand_flags[name] = frozenset(flags)
-    return subcommand_flags
-
-
-class TestClawableSurfaceParity:
-    """Every clawable-surface command MUST accept --output-format {text,json}.
-
-    This is the invariant that codifies 'claws can treat the CLI as a
-    unified protocol without special-casing'.
-    """
-
-    def test_all_clawable_surfaces_accept_output_format(self) -> None:
-        """All commands in CLAWABLE_SURFACES must have --output-format registered."""
-        subcommand_flags = _discover_subcommands_and_flags()
-        missing = []
-        for cmd in CLAWABLE_SURFACES:
-            if cmd not in subcommand_flags:
-                missing.append(f'{cmd}: not registered in parser')
-            elif '--output-format' not in subcommand_flags[cmd]:
-                missing.append(f'{cmd}: missing --output-format flag')
-        assert not missing, (
-            'Clawable-surface parity violation. Every command in '
-            'CLAWABLE_SURFACES must accept --output-format. Failures:\n'
-            + '\n'.join(f'  - {m}' for m in missing)
-        )
-
-    @pytest.mark.parametrize('cmd_name', sorted(CLAWABLE_SURFACES))
-    def test_clawable_surface_output_format_choices(self, cmd_name: str) -> None:
-        """Every clawable surface must accept exactly {text, json} choices."""
-        parser = build_parser()
-        for action in parser._actions:
-            if not hasattr(action, 'choices') or not action.choices:
-                continue
-            if action.dest != 'command':
-                continue
-            if cmd_name not in action.choices:
-                continue
-            subp = action.choices[cmd_name]
-            for a in subp._actions:
-                if '--output-format' in a.option_strings:
-                    assert a.choices == ['text', 'json'], (
-                        f'{cmd_name}: --output-format choices are {a.choices}, '
-                        f'expected [text, json]'
-                    )
-                    assert a.default == 'text', (
-                        f'{cmd_name}: --output-format default is {a.default!r}, '
-                        f'expected \'text\' for backward compat'
-                    )
-                    return
-        pytest.fail(f'{cmd_name}: no --output-format flag found')
-
-
-class TestCommandClassificationCoverage:
-    """Every registered subcommand must be classified as either CLAWABLE or OPT_OUT.
-
-    If a new command is added to the parser but forgotten in both sets, this
-    test fails loudly — forcing an explicit classification decision.
-    """
-
-    def test_every_registered_command_is_classified(self) -> None:
-        subcommand_flags = _discover_subcommands_and_flags()
-        all_classified = CLAWABLE_SURFACES | OPT_OUT_SURFACES
-        unclassified = set(subcommand_flags.keys()) - all_classified
-        assert not unclassified, (
-            'Unclassified subcommands detected. Every new command must be '
-            'explicitly added to either CLAWABLE_SURFACES (must accept '
-            '--output-format) or OPT_OUT_SURFACES (explicitly exempt with '
-            'rationale). Unclassified:\n'
-            + '\n'.join(f'  - {cmd}' for cmd in sorted(unclassified))
-        )
-
-    def test_no_command_in_both_sets(self) -> None:
-        """Sanity: a command cannot be both clawable AND opt-out."""
-        overlap = CLAWABLE_SURFACES & OPT_OUT_SURFACES
-        assert not overlap, (
-            f'Classification conflict: commands appear in both sets: {overlap}'
-        )
-
-    def test_all_classified_commands_actually_exist(self) -> None:
-        """No typos — every command in our sets must actually be registered."""
-        subcommand_flags = _discover_subcommands_and_flags()
-        ghosts = (CLAWABLE_SURFACES | OPT_OUT_SURFACES) - set(subcommand_flags.keys())
-        assert not ghosts, (
-            f'Phantom commands in classification sets (not in parser): {ghosts}. '
-            'Update CLAWABLE_SURFACES / OPT_OUT_SURFACES if commands were removed.'
-        )
-
-
-class TestJsonOutputContractEndToEnd:
-    """Verify the contract AT RUNTIME — not just parser-level, but actual execution.
-
-    Each clawable command must, when invoked with --output-format json,
-    produce parseable JSON on stdout (for success cases).
-    """
-
-    # Minimal invocation args for each clawable command (to hit success path)
-    RUNTIME_INVOCATIONS = {
-        'list-sessions': [],
-        # delete-session/load-session: skip (need state setup, covered by dedicated tests)
-        'show-command': ['add-dir'],
-        'show-tool': ['BashTool'],
-        'exec-command': ['add-dir', 'hi'],
-        'exec-tool': ['BashTool', '{}'],
-        'route': ['review'],
-        'bootstrap': ['hello'],
-        'command-graph': [],
-        'tool-pool': [],
-        'bootstrap-graph': [],
-        # flush-transcript: skip (creates files, covered by dedicated tests)
-    }
-
-    @pytest.mark.parametrize('cmd_name,cmd_args', sorted(RUNTIME_INVOCATIONS.items()))
-    def test_command_emits_parseable_json(self, cmd_name: str, cmd_args: list[str]) -> None:
-        """End-to-end: invoking with --output-format json yields valid JSON."""
-        import json
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', cmd_name, *cmd_args, '--output-format', 'json'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        # Accept exit 0 (success) or 1 (typed not-found) — both must still produce JSON
-        assert result.returncode in (0, 1), (
-            f'{cmd_name}: unexpected exit {result.returncode}\n'
-            f'stderr: {result.stderr}\n'
-            f'stdout: {result.stdout[:200]}'
-        )
-        try:
-            json.loads(result.stdout)
-        except json.JSONDecodeError as e:
-            pytest.fail(
-                f'{cmd_name} {cmd_args} --output-format json did not produce '
-                f'parseable JSON: {e}\nOutput: {result.stdout[:200]}'
-            )
-
-
-class TestOptOutSurfaceRejection:
-    """Cycle #30: OPT_OUT surfaces must REJECT --output-format, not silently accept.
-    
-    OPT_OUT_AUDIT.md classifies 12 surfaces as intentionally exempt from the
-    JSON envelope contract. This test LOCKS that rejection so accidental
-    drift (e.g., a developer adds --output-format to summary without thinking)
-    doesn't silently promote an OPT_OUT surface to CLAWABLE.
-    
-    Relationship to existing tests:
-    - test_clawable_surface_has_output_format: asserts CLAWABLE surfaces accept it
-    - TestOptOutSurfaceRejection: asserts OPT_OUT surfaces REJECT it
-    
-    Together, these two test classes form a complete parity check:
-    every surface is either IN or OUT, and both cases are explicitly tested.
-    
-    If an OPT_OUT surface is promoted to CLAWABLE intentionally:
-    1. Move it from OPT_OUT_SURFACES to CLAWABLE_SURFACES
-    2. Update OPT_OUT_AUDIT.md with promotion rationale
-    3. Remove from this test's expected rejections
-    4. Both sets of tests continue passing
-    """
-
-    @pytest.mark.parametrize('cmd_name', sorted(OPT_OUT_SURFACES))
-    def test_opt_out_surface_rejects_output_format(self, cmd_name: str) -> None:
-        """OPT_OUT surfaces must NOT accept --output-format flag.
-        
-        Passing --output-format to an OPT_OUT surface should produce an
-        'unrecognized arguments' error from argparse.
-        """
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', cmd_name, '--output-format', 'json'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        # Should fail — argparse exit 2 in text mode, exit 1 in JSON mode
-        # (both modes normalize to "unrecognized arguments" message)
-        assert result.returncode != 0, (
-            f'{cmd_name} unexpectedly accepted --output-format json. '
-            f'If this is intentional (promotion to CLAWABLE), move from '
-            f'OPT_OUT_SURFACES to CLAWABLE_SURFACES and update OPT_OUT_AUDIT.md. '
-            f'Output: {result.stdout[:200]}\nStderr: {result.stderr[:200]}'
-        )
-        # Verify the error is specifically about --output-format
-        error_text = result.stdout + result.stderr
-        assert '--output-format' in error_text or 'unrecognized' in error_text, (
-            f'{cmd_name} failed but error not about --output-format. '
-            f'Something else is broken:\n'
-            f'stdout: {result.stdout[:300]}\nstderr: {result.stderr[:300]}'
-        )
-
-    def test_opt_out_set_matches_audit_document(self) -> None:
-        """OPT_OUT_SURFACES constant must exactly match OPT_OUT_AUDIT.md listing.
-        
-        This test reads OPT_OUT_AUDIT.md and verifies the constant doesn't
-        drift from the documentation.
-        """
-        audit_path = Path(__file__).resolve().parent.parent / 'OPT_OUT_AUDIT.md'
-        audit_text = audit_path.read_text()
-        
-        # Expected 12 surfaces per audit doc
-        expected_surfaces = {
-            # Group A: Rich-Markdown Reports (4)
-            'summary', 'manifest', 'parity-audit', 'setup-report',
-            # Group B: List Commands (3)
-            'subsystems', 'commands', 'tools',
-            # Group C: Simulation/Debug (5)
-            'remote-mode', 'ssh-mode', 'teleport-mode',
-            'direct-connect-mode', 'deep-link-mode',
-        }
-        
-        assert OPT_OUT_SURFACES == expected_surfaces, (
-            f'OPT_OUT_SURFACES drift from expected 12 surfaces per audit:\n'
-            f'  Expected: {sorted(expected_surfaces)}\n'
-            f'  Actual:   {sorted(OPT_OUT_SURFACES)}'
-        )
-        
-        # Each surface should be mentioned in audit doc
-        missing_from_audit = [s for s in OPT_OUT_SURFACES if s not in audit_text]
-        assert not missing_from_audit, (
-            f'OPT_OUT surfaces not mentioned in OPT_OUT_AUDIT.md: {missing_from_audit}'
-        )
-
-    def test_opt_out_count_matches_declared(self) -> None:
-        """OPT_OUT_AUDIT.md declares '12 surfaces'. Constant must match."""
-        assert len(OPT_OUT_SURFACES) == 12, (
-            f'OPT_OUT_SURFACES has {len(OPT_OUT_SURFACES)} items, '
-            f'but OPT_OUT_AUDIT.md declares 12 total surfaces. '
-            f'Update either the audit doc or the constant.'
-        )

tests/test_command_graph_tool_pool_output_format.py

@@ -1,70 +0,0 @@
-"""Tests for --output-format on command-graph and tool-pool (ROADMAP #169).
-
-Diagnostic inventory surfaces now speak the CLI family's JSON contract.
-"""
-
-from __future__ import annotations
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-
-def _run(args: list[str]) -> subprocess.CompletedProcess:
-    return subprocess.run(
-        [sys.executable, '-m', 'src.main', *args],
-        cwd=Path(__file__).resolve().parent.parent,
-        capture_output=True,
-        text=True,
-    )
-
-
-class TestCommandGraphOutputFormat:
-    def test_command_graph_json(self) -> None:
-        result = _run(['command-graph', '--output-format', 'json'])
-        assert result.returncode == 0, result.stderr
-
-        envelope = json.loads(result.stdout)
-        assert 'builtins_count' in envelope
-        assert 'plugin_like_count' in envelope
-        assert 'skill_like_count' in envelope
-        assert 'total_count' in envelope
-        assert envelope['total_count'] == (
-            envelope['builtins_count'] + envelope['plugin_like_count'] + envelope['skill_like_count']
-        )
-        assert isinstance(envelope['builtins'], list)
-        if envelope['builtins']:
-            assert set(envelope['builtins'][0].keys()) == {'name', 'source_hint'}
-
-    def test_command_graph_text_backward_compat(self) -> None:
-        result = _run(['command-graph'])
-        assert result.returncode == 0
-        assert '# Command Graph' in result.stdout
-        assert 'Builtins:' in result.stdout
-        # Not JSON
-        assert not result.stdout.strip().startswith('{')
-
-
-class TestToolPoolOutputFormat:
-    def test_tool_pool_json(self) -> None:
-        result = _run(['tool-pool', '--output-format', 'json'])
-        assert result.returncode == 0, result.stderr
-
-        envelope = json.loads(result.stdout)
-        assert 'simple_mode' in envelope
-        assert 'include_mcp' in envelope
-        assert 'tool_count' in envelope
-        assert 'tools' in envelope
-        assert envelope['tool_count'] == len(envelope['tools'])
-        if envelope['tools']:
-            assert set(envelope['tools'][0].keys()) == {'name', 'source_hint'}
-
-    def test_tool_pool_text_backward_compat(self) -> None:
-        result = _run(['tool-pool'])
-        assert result.returncode == 0
-        assert '# Tool Pool' in result.stdout
-        assert 'Simple mode:' in result.stdout
-        assert not result.stdout.strip().startswith('{')

