diff --git a/.gitattributes b/.gitattributes
index b7ca04d95ed..378b7ab94aa 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -4,7 +4,7 @@
/skill-stubs/*.md text eol=lf
/skill-stubs/_shared/*.md text eol=lf
/skills/*/SKILL.md text eol=lf
-/src/cli/bundled-skill-guides.ts text eol=lf
+/src/cli/skills/bundled-skill-guides.ts text eol=lf
# SVG bytes feed embedded data URLs and asset hashes on every build host.
*.svg text eol=lf
# Compiler input line breaks must not depend on the checkout OS.
diff --git a/.github/actions/cloud-sql-rollout-lease/storage-lease.test.mjs b/.github/actions/cloud-sql-rollout-lease/storage-lease.test.mjs
index 469f64291d4..7463c8ee0b6 100644
--- a/.github/actions/cloud-sql-rollout-lease/storage-lease.test.mjs
+++ b/.github/actions/cloud-sql-rollout-lease/storage-lease.test.mjs
@@ -1,6 +1,5 @@
import assert from 'node:assert/strict'
import { test } from 'node:test'
-import { createAccessTokenSource } from './gcloud-access-token.mjs'
import {
CloudSqlRolloutLease,
LEASE_TTL_MS,
@@ -102,26 +101,6 @@ const HOLDER = {
runAttempt: '1'
}
-test('acquires a lease on an empty object with ifGenerationMatch=0', async () => {
- const storage = fakeStorage()
- const claim = await leaseFor(storage).acquire(HOLDER)
-
- assert.equal(claim.state, 'created')
- const upload = storage.state.requests.find((request) => request.path.startsWith('/upload/'))
- assert.equal(upload.search.get('ifGenerationMatch'), '0')
- assert.equal(upload.search.get('name'), OBJECT)
- assert.deepEqual(storage.state.object.body, {
- repository: 'stablyai/orca-cloud',
- workflow: 'Deploy Relay Production Same-Cap',
- run_id: '42',
- run_url: 'https://github.com/stablyai/orca-cloud/actions/runs/42',
- run_attempt: '1',
- acquired_at: NOW,
- expires_at: NOW + LEASE_TTL_MS,
- holder_key: 'stablyai/orca-cloud/42'
- })
-})
-
test('refuses a live lease held by another run and never writes', async () => {
const storage = fakeStorage({
object: {
@@ -221,19 +200,6 @@ test('refuses to release a lease another run now holds', async () => {
assert.equal(storage.state.object.generation, '1500')
})
-test('fails closed when the bucket answers 5xx', async () => {
- const storage = fakeStorage({
- faults: [{ when: (request) => request.method === 'GET', status: 503 }]
- })
-
- const error = await leaseFor(storage)
- .acquire(HOLDER)
- .catch((thrown) => thrown)
-
- assert.match(error.message, /lease inspection failed: 503/)
- assert.equal(storage.state.requests.filter((request) => request.method !== 'GET').length, 0)
-})
-
test('treats an unreadable record as held, not free', async () => {
const storage = fakeStorage({
object: { generation: '1500', body: { holder_key: 'stablyai/orca/9001' } }
@@ -247,19 +213,6 @@ test('treats an unreadable record as held, not free', async () => {
assert.equal(storage.state.object.generation, '1500')
})
-test('reports a 412 during acquisition as a conflict', async () => {
- const storage = fakeStorage({
- faults: [{ when: (request) => request.path.startsWith('/upload/'), status: 412 }]
- })
-
- const error = await leaseFor(storage)
- .acquire(HOLDER)
- .catch((thrown) => thrown)
-
- assert.ok(error instanceof LeaseConflict)
- assert.match(error.message, /changed concurrently/)
-})
-
test('renewal rewrites only expires_at on the observed generation', async () => {
const storage = fakeStorage()
const lease = leaseFor(storage)
@@ -273,37 +226,3 @@ test('renewal rewrites only expires_at on the observed generation', async () =>
assert.equal(storage.state.object.body.acquired_at, NOW)
assert.equal(storage.state.object.body.holder_key, HOLDER.holderKey)
})
-
-test('renewal stops once the object belongs to someone else', async () => {
- const storage = fakeStorage({
- object: {
- generation: '1500',
- body: storedRecord({ holderKey: 'stablyai/orca/9001', expiresAt: NOW + 60_000 })
- }
- })
-
- assert.deepEqual(await leaseFor(storage).renew(HOLDER.holderKey), {
- renewed: false,
- reason: 'foreign'
- })
-})
-
-test('the access token source re-mints only after the reuse window', () => {
- let clock = 0
- let mints = 0
- const source = createAccessTokenSource({
- run: () => `token-${++mints}`,
- now: () => clock
- })
-
- assert.equal(source(), 'token-1')
- clock = 39 * 60 * 1_000
- assert.equal(source(), 'token-1')
- clock = 41 * 60 * 1_000
- assert.equal(source(), 'token-2')
-})
-
-test('the access token source rejects an empty gcloud response', () => {
- const source = createAccessTokenSource({ run: () => '' })
- assert.throws(() => source(), /empty token/)
-})
diff --git a/.github/workflows/adhoc-mac-build.yml b/.github/workflows/adhoc-mac-build.yml
index fe133720ef4..0391563de52 100644
--- a/.github/workflows/adhoc-mac-build.yml
+++ b/.github/workflows/adhoc-mac-build.yml
@@ -385,7 +385,7 @@ jobs:
ORCA_RELEASE_JAVASCRIPT_BUILD_IDENTITY: dev
NODE_OPTIONS: --max-old-space-size=4096
# Leave build identity unset: telemetry accepts only official stable/rc, so branch artifacts stay silent.
- ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
+ ORCA_DIAGNOSTICS_TOKEN_URL: https://orca.dev/diagnostics/token
# After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
- name: Download the orcad deployment template
diff --git a/.github/workflows/ci-closed-pr-caches.yml b/.github/workflows/ci-closed-pr-caches.yml
index 37dc522417f..32e43244103 100644
--- a/.github/workflows/ci-closed-pr-caches.yml
+++ b/.github/workflows/ci-closed-pr-caches.yml
@@ -62,11 +62,24 @@ jobs:
current.closed_at === pr.closed_at
}
if (!Number.isSafeInteger(pr.number) || pr.number <= 0 ||
- (superseded ? !/^[a-f0-9]{40}$/.test(pr.head?.sha ?? '') :
- !Number.isFinite(Date.parse(pr.closed_at)))) {
+ (superseded && !/^[a-f0-9]{40}$/.test(pr.head?.sha ?? ''))) {
throw new Error('Missing PR identity')
}
- if (!await stillCurrent()) return
+ if (!superseded && !Number.isFinite(Date.parse(pr.closed_at))) {
+ // A close quickly followed by a reopen can deliver a payload rendered after the reopen.
+ const { data: current } = await github.rest.pulls.get({
+ ...context.repo, pull_number: pr.number
+ })
+ if (current.state !== 'closed' || current.merged_at !== null) {
+ core.info(`PR #${pr.number} changed after this close event; skipping cancellation`)
+ return
+ }
+ throw new Error('Missing PR identity')
+ }
+ if (!await stillCurrent()) {
+ core.info(`PR #${pr.number} changed after this event; skipping cancellation`)
+ return
+ }
for (const [prefix, workflow, suffix = ''] of targets) {
const group = prefix === 'cloud-verify-refs/pull'
? `${prefix}/${pr.number}${suffix}` : `${prefix}-${pr.number}${suffix}`
diff --git a/.github/workflows/computer-e2e.yml b/.github/workflows/computer-e2e.yml
index 369de291215..d0abf40cae2 100644
--- a/.github/workflows/computer-e2e.yml
+++ b/.github/workflows/computer-e2e.yml
@@ -48,12 +48,14 @@ on:
- 'src/cli/**'
- 'src/main/computer/**'
- 'src/main/runtime/rpc/dispatcher.ts'
- - 'src/main/runtime/rpc/errors.ts'
+ - 'src/main/runtime/rpc/responses/rpc-response.ts'
- 'src/main/runtime/rpc/methods/computer/computer*.ts'
- 'src/shared/computer-use-*.ts'
- 'tests/e2e/computer-linux.e2e.ts'
- 'tests/e2e/computer-windows.e2e.ts'
- 'tests/e2e/computer-windows-store.e2e.ts'
+ - 'tests/e2e/computer-windows-background.e2e.ts'
+ - 'tests/e2e/helpers/windows-semantic-controls-fixture.*'
- 'tests/e2e/helpers/computer-cli-driver.ts'
- 'tests/e2e/helpers/computer-driver.ts'
- 'tests/e2e/vitest.config.ts'
@@ -97,9 +99,8 @@ jobs:
src/main/computer/macos-native/macos-native-provider-client.test.ts
src/main/providers/windows-shell-preflight-runtime.windows.test.ts
src/main/computer/desktop-script/actions/desktop-script-provider-actions.test.ts
- src/cli/format.test.ts
- src/cli/handlers/computer-action-validation.test.ts
- src/cli/handlers/computer-state-formatting.test.ts
+ src/cli/output/command-result-output.test.ts
+ src/cli/computer/computer-state-formatting.test.ts
src/cli/index.test.ts
src/cli/runtime/envelope-schema.test.ts
src/shared/remote-runtime/remote-runtime-client.test.ts
@@ -152,4 +153,4 @@ jobs:
- run: pnpm verify:computer-native
- run: pnpm build:cli
- run: pnpm run build:electron-vite:parallel
- - run: pnpm test:e2e:computer --reporter=verbose tests/e2e/computer-windows.e2e.ts tests/e2e/computer-windows-store.e2e.ts
+ - run: pnpm test:e2e:computer --reporter=verbose tests/e2e/computer-windows.e2e.ts tests/e2e/computer-windows-store.e2e.ts tests/e2e/computer-windows-background.e2e.ts
diff --git a/.github/workflows/daily-mac-build.yml b/.github/workflows/daily-mac-build.yml
index ec0e08a3644..b06d51de2ac 100644
--- a/.github/workflows/daily-mac-build.yml
+++ b/.github/workflows/daily-mac-build.yml
@@ -235,7 +235,7 @@ jobs:
env:
NODE_OPTIONS: --max-old-space-size=4096
# Leave dev identity unset so official-only stable/rc telemetry stays silent.
- ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
+ ORCA_DIAGNOSTICS_TOKEN_URL: https://orca.dev/diagnostics/token
# After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
- name: Download the orcad deployment template
diff --git a/.github/workflows/dev-channel-win-build.yml b/.github/workflows/dev-channel-win-build.yml
index 7a4d062ecc3..2b7748cddeb 100644
--- a/.github/workflows/dev-channel-win-build.yml
+++ b/.github/workflows/dev-channel-win-build.yml
@@ -254,7 +254,7 @@ jobs:
ORCA_RELEASE_JAVASCRIPT_SOURCE_SHA: ${{ inputs.javascript_source_sha }}
ORCA_RELEASE_JAVASCRIPT_BUILD_IDENTITY: dev
# Unset dev build identity so official stable/rc telemetry stays silent.
- ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
+ ORCA_DIAGNOSTICS_TOKEN_URL: https://orca.dev/diagnostics/token
# Inline so refs predating the wait can still use the trusted dispatch workflow.
- name: Wait for the qualified orcad template
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 2c876199f4f..612b783b147 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -204,7 +204,7 @@ jobs:
timeout-minutes: 15
environment:
name: docs-production
- url: https://www.onorca.dev/docs
+ url: https://orca.dev/docs
env:
VERCEL_TELEMETRY_DISABLED: '1'
steps:
diff --git a/.github/workflows/git-command-termination-runtime.yml b/.github/workflows/git-command-termination-runtime.yml
index 60f82987909..9e5adf69606 100644
--- a/.github/workflows/git-command-termination-runtime.yml
+++ b/.github/workflows/git-command-termination-runtime.yml
@@ -3,7 +3,7 @@ on:
pull_request:
types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
paths:
- - 'src/main/git/command-runner/spawned-command-tree-kill*'
+ - 'src/main/git/command-runner/process-capture/spawned-command-tree-kill*'
- '.github/workflows/git-command-termination-runtime.yml'
workflow_dispatch:
permissions:
@@ -24,4 +24,4 @@ jobs:
persist-credentials: false
- uses: ./.github/actions/install-node-dependencies
- name: Verify exited native child does not trigger taskkill
- run: node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/git/command-runner/spawned-command-tree-kill.test.ts
+ run: node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/git/command-runner/process-capture/spawned-command-tree-kill.test.ts
diff --git a/.github/workflows/hourly-mac-build.yml b/.github/workflows/hourly-mac-build.yml
index bce2d132f30..17b7cc55065 100644
--- a/.github/workflows/hourly-mac-build.yml
+++ b/.github/workflows/hourly-mac-build.yml
@@ -224,7 +224,7 @@ jobs:
env:
NODE_OPTIONS: --max-old-space-size=4096
# Unset dev identity so official-only stable/rc telemetry stays silent.
- ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
+ ORCA_DIAGNOSTICS_TOKEN_URL: https://orca.dev/diagnostics/token
# After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
- name: Download the orcad deployment template
diff --git a/.github/workflows/layout-owner-e2e.yml b/.github/workflows/layout-owner-e2e.yml
index 7899e74285f..97655dae6fc 100644
--- a/.github/workflows/layout-owner-e2e.yml
+++ b/.github/workflows/layout-owner-e2e.yml
@@ -25,7 +25,7 @@ jobs:
uses: ./.github/workflows/e2e.yml
with:
ref: ${{ inputs.ref || github.sha }}
- test_files: '["tests/e2e/workspace-layout-oracle-headless.spec.ts","tests/e2e/workspace-layout-oracle.spec.ts","tests/e2e/cli-file-open-position.spec.ts","tests/e2e/relaunch-first-terminal.spec.ts","tests/e2e/relaunch-sleeping-agents-resume-on-view.spec.ts","tests/e2e/cli-first-worktree-single-terminal.spec.ts","tests/e2e/unopened-workspace-agent-single-resume.spec.ts","tests/e2e/terminal-pane-close-layout-consistency.spec.ts","tests/e2e/golden-file-open-edit-save.spec.ts","tests/e2e/golden-source-control-open-diff.spec.ts","tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts","tests/e2e/floating-workspace-pane-height.spec.ts","tests/e2e/editor-model-host-isolation.spec.ts","tests/e2e/editor-tab-selection-restore.spec.ts","tests/e2e/finished-agent-ghost-resume.spec.ts","tests/e2e/live-background-terminal-mount-authority.spec.ts","tests/e2e/workspace-back-forward-navigation.spec.ts","tests/e2e/worktree-lineage-toggle-shortcut.spec.ts","tests/e2e/local-cli-terminal-retention.spec.ts","tests/e2e/default-tabs-mark-crash-relaunch.spec.ts","tests/e2e/terminal-cli-split-closed-before-mount.spec.ts","tests/e2e/layout-stream-loss-reopen.spec.ts","tests/e2e/terminal-tab-close-restart-persistence.spec.ts","tests/e2e/artificial-opencode-terminal-load.spec.ts","tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts","tests/e2e/headless-paired-remote-terminal-reveal-grid.spec.ts","tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts","tests/e2e/headless-paired-remote-terminal-viewer-size.spec.ts","tests/e2e/headless-serve-browser-tab-restart.spec.ts","tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts","tests/e2e/headless-serve-desktop-activation.spec.ts","tests/e2e/headless-serve-chat-tab-placement.spec.ts","tests/e2e/headless-serve-mobile-native-chat-identity.spec.ts","tests/e2e/layout-compat-old-phone-on-new-server.spec.ts","tests/e2e/layout-compat-serve-restart-keeps-at-at-terminals.spec.ts","tests/e2e/paired-mobile-serve-restart-terminal-tabs.spec.ts","tests/e2e/paired-mobile-desktop-tab-composition.spec.ts","tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts","tests/e2e/paired-desktop-server-layout-frames.spec.ts","tests/e2e/paired-desktop-server-held-pane-reopen.spec.ts","tests/e2e/paired-desktop-server-layout-intents.spec.ts","tests/e2e/paired-desktop-server-layout-writes.spec.ts","tests/e2e/ssh-orcad-"]'
+ test_files: '["tests/e2e/workspace-layout-oracle-headless.spec.ts","tests/e2e/workspace-layout-oracle.spec.ts","tests/e2e/cli-file-open-position.spec.ts","tests/e2e/relaunch-first-terminal.spec.ts","tests/e2e/relaunch-sleeping-agents-resume-on-view.spec.ts","tests/e2e/cli-first-worktree-single-terminal.spec.ts","tests/e2e/unopened-workspace-agent-single-resume.spec.ts","tests/e2e/terminal-pane-close-layout-consistency.spec.ts","tests/e2e/golden-file-open-edit-save.spec.ts","tests/e2e/golden-source-control-open-diff.spec.ts","tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts","tests/e2e/floating-workspace-pane-height.spec.ts","tests/e2e/editor-model-host-isolation.spec.ts","tests/e2e/editor-tab-selection-restore.spec.ts","tests/e2e/finished-agent-ghost-resume.spec.ts","tests/e2e/live-background-terminal-mount-authority.spec.ts","tests/e2e/workspace-back-forward-navigation.spec.ts","tests/e2e/worktree-lineage-toggle-shortcut.spec.ts","tests/e2e/local-cli-terminal-retention.spec.ts","tests/e2e/default-tabs-mark-crash-relaunch.spec.ts","tests/e2e/terminal-cli-split-closed-before-mount.spec.ts","tests/e2e/layout-stream-loss-reopen.spec.ts","tests/e2e/terminal-tab-close-restart-persistence.spec.ts","tests/e2e/artificial-opencode-terminal-load.spec.ts","tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts","tests/e2e/headless-paired-remote-terminal-reveal-grid.spec.ts","tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts","tests/e2e/headless-paired-remote-terminal-viewer-size.spec.ts","tests/e2e/headless-serve-browser-tab-restart.spec.ts","tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts","tests/e2e/headless-serve-desktop-activation.spec.ts","tests/e2e/headless-serve-chat-tab-placement.spec.ts","tests/e2e/headless-serve-mobile-native-chat-identity.spec.ts","tests/e2e/layout-compat-old-phone-on-new-server.spec.ts","tests/e2e/layout-compat-serve-restart-keeps-at-at-terminals.spec.ts","tests/e2e/paired-mobile-serve-restart-terminal-tabs.spec.ts","tests/e2e/paired-mobile-desktop-tab-composition.spec.ts","tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts","tests/e2e/ssh-orcad-"]'
run_changed_e2e: true
needs_build: true
artifact_suffix: -layout-owner-switch-on
diff --git a/.github/workflows/macos-updater-tests.yml b/.github/workflows/macos-updater-tests.yml
index d050fb3db5c..6956a23e03d 100644
--- a/.github/workflows/macos-updater-tests.yml
+++ b/.github/workflows/macos-updater-tests.yml
@@ -11,8 +11,8 @@ on:
- 'native/macos-shipit-scheduling/**'
- 'config/scripts/macos-shipit-scheduling*'
- 'config/electron-builder.config.cjs'
- - 'src/main/startup/main-process-quit*'
- - 'src/main/window/main-window-state-lifecycle*'
+ - 'src/main/startup/quit/main-process-quit*'
+ - 'src/main/window/main-window/main-window-state-lifecycle*'
- 'src/main/window/dashboard-popout-window*'
- 'src/packages/process-host/**'
- 'src/main/runtime/agent-session/lifecycle/structured-agent-cli-writers*'
@@ -55,8 +55,8 @@ jobs:
src/main/updater/mac-install/updater.mac-install.test.ts
src/main/updater/updater.headless-serve-install.test.ts
src/main/updater/mac-install/updater-mac-quit-guard.test.ts
- src/main/startup/main-process-quit-update-veto.test.ts
- src/main/window/main-window-state-lifecycle.test.ts
+ src/main/startup/quit/main-process-quit-update-veto.test.ts
+ src/main/window/main-window/main-window-state-lifecycle.test.ts
- name: Prove login-backed terminal writer census on the disposable runner
env:
ORCA_MACOS_LOGIN_CENSUS_CI: '1'
diff --git a/.github/workflows/main-blocking-work.yml b/.github/workflows/main-blocking-work.yml
new file mode 100644
index 00000000000..312f4dcd487
--- /dev/null
+++ b/.github/workflows/main-blocking-work.yml
@@ -0,0 +1,26 @@
+name: Main blocking work guards
+on:
+ push:
+ branches: [main]
+ workflow_dispatch:
+permissions:
+ contents: read
+concurrency:
+ group: main-blocking-work-${{ github.ref }}
+ cancel-in-progress: false
+jobs:
+ ratchets:
+ runs-on: ubuntu-latest
+ timeout-minutes: 15
+ steps:
+ - uses: actions/checkout@v6
+ - uses: ./.github/actions/install-node-dependencies
+ # Run the blocking-work ratchets over the full tree after every main merge.