tests/test_cross_channel_consistency.py

@@ -1,242 +0,0 @@
-"""Cycle #27 cross-channel consistency audit (post-#181).
-
-After #181 fix (envelope.exit_code must match process exit), this test
-class systematizes the three-layer protocol invariant framework:
-
-1. Structural compliance: Does the envelope exist? (#178)
-2. Quality compliance: Is stderr silent + message truthful? (#179)
-3. Cross-channel consistency: Do multiple channels agree? (#181 + this)
-
-This file captures cycle #27's proactive invariant audit proving that
-envelope fields match their corresponding reality channels:
-
-- envelope.command ↔ argv dispatch
-- envelope.output_format ↔ --output-format flag
-- envelope.timestamp ↔ actual wall clock
-- envelope.found/handled/deleted ↔ operational truth (no error block mismatch)
-
-All tests passing = no drift detected.
-"""
-
-from __future__ import annotations
-
-import json
-import subprocess
-from datetime import datetime, timezone
-from pathlib import Path
-
-import pytest
-
-import sys
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-
-def _run(args: list[str]) -> subprocess.CompletedProcess:
-    """Run claw-code command and capture output."""
-    return subprocess.run(
-        ['python3', '-m', 'src.main'] + args,
-        cwd=Path(__file__).parent.parent,
-        capture_output=True,
-        text=True,
-    )
-
-
-class TestCrossChannelConsistency:
-    """Cycle #27: envelope fields must match reality channels.
-    
-    These are distinct from structural/quality tests. A command can
-    emit structurally valid JSON with clean stderr but still lie about
-    its own output_format or exit code (as #181 proved).
-    """
-
-    def test_envelope_command_matches_dispatch(self) -> None:
-        """Envelope.command must equal the dispatched subcommand."""
-        commands_to_test = [
-            'show-command',
-            'show-tool',
-            'list-sessions',
-            'exec-command',
-            'exec-tool',
-            'delete-session',
-        ]
-        failures = []
-        for cmd in commands_to_test:
-            # Dispatch varies by arity
-            if cmd == 'show-command':
-                args = [cmd, 'nonexistent', '--output-format', 'json']
-            elif cmd == 'show-tool':
-                args = [cmd, 'nonexistent', '--output-format', 'json']
-            elif cmd == 'exec-command':
-                args = [cmd, 'unknown', 'test', '--output-format', 'json']
-            elif cmd == 'exec-tool':
-                args = [cmd, 'unknown', '{}', '--output-format', 'json']
-            else:
-                args = [cmd, '--output-format', 'json']
-            
-            result = _run(args)
-            try:
-                envelope = json.loads(result.stdout)
-            except json.JSONDecodeError:
-                failures.append(f'{cmd}: JSON parse error')
-                continue
-            
-            if envelope.get('command') != cmd:
-                failures.append(
-                    f'{cmd}: envelope.command={envelope.get("command")}, '
-                    f'expected {cmd}'
-                )
-        assert not failures, (
-            'Envelope.command must match dispatched subcommand:\n' +
-            '\n'.join(failures)
-        )
-
-    def test_envelope_output_format_matches_flag(self) -> None:
-        """Envelope.output_format must match --output-format flag."""
-        result = _run(['list-sessions', '--output-format', 'json'])
-        envelope = json.loads(result.stdout)
-        assert envelope['output_format'] == 'json', (
-            f'output_format mismatch: flag=json, envelope={envelope["output_format"]}'
-        )
-
-    def test_envelope_timestamp_is_recent(self) -> None:
-        """Envelope.timestamp must be recent (generated at call time)."""
-        result = _run(['list-sessions', '--output-format', 'json'])
-        envelope = json.loads(result.stdout)
-        ts_str = envelope.get('timestamp')
-        assert ts_str, 'no timestamp field'
-        
-        ts = datetime.fromisoformat(ts_str.replace('Z', '+00:00'))
-        now = datetime.now(timezone.utc)
-        delta = abs((now - ts).total_seconds())
-        
-        assert delta < 5, f'timestamp off by {delta}s (should be <5s)'
-
-    def test_envelope_exit_code_matches_process_exit(self) -> None:
-        """Cycle #26/#181: envelope.exit_code == process exit code.
-        
-        This is a critical invariant. Claws that trust the envelope
-        field must get the truth, not a lie.
-        """
-        cases = [
-            (['show-command', 'nonexistent', '--output-format', 'json'], 1),
-            (['show-tool', 'nonexistent', '--output-format', 'json'], 1),
-            (['list-sessions', '--output-format', 'json'], 0),
-            (['delete-session', 'any-id', '--output-format', 'json'], 0),
-        ]
-        failures = []
-        for args, expected_exit in cases:
-            result = _run(args)
-            if result.returncode != expected_exit:
-                failures.append(
-                    f'{args[0]}: process exit {result.returncode}, '
-                    f'expected {expected_exit}'
-                )
-                continue
-            
-            envelope = json.loads(result.stdout)
-            if envelope['exit_code'] != result.returncode:
-                failures.append(
-                    f'{args[0]}: process exit {result.returncode}, '
-                    f'envelope.exit_code {envelope["exit_code"]}'
-                )
-        
-        assert not failures, (
-            'Envelope.exit_code must match process exit:\n' +
-            '\n'.join(failures)
-        )
-
-    def test_envelope_boolean_fields_match_error_presence(self) -> None:
-        """found/handled/deleted fields must correlate with error block.
-        
-        - If field is True, no error block should exist
-        - If field is False + operational error, error block must exist
-        - If field is False + idempotent (delete nonexistent), no error block
-        """
-        cases = [
-            # (args, bool_field, expected_value, expect_error_block)
-            (['show-command', 'nonexistent', '--output-format', 'json'],
-             'found', False, True),
-            (['exec-command', 'unknown', 'test', '--output-format', 'json'],
-             'handled', False, True),
-            (['delete-session', 'any-id', '--output-format', 'json'],
-             'deleted', False, False),  # idempotent, no error
-        ]
-        failures = []
-        for args, field, expected_val, expect_error in cases:
-            result = _run(args)
-            envelope = json.loads(result.stdout)
-            
-            actual_val = envelope.get(field)
-            has_error = 'error' in envelope
-            
-            if actual_val != expected_val:
-                failures.append(
-                    f'{args[0]}: {field}={actual_val}, expected {expected_val}'
-                )
-            if expect_error and not has_error:
-                failures.append(
-                    f'{args[0]}: expected error block, but none present'
-                )
-            elif not expect_error and has_error:
-                failures.append(
-                    f'{args[0]}: unexpected error block present'
-                )
-        
-        assert not failures, (
-            'Boolean fields must correlate with error block:\n' +
-            '\n'.join(failures)
-        )
-
-
-class TestTextVsJsonModeDivergence:
-    """Cycle #29: Document known text-mode vs JSON-mode exit code divergence.
-    
-    ERROR_HANDLING.md specifies the exit code contract applies ONLY when
-    --output-format json is set. Text mode follows argparse defaults (e.g.,
-    exit 2 for parse errors) while JSON mode normalizes to the contract
-    (exit 1 for parse errors).
-    
-    This test class LOCKS the expected divergence so:
-    1. Documentation stays aligned with implementation
-    2. Future changes to text mode behavior are caught as intentional
-    3. Claws consuming subprocess output can trust the docs
-    """
-
-    def test_unknown_command_text_mode_exits_2(self) -> None:
-        """Text mode: argparse default exit 2 for unknown subcommand."""
-        result = _run(['nonexistent-cmd'])
-        assert result.returncode == 2, (
-            f'text mode should exit 2 (argparse default), got {result.returncode}'
-        )
-
-    def test_unknown_command_json_mode_exits_1(self) -> None:
-        """JSON mode: normalized exit 1 for parse error (#178)."""
-        result = _run(['nonexistent-cmd', '--output-format', 'json'])
-        assert result.returncode == 1, (
-            f'JSON mode should exit 1 (protocol contract), got {result.returncode}'
-        )
-        envelope = json.loads(result.stdout)
-        assert envelope['error']['kind'] == 'parse'
-
-    def test_missing_required_arg_text_mode_exits_2(self) -> None:
-        """Text mode: argparse default exit 2 for missing required arg."""
-        result = _run(['exec-command'])  # missing name + prompt
-        assert result.returncode == 2, (
-            f'text mode should exit 2, got {result.returncode}'
-        )
-
-    def test_missing_required_arg_json_mode_exits_1(self) -> None:
-        """JSON mode: normalized exit 1 for parse error."""
-        result = _run(['exec-command', '--output-format', 'json'])
-        assert result.returncode == 1, (
-            f'JSON mode should exit 1, got {result.returncode}'
-        )
-
-    def test_success_path_identical_in_both_modes(self) -> None:
-        """Success exit codes are identical in both modes."""
-        text_result = _run(['list-sessions'])
-        json_result = _run(['list-sessions', '--output-format', 'json'])
-        assert text_result.returncode == json_result.returncode == 0, (
-            f'success exit should be 0 in both modes: '
-            f'text={text_result.returncode}, json={json_result.returncode}'
-        )

tests/test_exec_route_bootstrap_output_format.py

@@ -1,306 +0,0 @@
-"""Tests for --output-format on exec-command/exec-tool/route/bootstrap (ROADMAP #168).
-
-Closes the final JSON-parity gap across the CLI family. After #160/#165/
-#166/#167, the session-lifecycle and inspect CLI commands all spoke JSON;
-this batch extends that contract to the exec, route, and bootstrap
-surfaces — the commands claws actually invoke to DO work, not just inspect
-state.
-
-Verifies:
-- exec-command / exec-tool: JSON envelope with handled + source_hint on
-  success; {name, handled:false, error:{kind,message,retryable}} on
-  not-found
-- route: JSON envelope with match_count + matches list
-- bootstrap: JSON envelope with setup, routed_matches, turn, messages,
-  persisted_session_path
-- All 4 preserve legacy text mode byte-identically
-- Exit codes unchanged (0 success, 1 exec-not-found)
-"""
-
-from __future__ import annotations
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-
-def _run(args: list[str]) -> subprocess.CompletedProcess:
-    return subprocess.run(
-        [sys.executable, '-m', 'src.main', *args],
-        cwd=Path(__file__).resolve().parent.parent,
-        capture_output=True,
-        text=True,
-    )
-
-
-class TestExecCommandOutputFormat:
-    def test_exec_command_found_json(self) -> None:
-        result = _run(['exec-command', 'add-dir', 'hello', '--output-format', 'json'])
-        assert result.returncode == 0, result.stderr
-
-        envelope = json.loads(result.stdout)
-        assert envelope['handled'] is True
-        assert envelope['name'] == 'add-dir'
-        assert envelope['prompt'] == 'hello'
-        assert 'source_hint' in envelope
-        assert 'message' in envelope
-        assert 'error' not in envelope
-
-    def test_exec_command_not_found_json(self) -> None:
-        result = _run(['exec-command', 'nonexistent-cmd', 'hi', '--output-format', 'json'])
-        assert result.returncode == 1
-
-        envelope = json.loads(result.stdout)
-        assert envelope['handled'] is False
-        assert envelope['name'] == 'nonexistent-cmd'
-        assert envelope['prompt'] == 'hi'
-        assert envelope['error']['kind'] == 'command_not_found'
-        assert envelope['error']['retryable'] is False
-        assert 'source_hint' not in envelope
-
-    def test_exec_command_text_backward_compat(self) -> None:
-        result = _run(['exec-command', 'add-dir', 'hello'])
-        assert result.returncode == 0
-        # Single line prose (unchanged from pre-#168)
-        assert result.stdout.count('\n') == 1
-        assert 'add-dir' in result.stdout
-
-
-class TestExecToolOutputFormat:
-    def test_exec_tool_found_json(self) -> None:
-        result = _run(['exec-tool', 'BashTool', '{"cmd":"ls"}', '--output-format', 'json'])
-        assert result.returncode == 0, result.stderr
-
-        envelope = json.loads(result.stdout)
-        assert envelope['handled'] is True
-        assert envelope['name'] == 'BashTool'
-        assert envelope['payload'] == '{"cmd":"ls"}'
-        assert 'source_hint' in envelope
-        assert 'error' not in envelope
-
-    def test_exec_tool_not_found_json(self) -> None:
-        result = _run(['exec-tool', 'NotATool', '{}', '--output-format', 'json'])
-        assert result.returncode == 1
-
-        envelope = json.loads(result.stdout)
-        assert envelope['handled'] is False
-        assert envelope['name'] == 'NotATool'
-        assert envelope['error']['kind'] == 'tool_not_found'
-        assert envelope['error']['retryable'] is False
-
-    def test_exec_tool_text_backward_compat(self) -> None:
-        result = _run(['exec-tool', 'BashTool', '{}'])
-        assert result.returncode == 0
-        assert result.stdout.count('\n') == 1
-
-
-class TestRouteOutputFormat:
-    def test_route_json_envelope(self) -> None:
-        result = _run(['route', 'review mcp', '--limit', '3', '--output-format', 'json'])
-        assert result.returncode == 0
-
-        envelope = json.loads(result.stdout)
-        assert envelope['prompt'] == 'review mcp'
-        assert envelope['limit'] == 3
-        assert 'match_count' in envelope
-        assert 'matches' in envelope
-        assert envelope['match_count'] == len(envelope['matches'])
-        # Every match has required keys
-        for m in envelope['matches']:
-            assert set(m.keys()) == {'kind', 'name', 'score', 'source_hint'}
-            assert m['kind'] in ('command', 'tool')
-
-    def test_route_json_no_matches(self) -> None:
-        # Very unusual string should yield zero matches
-        result = _run(['route', 'zzzzzzzzzqqqqq', '--output-format', 'json'])
-        assert result.returncode == 0
-
-        envelope = json.loads(result.stdout)
-        assert envelope['match_count'] == 0
-        assert envelope['matches'] == []
-
-    def test_route_text_backward_compat(self) -> None:
-        """Text mode tab-separated output unchanged from pre-#168."""
-        result = _run(['route', 'review mcp', '--limit', '2'])
-        assert result.returncode == 0
-        # Each non-empty line has exactly 3 tabs (kind\tname\tscore\tsource_hint)
-        for line in result.stdout.strip().split('\n'):
-            if line:
-                assert line.count('\t') == 3
-
-
-class TestBootstrapOutputFormat:
-    def test_bootstrap_json_envelope(self) -> None:
-        result = _run(['bootstrap', 'review MCP', '--limit', '2', '--output-format', 'json'])
-        assert result.returncode == 0, result.stderr
-
-        envelope = json.loads(result.stdout)
-        # Required top-level keys
-        required = {
-            'prompt', 'limit', 'setup', 'routed_matches',
-            'command_execution_messages', 'tool_execution_messages',
-            'turn', 'persisted_session_path',
-        }
-        assert required.issubset(envelope.keys())
-        # Setup sub-envelope
-        assert 'python_version' in envelope['setup']
-        assert 'platform_name' in envelope['setup']
-        # Turn sub-envelope
-        assert 'stop_reason' in envelope['turn']
-        assert 'prompt' in envelope['turn']
-
-    def test_bootstrap_text_is_markdown(self) -> None:
-        """Text mode produces Markdown (unchanged from pre-#168)."""
-        result = _run(['bootstrap', 'hello', '--limit', '2'])
-        assert result.returncode == 0
-        # Markdown headers
-        assert '# Runtime Session' in result.stdout
-        assert '## Setup' in result.stdout
-        assert '## Routed Matches' in result.stdout
-
-
-class TestFamilyWideJsonParity:
-    """After #167 and #168, ALL inspect/exec/route/lifecycle commands
-    support --output-format. Verify the full family is now parity-complete."""
-
-    FAMILY_SURFACES = [
-        # (cmd_args, expected_to_parse_json)
-        (['show-command', 'add-dir'], True),
-        (['show-tool', 'BashTool'], True),
-        (['exec-command', 'add-dir', 'hi'], True),
-        (['exec-tool', 'BashTool', '{}'], True),
-        (['route', 'review'], True),
-        (['bootstrap', 'hello'], True),
-    ]
-
-    def test_all_family_commands_accept_output_format_json(self) -> None:
-        """Every family command accepts --output-format json and emits parseable JSON."""
-        failures = []
-        for args_base, should_parse in self.FAMILY_SURFACES:
-            result = _run([*args_base, '--output-format', 'json'])
-            if result.returncode not in (0, 1):
-                failures.append(f'{args_base}: exit {result.returncode} — {result.stderr}')
-                continue
-            try:
-                json.loads(result.stdout)
-            except json.JSONDecodeError as e:
-                failures.append(f'{args_base}: not parseable JSON ({e}): {result.stdout[:100]}')
-        assert not failures, (
-            'CLI family JSON parity gap:\n' + '\n'.join(failures)
-        )
-
-    def test_all_family_commands_text_mode_unchanged(self) -> None:
-        """Omitting --output-format defaults to text for every family command."""
-        # Sanity: just verify each runs without error in text mode
-        for args_base, _ in self.FAMILY_SURFACES:
-            result = _run(args_base)
-            assert result.returncode in (0, 1), (
-                f'{args_base} failed in text mode: {result.stderr}'
-            )
-            # Output should not be JSON-shaped (no leading {)
-            assert not result.stdout.strip().startswith('{')
-
-
-class TestEnvelopeExitCodeMatchesProcessExit:
-    """#181: Envelope exit_code field must match actual process exit code.
-    
-    Regression test for the protocol violation where exec-command/exec-tool
-    not-found cases returned exit code 1 from the process but emitted
-    envelopes with exit_code: 0 (default wrap_json_envelope). Claws reading
-    the envelope would misclassify failures as successes.
-    
-    Contract (from ERROR_HANDLING.md):
-    - Exit code 0 = success
-    - Exit code 1 = error/not-found
-    - Envelope MUST reflect process exit
-    """
-
-    def test_exec_command_not_found_envelope_exit_matches(self) -> None:
-        """exec-command 'unknown-name' must have exit_code=1 in envelope."""
-        result = _run(['exec-command', 'nonexistent-cmd-name', 'test-prompt', '--output-format', 'json'])
-        assert result.returncode == 1, f'process exit should be 1, got {result.returncode}'
-        envelope = json.loads(result.stdout)
-        assert envelope['exit_code'] == 1, (
-            f'envelope.exit_code mismatch: process=1, envelope={envelope["exit_code"]}'
-        )
-        assert envelope['handled'] is False
-        assert envelope['error']['kind'] == 'command_not_found'
-
-    def test_exec_tool_not_found_envelope_exit_matches(self) -> None:
-        """exec-tool 'unknown-tool' must have exit_code=1 in envelope."""
-        result = _run(['exec-tool', 'nonexistent-tool-name', '{}', '--output-format', 'json'])
-        assert result.returncode == 1, f'process exit should be 1, got {result.returncode}'
-        envelope = json.loads(result.stdout)
-        assert envelope['exit_code'] == 1, (
-            f'envelope.exit_code mismatch: process=1, envelope={envelope["exit_code"]}'
-        )
-        assert envelope['handled'] is False
-        assert envelope['error']['kind'] == 'tool_not_found'
-
-    def test_all_commands_exit_code_invariant(self) -> None:
-        """Audit: for every clawable command, envelope.exit_code == process exit.
-        
-        This is a stronger invariant than 'emits JSON'. Claws dispatching on
-        the envelope's exit_code field must get the truth, not a lie.
-        """
-        # Sample cases known to return non-zero
-        cases = [
-            # command, expected_exit, justification
-            (['show-command', 'nonexistent-abc'], 1, 'not-found inventory lookup'),
-            (['show-tool', 'nonexistent-xyz'], 1, 'not-found inventory lookup'),
-            (['exec-command', 'nonexistent-1', 'test'], 1, 'not-found execution'),
-            (['exec-tool', 'nonexistent-2', '{}'], 1, 'not-found execution'),
-        ]
-        mismatches = []
-        for args, expected_exit, reason in cases:
-            result = _run([*args, '--output-format', 'json'])
-            if result.returncode != expected_exit:
-                mismatches.append(
-                    f'{args}: expected process exit {expected_exit} ({reason}), '
-                    f'got {result.returncode}'
-                )
-                continue
-            try:
-                envelope = json.loads(result.stdout)
-            except json.JSONDecodeError as e:
-                mismatches.append(f'{args}: JSON parse failed: {e}')
-                continue
-            if envelope.get('exit_code') != result.returncode:
-                mismatches.append(
-                    f'{args}: envelope.exit_code={envelope.get("exit_code")} '
-                    f'!= process exit={result.returncode} ({reason})'
-                )
-        assert not mismatches, (
-            'Envelope exit_code must match process exit code:\n' + 
-            '\n'.join(mismatches)
-        )
-
-
-class TestMetadataFlags:
-    """Cycle #28: --version flag implementation (#180 gap closure)."""
-
-    def test_version_flag_returns_version_text(self) -> None:
-        """--version returns version string and exits successfully."""
-        result = _run(['--version'])
-        assert result.returncode == 0
-        assert 'claw-code' in result.stdout
-        assert '1.0.0' in result.stdout
-
-    def test_help_flag_returns_help_text(self) -> None:
-        """--help returns help text and exits successfully."""
-        result = _run(['--help'])
-        assert result.returncode == 0
-        assert 'usage:' in result.stdout
-        assert 'Python porting workspace' in result.stdout
-
-    def test_help_still_works_after_version_added(self) -> None:
-        """Verify -h and --help both work (no regression)."""
-        result_short = _run(['-h'])
-        result_long = _run(['--help'])
-        assert result_short.returncode == 0
-        assert result_long.returncode == 0
-        assert 'usage:' in result_short.stdout
-        assert 'usage:' in result_long.stdout

tests/test_flush_transcript_cli.py

@@ -1,206 +0,0 @@
-"""Tests for flush-transcript CLI parity with the #160/#165 lifecycle triplet (ROADMAP #166).
-
-Verifies that session *creation* now accepts the same flag family as session
-management (list/delete/load):
-- --directory DIR (alternate storage location)
-- --output-format {text,json} (structured output)
-- --session-id ID (deterministic IDs for claw checkpointing)
-
-Also verifies backward compat: default text output unchanged byte-for-byte.
-"""
-
-from __future__ import annotations
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-
-_REPO_ROOT = Path(__file__).resolve().parent.parent
-
-
-def _run_cli(*args: str) -> subprocess.CompletedProcess[str]:
-    return subprocess.run(
-        [sys.executable, '-m', 'src.main', *args],
-        capture_output=True, text=True, cwd=str(_REPO_ROOT),
-    )
-
-
-class TestDirectoryFlag:
-    def test_flush_transcript_writes_to_custom_directory(self, tmp_path: Path) -> None:
-        result = _run_cli(
-            'flush-transcript', 'hello world',
-            '--directory', str(tmp_path),
-        )
-        assert result.returncode == 0, result.stderr
-        # Exactly one session file should exist in the directory
-        files = list(tmp_path.glob('*.json'))
-        assert len(files) == 1
-        # And the legacy text output points to that file
-        assert str(files[0]) in result.stdout
-
-
-class TestSessionIdFlag:
-    def test_explicit_session_id_is_respected(self, tmp_path: Path) -> None:
-        result = _run_cli(
-            'flush-transcript', 'hello',
-            '--directory', str(tmp_path),
-            '--session-id', 'deterministic-id-42',
-        )
-        assert result.returncode == 0, result.stderr
-        expected_path = tmp_path / 'deterministic-id-42.json'
-        assert expected_path.exists(), (
-            f'session file not created at deterministic path: {expected_path}'
-        )
-        # And it should contain the ID we asked for
-        data = json.loads(expected_path.read_text())
-        assert data['session_id'] == 'deterministic-id-42'
-
-    def test_auto_session_id_when_flag_omitted(self, tmp_path: Path) -> None:
-        """Without --session-id, engine still auto-generates a UUID (backward compat)."""
-        result = _run_cli(
-            'flush-transcript', 'hello',
-            '--directory', str(tmp_path),
-        )
-        assert result.returncode == 0
-        files = list(tmp_path.glob('*.json'))
-        assert len(files) == 1
-        # The filename (minus .json) should be a 32-char hex UUID
-        stem = files[0].stem
-        assert len(stem) == 32
-        assert all(c in '0123456789abcdef' for c in stem)
-
-
-class TestOutputFormatFlag:
-    def test_json_mode_emits_structured_envelope(self, tmp_path: Path) -> None:
-        result = _run_cli(
-            'flush-transcript', 'hello',
-            '--directory', str(tmp_path),
-            '--session-id', 'beta',
-            '--output-format', 'json',
-        )
-        assert result.returncode == 0
-        data = json.loads(result.stdout)
-        assert data['session_id'] == 'beta'
-        assert data['flushed'] is True
-        assert data['path'].endswith('beta.json')
-        # messages_count and token counts should be present and typed
-        assert isinstance(data['messages_count'], int)
-        assert isinstance(data['input_tokens'], int)
-        assert isinstance(data['output_tokens'], int)
-
-    def test_text_mode_byte_identical_to_pre_166_output(self, tmp_path: Path) -> None:
-        """Legacy text output must not change — claws may be parsing it."""
-        result = _run_cli(
-            'flush-transcript', 'hello',
-            '--directory', str(tmp_path),
-        )
-        assert result.returncode == 0
-        lines = result.stdout.strip().split('\n')
-        # Line 1: path ending in .json
-        assert lines[0].endswith('.json')
-        # Line 2: exact legacy format
-        assert lines[1] == 'flushed=True'
-
-
-class TestBackwardCompat:
-    def test_no_flags_default_behaviour(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        """Running with no flags still works (default dir, text mode, auto UUID)."""
-        import os
-        env = os.environ.copy()
-        env['PYTHONPATH'] = str(_REPO_ROOT)
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'flush-transcript', 'hello'],
-            capture_output=True, text=True, cwd=str(tmp_path), env=env,
-        )
-        assert result.returncode == 0, result.stderr
-        # Default dir is `.port_sessions` in CWD
-        sessions_dir = tmp_path / '.port_sessions'
-        assert sessions_dir.exists()
-        assert len(list(sessions_dir.glob('*.json'))) == 1
-
-
-class TestLifecycleIntegration:
-    """#166's real value: the triplet + creation command are now a coherent family."""
-
-    def test_create_then_list_then_load_then_delete_roundtrip(
-        self, tmp_path: Path,
-    ) -> None:
-        """End-to-end: flush → list → load → delete, all via the same --directory."""
-        # 1. Create
-        create_result = _run_cli(
-            'flush-transcript', 'roundtrip test',
-            '--directory', str(tmp_path),
-            '--session-id', 'rt-session',
-            '--output-format', 'json',
-        )
-        assert create_result.returncode == 0
-        assert json.loads(create_result.stdout)['session_id'] == 'rt-session'
-
-        # 2. List
-        list_result = _run_cli(
-            'list-sessions',
-            '--directory', str(tmp_path),
-            '--output-format', 'json',
-        )
-        assert list_result.returncode == 0
-        list_data = json.loads(list_result.stdout)
-        assert 'rt-session' in list_data['sessions']
-
-        # 3. Load
-        load_result = _run_cli(
-            'load-session', 'rt-session',
-            '--directory', str(tmp_path),
-            '--output-format', 'json',
-        )
-        assert load_result.returncode == 0
-        assert json.loads(load_result.stdout)['loaded'] is True
-
-        # 4. Delete
-        delete_result = _run_cli(
-            'delete-session', 'rt-session',
-            '--directory', str(tmp_path),
-            '--output-format', 'json',
-        )
-        assert delete_result.returncode == 0
-
-        # 5. Verify gone
-        verify_result = _run_cli(
-            'load-session', 'rt-session',
-            '--directory', str(tmp_path),
-            '--output-format', 'json',
-        )
-        assert verify_result.returncode == 1
-        assert json.loads(verify_result.stdout)['error']['kind'] == 'session_not_found'
-
-
-class TestFullFamilyParity:
-    """All four session-lifecycle CLI commands accept the same core flag pair.
-
-    This is the #166 acceptance test: flush-transcript joins the family.
-    """
-
-    @pytest.mark.parametrize(
-        'command',
-        ['list-sessions', 'delete-session', 'load-session', 'flush-transcript'],
-    )
-    def test_all_four_accept_directory_flag(self, command: str) -> None:
-        help_text = _run_cli(command, '--help').stdout
-        assert '--directory' in help_text, (
-            f'{command} missing --directory flag (#166 parity gap)'
-        )
-
-    @pytest.mark.parametrize(
-        'command',
-        ['list-sessions', 'delete-session', 'load-session', 'flush-transcript'],
-    )
-    def test_all_four_accept_output_format_flag(self, command: str) -> None:
-        help_text = _run_cli(command, '--help').stdout
-        assert '--output-format' in help_text, (
-            f'{command} missing --output-format flag (#166 parity gap)'
-        )