+ - name: Enforce ratchets
+ run: |
+ node config/scripts/static-analysis/ratchets/runtime-lifecycle/check-main-sync-fs-ratchet.mjs
+ node config/scripts/static-analysis/ratchets/runtime-lifecycle/check-main-blocking-api-ratchet.mjs
+ # The PR preflight runs spawn separately, so the discovery runner intentionally excludes it.
+ - name: Enforce synchronous launches
+ if: '!cancelled()'
+ run: node config/scripts/static-analysis/process-boundaries/check-main-sync-spawn-ratchet.mjs
diff --git a/.github/workflows/mobile-android-release.yml b/.github/workflows/mobile-android-release.yml
index ed0820862a5..770b391af27 100644
--- a/.github/workflows/mobile-android-release.yml
+++ b/.github/workflows/mobile-android-release.yml
@@ -284,7 +284,7 @@ jobs:
"${{ steps.apk.outputs.checksum }}"
fi
- # Advisory like the site bump: a failed mirror only leaves onorca.dev's "mirror link" on the prior APK.
+ # Advisory like the site bump: a failed mirror only leaves orca.dev's "mirror link" on the prior APK.
release-mirror-r2:
needs: android-build
if: needs.android-build.outputs.publish_release == 'true'
diff --git a/.github/workflows/mobile.yml b/.github/workflows/mobile.yml
index 4eb8ec63f31..0ba46d5730c 100644
--- a/.github/workflows/mobile.yml
+++ b/.github/workflows/mobile.yml
@@ -34,18 +34,24 @@ on:
- 'src/main/runtime/agent-session/agent-session-unsaved-*.ts'
# The phone/host contract program's unmocked desktop sources and its declaration owner's inputs.
- 'src/main/runtime/integrations/github/runtime-github-repository-query-commands.ts'
- - 'src/main/github/issue-field-options.ts'
+ - 'src/main/github/issues/issue-field-options.ts'
- 'config/tsconfig.test.mobile-host-declarations.json'
- 'config/tsconfig.node.json'
- 'src/types/build-constants.d.ts'
- 'src/main/native-chat/agent-session-wire/**'
# Recorded phone transcripts exercise these host decoders and their runtime dependencies.
- 'src/main/native-chat/*transcript*.ts'
+ - 'src/main/native-chat/transcript-discovery/**'
+ - 'src/main/native-chat/transcript-filesystem/**'
+ - 'src/main/native-chat/transcript-decoding/**'
+ - 'src/main/native-chat/transcript-streaming/**'
+ - 'src/main/native-chat/transcript-watching/**'
+ - 'src/main/native-chat/transcript-history/**'
- 'src/main/native-chat/subagent-entry-id-bounds.ts'
- 'src/main/native-chat/agent-session-journal/item-lifecycle/journal-payload-bounds.ts'
- 'src/main/native-chat/agent-session-journal/item-lifecycle/journal-reasoning-row.ts'
- - 'src/main/claude/claude-internal-message-content.ts'
- - 'src/main/claude/claude-stop-hook-feedback.ts'
+ - 'src/main/claude/structured/journal/claude-internal-message-content.ts'
+ - 'src/main/claude/structured/journal/claude-stop-hook-feedback.ts'
- 'src/main/claude/structured/journal/**'
- 'src/main/claude/__fixtures__/claude-adapter-capture-fold.jsonl'
- 'src/main/codex/app-server/codex-item-field-readers.ts'
@@ -54,7 +60,55 @@ on:
- 'src/main/codex/structured/journal/codex-goal-journal-rows.ts'
- 'src/main/codex/__fixtures__/codex-hook-outcomes.jsonl'
- 'src/main/ai-vault/session-scanner-*.ts'
- - 'src/main/ai-vault/ai-vault-scan-cancellation.ts'
+ - 'src/main/ai-vault/discovery/agent-session-directories.ts'
+ - 'src/main/ai-vault/discovery/session-file-discovery.ts'
+ - 'src/main/ai-vault/discovery/session-json-file.ts'
+ - 'src/main/ai-vault/discovery/session-path-absence.ts'
+ - 'src/main/ai-vault/discovery/session-scanner-agent-sources.ts'
+ - 'src/main/ai-vault/discovery/session-scanner-candidates.ts'
+ - 'src/main/ai-vault/discovery/session-scanner-directory-reader.test.ts'
+ - 'src/main/ai-vault/discovery/session-scanner-discovery-pipeline.test.ts'
+ - 'src/main/ai-vault/discovery/session-scanner-discovery.ts'
+ - 'src/main/ai-vault/discovery/session-scanner-roots.ts'
+ - 'src/main/ai-vault/discovery/session-scanner-source-discovery.ts'
+ - 'src/main/ai-vault/parsing/session-json-object.ts'
+ - 'src/main/ai-vault/parsing/session-record-fields.ts'
+ - 'src/main/ai-vault/parsing/session-record-time.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-accumulator.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-agent-parser.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-candidate-parse.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-core-parser-wsl-stall.test.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-injected-title.test.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-jsonl-reader.test.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-jsonl-reader.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-messages.test.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-messages.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-parse-wsl-stall.test.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-record-budget.test.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-recoverable-empty.test.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-text-normalization.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-token-values.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-unlimited-dedup.test.ts'
+ - 'src/main/ai-vault/prompts/session-scanner-first-user-prompt-capture.ts'
+ - 'src/main/ai-vault/prompts/session-scanner-first-user-prompt.test.ts'
+ - 'src/main/ai-vault/prompts/session-scanner-first-user-prompt.ts'
+ - 'src/main/ai-vault/scanner-fixtures/session-scanner-incremental-fixtures.ts'
+ - 'src/main/ai-vault/scanner-fixtures/session-scanner-prime-agent-fixtures.ts'
+ - 'src/main/ai-vault/scanner-fixtures/session-scanner-test-fixtures.ts'
+ - 'src/main/ai-vault/scanners/copilot/session-scanner-copilot-parser.ts'
+ - 'src/main/ai-vault/scanners/opencode/session-scanner-opencode-parser.ts'
+ - 'src/main/ai-vault/scope/session-scanner-scope-discovery.ts'
+ - 'src/main/ai-vault/scope/session-scanner-scope-inventory.test.ts'
+ - 'src/main/ai-vault/scope/session-scanner-scope-inventory.ts'
+ - 'src/main/ai-vault/scope/session-scanner-scope-only.test.ts'
+ - 'src/main/ai-vault/scope/session-scanner-scope-walk.test.ts'
+ - 'src/main/ai-vault/scope/session-scanner-scope-walk.ts'
+ - 'src/main/ai-vault/scope/session-scanner-scope.test.ts'
+ - 'src/main/ai-vault/session-scanner.ts'
+ - 'src/shared/error-message.ts'
+ - 'src/shared/surrogate-safe-text-slice.ts'
+ - 'src/shared/trimmed-string.ts'
+ - 'src/main/ai-vault/scan-lifecycle/ai-vault-scan-cancellation.ts'
- 'src/main/ai-vault/scan-service/session-scanner-service-env.ts'
- 'src/main/ai-vault/scanners/grok/session-scanner-grok-user-text.ts'
- 'src/main/provider-process/provider-json-record.ts'
@@ -122,18 +176,24 @@ on:
- 'src/main/runtime/agent-session/agent-session-unsaved-*.ts'
# The phone/host contract program's unmocked desktop sources and its declaration owner's inputs.
- 'src/main/runtime/integrations/github/runtime-github-repository-query-commands.ts'
- - 'src/main/github/issue-field-options.ts'
+ - 'src/main/github/issues/issue-field-options.ts'
- 'config/tsconfig.test.mobile-host-declarations.json'
- 'config/tsconfig.node.json'
- 'src/types/build-constants.d.ts'
- 'src/main/native-chat/agent-session-wire/**'