tests/test_json_envelope_field_consistency.py

@@ -1,213 +0,0 @@
-"""JSON envelope field consistency validation (ROADMAP #173 prep).
-
-This test suite validates that clawable-surface commands' JSON output
-follows the contract defined in SCHEMAS.md. Currently, commands emit
-command-specific envelopes without the canonical common fields
-(timestamp, command, exit_code, output_format, schema_version).
-
-This test documents the current gap and validates the consistency
-of what IS there, providing a baseline for #173 (common field wrapping).
-
-Phase 1 (this test): Validate consistency within each command's envelope.
-Phase 2 (future #173): Wrap all 13 commands with canonical common fields.
-"""
-
-from __future__ import annotations
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-from typing import Any
-
-import pytest
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from src.main import build_parser  # noqa: E402
-
-
-# Expected fields for each clawable command's JSON envelope.
-# These are the command-specific fields (not including common fields yet).
-# Entries are (command_name, required_fields, optional_fields).
-ENVELOPE_CONTRACTS = {
-    'list-sessions': (
-        {'count', 'sessions'},
-        set(),
-    ),
-    'delete-session': (
-        {'session_id', 'deleted', 'directory'},
-        set(),
-    ),
-    'load-session': (
-        {'session_id', 'loaded', 'directory', 'path'},
-        set(),
-    ),
-    'flush-transcript': (
-        {'session_id', 'path', 'flushed', 'messages_count', 'input_tokens', 'output_tokens'},
-        set(),
-    ),
-    'show-command': (
-        {'name', 'found', 'source_hint', 'responsibility'},
-        set(),
-    ),
-    'show-tool': (
-        {'name', 'found', 'source_hint'},
-        set(),
-    ),
-    'exec-command': (
-        {'name', 'prompt', 'handled', 'message', 'source_hint'},
-        set(),
-    ),
-    'exec-tool': (
-        {'name', 'payload', 'handled', 'message', 'source_hint'},
-        set(),
-    ),
-    'route': (
-        {'prompt', 'limit', 'match_count', 'matches'},
-        set(),
-    ),
-    'bootstrap': (
-        {'prompt', 'setup', 'routed_matches', 'turn', 'persisted_session_path'},
-        set(),
-    ),
-    'command-graph': (
-        {'builtins_count', 'plugin_like_count', 'skill_like_count', 'total_count', 'builtins', 'plugin_like', 'skill_like'},
-        set(),
-    ),
-    'tool-pool': (
-        {'simple_mode', 'include_mcp', 'tool_count', 'tools'},
-        set(),
-    ),
-    'bootstrap-graph': (
-        {'stages', 'note'},
-        set(),
-    ),
-}
-
-
-class TestJsonEnvelopeConsistency:
-    """Validate current command envelopes match their declared contracts.
-
-    This is a consistency check, not a conformance check. Once #173 adds
-    common fields to all commands, these tests will auto-pass the common
-    field assertions and verify command-specific fields stay consistent.
-    """
-
-    @pytest.mark.parametrize('cmd_name,contract', sorted(ENVELOPE_CONTRACTS.items()))
-    def test_command_json_fields_present(self, cmd_name: str, contract: tuple[set[str], set[str]]) -> None:
-        required, optional = contract
-        """Command's JSON envelope must include all required fields."""
-        # Get minimal invocation args for this command
-        test_invocations = {
-            'list-sessions': [],
-            'show-command': ['add-dir'],
-            'show-tool': ['BashTool'],
-            'exec-command': ['add-dir', 'hi'],
-            'exec-tool': ['BashTool', '{}'],
-            'route': ['review'],
-            'bootstrap': ['hello'],
-            'command-graph': [],
-            'tool-pool': [],
-            'bootstrap-graph': [],
-        }
-        
-        if cmd_name not in test_invocations:
-            pytest.skip(f'{cmd_name} requires session setup; skipped')
-        
-        cmd_args = test_invocations[cmd_name]
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', cmd_name, *cmd_args, '--output-format', 'json'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        
-        if result.returncode not in (0, 1):
-            pytest.fail(f'{cmd_name}: unexpected exit {result.returncode}\nstderr: {result.stderr}')
-        
-        try:
-            envelope = json.loads(result.stdout)
-        except json.JSONDecodeError as e:
-            pytest.fail(f'{cmd_name}: invalid JSON: {e}\nOutput: {result.stdout[:200]}')
-        
-        # Check required fields (command-specific)
-        missing = required - set(envelope.keys())
-        if missing:
-            pytest.fail(
-                f'{cmd_name} envelope missing required fields: {missing}\n'
-                f'Expected: {required}\nGot: {set(envelope.keys())}'
-            )
-        
-        # Check that extra fields are accounted for (warn if unknown)
-        known = required | optional
-        extra = set(envelope.keys()) - known
-        if extra:
-            # Warn but don't fail — there may be new fields added
-            pytest.warns(UserWarning, match=f'extra fields in {cmd_name}: {extra}')
-
-    def test_envelope_field_value_types(self) -> None:
-        """Smoke test: envelope fields have expected types (bool, int, str, list, dict, null)."""
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'list-sessions', '--output-format', 'json'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        
-        envelope = json.loads(result.stdout)
-        
-        # Spot check a few fields
-        assert isinstance(envelope.get('count'), int), 'count should be int'
-        assert isinstance(envelope.get('sessions'), list), 'sessions should be list'
-
-
-class TestJsonEnvelopeCommonFieldPrep:
-    """Validation stubs for common fields (part of #173 implementation).
-
-    These tests will activate once wrap_json_envelope() is applied to all
-    13 clawable commands. Currently they document the expected contract.
-    """
-
-    def test_all_envelopes_include_timestamp(self) -> None:
-        """Every clawable envelope must include ISO 8601 UTC timestamp."""
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'command-graph', '--output-format', 'json'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        envelope = json.loads(result.stdout)
-        assert 'timestamp' in envelope, 'Missing timestamp field'
-        # Verify ISO 8601 format (ends with Z for UTC)
-        assert envelope['timestamp'].endswith('Z'), f'Timestamp not UTC: {envelope["timestamp"]}'
-
-    def test_all_envelopes_include_command(self) -> None:
-        """Every envelope must echo the command name."""
-        test_cases = [
-            ('list-sessions', []),
-            ('command-graph', []),
-            ('bootstrap', ['hello']),
-        ]
-        for cmd_name, cmd_args in test_cases:
-            result = subprocess.run(
-                [sys.executable, '-m', 'src.main', cmd_name, *cmd_args, '--output-format', 'json'],
-                cwd=Path(__file__).resolve().parent.parent,
-                capture_output=True,
-                text=True,
-            )
-            envelope = json.loads(result.stdout)
-            assert envelope.get('command') == cmd_name, f'{cmd_name} envelope.command mismatch'
-
-    def test_all_envelopes_include_exit_code_and_schema_version(self) -> None:
-        """Every envelope must include exit_code and schema_version."""
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'tool-pool', '--output-format', 'json'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        envelope = json.loads(result.stdout)
-        assert 'exit_code' in envelope, 'Missing exit_code'
-        assert 'schema_version' in envelope, 'Missing schema_version'
-        assert envelope['schema_version'] == '1.0', 'Wrong schema_version'

tests/test_load_session_cli.py

@@ -1,183 +0,0 @@
-"""Tests for load-session CLI parity with list-sessions/delete-session (ROADMAP #165).
-
-Verifies the session-lifecycle CLI triplet is now symmetric:
-- --directory DIR accepted (alternate storage locations reachable)
-- --output-format {text,json} accepted
-- Not-found emits typed JSON error envelope, never a Python traceback
-- Corrupted session file distinguished from not-found via 'kind'
-- Legacy text-mode output unchanged (backward compat)
-"""
-
-from __future__ import annotations
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from src.session_store import StoredSession, save_session  # noqa: E402
-
-
-_REPO_ROOT = Path(__file__).resolve().parent.parent
-
-
-def _run_cli(
-    *args: str, cwd: Path | None = None,
-) -> subprocess.CompletedProcess[str]:
-    """Always invoke the CLI with cwd=repo-root so ``python -m src.main``
-    can resolve the ``src`` package, regardless of where the test's
-    tmp_path is.
-    """
-    return subprocess.run(
-        [sys.executable, '-m', 'src.main', *args],
-        capture_output=True,
-        text=True,
-        cwd=str(cwd) if cwd else str(_REPO_ROOT),
-    )
-
-
-def _make_session(session_id: str) -> StoredSession:
-    return StoredSession(
-        session_id=session_id, messages=('hi',), input_tokens=1, output_tokens=2,
-    )
-
-
-class TestDirectoryFlagParity:
-    def test_load_session_accepts_directory_flag(self, tmp_path: Path) -> None:
-        save_session(_make_session('alpha'), tmp_path)
-        result = _run_cli('load-session', 'alpha', '--directory', str(tmp_path))
-        assert result.returncode == 0, result.stderr
-        assert 'alpha' in result.stdout
-
-    def test_load_session_without_directory_uses_cwd_default(
-        self, tmp_path: Path,
-    ) -> None:
-        """When --directory is omitted, fall back to .port_sessions in CWD.
-
-        Subprocess CWD must still be able to import ``src.main``, so we use
-        ``cwd=tmp_path`` which means ``python -m src.main`` needs ``src/`` on
-        sys.path. We set PYTHONPATH to the repo root via env.
-        """
-        sessions_dir = tmp_path / '.port_sessions'
-        sessions_dir.mkdir()
-        save_session(_make_session('beta'), sessions_dir)
-        import os
-        env = os.environ.copy()
-        env['PYTHONPATH'] = str(_REPO_ROOT)
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'load-session', 'beta'],
-            capture_output=True, text=True, cwd=str(tmp_path), env=env,
-        )
-        assert result.returncode == 0, result.stderr
-        assert 'beta' in result.stdout
-
-
-class TestOutputFormatFlagParity:
-    def test_json_mode_on_success(self, tmp_path: Path) -> None:
-        save_session(
-            StoredSession(
-                session_id='gamma', messages=('x', 'y'),
-                input_tokens=5, output_tokens=7,
-            ),
-            tmp_path,
-        )
-        result = _run_cli(
-            'load-session', 'gamma',
-            '--directory', str(tmp_path),
-            '--output-format', 'json',
-        )
-        assert result.returncode == 0
-        data = json.loads(result.stdout)
-        # Verify common envelope fields (SCHEMAS.md contract)
-        assert 'timestamp' in data
-        assert data['command'] == 'load-session'
-        assert data['exit_code'] == 0
-        assert data['schema_version'] == '1.0'
-        # Verify command-specific fields
-        assert data['session_id'] == 'gamma'
-        assert data['loaded'] is True
-        assert data['messages_count'] == 2
-        assert data['input_tokens'] == 5
-        assert data['output_tokens'] == 7
-
-    def test_text_mode_unchanged_on_success(self, tmp_path: Path) -> None:
-        """Legacy text output must be byte-identical for backward compat."""
-        save_session(_make_session('delta'), tmp_path)
-        result = _run_cli('load-session', 'delta', '--directory', str(tmp_path))
-        assert result.returncode == 0
-        lines = result.stdout.strip().split('\n')
-        assert lines == ['delta', '1 messages', 'in=1 out=2']
-
-
-class TestNotFoundTypedError:
-    def test_not_found_json_envelope(self, tmp_path: Path) -> None:
-        """Not-found emits structured JSON, never a Python traceback."""
-        result = _run_cli(
-            'load-session', 'missing',
-            '--directory', str(tmp_path),
-            '--output-format', 'json',
-        )
-        assert result.returncode == 1
-        assert 'Traceback' not in result.stderr, (
-            'regression #165: raw traceback leaked to stderr'
-        )
-        assert 'SessionNotFoundError' not in result.stdout, (
-            'regression #165: internal class name leaked into CLI output'
-        )
-        data = json.loads(result.stdout)
-        assert data['session_id'] == 'missing'
-        assert data['loaded'] is False
-        assert data['error']['kind'] == 'session_not_found'
-        assert data['error']['retryable'] is False
-        # directory field is populated so claws know where we looked
-        assert 'directory' in data['error']
-
-    def test_not_found_text_mode_no_traceback(self, tmp_path: Path) -> None:
-        """Text mode on not-found must not dump a Python stack either."""
-        result = _run_cli(
-            'load-session', 'missing', '--directory', str(tmp_path),
-        )
-        assert result.returncode == 1
-        assert 'Traceback' not in result.stderr
-        assert result.stdout.startswith('error:')
-
-
-class TestLoadFailedDistinctFromNotFound:
-    def test_corrupted_session_file_surfaces_distinct_kind(
-        self, tmp_path: Path,
-    ) -> None:
-        """A corrupted JSON file must emit kind='session_load_failed', not 'session_not_found'."""
-        (tmp_path / 'broken.json').write_text('{ not valid json')
-        result = _run_cli(
-            'load-session', 'broken',
-            '--directory', str(tmp_path),
-            '--output-format', 'json',
-        )
-        assert result.returncode == 1
-        data = json.loads(result.stdout)
-        assert data['error']['kind'] == 'session_load_failed'
-        assert data['error']['retryable'] is True, (
-            'corrupted file is potentially retryable (fs glitch) unlike not-found'
-        )
-
-
-class TestTripletParityConsistency:
-    """All three #160 CLI commands should accept the same flag pair."""
-
-    @pytest.mark.parametrize('command', ['list-sessions', 'delete-session', 'load-session'])
-    def test_all_three_accept_directory_flag(self, command: str) -> None:
-        help_text = _run_cli(command, '--help').stdout
-        assert '--directory' in help_text, (
-            f'{command} missing --directory flag (#165 parity gap)'
-        )
-
-    @pytest.mark.parametrize('command', ['list-sessions', 'delete-session', 'load-session'])
-    def test_all_three_accept_output_format_flag(self, command: str) -> None:
-        help_text = _run_cli(command, '--help').stdout
-        assert '--output-format' in help_text, (
-            f'{command} missing --output-format flag (#165 parity gap)'
-        )

tests/test_parse_error_envelope.py

@@ -1,239 +0,0 @@
-"""#178 — argparse-level errors emit JSON envelope when --output-format json is requested.
-
-Before #178:
-  $ claw nonexistent --output-format json
-  usage: main.py [-h] {summary,manifest,...} ...
-  main.py: error: argument command: invalid choice: 'nonexistent' (choose from ...)
-  [exit 2, argparse dumps help to stderr, no JSON envelope]
-
-After #178:
-  $ claw nonexistent --output-format json
-  {"timestamp": "...", "command": "nonexistent", "exit_code": 1, ...,
-   "error": {"kind": "parse", "operation": "argparse", ...}}
-  [exit 1, JSON envelope on stdout, matches SCHEMAS.md contract]
-
-Contract:
-- text mode: unchanged (argparse still dumps help to stderr, exit code 2)
-- JSON mode: envelope matches SCHEMAS.md 'error' shape, exit code 1
-- Parse errors use error.kind='parse' (distinct from runtime/session/etc.)
-"""
-
-from __future__ import annotations
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-CLI = [sys.executable, '-m', 'src.main']
-REPO_ROOT = Path(__file__).resolve().parent.parent
-
-
-class TestParseErrorJsonEnvelope:
-    """Argparse errors emit JSON envelope when --output-format json is requested."""
-
-    def test_unknown_command_json_mode_emits_envelope(self) -> None:
-        """Unknown command + --output-format json → parse-error envelope."""
-        result = subprocess.run(
-            CLI + ['nonexistent-command', '--output-format', 'json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        assert result.returncode == 1, f"expected exit 1; got {result.returncode}"
-        envelope = json.loads(result.stdout)
-        # Common fields
-        assert envelope['schema_version'] == '1.0'
-        assert envelope['output_format'] == 'json'
-        assert envelope['exit_code'] == 1
-        # Error envelope shape
-        assert envelope['error']['kind'] == 'parse'
-        assert envelope['error']['operation'] == 'argparse'
-        assert envelope['error']['retryable'] is False
-        assert envelope['error']['target'] == 'nonexistent-command'
-        assert 'hint' in envelope['error']
-
-    def test_unknown_command_json_equals_syntax(self) -> None:
-        """--output-format=json syntax also works."""
-        result = subprocess.run(
-            CLI + ['nonexistent-command', '--output-format=json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        assert result.returncode == 1
-        envelope = json.loads(result.stdout)
-        assert envelope['error']['kind'] == 'parse'
-
-    def test_unknown_command_text_mode_unchanged(self) -> None:
-        """Text mode (default) preserves argparse behavior: help to stderr, exit 2."""
-        result = subprocess.run(
-            CLI + ['nonexistent-command'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        assert result.returncode == 2, f"text mode must preserve argparse exit 2; got {result.returncode}"
-        # stderr should have argparse error (help + error message)
-        assert 'invalid choice' in result.stderr
-        # stdout should be empty (no JSON leaked)
-        assert result.stdout == ''
-
-    def test_invalid_flag_json_mode_emits_envelope(self) -> None:
-        """Invalid flag at top level + --output-format json → envelope."""
-        result = subprocess.run(
-            CLI + ['--invalid-top-level-flag', '--output-format', 'json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        # argparse might reject before --output-format is parsed; still emit envelope
-        assert result.returncode == 1, f"got {result.returncode}: {result.stderr}"
-        envelope = json.loads(result.stdout)
-        assert envelope['error']['kind'] == 'parse'
-
-    def test_missing_command_no_json_flag_behaves_normally(self) -> None:
-        """No --output-format flag + missing command → normal argparse behavior."""
-        result = subprocess.run(
-            CLI,
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        # argparse exits 2 when required subcommand is missing
-        assert result.returncode == 2
-        assert 'required' in result.stderr.lower() or 'the following arguments are required' in result.stderr.lower()
-
-    def test_valid_command_unaffected(self) -> None:
-        """Valid commands still work normally (no regression)."""
-        result = subprocess.run(
-            CLI + ['list-sessions', '--output-format', 'json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        assert result.returncode == 0
-        envelope = json.loads(result.stdout)
-        assert envelope['command'] == 'list-sessions'
-        assert 'sessions' in envelope
-
-    def test_parse_error_envelope_contains_common_fields(self) -> None:
-        """Parse-error envelope must include all common fields per SCHEMAS.md."""
-        result = subprocess.run(
-            CLI + ['bogus', '--output-format', 'json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        envelope = json.loads(result.stdout)
-        # All common fields required by SCHEMAS.md
-        for field in ('timestamp', 'command', 'exit_code', 'output_format', 'schema_version'):
-            assert field in envelope, f"common field '{field}' missing from parse-error envelope"
-
-
-class TestParseErrorSchemaCompliance:
-    """Parse-error envelope matches SCHEMAS.md error shape."""
-
-    def test_error_kind_is_parse(self) -> None:
-        """error.kind='parse' distinguishes argparse errors from runtime errors."""
-        result = subprocess.run(
-            CLI + ['unknown', '--output-format', 'json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        envelope = json.loads(result.stdout)
-        assert envelope['error']['kind'] == 'parse'
-
-    def test_error_retryable_false(self) -> None:
-        """Parse errors are never retryable (typo won't magically fix itself)."""
-        result = subprocess.run(
-            CLI + ['unknown', '--output-format', 'json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        envelope = json.loads(result.stdout)
-        assert envelope['error']['retryable'] is False
-
-
-class TestParseErrorStderrHygiene:
-    """#179: JSON mode must fully suppress argparse stderr output.
-
-    Before #179: stderr leaked argparse usage + error text even when --output-format json.
-    After #179: stderr is silent; envelope carries the real error message verbatim.
-    """
-
-    def test_json_mode_stderr_is_silent_on_unknown_command(self) -> None:
-        """Unknown command in JSON mode: stderr empty."""
-        result = subprocess.run(
-            CLI + ['nonexistent-cmd', '--output-format', 'json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        assert result.stderr == '', (
-            f"JSON mode stderr must be empty; got:\n{result.stderr!r}"
-        )
-
-    def test_json_mode_stderr_is_silent_on_missing_arg(self) -> None:
-        """Missing required arg in JSON mode: stderr empty (no argparse usage leak)."""
-        result = subprocess.run(
-            CLI + ['load-session', '--output-format', 'json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        assert result.stderr == '', (
-            f"JSON mode stderr must be empty on missing arg; got:\n{result.stderr!r}"
-        )
-
-    def test_json_mode_envelope_carries_real_argparse_message(self) -> None:
-        """#179: envelope.error.message contains argparse's actual text, not generic rejection."""
-        result = subprocess.run(
-            CLI + ['load-session', '--output-format', 'json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        envelope = json.loads(result.stdout)
-        # Real argparse message: 'the following arguments are required: session_id'
-        msg = envelope['error']['message']
-        assert 'session_id' in msg, (
-            f"envelope.error.message must carry real argparse text mentioning missing arg; got: {msg!r}"
-        )
-        assert 'required' in msg.lower(), (
-            f"envelope.error.message must indicate what is required; got: {msg!r}"
-        )
-
-    def test_json_mode_envelope_carries_invalid_choice_details(self) -> None:
-        """#179: unknown command envelope includes valid-choice list from argparse."""
-        result = subprocess.run(
-            CLI + ['typo-command', '--output-format', 'json'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        envelope = json.loads(result.stdout)
-        msg = envelope['error']['message']
-        assert 'invalid choice' in msg.lower(), (
-            f"envelope must mention 'invalid choice'; got: {msg!r}"
-        )
-        # Should include at least one valid command name for discoverability
-        assert 'bootstrap' in msg or 'summary' in msg, (
-            f"envelope must include valid choices for discoverability; got: {msg!r}"
-        )
-
-    def test_text_mode_stderr_preserved_on_unknown_command(self) -> None:
-        """Text mode: argparse stderr behavior unchanged (backward compat)."""
-        result = subprocess.run(
-            CLI + ['nonexistent-cmd'],
-            cwd=REPO_ROOT,
-            capture_output=True,
-            text=True,
-        )
-        # Text mode still dumps argparse help to stderr
-        assert 'invalid choice' in result.stderr
-        assert result.returncode == 2

tests/test_porting_workspace.py

@@ -173,105 +173,6 @@ class PortingWorkspaceTests(unittest.TestCase):
         self.assertIn(session_id, result.stdout)
         self.assertIn('messages', result.stdout)
 
-    def test_list_sessions_cli_runs(self) -> None:
-        """#160: list-sessions CLI enumerates stored sessions in text + json."""
-        import json
-        import tempfile
-        from src.session_store import StoredSession, save_session
-
-        with tempfile.TemporaryDirectory() as tmp:
-            tmp_path = Path(tmp)
-            for sid in ['alpha', 'bravo']:
-                save_session(
-                    StoredSession(session_id=sid, messages=('hi',), input_tokens=1, output_tokens=2),
-                    tmp_path,
-                )
-            # text mode
-            text_result = subprocess.run(
-                [sys.executable, '-m', 'src.main', 'list-sessions', '--directory', str(tmp_path)],
-                check=True, capture_output=True, text=True,
-            )
-            self.assertIn('alpha', text_result.stdout)
-            self.assertIn('bravo', text_result.stdout)
-            # json mode
-            json_result = subprocess.run(
-                [sys.executable, '-m', 'src.main', 'list-sessions',
-                 '--directory', str(tmp_path), '--output-format', 'json'],
-                check=True, capture_output=True, text=True,
-            )
-            data = json.loads(json_result.stdout)
-            # Verify common envelope fields (SCHEMAS.md contract)
-            self.assertIn('timestamp', data)
-            self.assertEqual(data['command'], 'list-sessions')
-            self.assertEqual(data['schema_version'], '1.0')
-            # Verify command-specific fields
-            self.assertEqual(data['sessions'], ['alpha', 'bravo'])
-            self.assertEqual(data['count'], 2)
-
-    def test_delete_session_cli_idempotent(self) -> None:
-        """#160: delete-session CLI is idempotent (not-found is exit 0, status=not_found)."""
-        import json
-        import tempfile
-        from src.session_store import StoredSession, save_session
-
-        with tempfile.TemporaryDirectory() as tmp:
-            tmp_path = Path(tmp)
-            save_session(
-                StoredSession(session_id='once', messages=('hi',), input_tokens=1, output_tokens=2),
-                tmp_path,
-            )
-            # first delete: success
-            first = subprocess.run(
-                [sys.executable, '-m', 'src.main', 'delete-session', 'once',
-                 '--directory', str(tmp_path), '--output-format', 'json'],
-                capture_output=True, text=True,
-            )
-            self.assertEqual(first.returncode, 0)
-            envelope_first = json.loads(first.stdout)
-            # Verify common envelope fields (SCHEMAS.md contract)
-            self.assertIn('timestamp', envelope_first)
-            self.assertEqual(envelope_first['command'], 'delete-session')
-            self.assertEqual(envelope_first['exit_code'], 0)
-            self.assertEqual(envelope_first['schema_version'], '1.0')
-            # Verify command-specific fields
-            self.assertEqual(envelope_first['session_id'], 'once')
-            self.assertEqual(envelope_first['deleted'], True)
-            self.assertEqual(envelope_first['status'], 'deleted')
-            # second delete: idempotent, still exit 0
-            second = subprocess.run(
-                [sys.executable, '-m', 'src.main', 'delete-session', 'once',
-                 '--directory', str(tmp_path), '--output-format', 'json'],
-                capture_output=True, text=True,
-            )
-            self.assertEqual(second.returncode, 0)
-            envelope_second = json.loads(second.stdout)
-            self.assertEqual(envelope_second['session_id'], 'once')
-            self.assertEqual(envelope_second['deleted'], False)
-            self.assertEqual(envelope_second['status'], 'not_found')
-
-    def test_delete_session_cli_partial_failure_exit_1(self) -> None:
-        """#160: partial-failure (permission error) surfaces as exit 1 + typed JSON error."""
-        import json
-        import tempfile
-
-        with tempfile.TemporaryDirectory() as tmp:
-            tmp_path = Path(tmp)
-            bad = tmp_path / 'locked.json'
-            bad.mkdir()
-            try:
-                result = subprocess.run(
-                    [sys.executable, '-m', 'src.main', 'delete-session', 'locked',
-                     '--directory', str(tmp_path), '--output-format', 'json'],
-                    capture_output=True, text=True,
-                )
-                self.assertEqual(result.returncode, 1)
-                data = json.loads(result.stdout)
-                self.assertFalse(data['deleted'])
-                self.assertEqual(data['error']['kind'], 'session_delete_failed')
-                self.assertTrue(data['error']['retryable'])
-            finally:
-                bad.rmdir()
-
     def test_tool_permission_filtering_cli_runs(self) -> None:
         result = subprocess.run(
             [sys.executable, '-m', 'src.main', 'tools', '--limit', '10', '--deny-prefix', 'mcp'],

tests/test_run_turn_loop_cancellation.py

@@ -1,156 +0,0 @@
-"""Tests for run_turn_loop timeout triggering cooperative cancel (ROADMAP #164 Stage A).
-
-End-to-end integration: when the wall-clock timeout fires in run_turn_loop,
-the runtime must signal the cancel_event so any in-flight submit_message
-thread sees it at its next safe checkpoint and returns without mutating
-state.
-
-This closes the gap filed in #164: #161's timeout bounded caller wait but
-did not prevent ghost turns.
-"""
-
-from __future__ import annotations
-
-import sys
-import threading
-import time
-from pathlib import Path
-from unittest.mock import patch
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from src.models import UsageSummary  # noqa: E402
-from src.query_engine import TurnResult  # noqa: E402
-from src.runtime import PortRuntime  # noqa: E402
-
-
-def _completed(prompt: str) -> TurnResult:
-    return TurnResult(
-        prompt=prompt,
-        output='ok',
-        matched_commands=(),
-        matched_tools=(),
-        permission_denials=(),
-        usage=UsageSummary(),
-        stop_reason='completed',
-    )
-
-
-class TestTimeoutPropagatesCancelEvent:
-    def test_runtime_passes_cancel_event_to_submit_message(self) -> None:
-        """submit_message receives a cancel_event when a deadline is in play."""
-        runtime = PortRuntime()
-        captured_event: list[threading.Event | None] = []
-
-        def _capture(prompt, commands, tools, denials, cancel_event=None):
-            captured_event.append(cancel_event)
-            return _completed(prompt)
-
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            engine.submit_message.side_effect = _capture
-
-            runtime.run_turn_loop(
-                'hello', max_turns=1, timeout_seconds=5.0,
-            )
-
-            # Runtime passed a real Event object, not None
-            assert len(captured_event) == 1
-            assert isinstance(captured_event[0], threading.Event)
-
-    def test_legacy_no_timeout_does_not_pass_cancel_event(self) -> None:
-        """Without timeout_seconds, the cancel_event is None (legacy behaviour)."""
-        runtime = PortRuntime()
-        captured_kwargs: list[dict] = []
-
-        def _capture(prompt, commands, tools, denials):
-            # Legacy call signature: no cancel_event kwarg
-            captured_kwargs.append({'prompt': prompt})
-            return _completed(prompt)
-
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            engine.submit_message.side_effect = _capture
-
-            runtime.run_turn_loop('hello', max_turns=1)
-
-            # Legacy path didn't pass cancel_event at all
-            assert len(captured_kwargs) == 1
-
-    def test_timeout_sets_cancel_event_before_returning(self) -> None:
-        """When timeout fires mid-call, the event is set and the still-running
-        thread would see 'cancelled' if it checks before returning."""
-        runtime = PortRuntime()
-        observed_events_at_checkpoint: list[bool] = []
-        release = threading.Event()  # test-side release so the thread doesn't leak forever
-
-        def _slow_submit(prompt, commands, tools, denials, cancel_event=None):
-            # Simulate provider work: block until either cancel or a test-side release.
-            # If cancel fires, check if the event is observably set.
-            start = time.monotonic()
-            while time.monotonic() - start < 2.0:
-                if cancel_event is not None and cancel_event.is_set():
-                    observed_events_at_checkpoint.append(True)
-                    return TurnResult(
-                        prompt=prompt, output='',
-                        matched_commands=(), matched_tools=(),
-                        permission_denials=(), usage=UsageSummary(),
-                        stop_reason='cancelled',
-                    )
-                if release.is_set():
-                    break
-                time.sleep(0.05)
-            return _completed(prompt)
-
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            engine.submit_message.side_effect = _slow_submit
-
-            # Tight deadline: 0.2s, submit will be mid-loop when timeout fires
-            start = time.monotonic()
-            results = runtime.run_turn_loop(
-                'hello', max_turns=1, timeout_seconds=0.2,
-            )
-            elapsed = time.monotonic() - start
-            release.set()  # let the background thread exit cleanly
-
-            # Runtime returned a timeout TurnResult to the caller
-            assert results[-1].stop_reason == 'timeout'
-            # And it happened within a reasonable window of the deadline
-            assert elapsed < 1.5, f'runtime did not honour deadline: {elapsed:.2f}s'
-
-            # Give the background thread a moment to observe the cancel.
-            # We don't assert on it directly (thread-level observability is
-            # timing-dependent), but the contract is: the event IS set, so any
-            # cooperative checkpoint will see it.
-            time.sleep(0.3)
-
-
-class TestCancelEventSharedAcrossTurns:
-    """Event is created once per run_turn_loop invocation and shared across turns."""
-
-    def test_same_event_threaded_to_every_submit_message(self) -> None:
-        runtime = PortRuntime()
-        captured_events: list[threading.Event] = []
-
-        def _capture(prompt, commands, tools, denials, cancel_event=None):
-            if cancel_event is not None:
-                captured_events.append(cancel_event)
-            return _completed(prompt)
-
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            engine.submit_message.side_effect = _capture
-
-            runtime.run_turn_loop(
-                'hello', max_turns=3, timeout_seconds=5.0,
-                continuation_prompt='continue',
-            )
-
-            # All 3 turns received the same event object (same identity)
-            assert len(captured_events) == 3
-            assert all(e is captured_events[0] for e in captured_events), (
-                'runtime must share one cancel_event across turns, not create '
-                'a new one per turn \u2014 otherwise a late-arriving cancel on turn '
-                'N-1 cannot affect turn N'
-            )