# Recorded phone transcripts exercise these host decoders and their runtime dependencies.
- 'src/main/native-chat/*transcript*.ts'
+ - 'src/main/native-chat/transcript-discovery/**'
+ - 'src/main/native-chat/transcript-filesystem/**'
+ - 'src/main/native-chat/transcript-decoding/**'
+ - 'src/main/native-chat/transcript-streaming/**'
+ - 'src/main/native-chat/transcript-watching/**'
+ - 'src/main/native-chat/transcript-history/**'
- 'src/main/native-chat/subagent-entry-id-bounds.ts'
- 'src/main/native-chat/agent-session-journal/item-lifecycle/journal-payload-bounds.ts'
- 'src/main/native-chat/agent-session-journal/item-lifecycle/journal-reasoning-row.ts'
- - 'src/main/claude/claude-internal-message-content.ts'
- - 'src/main/claude/claude-stop-hook-feedback.ts'
+ - 'src/main/claude/structured/journal/claude-internal-message-content.ts'
+ - 'src/main/claude/structured/journal/claude-stop-hook-feedback.ts'
- 'src/main/claude/structured/journal/**'
- 'src/main/claude/__fixtures__/claude-adapter-capture-fold.jsonl'
- 'src/main/codex/app-server/codex-item-field-readers.ts'
@@ -142,7 +202,55 @@ on:
- 'src/main/codex/structured/journal/codex-goal-journal-rows.ts'
- 'src/main/codex/__fixtures__/codex-hook-outcomes.jsonl'
- 'src/main/ai-vault/session-scanner-*.ts'
- - 'src/main/ai-vault/ai-vault-scan-cancellation.ts'
+ - 'src/main/ai-vault/discovery/agent-session-directories.ts'
+ - 'src/main/ai-vault/discovery/session-file-discovery.ts'
+ - 'src/main/ai-vault/discovery/session-json-file.ts'
+ - 'src/main/ai-vault/discovery/session-path-absence.ts'
+ - 'src/main/ai-vault/discovery/session-scanner-agent-sources.ts'
+ - 'src/main/ai-vault/discovery/session-scanner-candidates.ts'
+ - 'src/main/ai-vault/discovery/session-scanner-directory-reader.test.ts'
+ - 'src/main/ai-vault/discovery/session-scanner-discovery-pipeline.test.ts'
+ - 'src/main/ai-vault/discovery/session-scanner-discovery.ts'
+ - 'src/main/ai-vault/discovery/session-scanner-roots.ts'
+ - 'src/main/ai-vault/discovery/session-scanner-source-discovery.ts'
+ - 'src/main/ai-vault/parsing/session-json-object.ts'
+ - 'src/main/ai-vault/parsing/session-record-fields.ts'
+ - 'src/main/ai-vault/parsing/session-record-time.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-accumulator.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-agent-parser.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-candidate-parse.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-core-parser-wsl-stall.test.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-injected-title.test.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-jsonl-reader.test.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-jsonl-reader.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-messages.test.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-messages.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-parse-wsl-stall.test.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-record-budget.test.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-recoverable-empty.test.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-text-normalization.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-token-values.ts'
+ - 'src/main/ai-vault/parsing/session-scanner-unlimited-dedup.test.ts'
+ - 'src/main/ai-vault/prompts/session-scanner-first-user-prompt-capture.ts'
+ - 'src/main/ai-vault/prompts/session-scanner-first-user-prompt.test.ts'
+ - 'src/main/ai-vault/prompts/session-scanner-first-user-prompt.ts'
+ - 'src/main/ai-vault/scanner-fixtures/session-scanner-incremental-fixtures.ts'
+ - 'src/main/ai-vault/scanner-fixtures/session-scanner-prime-agent-fixtures.ts'
+ - 'src/main/ai-vault/scanner-fixtures/session-scanner-test-fixtures.ts'
+ - 'src/main/ai-vault/scanners/copilot/session-scanner-copilot-parser.ts'
+ - 'src/main/ai-vault/scanners/opencode/session-scanner-opencode-parser.ts'
+ - 'src/main/ai-vault/scope/session-scanner-scope-discovery.ts'
+ - 'src/main/ai-vault/scope/session-scanner-scope-inventory.test.ts'
+ - 'src/main/ai-vault/scope/session-scanner-scope-inventory.ts'
+ - 'src/main/ai-vault/scope/session-scanner-scope-only.test.ts'
+ - 'src/main/ai-vault/scope/session-scanner-scope-walk.test.ts'
+ - 'src/main/ai-vault/scope/session-scanner-scope-walk.ts'
+ - 'src/main/ai-vault/scope/session-scanner-scope.test.ts'
+ - 'src/main/ai-vault/session-scanner.ts'
+ - 'src/shared/error-message.ts'
+ - 'src/shared/surrogate-safe-text-slice.ts'
+ - 'src/shared/trimmed-string.ts'
+ - 'src/main/ai-vault/scan-lifecycle/ai-vault-scan-cancellation.ts'
- 'src/main/ai-vault/scan-service/session-scanner-service-env.ts'
- 'src/main/ai-vault/scanners/grok/session-scanner-grok-user-text.ts'
- 'src/main/provider-process/provider-json-record.ts'
diff --git a/.github/workflows/node-server-tests.yml b/.github/workflows/node-server-tests.yml
index 18334d1e587..bf9d65525a1 100644
--- a/.github/workflows/node-server-tests.yml
+++ b/.github/workflows/node-server-tests.yml
@@ -247,7 +247,7 @@ jobs:
run: node "$(if [ -f config/scripts/orcad-distribution/template/build-orcad-template.mjs ]; then printf %s config/scripts/orcad-distribution/template/build-orcad-template.mjs; else printf %s config/scripts/build-orcad-template.mjs; fi)" --targets linux-${{ runner.arch == 'ARM64' && 'arm64' || 'x64' }}-glibc
- name: Verify a structured chat from the desktop server template
if: runner.os == 'Linux'
- run: pnpm test:node-server --artifact src/main/orcad/orcad-packaged-structured-chat.integration.test.ts --maxWorkers=2
+ run: pnpm test:node-server --artifact src/main/orcad/testing/structured-chat/orcad-packaged-structured-chat.integration.test.ts --maxWorkers=2
# Only a Windows runner compiles it; arm64 cross-compiles here.
# Before the Node 18 check below: the build script imports TypeScript, which Node 18 cannot load.
# orcad's instance lock and stop proof read a PID's creation time through it; the x64 binary this
diff --git a/.github/workflows/performance-contracts.yml b/.github/workflows/performance-contracts.yml
index e39f3001d60..850f0671463 100644
--- a/.github/workflows/performance-contracts.yml
+++ b/.github/workflows/performance-contracts.yml
@@ -25,7 +25,6 @@ on:
- 'src/main/codex-usage/codex-rollout-file-lifetime.test.ts'
- 'src/main/codex-usage/scanner-incremental-append.test.ts'
- 'src/main/usage/source-input/jsonl/jsonl-file-reader.test.ts'
- - 'src/main/claude-usage/scanner-incremental-append.test.ts'
permissions:
contents: read
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index ef97a54bf90..afa721690d0 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -851,9 +851,10 @@ jobs:
src/main/pty/history/terminal-history-fish-session.node-pty.test.ts \
src/main/pty/shell-startup/zsh-scoped-histfile.live-shell.test.ts \
src/main/pty/shell-startup/zsh-startup-hook-user-config-equivalence.live-shell.test.ts \
+ src/main/runtime/terminal/wait/tui-idle-zsh-preexec-hook-order.live-shell.test.ts \
src/main/runtime/agent-session/environment/structured-session-cli-login-shell.live-shell.test.ts \
- src/main/startup/shell-probe-terminal-detach.live-shell.test.ts \
- src/main/startup/shell-probe-lifetime.live-shell.test.ts \
+ src/main/startup/shell-environment/shell-probe-terminal-detach.live-shell.test.ts \
+ src/main/startup/shell-environment/shell-probe-lifetime.live-shell.test.ts \
src/renderer/src/components/terminal-pane/pty-connection/emulation/fish-color-scheme-child-stdin.node-pty.test.ts \
src/shared/fish-wsl-cwd-report.node-pty.test.ts \
src/main/wsl/filesystem/wsl-sh-cwd-report.node-pty.test.ts \
@@ -1116,7 +1117,6 @@ jobs:
src/main/browser/cookies/browser-google-cookie-clear.electron.test.ts
src/main/browser/guest-lifecycle/popups/presentation/popup-origin-chrome.electron.test.ts
src/main/browser/guest-lifecycle/navigation/browser-link-materialization.electron.test.ts
- src/main/browser/guest-lifecycle/popups/compatibility/browser-popup-compatibility.electron.test.ts
src/main/browser/guest-lifecycle/popups/compatibility/browser-popup-native-compatibility.electron.test.ts
src/main/browser/guest-lifecycle/popups/compatibility/browser-popup-background-compatibility.electron.test.ts
src/main/browser/extensions/api-runtime/browser-extension-api.electron.test.ts
diff --git a/.github/workflows/preflight-cli-platforms.yml b/.github/workflows/preflight-cli-platforms.yml
index ba38aee2ea6..566c3a27418 100644
--- a/.github/workflows/preflight-cli-platforms.yml
+++ b/.github/workflows/preflight-cli-platforms.yml
@@ -47,8 +47,8 @@ jobs:
src/main/ipc/preflight-runnable-local-cli.test.ts
src/main/ipc/preflight-wsl-agent-detection.test.ts
src/main/ipc/preflight-windows-path-refresh.repro.test.ts
- src/main/startup/hydrate-shell-path.windows.test.ts
- src/main/startup/login-shell-environment.test.ts
+ src/main/startup/shell-environment/hydrate-shell-path.windows.test.ts
+ src/main/startup/shell-environment/login-shell-environment.test.ts
src/packages/process-host/src/process-tree-termination.test.ts
src/packages/process-host/src/run-process.test.ts
src/packages/process-host/src/run-process-termination-failure.test.ts
diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index 01ed0b8ffe1..7ad27fefb3c 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -1321,7 +1321,7 @@ jobs:
ORCA_BUILD_IDENTITY: ${{ steps.tag-classify.outputs.identity }}
SHARED_JAVASCRIPT: ${{ needs.release-javascript.outputs.supported }}
ORCA_RELEASE_JAVASCRIPT_SOURCE_SHA: ${{ needs.release-javascript.outputs.source_sha }}
- ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
+ ORCA_DIAGNOSTICS_TOKEN_URL: https://orca.dev/diagnostics/token
ORCA_POSTHOG_WRITE_KEY: ${{ secrets.ORCA_POSTHOG_WRITE_KEY }}
# After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
@@ -2357,7 +2357,7 @@ jobs:
needs:
- cut
- publish-release
- # Why stable-only: onorca.dev's mirror link tracks GitHub's latest release, which skips RCs.