tests/test_run_turn_loop_continuation.py

@@ -1,161 +0,0 @@
-"""Tests for run_turn_loop continuation contract (ROADMAP #163).
-
-The deprecated ``f'{prompt} [turn N]'`` suffix injection is gone. Verifies:
-- No ``[turn N]`` string ever lands in a submitted prompt
-- Default (``continuation_prompt=None``) stops the loop after turn 0
-- Explicit ``continuation_prompt`` is submitted verbatim on subsequent turns
-- The first turn always gets the original prompt, not the continuation
-"""
-
-from __future__ import annotations
-
-import subprocess
-import sys
-from pathlib import Path
-from unittest.mock import patch
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from src.models import UsageSummary  # noqa: E402
-from src.query_engine import TurnResult  # noqa: E402
-from src.runtime import PortRuntime  # noqa: E402
-
-
-def _completed_result(prompt: str) -> TurnResult:
-    return TurnResult(
-        prompt=prompt,
-        output='ok',
-        matched_commands=(),
-        matched_tools=(),
-        permission_denials=(),
-        usage=UsageSummary(),
-        stop_reason='completed',
-    )
-
-
-class TestNoTurnSuffixInjection:
-    """Core acceptance: no prompt submitted to the engine ever contains '[turn N]'."""
-
-    def test_default_path_submits_original_prompt_only(self) -> None:
-        runtime = PortRuntime()
-        submitted: list[str] = []
-
-        def _capture(prompt, commands, tools, denials):
-            submitted.append(prompt)
-            return _completed_result(prompt)
-
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            engine.submit_message.side_effect = _capture
-
-            runtime.run_turn_loop('investigate this bug', max_turns=3)
-
-            # Without continuation_prompt, only turn 0 should run
-            assert submitted == ['investigate this bug']
-            # And no '[turn N]' suffix anywhere
-            for p in submitted:
-                assert '[turn' not in p, f'found [turn suffix in submitted prompt: {p!r}'
-
-    def test_with_continuation_prompt_no_turn_suffix(self) -> None:
-        runtime = PortRuntime()
-        submitted: list[str] = []
-
-        def _capture(prompt, commands, tools, denials):
-            submitted.append(prompt)
-            return _completed_result(prompt)
-
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            engine.submit_message.side_effect = _capture
-
-            runtime.run_turn_loop(
-                'investigate this bug',
-                max_turns=3,
-                continuation_prompt='Continue.',
-            )
-
-            # Turn 0 = original, turns 1-2 = continuation, verbatim
-            assert submitted == ['investigate this bug', 'Continue.', 'Continue.']
-            # No harness-injected suffix anywhere
-            for p in submitted:
-                assert '[turn' not in p
-                assert not p.endswith(']')
-
-
-class TestContinuationDefaultStopsAfterTurnZero:
-    def test_default_continuation_returns_one_result(self) -> None:
-        runtime = PortRuntime()
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            engine.submit_message.side_effect = lambda p, *_: _completed_result(p)
-
-            results = runtime.run_turn_loop('x', max_turns=5)
-            assert len(results) == 1
-            assert results[0].prompt == 'x'
-
-    def test_default_continuation_does_not_call_engine_twice(self) -> None:
-        runtime = PortRuntime()
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            engine.submit_message.side_effect = lambda p, *_: _completed_result(p)
-
-            runtime.run_turn_loop('x', max_turns=10)
-            # Exactly one submit_message call despite max_turns=10
-            assert engine.submit_message.call_count == 1
-
-
-class TestExplicitContinuationBehaviour:
-    def test_first_turn_always_uses_original_prompt(self) -> None:
-        runtime = PortRuntime()
-        captured: list[str] = []
-
-        def _capture(prompt, *_):
-            captured.append(prompt)
-            return _completed_result(prompt)
-
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            engine.submit_message.side_effect = _capture
-
-            runtime.run_turn_loop(
-                'original task', max_turns=2, continuation_prompt='keep going'
-            )
-
-            assert captured[0] == 'original task'
-            assert captured[1] == 'keep going'
-
-    def test_continuation_respects_max_turns(self) -> None:
-        runtime = PortRuntime()
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            engine.submit_message.side_effect = lambda p, *_: _completed_result(p)
-
-            runtime.run_turn_loop('x', max_turns=3, continuation_prompt='go')
-            assert engine.submit_message.call_count == 3
-
-
-class TestCLIContinuationFlag:
-    def test_cli_default_runs_one_turn(self) -> None:
-        """Without --continuation-prompt, CLI should emit exactly '## Turn 1'."""
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'turn-loop', 'review MCP tool',
-             '--max-turns', '3', '--structured-output'],
-            check=True, capture_output=True, text=True,
-        )
-        assert '## Turn 1' in result.stdout
-        assert '## Turn 2' not in result.stdout
-        assert '[turn' not in result.stdout
-
-    def test_cli_with_continuation_runs_multiple_turns(self) -> None:
-        """With --continuation-prompt, CLI should run up to max_turns."""
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'turn-loop', 'review MCP tool',
-             '--max-turns', '2', '--structured-output',
-             '--continuation-prompt', 'continue'],
-            check=True, capture_output=True, text=True,
-        )
-        assert '## Turn 1' in result.stdout
-        assert '## Turn 2' in result.stdout
-        # The continuation text is visible (it's submitted as the turn prompt)
-        # but no harness-injected [turn N] suffix
-        assert '[turn' not in result.stdout

tests/test_run_turn_loop_permissions.py

@@ -1,95 +0,0 @@
-"""Tests for run_turn_loop permission denials parity (ROADMAP #159).
-
-Verifies that multi-turn sessions have the same security posture as
-single-turn bootstrap_session: denied_tools are inferred from matches
-and threaded through every turn, not hardcoded empty.
-"""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from src.runtime import PortRuntime  # noqa: E402
-
-
-class TestPermissionDenialsInTurnLoop:
-    """#159: permission denials must be non-empty in run_turn_loop,
-    matching what bootstrap_session produces for the same prompt.
-    """
-
-    def test_turn_loop_surfaces_permission_denials_like_bootstrap(self) -> None:
-        """Symmetry check: turn_loop and bootstrap_session infer the same denials."""
-        runtime = PortRuntime()
-        prompt = 'run bash ls'
-
-        # Single-turn via bootstrap
-        bootstrap_result = runtime.bootstrap_session(prompt)
-        bootstrap_denials = bootstrap_result.turn_result.permission_denials
-
-        # Multi-turn via run_turn_loop (single turn, no continuation)
-        loop_results = runtime.run_turn_loop(prompt, max_turns=1)
-        loop_denials = loop_results[0].permission_denials
-
-        # Both should infer denials for bash-family tools
-        assert len(bootstrap_denials) > 0, (
-            'bootstrap_session should deny bash-family tools'
-        )
-        assert len(loop_denials) > 0, (
-            f'#159 regression: run_turn_loop returned empty denials; '
-            f'expected {len(bootstrap_denials)} like bootstrap_session'
-        )
-
-        # The denial kinds should match (both deny the same tools)
-        bootstrap_denied_names = {d.tool_name for d in bootstrap_denials}
-        loop_denied_names = {d.tool_name for d in loop_denials}
-        assert bootstrap_denied_names == loop_denied_names, (
-            f'asymmetric denials: bootstrap denied {bootstrap_denied_names}, '
-            f'loop denied {loop_denied_names}'
-        )
-
-    def test_turn_loop_with_continuation_preserves_denials(self) -> None:
-        """Denials are inferred once at loop start, then passed to every turn."""
-        runtime = PortRuntime()
-        from unittest.mock import patch
-
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            from src.models import UsageSummary
-            from src.query_engine import TurnResult
-
-            engine = mock_factory.return_value
-            submitted_denials: list[tuple] = []
-
-            def _capture(prompt, commands, tools, denials):
-                submitted_denials.append(denials)
-                return TurnResult(
-                    prompt=prompt,
-                    output='ok',
-                    matched_commands=(),
-                    matched_tools=(),
-                    permission_denials=denials,  # echo back the denials
-                    usage=UsageSummary(),
-                    stop_reason='completed',
-                )
-
-            engine.submit_message.side_effect = _capture
-
-            loop_results = runtime.run_turn_loop(
-                'run bash rm', max_turns=2, continuation_prompt='continue'
-            )
-
-            # Both turn 0 and turn 1 should have received the same denials
-            assert len(submitted_denials) == 2
-            assert submitted_denials[0] == submitted_denials[1], (
-                'denials should be consistent across all turns'
-            )
-            # And they should be non-empty (bash is destructive)
-            assert len(submitted_denials[0]) > 0, (
-                'turn-loop denials were empty — #159 regression'
-            )
-
-            # Turn results should reflect the denials that were passed
-            for result in loop_results:
-                assert len(result.permission_denials) > 0

tests/test_run_turn_loop_timeout.py

@@ -1,179 +0,0 @@
-"""Tests for run_turn_loop wall-clock timeout (ROADMAP #161).
-
-Covers:
-- timeout_seconds=None preserves legacy unbounded behaviour
-- timeout_seconds=X aborts a hung turn and emits stop_reason='timeout'
-- Timeout budget is total wall-clock across all turns, not per-turn
-- Already-exhausted budget short-circuits before the first turn runs
-- Legacy path still runs without a ThreadPoolExecutor in the way
-"""
-
-from __future__ import annotations
-
-import sys
-import time
-from pathlib import Path
-from unittest.mock import patch
-
-import pytest
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from src.models import UsageSummary  # noqa: E402
-from src.query_engine import TurnResult  # noqa: E402
-from src.runtime import PortRuntime  # noqa: E402
-
-
-def _completed_result(prompt: str) -> TurnResult:
-    return TurnResult(
-        prompt=prompt,
-        output='ok',
-        matched_commands=(),
-        matched_tools=(),
-        permission_denials=(),
-        usage=UsageSummary(),
-        stop_reason='completed',
-    )
-
-
-class TestLegacyUnboundedBehaviour:
-    def test_no_timeout_preserves_existing_behaviour(self) -> None:
-        """timeout_seconds=None must not change legacy path at all."""
-        results = PortRuntime().run_turn_loop('review MCP tool', max_turns=2)
-        assert len(results) >= 1
-        for r in results:
-            assert r.stop_reason in {'completed', 'max_turns_reached', 'max_budget_reached'}
-            assert r.stop_reason != 'timeout'
-
-
-class TestTimeoutAbortsHungTurn:
-    def test_hung_submit_message_times_out(self) -> None:
-        """A stalled submit_message must be aborted and emit stop_reason='timeout'."""
-        runtime = PortRuntime()
-
-        # #164 Stage A: runtime now passes cancel_event as a 5th positional
-        # arg on the timeout path, so mocks must accept it (even if they ignore it).
-        def _hang(prompt, commands, tools, denials, cancel_event=None):
-            time.sleep(5.0)  # would block the loop
-            return _completed_result(prompt)
-
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            engine.config = None  # attribute-assigned in run_turn_loop
-            engine.submit_message.side_effect = _hang
-
-            start = time.monotonic()
-            results = runtime.run_turn_loop(
-                'review MCP tool', max_turns=3, timeout_seconds=0.3
-            )
-            elapsed = time.monotonic() - start
-
-            # Must exit well under the 5s hang
-            assert elapsed < 1.5, f'run_turn_loop did not honor timeout: {elapsed:.2f}s'
-            assert len(results) == 1
-            assert results[-1].stop_reason == 'timeout'
-
-
-class TestTimeoutBudgetIsTotal:
-    def test_budget_is_cumulative_across_turns(self) -> None:
-        """timeout_seconds is total wall-clock across all turns, not per-turn.
-
-        #163 interaction: multi-turn behaviour now requires an explicit
-        ``continuation_prompt``; otherwise the loop stops after turn 0 and
-        the cumulative-budget contract is trivially satisfied. We supply one
-        here so the test actually exercises the cross-turn deadline.
-        """
-        runtime = PortRuntime()
-        call_count = {'n': 0}
-
-        def _slow(prompt, commands, tools, denials, cancel_event=None):
-            call_count['n'] += 1
-            time.sleep(0.4)  # each turn burns 0.4s
-            return _completed_result(prompt)
-
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            engine.submit_message.side_effect = _slow
-
-            start = time.monotonic()
-            # 0.6s budget, 0.4s per turn. First turn completes (~0.4s),
-            # second turn times out before finishing.
-            results = runtime.run_turn_loop(
-                'review MCP tool',
-                max_turns=5,
-                timeout_seconds=0.6,
-                continuation_prompt='continue',
-            )
-            elapsed = time.monotonic() - start
-
-            # Should exit at around 0.6s, not 2.0s (5 turns * 0.4s)
-            assert elapsed < 1.5, f'cumulative budget not honored: {elapsed:.2f}s'
-            # Last result should be the timeout
-            assert results[-1].stop_reason == 'timeout'
-
-
-class TestExhaustedBudget:
-    def test_zero_timeout_short_circuits_first_turn(self) -> None:
-        """timeout_seconds=0 emits timeout before the first submit_message call."""
-        runtime = PortRuntime()
-
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            # submit_message should never be called when budget is already 0
-            engine.submit_message.side_effect = AssertionError(
-                'submit_message should not run when budget is exhausted'
-            )
-
-            results = runtime.run_turn_loop(
-                'review MCP tool', max_turns=3, timeout_seconds=0.0
-            )
-
-            assert len(results) == 1
-            assert results[0].stop_reason == 'timeout'
-
-
-class TestTimeoutResultShape:
-    def test_timeout_result_has_correct_prompt_and_matches(self) -> None:
-        """Synthetic TurnResult on timeout must carry the turn's prompt + routed matches."""
-        runtime = PortRuntime()
-
-        def _hang(prompt, commands, tools, denials, cancel_event=None):
-            time.sleep(5.0)
-            return _completed_result(prompt)
-
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            engine.submit_message.side_effect = _hang
-
-            results = runtime.run_turn_loop(
-                'review MCP tool', max_turns=2, timeout_seconds=0.2
-            )
-
-            timeout_result = results[-1]
-            assert timeout_result.stop_reason == 'timeout'
-            assert timeout_result.prompt == 'review MCP tool'
-            # matched_commands / matched_tools should still be populated from routing,
-            # so downstream transcripts don't lose the routing context.
-            # These may be empty tuples depending on routing; they must be tuples.
-            assert isinstance(timeout_result.matched_commands, tuple)
-            assert isinstance(timeout_result.matched_tools, tuple)
-            assert isinstance(timeout_result.usage, UsageSummary)
-
-
-class TestNegativeTimeoutTreatedAsExhausted:
-    def test_negative_timeout_short_circuits(self) -> None:
-        """A negative budget should behave identically to exhausted."""
-        runtime = PortRuntime()
-
-        with patch('src.runtime.QueryEnginePort.from_workspace') as mock_factory:
-            engine = mock_factory.return_value
-            engine.submit_message.side_effect = AssertionError(
-                'submit_message should not run when budget is negative'
-            )
-
-            results = runtime.run_turn_loop(
-                'review MCP tool', max_turns=3, timeout_seconds=-1.0
-            )
-
-            assert len(results) == 1
-            assert results[0].stop_reason == 'timeout'