+ # Why stable-only: orca.dev's mirror link tracks GitHub's latest release, which skips RCs.
if: ${{ !cancelled() && needs.publish-release.result == 'success' && needs.cut.outputs.tag != '' && !contains(needs.cut.outputs.tag, '-rc.') && startsWith(needs.cut.outputs.tag, 'v') }}
uses: ./.github/workflows/release-mirror-r2.yml
with:
diff --git a/.github/workflows/release-javascript.yml b/.github/workflows/release-javascript.yml
index 547794d2ab5..3dce7ab7500 100644
--- a/.github/workflows/release-javascript.yml
+++ b/.github/workflows/release-javascript.yml
@@ -92,7 +92,7 @@ jobs:
ORCA_CLI_BUILD_COMPILER: ${{ inputs.dev_build && 'tsrs' || 'bun' }}
ORCA_BUILD_IDENTITY: ${{ steps.identity.outputs.value }}
ORCA_RELEASE_JAVASCRIPT_BUILD_IDENTITY: ${{ inputs.dev_build && 'dev' || '' }}
- ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
+ ORCA_DIAGNOSTICS_TOKEN_URL: https://orca.dev/diagnostics/token
ORCA_POSTHOG_WRITE_KEY: ${{ !inputs.dev_build && secrets.ORCA_POSTHOG_WRITE_KEY || '' }}
run: |
pnpm run "$JAVASCRIPT_BUILD_SCRIPT"
diff --git a/.github/workflows/release-mac-build.yml b/.github/workflows/release-mac-build.yml
index dabbe336dfe..443a9e14a86 100644
--- a/.github/workflows/release-mac-build.yml
+++ b/.github/workflows/release-mac-build.yml
@@ -189,7 +189,7 @@ jobs:
NODE_OPTIONS: --max-old-space-size=4096
ORCA_BUILD_IDENTITY: ${{ steps.tag-classify.outputs.identity }}
ORCA_RELEASE_JAVASCRIPT_SOURCE_SHA: ${{ inputs.javascript_source_sha }}
- ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
+ ORCA_DIAGNOSTICS_TOKEN_URL: https://orca.dev/diagnostics/token
ORCA_POSTHOG_WRITE_KEY: ${{ secrets.ORCA_POSTHOG_WRITE_KEY }}
# Design D2: the parent release-cut run merged it from every node-server lane at this tag.
diff --git a/.github/workflows/release-mirror-r2.yml b/.github/workflows/release-mirror-r2.yml
index 1c26596b29a..5eb6ef0983d 100644
--- a/.github/workflows/release-mirror-r2.yml
+++ b/.github/workflows/release-mirror-r2.yml
@@ -1,7 +1,7 @@
name: Release Mirror (R2)
-# Copy published release downloads to the public R2 bucket behind https://downloads.onorca.dev.
-# onorca.dev keeps GitHub as the default download and offers this as an opt-in "mirror link"
+# Copy published release downloads to the public R2 bucket behind https://downloads.orca.dev.
+# orca.dev keeps GitHub as the default download and offers this as an opt-in "mirror link"
# for when GitHub release downloads return 5xx. Called by release-cut (stable desktop tags) and
# mobile-android-release after publishing; dispatch manually to backfill a tag.
@@ -13,7 +13,7 @@ on:
required: true
type: string
assets:
- description: Space-separated asset names (blank = the onorca.dev download assets)
+ description: Space-separated asset names (blank = the orca.dev download assets)
required: false
default: ''
type: string
@@ -24,7 +24,7 @@ on:
required: true
type: string
assets:
- description: Space-separated asset names (blank = the onorca.dev download assets)
+ description: Space-separated asset names (blank = the orca.dev download assets)
required: false
default: ''
type: string
diff --git a/.github/workflows/ssh-hostile-hosts.yml b/.github/workflows/ssh-hostile-hosts.yml
index 00c23a1b9de..fa45eff64b3 100644
--- a/.github/workflows/ssh-hostile-hosts.yml
+++ b/.github/workflows/ssh-hostile-hosts.yml
@@ -15,8 +15,8 @@ on:
- 'src/main/managed-server/**'
- 'src/main/ssh/migration-source/**'
- 'src/main/persistence/migrating-orcad-catalog/**'
- - 'src/main/orcad/orcad-artifact-materializer.ts'
- - 'src/main/orcad/orcad-host-unavailable.ts'
+ - 'src/main/orcad/artifact-slots/orcad-artifact-materializer.ts'
+ - 'src/main/orcad/diagnostics/orcad-host-unavailable.ts'
- 'src/main/node-runtime/**'
- 'src/main/ssh/remote-exec/**'
- 'src/main/ssh/remote-host/**'
diff --git a/.github/workflows/ssh-windows-hosts.yml b/.github/workflows/ssh-windows-hosts.yml
index 9f7a2496700..f2a0ca584dd 100644
--- a/.github/workflows/ssh-windows-hosts.yml
+++ b/.github/workflows/ssh-windows-hosts.yml
@@ -12,8 +12,8 @@ on:
- 'src/main/managed-server/**'
- 'src/main/ssh/migration-source/**'
- 'src/main/persistence/migrating-orcad-catalog/**'
- - 'src/main/orcad/orcad-artifact-materializer.ts'
- - 'src/main/orcad/orcad-host-unavailable.ts'
+ - 'src/main/orcad/artifact-slots/orcad-artifact-materializer.ts'
+ - 'src/main/orcad/diagnostics/orcad-host-unavailable.ts'
- 'src/main/node-runtime/**'
- 'src/main/ssh/remote-exec/**'
- 'src/main/ssh/remote-host/**'
@@ -38,7 +38,7 @@ on:
- 'config/scripts/native-build/windows/build-windows-cli-launcher.mjs'
- 'config/scripts/native-build/windows/windows-rust-executable-build.mjs'
- 'native/windows-cli-launcher/**'
- - 'src/main/orcad/orcad-cli-launcher.ts'
+ - 'src/main/orcad/serve-startup/orcad-cli-launcher.ts'
- '.github/actions/prepare-windows-cli-launcher/**'
- 'config/patches/node-pty*'
- 'config/patches/@vscode__windows-process-tree*'
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 0473b42de3b..598db059065 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -221,8 +221,8 @@ jobs:
pnpm-lock.yaml
cloud/pnpm-lock.yaml
- # These two tests import the cloud relay workspace directly. Keeping them in one job
- # avoids installing and building the same workspace once per unit-test shard.
+ # This test imports the cloud relay workspace directly. Its dedicated job avoids
+ # installing and building the same workspace once per unit-test shard.
- name: Install relay integration dependencies
id: relay_dependencies
if: ${{ !cancelled() && steps.root_dependencies.outcome == 'success' }}
@@ -237,5 +237,4 @@ jobs:
ORCA_BACKGROUND_LAUNCH: '1'
run: >-
pnpm exec vitest run --config config/vitest.config.ts
- tests/e2e/relay-region-compatibility.unit.test.ts
tests/e2e/relay-region-correction.unit.test.ts
diff --git a/.github/workflows/zcode-transcript-contract.yml b/.github/workflows/zcode-transcript-contract.yml
index 3c1c7b640a8..eacd35634f8 100644
--- a/.github/workflows/zcode-transcript-contract.yml
+++ b/.github/workflows/zcode-transcript-contract.yml
@@ -7,8 +7,7 @@ on:
- 'src/main/ai-vault/scanners/opencode/**'
- 'src/main/ai-vault/scanners/opencode2/**'
- 'src/main/ai-vault/scanners/opencode/reader-transport/opencode-wsl-runtime*'
- - 'src/main/native-chat/transcript-opencode*'
- - 'src/main/native-chat/transcript-zcode*'
+ - 'src/main/native-chat/transcript-history/opencode/**'
- 'src/shared/native-chat/native-chat-types.ts'
- 'src/shared/native-chat/transcript/native-chat-transcript-projection*'
- '.github/workflows/zcode-transcript-contract.yml'
@@ -41,4 +40,4 @@ jobs:
bun-version-file: config/.bun-version
no-cache: true
- name: Verify SQLite ordering, legacy readers, and host routing
- run: pnpm test src/main/native-chat/transcript-zcode.test.ts src/main/native-chat/transcript-opencode-sqlite-query.test.ts src/main/ai-vault/scanners/zcode/session-scanner-zcode.test.ts src/main/ai-vault/scanners/opencode/reader-transport/opencode-wsl-runtime-preparation.test.ts src/shared/native-chat/transcript/native-chat-transcript-projection.test.ts src/renderer/src/components/native-chat/conversation/projection/structured-agent-session-transcript-order.test.ts
+ run: pnpm test src/main/native-chat/transcript-history/opencode/transcript-zcode.test.ts src/main/native-chat/transcript-history/opencode/transcript-opencode-sqlite-query.test.ts src/main/ai-vault/scanners/zcode/session-scanner-zcode.test.ts src/main/ai-vault/scanners/opencode/reader-transport/opencode-wsl-runtime-preparation.test.ts src/shared/native-chat/transcript/native-chat-transcript-projection.test.ts src/renderer/src/components/native-chat/conversation/projection/structured-agent-session-transcript-order.test.ts
diff --git a/.oxlintrc.json b/.oxlintrc.json
index d0b480c6b59..a2f65ca794b 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -114,6 +114,22 @@
"unicorn/throw-new-error": "error"
},
"overrides": [
+ {
+ "files": ["src/main/backend/**/*.ts"],
+ "rules": {
+ "no-restricted-imports": [
+ "error",
+ {
+ "patterns": [
+ {
+ "group": ["electron", "electron/*"],
+ "message": "Backend services use the typed desktop capability bridge; only the shell imports Electron."
+ }
+ ]
+ }
+ ]
+ }
+ },
{
"files": ["**/*.{js,cjs,mjs,jsx,ts,tsx,mts,cts}"],
"excludeFiles": [
@@ -151,6 +167,47 @@
]
}
},
+ {
+ "files": ["src/main/backend/**/*.ts"],
+ "excludeFiles": [
+ "**/*.{test,spec}.{js,cjs,mjs,jsx,ts,tsx,mts,cts}",
+ "**/__tests__/**",
+ "src/renderer/src/runtime/web-runtime-browser-creation-placement-test-rig.ts"
+ ],
+ "rules": {
+ "no-restricted-imports": [
+ "error",
+ {
+ "paths": [
+ {
+ "name": "@linear/sdk",
+ "allowTypeImports": true,
+ "message": "Value-importing @linear/sdk hoists its ~2.6MB CJS bundle into the eager top-level require block and defeats the lazy loader. Use `import type` plus loadLinearSdk() from src/main/linear/linear-sdk.ts."
+ },
+ {
+ "name": "ssh2",
+ "allowTypeImports": true,
+ "message": "Value-importing ssh2 hoists it into the eager main-process require block and blocks startup (#35731). Use `import type` plus loadSsh2() from src/main/ssh/ssh2-module-load.ts."
+ }
+ ],
+ "patterns": [
+ {
+ "regex": "(?i)(?:^|[/\\\\])(?:web-session-tabs-sync-test-harness|web-runtime-browser-creation-placement-test-rig)(?:\\.[cm]?[jt]sx?)?(?:[?#].*)?$",
+ "message": "This module is unit-test support. Import the production web-session owner instead."
+ },
+ {
+ "regex": "\\.fixture(?:\\.tsx?)?(?:[?#].*)?$",
+ "message": "Component fixtures are dev-only and load through the fixture explorer's import.meta.glob; importing one would ship it in a production bundle."
+ },
+ {
+ "group": ["electron", "electron/*"],
+ "message": "Backend services use the typed desktop capability bridge; only the shell imports Electron."
+ }
+ ]
+ }
+ ]
+ }
+ },
{
"files": ["src/renderer/src/**/*.{ts,tsx}"],
"rules": {
@@ -251,7 +308,7 @@
"ignorePatterns": [
"src/main/acp/generated/acp-protocol.generated.ts",
"src/shared/rpc-contract/rpc-params-catalog.generated.ts",
- "src/cli/bundled-skill-guides.ts",
+ "src/cli/skills/bundled-skill-guides.ts",
"resources/plugins/declarative/*.mjs",
"**/node_modules",
"**/dist",
diff --git a/Casks/orca.rb b/Casks/orca.rb
index 51787cde42f..8e6dbf1bec8 100644
--- a/Casks/orca.rb
+++ b/Casks/orca.rb
@@ -8,7 +8,7 @@ cask "orca" do
url "https://github.com/stablyai/orca/releases/download/v#{version}/orca-macos-#{arch}.dmg"
name "Orca"
desc "IDE for orchestrating AI coding agents across terminals and worktrees"
- homepage "https://onorca.dev/"
+ homepage "https://orca.dev/"
livecheck do
url :url
diff --git a/Casks/orca@rc.rb b/Casks/orca@rc.rb
index 61b1aeb268a..21769cceb15 100644
--- a/Casks/orca@rc.rb
+++ b/Casks/orca@rc.rb
@@ -8,7 +8,7 @@ cask "orca@rc" do
url "https://github.com/stablyai/orca/releases/download/v#{version}/orca-macos-#{arch}.dmg"
name "Orca RC"
desc "IDE for orchestrating AI coding agents across terminals and worktrees"
- homepage "https://onorca.dev/"
+ homepage "https://orca.dev/"
livecheck do
url "https://github.com/stablyai/orca"
diff --git a/README.md b/README.md
index bc1defaa9c6..aca12561eb8 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@
- Orca
+ Orca
@@ -20,7 +20,7 @@
Run Claude Code, Codex, and any other coding agent in parallel, each in its own worktree. Chat or terminal, on your laptop or in the cloud, with diffs, a browser, and a CLI in one app.
@@ -36,11 +36,11 @@
Run any agent in Chat UI or as the raw CLI, and move a conversation between the two without losing context.
-[Docs →](https://www.onorca.dev/docs/agents/native-chat)
+[Docs →](https://orca.dev/docs/agents/native-chat)
-
+
@@ -50,11 +50,11 @@ Run any agent in Chat UI or as the raw CLI, and move a conversation between the
Hand a big task to one agent. It splits the work, starts worker agents in their own workspaces, and brings their results back to you.
-[Docs →](https://www.onorca.dev/docs/cli/orchestration)
+[Docs →](https://orca.dev/docs/cli/orchestration)
-
+
@@ -64,11 +64,11 @@ Hand a big task to one agent. It splits the work, starts worker agents in their
Pair a Remote Orca Server, work on any SSH host, or give a worktree its own cloud VM. Your agents keep running when your laptop sleeps.
-[Docs →](https://www.onorca.dev/docs/ways-to-run)
+[Docs →](https://orca.dev/docs/ways-to-run)
-
+
@@ -78,11 +78,11 @@ Pair a Remote Orca Server, work on any SSH host, or give a worktree its own clou
Pair Orca with the mobile app to get pinged when an agent needs you, reply in chat, and keep work moving on any of your machines when you are away from your desk.
-[iOS App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) · [Android APK](https://www.onorca.dev/download/android) · [Docs →](https://www.onorca.dev/docs/mobile)
+[iOS App Store](https://apps.apple.com/us/app/orca-ide/id6766130217) · [Android APK](https://orca.dev/download/android) · [Docs →](https://orca.dev/docs/mobile)
-
+
@@ -92,11 +92,11 @@ Pair Orca with the mobile app to get pinged when an agent needs you, reply in ch
Review diffs, leave notes on exact changed lines, and send focused feedback back to an agent.
-[Docs →](https://www.onorca.dev/docs/review/annotate-ai-diff)
+[Docs →](https://orca.dev/docs/review/annotate-ai-diff)
-
+
@@ -106,11 +106,11 @@ Review diffs, leave notes on exact changed lines, and send focused feedback back
Draft commit messages and pull requests from the diff, then send failing checks or PR review comments back to an agent to fix.
-[Docs →](https://www.onorca.dev/docs/review/commit-push)
+[Docs →](https://orca.dev/docs/review/commit-push)
-
+
@@ -120,11 +120,11 @@ Draft commit messages and pull requests from the diff, then send failing checks
Quickly split tasks into isolated environments, so multiple agents can work side by side without interfering with each other.
-[Docs →](https://www.onorca.dev/docs/model/worktrees)
+[Docs →](https://orca.dev/docs/model/worktrees)
-
+
@@ -134,11 +134,11 @@ Quickly split tasks into isolated environments, so multiple agents can work side
Click any element in Orca's browser to copy its HTML, styles, and selector, then paste it into your agent's chat.
-[Docs →](https://www.onorca.dev/docs/browser/design-mode)
+[Docs →](https://orca.dev/docs/browser/design-mode)
-
+
@@ -148,11 +148,11 @@ Click any element in Orca's browser to copy its HTML, styles, and selector, then
See your GitHub and Linear tasks in one place, and start a workspace for each when you're ready to build.
-[Docs →](https://www.onorca.dev/docs/review/linear)
+[Docs →](https://orca.dev/docs/review/linear)
-
+
@@ -162,11 +162,11 @@ See your GitHub and Linear tasks in one place, and start a workspace for each wh
Anything you can do in Orca, your agents can do too: create worktrees, start workers, drive the browser and desktop apps, and schedule automations, all from the command line.
-[Docs →](https://www.onorca.dev/docs/cli/overview)
+[Docs →](https://orca.dev/docs/cli/overview)
-
+
@@ -176,11 +176,11 @@ Anything you can do in Orca, your agents can do too: create worktrees, start wor
Themes, editors, languages, and panels from the community, installed in a click.
-[Browse plugins →](https://www.onorca.dev/plugins)
+[Browse plugins →](https://orca.dev/plugins)
-
+
@@ -190,25 +190,25 @@ Themes, editors, languages, and panels from the community, installed in a click.
Put agents, terminals, browsers, and diffs side by side in split panes shaped to the task.
-[Docs →](https://www.onorca.dev/docs/model/tabs-panes-splits)
+[Docs →](https://orca.dev/docs/model/tabs-panes-splits)
-
+
**Also in the box:**
-- **[Drag Files to Agents](https://www.onorca.dev/docs/editing/file-explorer)**: drag files from the explorer, or images from your desktop, straight into an agent's prompt.
-- **[Jump Anywhere](https://www.onorca.dev/docs/model/quick-open)**: one shortcut jumps to any workspace or tab across every repo and host.
-- **[Rich Previews](https://www.onorca.dev/docs/editing/viewers)**: open images, PDFs, and Markdown right in the workspace, next to the agent that made them.
-- **[Mobile Emulator](https://www.onorca.dev/docs/cli/overview#mobile-emulator)**: run an iOS Simulator or Android emulator beside your agent, and let it tap, type, and check its own work.