tests/test_session_store.py

@@ -1,173 +0,0 @@
-"""Tests for session_store CRUD surface (ROADMAP #160).
-
-Covers:
-- list_sessions enumeration
-- session_exists boolean check
-- delete_session idempotency + race-safety + partial-failure contract
-- SessionNotFoundError typing (KeyError subclass)
-- SessionDeleteError typing (OSError subclass)
-"""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-
-import pytest
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent / 'src'))
-
-from session_store import (  # noqa: E402
-    StoredSession,
-    SessionDeleteError,
-    SessionNotFoundError,
-    delete_session,
-    list_sessions,
-    load_session,
-    save_session,
-    session_exists,
-)
-
-
-def _make_session(session_id: str) -> StoredSession:
-    return StoredSession(
-        session_id=session_id,
-        messages=('hello',),
-        input_tokens=1,
-        output_tokens=2,
-    )
-
-
-class TestListSessions:
-    def test_empty_directory_returns_empty_list(self, tmp_path: Path) -> None:
-        assert list_sessions(tmp_path) == []
-
-    def test_nonexistent_directory_returns_empty_list(self, tmp_path: Path) -> None:
-        missing = tmp_path / 'never-created'
-        assert list_sessions(missing) == []
-
-    def test_lists_saved_sessions_sorted(self, tmp_path: Path) -> None:
-        save_session(_make_session('charlie'), tmp_path)
-        save_session(_make_session('alpha'), tmp_path)
-        save_session(_make_session('bravo'), tmp_path)
-        assert list_sessions(tmp_path) == ['alpha', 'bravo', 'charlie']
-
-    def test_ignores_non_json_files(self, tmp_path: Path) -> None:
-        save_session(_make_session('real'), tmp_path)
-        (tmp_path / 'notes.txt').write_text('ignore me')
-        (tmp_path / 'data.yaml').write_text('ignore me too')
-        assert list_sessions(tmp_path) == ['real']
-
-
-class TestSessionExists:
-    def test_returns_true_for_saved_session(self, tmp_path: Path) -> None:
-        save_session(_make_session('present'), tmp_path)
-        assert session_exists('present', tmp_path) is True
-
-    def test_returns_false_for_missing_session(self, tmp_path: Path) -> None:
-        assert session_exists('absent', tmp_path) is False
-
-    def test_returns_false_for_nonexistent_directory(self, tmp_path: Path) -> None:
-        missing = tmp_path / 'never-created'
-        assert session_exists('anything', missing) is False
-
-
-class TestLoadSession:
-    def test_raises_typed_error_on_missing(self, tmp_path: Path) -> None:
-        with pytest.raises(SessionNotFoundError) as exc_info:
-            load_session('nonexistent', tmp_path)
-        assert 'nonexistent' in str(exc_info.value)
-
-    def test_not_found_error_is_keyerror_subclass(self, tmp_path: Path) -> None:
-        """Orchestrators catching KeyError should still work."""
-        with pytest.raises(KeyError):
-            load_session('nonexistent', tmp_path)
-
-    def test_not_found_error_is_not_filenotfounderror(self, tmp_path: Path) -> None:
-        """Callers can distinguish 'not found' from IO errors."""
-        with pytest.raises(SessionNotFoundError):
-            load_session('nonexistent', tmp_path)
-        # Specifically, it should NOT match bare FileNotFoundError alone
-        # (SessionNotFoundError inherits from KeyError, not FileNotFoundError)
-        assert not issubclass(SessionNotFoundError, FileNotFoundError)
-
-
-class TestDeleteSessionIdempotency:
-    """Contract: delete_session(x) followed by delete_session(x) must be safe."""
-
-    def test_first_delete_returns_true(self, tmp_path: Path) -> None:
-        save_session(_make_session('to-delete'), tmp_path)
-        assert delete_session('to-delete', tmp_path) is True
-
-    def test_second_delete_returns_false_no_raise(self, tmp_path: Path) -> None:
-        """Idempotency: deleting an already-deleted session is a no-op."""
-        save_session(_make_session('once'), tmp_path)
-        delete_session('once', tmp_path)
-        # Second call must not raise
-        assert delete_session('once', tmp_path) is False
-
-    def test_delete_nonexistent_returns_false_no_raise(self, tmp_path: Path) -> None:
-        """Never-existed session is treated identically to already-deleted."""
-        assert delete_session('never-existed', tmp_path) is False
-
-    def test_delete_removes_only_target(self, tmp_path: Path) -> None:
-        save_session(_make_session('keep'), tmp_path)
-        save_session(_make_session('remove'), tmp_path)
-        delete_session('remove', tmp_path)
-        assert list_sessions(tmp_path) == ['keep']
-
-
-class TestDeleteSessionPartialFailure:
-    """Contract: file exists but cannot be removed -> SessionDeleteError."""
-
-    def test_partial_failure_raises_session_delete_error(self, tmp_path: Path) -> None:
-        """If a directory exists where a session file should be, unlink fails."""
-        bad_path = tmp_path / 'locked.json'
-        bad_path.mkdir()
-        try:
-            with pytest.raises(SessionDeleteError) as exc_info:
-                delete_session('locked', tmp_path)
-            # Underlying cause should be wrapped
-            assert exc_info.value.__cause__ is not None
-            assert isinstance(exc_info.value.__cause__, OSError)
-        finally:
-            bad_path.rmdir()
-
-    def test_delete_error_is_oserror_subclass(self, tmp_path: Path) -> None:
-        """Callers catching OSError should still work for retries."""
-        bad_path = tmp_path / 'locked.json'
-        bad_path.mkdir()
-        try:
-            with pytest.raises(OSError):
-                delete_session('locked', tmp_path)
-        finally:
-            bad_path.rmdir()
-
-
-class TestRaceSafety:
-    """Contract: delete_session must be race-safe between exists-check and unlink."""
-
-    def test_concurrent_deletion_returns_false_not_raises(
-        self, tmp_path: Path, monkeypatch
-    ) -> None:
-        """If another process deletes between exists-check and unlink, return False."""
-        save_session(_make_session('racy'), tmp_path)
-        # Simulate: file disappears right before unlink (concurrent deletion)
-        path = tmp_path / 'racy.json'
-        path.unlink()
-        # Now delete_session should return False, not raise
-        assert delete_session('racy', tmp_path) is False
-
-
-class TestRoundtrip:
-    def test_save_list_load_delete_cycle(self, tmp_path: Path) -> None:
-        session = _make_session('lifecycle')
-        save_session(session, tmp_path)
-        assert 'lifecycle' in list_sessions(tmp_path)
-        assert session_exists('lifecycle', tmp_path)
-        loaded = load_session('lifecycle', tmp_path)
-        assert loaded.session_id == 'lifecycle'
-        assert loaded.messages == ('hello',)
-        assert delete_session('lifecycle', tmp_path) is True
-        assert not session_exists('lifecycle', tmp_path)
-        assert list_sessions(tmp_path) == []

tests/test_show_command_tool_output_format.py

@@ -1,203 +0,0 @@
-"""Tests for --output-format flag on show-command and show-tool (ROADMAP #167).
-
-Verifies parity with session-lifecycle CLI family (#160/#165/#166):
-- show-command and show-tool now accept --output-format {text,json}
-- Found case returns success with JSON envelope: {name, found: true, source_hint, responsibility}
-- Not-found case returns typed error envelope: {name, found: false, error: {kind, message, retryable}}
-- Legacy text output (default) unchanged for backward compat
-- Exit code 0 on success, 1 on not-found (matching load-session contract)
-"""
-
-from __future__ import annotations
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-
-class TestShowCommandOutputFormat:
-    """show-command --output-format {text,json} parity with session-lifecycle family."""
-
-    def test_show_command_found_json(self) -> None:
-        """show-command with found entry returns JSON envelope."""
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'show-command', 'add-dir', '--output-format', 'json'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        assert result.returncode == 0, f'Expected exit 0, got {result.returncode}: {result.stderr}'
-
-        envelope = json.loads(result.stdout)
-        assert envelope['found'] is True
-        assert envelope['name'] == 'add-dir'
-        assert 'source_hint' in envelope
-        assert 'responsibility' in envelope
-        # No error field when found
-        assert 'error' not in envelope
-
-    def test_show_command_not_found_json(self) -> None:
-        """show-command with missing entry returns typed error envelope."""
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'show-command', 'nonexistent-cmd', '--output-format', 'json'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        assert result.returncode == 1, f'Expected exit 1 on not-found, got {result.returncode}'
-
-        envelope = json.loads(result.stdout)
-        assert envelope['found'] is False
-        assert envelope['name'] == 'nonexistent-cmd'
-        assert envelope['error']['kind'] == 'command_not_found'
-        assert envelope['error']['retryable'] is False
-        # No source_hint/responsibility when not found
-        assert 'source_hint' not in envelope or envelope.get('source_hint') is None
-        assert 'responsibility' not in envelope or envelope.get('responsibility') is None
-
-    def test_show_command_text_mode_backward_compat(self) -> None:
-        """show-command text mode (default) is unchanged from pre-#167."""
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'show-command', 'add-dir'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        assert result.returncode == 0
-
-        # Text output is newline-separated (name, source_hint, responsibility)
-        lines = result.stdout.strip().split('\n')
-        assert len(lines) == 3
-        assert lines[0] == 'add-dir'
-        assert 'commands/add-dir/add-dir.tsx' in lines[1]
-
-    def test_show_command_text_mode_not_found(self) -> None:
-        """show-command text mode on not-found returns prose error."""
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'show-command', 'missing'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        assert result.returncode == 1
-        assert 'not found' in result.stdout.lower()
-        assert 'missing' in result.stdout
-
-    def test_show_command_default_is_text(self) -> None:
-        """Omitting --output-format defaults to text."""
-        result_implicit = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'show-command', 'add-dir'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        result_explicit = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'show-command', 'add-dir', '--output-format', 'text'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        assert result_implicit.stdout == result_explicit.stdout
-
-
-class TestShowToolOutputFormat:
-    """show-tool --output-format {text,json} parity with session-lifecycle family."""
-
-    def test_show_tool_found_json(self) -> None:
-        """show-tool with found entry returns JSON envelope."""
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'show-tool', 'BashTool', '--output-format', 'json'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        assert result.returncode == 0, f'Expected exit 0, got {result.returncode}: {result.stderr}'
-
-        envelope = json.loads(result.stdout)
-        assert envelope['found'] is True
-        assert envelope['name'] == 'BashTool'
-        assert 'source_hint' in envelope
-        assert 'responsibility' in envelope
-        assert 'error' not in envelope
-
-    def test_show_tool_not_found_json(self) -> None:
-        """show-tool with missing entry returns typed error envelope."""
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'show-tool', 'NotARealTool', '--output-format', 'json'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        assert result.returncode == 1, f'Expected exit 1 on not-found, got {result.returncode}'
-
-        envelope = json.loads(result.stdout)
-        assert envelope['found'] is False
-        assert envelope['name'] == 'NotARealTool'
-        assert envelope['error']['kind'] == 'tool_not_found'
-        assert envelope['error']['retryable'] is False
-
-    def test_show_tool_text_mode_backward_compat(self) -> None:
-        """show-tool text mode (default) is unchanged from pre-#167."""
-        result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'show-tool', 'BashTool'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        assert result.returncode == 0
-
-        lines = result.stdout.strip().split('\n')
-        assert len(lines) == 3
-        assert lines[0] == 'BashTool'
-        assert 'tools/BashTool/BashTool.tsx' in lines[1]
-
-
-class TestShowCommandToolFormatParity:
-    """Verify symmetry between show-command and show-tool formats."""
-
-    def test_both_accept_output_format_flag(self) -> None:
-        """Both commands accept the same --output-format choices."""
-        # Just ensure both fail with invalid choice (they accept text/json)
-        result_cmd = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'show-command', 'add-dir', '--output-format', 'invalid'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        result_tool = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'show-tool', 'BashTool', '--output-format', 'invalid'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        # Both should fail with argument parser error
-        assert result_cmd.returncode != 0
-        assert result_tool.returncode != 0
-        assert 'invalid choice' in result_cmd.stderr
-        assert 'invalid choice' in result_tool.stderr
-
-    def test_json_envelope_shape_consistency(self) -> None:
-        """Both commands return consistent JSON envelope shape."""
-        cmd_result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'show-command', 'add-dir', '--output-format', 'json'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-        tool_result = subprocess.run(
-            [sys.executable, '-m', 'src.main', 'show-tool', 'BashTool', '--output-format', 'json'],
-            cwd=Path(__file__).resolve().parent.parent,
-            capture_output=True,
-            text=True,
-        )
-
-        cmd_envelope = json.loads(cmd_result.stdout)
-        tool_envelope = json.loads(tool_result.stdout)
-
-        # Same top-level keys for found=true case
-        assert set(cmd_envelope.keys()) == set(tool_envelope.keys())
-        assert cmd_envelope['found'] is True
-        assert tool_envelope['found'] is True