-- **[Dictation](https://www.onorca.dev/docs/settings#voice)**: press a shortcut and talk. Orca types what you say into the agent's prompt or terminal.
-- **[Usage & Accounts](https://www.onorca.dev/docs/agents/usage-tracking)**: see how much of your agent limits you've used and when they reset, and switch accounts without logging out.
-- **[Automations](https://www.onorca.dev/docs/cli/automations)**: schedule prompts to run on any repo: nightly dependency bumps, weekly triage, flaky-test sweeps.
-- **[Computer Use](https://www.onorca.dev/docs/cli/computer-use)**: when there's no CLI or API, agents can see and drive desktop apps and external browsers.
+- **[Drag Files to Agents](https://orca.dev/docs/editing/file-explorer)**: drag files from the explorer, or images from your desktop, straight into an agent's prompt.
+- **[Jump Anywhere](https://orca.dev/docs/model/quick-open)**: one shortcut jumps to any workspace or tab across every repo and host.
+- **[Rich Previews](https://orca.dev/docs/editing/viewers)**: open images, PDFs, and Markdown right in the workspace, next to the agent that made them.
+- **[Mobile Emulator](https://orca.dev/docs/cli/overview#mobile-emulator)**: run an iOS Simulator or Android emulator beside your agent, and let it tap, type, and check its own work.
+- **[Dictation](https://orca.dev/docs/settings#voice)**: press a shortcut and talk. Orca types what you say into the agent's prompt or terminal.
+- **[Usage & Accounts](https://orca.dev/docs/agents/usage-tracking)**: see how much of your agent limits you've used and when they reset, and switch accounts without logging out.
+- **[Automations](https://orca.dev/docs/cli/automations)**: schedule prompts to run on any repo: nightly dependency bumps, weekly triage, flaky-test sweeps.
+- **[Computer Use](https://orca.dev/docs/cli/computer-use)**: when there's no CLI or API, agents can see and drive desktop apps and external browsers.
- **And many, many more**: we ship daily, so this list is perpetually behind. The [changelog](https://github.com/stablyai/orca/releases) is the real feature list.
---
@@ -261,7 +261,7 @@ Works with **any CLI agent** — if it runs in a terminal, it runs in Orca.
### Desktop — macOS, Windows, Linux
-- **[Download from onOrca.dev](https://onorca.dev/download)**
+- **[Download from orca.dev](https://orca.dev/download)**
- Or grab a build directly: [macOS Apple Silicon](https://github.com/stablyai/orca/releases/latest/download/orca-macos-arm64.dmg) · [macOS Intel](https://github.com/stablyai/orca/releases/latest/download/orca-macos-x64.dmg) · [Windows (.exe)](https://github.com/stablyai/orca/releases/latest/download/orca-windows-setup.exe) · [Linux AppImage](https://github.com/stablyai/orca/releases/latest/download/orca-linux.AppImage) · [All builds](https://github.com/stablyai/orca/releases/latest)
_Or via a package manager:_
@@ -284,7 +284,7 @@ yay -S stably-orca-bin
Pair with your desktop app to monitor and steer your agents from your phone.
- **iOS:** [Download on the App Store](https://apps.apple.com/us/app/orca-ide/id6766130217)
-- **Android:** [Download APK](https://www.onorca.dev/download/android) · [Install guide](https://www.onorca.dev/docs/android-apk)
+- **Android:** [Download APK](https://orca.dev/download/android) · [Install guide](https://orca.dev/docs/android-apk)
---
@@ -297,7 +297,7 @@ Pair with your desktop app to monitor and steer your agents from your phone.
- **Feedback & Ideas:** We ship fast. Missing something? [Request a new feature](https://github.com/stablyai/orca/issues).
-- **Privacy:** See the [privacy & telemetry docs](https://www.onorca.dev/docs/telemetry) for what anonymous usage data Orca collects and how to opt out.
+- **Privacy:** See the [privacy & telemetry docs](https://orca.dev/docs/telemetry) for what anonymous usage data Orca collects and how to opt out.
- **Show Support:** [Star](https://github.com/stablyai/orca) this repo to follow along with our daily ships.
---
diff --git a/cloud/apps/push/package.json b/cloud/apps/push/package.json
index d932fed48fe..cd4e6b2011e 100644
--- a/cloud/apps/push/package.json
+++ b/cloud/apps/push/package.json
@@ -15,11 +15,11 @@
"typecheck": "tsc -p tsconfig.json --noEmit"
},
"dependencies": {
- "@hono/node-server": "^2.1.5",
+ "@hono/node-server": "^2.1.6",
"@orca-cloud/cloud-database": "workspace:*",
"@orca-cloud/push-contract": "workspace:*",
"google-auth-library": "^11.3.1",
- "hono": "^4.13.13",
+ "hono": "^4.13.17",
"tweetnacl": "^1.0.3",
"zod": "^4.6.7"
},
diff --git a/cloud/apps/push/src/apns-client.test.ts b/cloud/apps/push/src/apns-client.test.ts
deleted file mode 100644
index 6e17085506d..00000000000
--- a/cloud/apps/push/src/apns-client.test.ts
+++ /dev/null
@@ -1,100 +0,0 @@
-import { generateKeyPairSync } from 'node:crypto'
-import { expect, it } from 'vitest'
-
-import { ApnsClient } from './apns-client.js'
-import type { ApnsRequest, ApnsResponse } from './apns-http2-transport.js'
-import type { ApnsCredentials } from './config.js'
-import { buildPushDelivery } from './push-delivery-message.js'
-
-const HOST = 'abcdefghijklmnop'
-
-function credentials(): ApnsCredentials {
- const { privateKey } = generateKeyPairSync('ec', {
- namedCurve: 'P-256',
- privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
- publicKeyEncoding: { type: 'spki', format: 'pem' }
- })
- return { keyPem: privateKey, keyId: 'ABCDE12345', teamId: 'TEAM123456' }
-}
-
-function delivery(now = Date.now()) {
- return buildPushDelivery({
- expiresAt: now + 300_000,
- registrationId: 'reg-1',
- hostFingerprint: HOST,
- notification: {
- notificationId: 'note-1',
- notificationSeq: 7,
- notificationEpoch: 'epoch-1',
- source: 'agent-task-complete',
- agentState: 'needs-input',
- title: 'Agent needs input',
- body: 'Waiting on your answer',
- worktreeId: 'wt-1'
- }
- })
-}
-
-function fakeTransport(response: ApnsResponse) {
- const requests: ApnsRequest[] = []
- return {
- requests,
- transport: async (request: ApnsRequest): Promise => {
- requests.push(request)
- return response
- }
- }
-}
-
-
-
-
-
-it('does not collapse background dismissals with visible alerts', async () => {
- const fake = fakeTransport({ status: 200, body: '' })
- const apns = new ApnsClient({
- topic: 'test',
- credentials: credentials(),
- transport: fake.transport
- })
- const alert = delivery()
- await apns.send(
- { ...alert, orca: { ...alert.orca, kind: 'dismiss' } },
- {
- token: 'test',
- apnsEnvironment: 'sandbox'
- }
- )
- expect(fake.requests[0]?.headers).not.toHaveProperty('apns-collapse-id')
- expect(fake.requests[0]?.headers).toMatchObject({
- 'apns-push-type': 'background',
- 'apns-priority': '5'
- })
- expect(JSON.parse(fake.requests[0]!.body).aps).toEqual({ 'content-available': 1 })
-})
-
-it('keeps the absolute deadline across retries and refuses expired delivery', async () => {
- let now = 1_700_000_000_000
- const fake = fakeTransport({ status: 503, body: '{}' })
- const client = new ApnsClient({
- topic: 'test',
- credentials: credentials(),
- now: () => now,
- transport: fake.transport
- })
- const pending = delivery(now)
- const device = { token: 'test', apnsEnvironment: 'sandbox' as const }
- await client.send(pending, device)
- now += 60_000
- await client.send(pending, device)
- expect(fake.requests.map((request) => request.headers['apns-expiration'])).toEqual([
- String(pending.expiresAt / 1000),
- String(pending.expiresAt / 1000)
- ])
- now = pending.expiresAt
- await expect(client.send(pending, device)).resolves.toEqual({
- status: 'error',
- reason: 'expired'
- })
- expect(fake.requests).toHaveLength(2)
-})
diff --git a/cloud/apps/push/src/apns-session-replacement.test.ts b/cloud/apps/push/src/apns-session-replacement.test.ts
deleted file mode 100644
index 2678732ca94..00000000000
--- a/cloud/apps/push/src/apns-session-replacement.test.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-import { EventEmitter } from 'node:events'
-import { expect, it, vi } from 'vitest'
-const mocks = vi.hoisted(() => ({
- connect: vi.fn(),
- read: vi.fn(async () => ({ status: 200, body: '' }))
-}))
-vi.mock('node:http2', async (original) => ({
- ...(await original()),
- connect: mocks.connect
-}))
-vi.mock('./apns-stream-response.js', () => ({ readApnsStreamResponse: mocks.read }))
-import { createApnsHttp2Transport } from './apns-http2-transport.js'
-
-it('keeps the replacement cached when the draining session closes later', async () => {
- const sessions: Array<
- EventEmitter & {
- closed: boolean
- destroyed: boolean
- request: ReturnType
- close: ReturnType
- }
- > = []
- mocks.connect.mockImplementation(() => {
- const session = Object.assign(new EventEmitter(), {
- closed: false,
- destroyed: false,
- request: vi.fn(() => ({})),
- close: vi.fn()
- })
- sessions.push(session)
- return session
- })
- const transport = createApnsHttp2Transport()
- const request = { host: 'api.push.apple.com', path: '/synthetic', headers: {}, body: '{}' }
- await transport(request)
- sessions[0]!.closed = true
- await transport(request)
- sessions[0]!.emit('close')
- sessions[0]!.emit('error', new Error('old-session'))
- await transport(request)
- expect(sessions).toHaveLength(2)
- expect(sessions[1]!.request).toHaveBeenCalledTimes(2)
- transport.close()
- expect(sessions[1]!.close).toHaveBeenCalledOnce()
-})
diff --git a/cloud/apps/push/src/client-ip-rate-limit.test.ts b/cloud/apps/push/src/client-ip-rate-limit.test.ts
deleted file mode 100644
index 11baec26394..00000000000
--- a/cloud/apps/push/src/client-ip-rate-limit.test.ts
+++ /dev/null
@@ -1,93 +0,0 @@
-import { PUSH_LIMITS } from '@orca-cloud/push-contract'
-import { Hono } from 'hono'
-import { describe, expect, it } from 'vitest'
-import { ClientIpRateLimiter, clientIpRateLimit } from './client-ip-rate-limit.js'
-
-const CAPACITY = PUSH_LIMITS.unauthenticatedRequestsPerMinutePerIp
-
-function limiterApp(limiter: ClientIpRateLimiter, trustedProxyHops = 0): Hono {
- const app = new Hono()
- app.post('/probe', clientIpRateLimit(limiter, { trustedProxyHops }), (context) =>
- context.json({ ok: true })
- )
- return app
-}
-
-describe('client ip rate limiter', () => {
-
-
-
-
-
-
-
-
-
-
-
-
- it('buckets on the last forwarded hop, the only one the platform appended', async () => {
- const app = limiterApp(new ClientIpRateLimiter({ now: () => 1_000 }))
- for (let index = 0; index < CAPACITY; index++) {
- await app.request('/probe', {
- method: 'POST',
- headers: { 'x-forwarded-for': `10.0.0.${index}, 203.0.113.7` }
- })
- }
- const sameClient = await app.request('/probe', {
- method: 'POST',
- headers: { 'x-forwarded-for': '10.9.9.9, 203.0.113.7' }
- })
- expect(sameClient.status).toBe(429)
- const otherClient = await app.request('/probe', {
- method: 'POST',
- headers: { 'x-forwarded-for': '10.0.0.1, 198.51.100.9' }
- })
- expect(otherClient.status).toBe(200)
- })
-
- it('skips the configured trusted proxies when counting from the right', async () => {
- const app = limiterApp(new ClientIpRateLimiter({ now: () => 1_000, capacity: 1 }), 1)
- // , , : one trusted hop after the client.