tests/test_submit_message_budget.py

@@ -1,167 +0,0 @@
-"""Tests for submit_message budget-overflow atomicity (ROADMAP #162).
-
-Covers:
-- Budget overflow returns stop_reason='max_budget_reached' without mutating session
-- mutable_messages, transcript_store, permission_denials, total_usage all unchanged
-- Session persisted after overflow does not contain the overflow turn
-- Engine remains usable after overflow: subsequent in-budget call succeeds
-- Normal (non-overflow) path still commits state as before
-"""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-
-import pytest
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from src.models import PermissionDenial, UsageSummary  # noqa: E402
-from src.port_manifest import build_port_manifest  # noqa: E402
-from src.query_engine import QueryEngineConfig, QueryEnginePort  # noqa: E402
-from src.session_store import StoredSession, load_session, save_session  # noqa: E402
-
-
-def _make_engine(max_budget_tokens: int = 10) -> QueryEnginePort:
-    engine = QueryEnginePort(manifest=build_port_manifest())
-    engine.config = QueryEngineConfig(max_budget_tokens=max_budget_tokens)
-    return engine
-
-
-class TestBudgetOverflowDoesNotMutate:
-    """The core #162 contract: overflow must leave session state untouched."""
-
-    def test_mutable_messages_unchanged_on_overflow(self) -> None:
-        engine = _make_engine(max_budget_tokens=10)
-        pre_count = len(engine.mutable_messages)
-        overflow_prompt = ' '.join(['word'] * 50)
-        result = engine.submit_message(overflow_prompt)
-        assert result.stop_reason == 'max_budget_reached'
-        assert len(engine.mutable_messages) == pre_count
-
-    def test_transcript_unchanged_on_overflow(self) -> None:
-        engine = _make_engine(max_budget_tokens=10)
-        pre_count = len(engine.transcript_store.entries)
-        overflow_prompt = ' '.join(['word'] * 50)
-        result = engine.submit_message(overflow_prompt)
-        assert result.stop_reason == 'max_budget_reached'
-        assert len(engine.transcript_store.entries) == pre_count
-
-    def test_permission_denials_unchanged_on_overflow(self) -> None:
-        engine = _make_engine(max_budget_tokens=10)
-        pre_count = len(engine.permission_denials)
-        denials = (PermissionDenial(tool_name='bash', reason='gated in test'),)
-        overflow_prompt = ' '.join(['word'] * 50)
-        result = engine.submit_message(overflow_prompt, denied_tools=denials)
-        assert result.stop_reason == 'max_budget_reached'
-        assert len(engine.permission_denials) == pre_count
-
-    def test_total_usage_unchanged_on_overflow(self) -> None:
-        engine = _make_engine(max_budget_tokens=10)
-        pre_usage = engine.total_usage
-        overflow_prompt = ' '.join(['word'] * 50)
-        result = engine.submit_message(overflow_prompt)
-        assert result.stop_reason == 'max_budget_reached'
-        assert engine.total_usage == pre_usage
-
-    def test_turn_result_reports_pre_mutation_usage(self) -> None:
-        """The TurnResult.usage must reflect session state as-if overflow never happened."""
-        engine = _make_engine(max_budget_tokens=10)
-        pre_usage = engine.total_usage
-        overflow_prompt = ' '.join(['word'] * 50)
-        result = engine.submit_message(overflow_prompt)
-        assert result.stop_reason == 'max_budget_reached'
-        assert result.usage == pre_usage
-
-
-class TestOverflowPersistence:
-    """Session persisted after overflow must not contain the overflow turn."""
-
-    def test_persisted_session_empty_when_first_turn_overflows(
-        self, tmp_path: Path, monkeypatch
-    ) -> None:
-        """When the very first call overflows, persisted session has zero messages."""
-        monkeypatch.chdir(tmp_path)
-        engine = _make_engine(max_budget_tokens=10)
-        overflow_prompt = ' '.join(['word'] * 50)
-        result = engine.submit_message(overflow_prompt)
-        assert result.stop_reason == 'max_budget_reached'
-
-        path_str = engine.persist_session()
-        path = Path(path_str)
-        assert path.exists()
-        loaded = load_session(path.stem, path.parent)
-        assert loaded.messages == (), (
-            f'overflow turn poisoned session: {loaded.messages!r}'
-        )
-
-    def test_persisted_session_retains_only_successful_turns(
-        self, tmp_path: Path, monkeypatch
-    ) -> None:
-        """A successful turn followed by an overflow persists only the successful turn."""
-        monkeypatch.chdir(tmp_path)
-        # Budget large enough for one short turn but not a second big one.
-        # Token counting is whitespace-split (see UsageSummary.add_turn),
-        # so overflow prompts must contain many whitespace-separated words.
-        engine = QueryEnginePort(manifest=build_port_manifest())
-        engine.config = QueryEngineConfig(max_budget_tokens=50)
-
-        ok = engine.submit_message('short')
-        assert ok.stop_reason == 'completed'
-        assert 'short' in engine.mutable_messages
-
-        # 500 whitespace-separated tokens — definitely over a 50-token budget
-        overflow_prompt = ' '.join(['word'] * 500)
-        overflow = engine.submit_message(overflow_prompt)
-        assert overflow.stop_reason == 'max_budget_reached'
-
-        path = Path(engine.persist_session())
-        loaded = load_session(path.stem, path.parent)
-        assert loaded.messages == ('short',), (
-            f'expected only the successful turn, got {loaded.messages!r}'
-        )
-
-
-class TestEngineUsableAfterOverflow:
-    """After overflow, engine must still be usable — overflow is rejection, not corruption."""
-
-    def test_subsequent_in_budget_call_succeeds(self) -> None:
-        """After an overflow rejection, raising the budget and retrying works."""
-        engine = _make_engine(max_budget_tokens=10)
-        overflow_prompt = ' '.join(['word'] * 100)
-        overflow = engine.submit_message(overflow_prompt)
-        assert overflow.stop_reason == 'max_budget_reached'
-
-        # Raise the budget and retry — the engine should be in a clean state
-        engine.config = QueryEngineConfig(max_budget_tokens=10_000)
-        ok = engine.submit_message('short retry')
-        assert ok.stop_reason == 'completed'
-        assert 'short retry' in engine.mutable_messages
-        # The overflow prompt should never have been recorded
-        assert overflow_prompt not in engine.mutable_messages
-
-    def test_multiple_overflow_calls_remain_idempotent(self) -> None:
-        """Repeated overflow calls must not accumulate hidden state."""
-        engine = _make_engine(max_budget_tokens=10)
-        overflow_prompt = ' '.join(['word'] * 50)
-        for _ in range(5):
-            result = engine.submit_message(overflow_prompt)
-            assert result.stop_reason == 'max_budget_reached'
-        assert len(engine.mutable_messages) == 0
-        assert len(engine.transcript_store.entries) == 0
-        assert engine.total_usage == UsageSummary()
-
-
-class TestNormalPathStillCommits:
-    """Regression guard: non-overflow path must still mutate state as before."""
-
-    def test_in_budget_turn_commits_all_state(self) -> None:
-        engine = QueryEnginePort(manifest=build_port_manifest())
-        engine.config = QueryEngineConfig(max_budget_tokens=10_000)
-        result = engine.submit_message('review MCP tool')
-        assert result.stop_reason == 'completed'
-        assert len(engine.mutable_messages) == 1
-        assert len(engine.transcript_store.entries) == 1
-        assert engine.total_usage.input_tokens > 0
-        assert engine.total_usage.output_tokens > 0

tests/test_submit_message_cancellation.py

@@ -1,220 +0,0 @@
-"""Tests for cooperative cancellation in submit_message (ROADMAP #164 Stage A).
-
-Verifies that cancel_event enables safe early termination:
-- Event set before call => immediate return with stop_reason='cancelled'
-- Event set between budget check and commit => still 'cancelled', no mutation
-- Event set after commit => not observable (honest cooperative limit)
-- Legacy callers (cancel_event=None) see zero behaviour change
-- State is untouched on cancellation: mutable_messages, transcript_store,
-  permission_denials, total_usage all preserved
-
-This closes the #161 follow-up gap filed as #164: wedged provider threads
-can no longer silently commit ghost turns after the caller observed a
-timeout.
-"""
-
-from __future__ import annotations
-
-import sys
-import threading
-from pathlib import Path
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from src.models import PermissionDenial  # noqa: E402
-from src.port_manifest import build_port_manifest  # noqa: E402
-from src.query_engine import QueryEngineConfig, QueryEnginePort, TurnResult  # noqa: E402
-
-
-def _fresh_engine(**config_overrides) -> QueryEnginePort:
-    config = QueryEngineConfig(**config_overrides) if config_overrides else QueryEngineConfig()
-    return QueryEnginePort(manifest=build_port_manifest(), config=config)
-
-
-class TestCancellationBeforeCall:
-    """Event set before submit_message is invoked => immediate 'cancelled'."""
-
-    def test_pre_set_event_returns_cancelled_immediately(self) -> None:
-        engine = _fresh_engine()
-        event = threading.Event()
-        event.set()
-
-        result = engine.submit_message('hello', cancel_event=event)
-
-        assert result.stop_reason == 'cancelled'
-        assert result.prompt == 'hello'
-        # Output is empty on pre-budget cancel (no synthesis)
-        assert result.output == ''
-
-    def test_pre_set_event_preserves_mutable_messages(self) -> None:
-        engine = _fresh_engine()
-        event = threading.Event()
-        event.set()
-
-        engine.submit_message('ghost turn', cancel_event=event)
-
-        assert engine.mutable_messages == [], (
-            'cancelled turn must not appear in mutable_messages'
-        )
-
-    def test_pre_set_event_preserves_transcript_store(self) -> None:
-        engine = _fresh_engine()
-        event = threading.Event()
-        event.set()
-
-        engine.submit_message('ghost turn', cancel_event=event)
-
-        assert engine.transcript_store.entries == [], (
-            'cancelled turn must not appear in transcript_store'
-        )
-
-    def test_pre_set_event_preserves_usage_counters(self) -> None:
-        engine = _fresh_engine()
-        initial_usage = engine.total_usage
-        event = threading.Event()
-        event.set()
-
-        engine.submit_message('expensive prompt ' * 100, cancel_event=event)
-
-        assert engine.total_usage == initial_usage, (
-            'cancelled turn must not increment token counters'
-        )
-
-    def test_pre_set_event_preserves_permission_denials(self) -> None:
-        engine = _fresh_engine()
-        event = threading.Event()
-        event.set()
-
-        denials = (PermissionDenial(tool_name='BashTool', reason='destructive'),)
-        engine.submit_message('run bash ls', denied_tools=denials, cancel_event=event)
-
-        assert engine.permission_denials == [], (
-            'cancelled turn must not extend permission_denials'
-        )
-
-
-class TestCancellationAfterBudgetCheck:
-    """Event set between budget projection and commit => 'cancelled', state intact.
-
-    This simulates the realistic racy case: engine starts computing output,
-    caller hits deadline, sets event. Engine observes at post-budget checkpoint
-    and returns cleanly.
-    """
-
-    def test_post_budget_cancel_returns_cancelled(self) -> None:
-        engine = _fresh_engine()
-        event = threading.Event()
-
-        # Patch: set the event after projection but before mutation. We do this
-        # by wrapping _format_output (called mid-submit) to set the event.
-        original_format = engine._format_output
-
-        def _set_then_format(*args, **kwargs):
-            result = original_format(*args, **kwargs)
-            event.set()  # trigger cancel right after output is built
-            return result
-
-        engine._format_output = _set_then_format  # type: ignore[method-assign]
-
-        result = engine.submit_message('hello', cancel_event=event)
-
-        assert result.stop_reason == 'cancelled'
-        # Output IS built here (we're past the pre-budget checkpoint), so it's
-        # not empty. The contract is about *state*, not output synthesis.
-        assert result.output != ''
-        # Critical: state still unchanged
-        assert engine.mutable_messages == []
-        assert engine.transcript_store.entries == []
-
-
-class TestCancellationAfterCommit:
-    """Event set after commit is not observable \u2014 honest cooperative limit."""
-
-    def test_post_commit_cancel_is_not_observable(self) -> None:
-        engine = _fresh_engine()
-        event = threading.Event()
-
-        # Event only set *after* submit_message returns. The first call has
-        # already committed before the event is set.
-        result = engine.submit_message('hello', cancel_event=event)
-        event.set()  # too late
-
-        assert result.stop_reason == 'completed', (
-            'cancel set after commit must not retroactively invalidate the turn'
-        )
-        assert engine.mutable_messages == ['hello']
-
-    def test_next_call_observes_cancel(self) -> None:
-        """The cancel_event persists \u2014 the next call on the same engine sees it."""
-        engine = _fresh_engine()
-        event = threading.Event()
-
-        engine.submit_message('first', cancel_event=event)
-        assert engine.mutable_messages == ['first']
-
-        event.set()
-        # Next call observes the cancel at entry
-        result = engine.submit_message('second', cancel_event=event)
-
-        assert result.stop_reason == 'cancelled'
-        # 'second' must NOT have been committed
-        assert engine.mutable_messages == ['first']
-
-
-class TestLegacyCallersUnchanged:
-    """cancel_event=None (default) => zero behaviour change from pre-#164."""
-
-    def test_no_event_submits_normally(self) -> None:
-        engine = _fresh_engine()
-        result = engine.submit_message('hello')
-
-        assert result.stop_reason == 'completed'
-        assert engine.mutable_messages == ['hello']
-
-    def test_no_event_with_budget_overflow_still_rejects_atomically(self) -> None:
-        """#162 atomicity contract survives when cancel_event is absent."""
-        engine = _fresh_engine(max_budget_tokens=1)
-        words = ' '.join(['word'] * 100)
-
-        result = engine.submit_message(words)  # no cancel_event
-
-        assert result.stop_reason == 'max_budget_reached'
-        assert engine.mutable_messages == []
-
-    def test_no_event_respects_max_turns(self) -> None:
-        """max_turns_reached contract survives when cancel_event is absent."""
-        engine = _fresh_engine(max_turns=1)
-        engine.submit_message('first')
-        result = engine.submit_message('second')  # no cancel_event
-
-        assert result.stop_reason == 'max_turns_reached'
-        assert engine.mutable_messages == ['first']
-
-
-class TestCancellationVsOtherStopReasons:
-    """cancel_event has a defined precedence relative to budget/turns."""
-
-    def test_cancel_precedes_max_turns_check(self) -> None:
-        """If cancel is set when capacity is also full, cancel wins (clearer signal)."""
-        engine = _fresh_engine(max_turns=0)  # immediately full
-        event = threading.Event()
-        event.set()
-
-        result = engine.submit_message('hello', cancel_event=event)
-
-        # cancel_event check is the very first thing in submit_message,
-        # so it fires before the max_turns check even sees capacity
-        assert result.stop_reason == 'cancelled'
-
-    def test_cancel_does_not_override_commit(self) -> None:
-        """Completed turn with late cancel still reports 'completed' \u2014 the
-        turn already succeeded; we don't lie about it."""
-        engine = _fresh_engine()
-        event = threading.Event()
-
-        # Event gets set after the mutation is done \u2014 submit_message doesn't
-        # re-check after commit
-        result = engine.submit_message('hello', cancel_event=event)
-        event.set()
-
-        assert result.stop_reason == 'completed'