- const headers = { 'x-forwarded-for': '203.0.113.7, 10.0.0.1' }
- expect((await app.request('/probe', { method: 'POST', headers })).status).toBe(200)
- expect((await app.request('/probe', { method: 'POST', headers })).status).toBe(429)
- expect(
- (
- await app.request('/probe', {
- method: 'POST',
- headers: { 'x-forwarded-for': '198.51.100.9, 10.0.0.1' }
- })
- ).status
- ).toBe(200)
- })
-
- it('trusts nothing when the header is shorter than the configured depth', async () => {
- const app = limiterApp(new ClientIpRateLimiter({ now: () => 1_000, capacity: 1 }), 1)
- // Only one hop, so the client value the depth points at does not exist.
- const headers = { 'x-forwarded-for': '203.0.113.7' }
- expect((await app.request('/probe', { method: 'POST', headers })).status).toBe(200)
- expect(
- (
- await app.request('/probe', {
- method: 'POST',
- headers: { 'x-forwarded-for': '198.51.100.9' }
- })
- ).status
- ).toBe(429)
- })
-
- it('ignores spoofable x-real-ip and uses a single shared bucket', async () => {
- const app = limiterApp(new ClientIpRateLimiter({ now: () => 1_000, capacity: 1 }))
- expect(
- (await app.request('/probe', { method: 'POST', headers: { 'x-real-ip': '198.51.100.9' } }))
- .status
- ).toBe(200)
- expect(
- (await app.request('/probe', { method: 'POST', headers: { 'x-real-ip': '203.0.113.7' } }))
- .status
- ).toBe(429)
- expect((await app.request('/probe', { method: 'POST' })).status).toBe(429)
- expect((await app.request('/probe', { method: 'POST' })).status).toBe(429)
- })
-})
diff --git a/cloud/apps/push/src/config.ts b/cloud/apps/push/src/config.ts
index 2ed0d2111f1..3a885edc22c 100644
--- a/cloud/apps/push/src/config.ts
+++ b/cloud/apps/push/src/config.ts
@@ -1,4 +1,4 @@
-import { PUSH_DEFAULTS } from '@orca-cloud/push-contract'
+import { PUSH_DEFAULTS } from '@orca-cloud/push-contract/push-limits'
import { z } from 'zod'
export const PUSH_DATABASE_POOL_MAX = 10
diff --git a/cloud/apps/push/src/durable-push-schema.ts b/cloud/apps/push/src/database/durable-push-schema.ts
similarity index 100%
rename from cloud/apps/push/src/durable-push-schema.ts
rename to cloud/apps/push/src/database/durable-push-schema.ts
diff --git a/cloud/apps/push/src/push-background-database.ts b/cloud/apps/push/src/database/push-background-database.ts
similarity index 92%
rename from cloud/apps/push/src/push-background-database.ts
rename to cloud/apps/push/src/database/push-background-database.ts
index 8a6b759badf..d3d26b9bf31 100644
--- a/cloud/apps/push/src/push-background-database.ts
+++ b/cloud/apps/push/src/database/push-background-database.ts
@@ -1,4 +1,4 @@
-import type { PushDatabase } from './push-database.js'
+import type { CloudDatabase as PushDatabase } from '@orca-cloud/cloud-database/cloud-database'
// Caps worker and prune traffic at poolMax - 1 connections so request-path lookups always find one.
export function reserveRequestConnection(database: PushDatabase, poolMax: number): PushDatabase {
diff --git a/cloud/apps/push/src/database/push-database.ts b/cloud/apps/push/src/database/push-database.ts
new file mode 100644
index 00000000000..fa6e375f9df
--- /dev/null
+++ b/cloud/apps/push/src/database/push-database.ts
@@ -0,0 +1,21 @@
+import {
+ openCloudDatabase,
+ openInMemoryCloudDatabase,
+ type CloudDatabase,
+ type OpenCloudDatabaseInput
+} from '@orca-cloud/cloud-database/cloud-database'
+import { pushSchemaStatements } from './push-schema.js'
+
+export async function openPushDatabase(
+ input: Omit
+): Promise {
+ return await openCloudDatabase({
+ ...input,
+ service: 'push',
+ schemaStatements: pushSchemaStatements()
+ })
+}
+
+export async function openInMemoryPushDatabase(): Promise {
+ return await openInMemoryCloudDatabase(pushSchemaStatements())
+}
diff --git a/cloud/apps/push/src/push-schema.ts b/cloud/apps/push/src/database/push-schema.ts
similarity index 100%
rename from cloud/apps/push/src/push-schema.ts
rename to cloud/apps/push/src/database/push-schema.ts
diff --git a/cloud/apps/push/src/delivery/durable-push-claim.test.ts b/cloud/apps/push/src/delivery/durable-push-claim.test.ts
new file mode 100644
index 00000000000..93f65135504
--- /dev/null
+++ b/cloud/apps/push/src/delivery/durable-push-claim.test.ts
@@ -0,0 +1,158 @@
+import { afterEach, expect, it } from 'vitest'
+import type { CloudDatabase as PushDatabase } from '@orca-cloud/cloud-database/cloud-database'
+import { DELIVERY_LEASE_MS, DurablePushStore } from './durable-push-store.js'
+
+import {
+ cleanupDurablePushFixtures,
+ DEVICE_HEAD_SQL,
+ durablePushTestDatabaseUrl,
+ fixture,
+ notification,
+ pauseAfter,
+ within
+} from './durable-push-store.test-fixture.js'
+
+afterEach(cleanupDurablePushFixtures)
+
+it.skipIf(!durablePushTestDatabaseUrl)(
+ 'rolls back a failed claim and admits a fourth waiter while the other claims stay held',
+ async () => {
+ const { db, store, clock, advance } = await fixture({ poolMax: 6 })
+ await store.accept('host', 'phone-a', notification(1))
+ advance(1)
+ await store.accept('host', 'phone-b', notification(2))
+ advance(1)
+ await store.accept('host', 'phone-c', notification(3))
+ const held = [pauseAfter(db), pauseAfter(db), pauseAfter(db)] as const
+ let admitted = 0
+ const failing: PushDatabase = {
+ ...held[0].wrapped,
+ transaction: (run) => {
+ const position = admitted++
+ return (held[position]?.wrapped ?? db).transaction(async (tx) => {
+ const result = await run(tx)
+ if (position === 0) throw new Error('claim_commit_failed')
+ return result
+ })
+ }
+ }
+ const limited = new DurablePushStore(db, clock, failing)
+ const first = limited.claim()
+ const rejected = expect(first).rejects.toThrow('claim_commit_failed')
+ await held[0].atCandidate
+ const second = limited.claim()
+ await held[1].atCandidate
+ const third = limited.claim()
+ await held[2].atCandidate
+ const next = limited.claim()
+ try {
+ held[0].release()
+ await rejected
+ const delivery = await within(next, 2_000)
+ expect(delivery?.notification.notificationSeq).toBe(1)
+ expect(delivery?.attempts).toBe(1)
+ if (!delivery) throw new Error('queued_claim_missing')
+ await limited.finish(delivery)
+ expect(await limited.pendingCount('phone-a')).toBe(0)
+ } finally {
+ for (const pause of held) pause.release()
+ await Promise.allSettled([first, second, third, next])
+ }
+ expect((await second)?.registrationId).toBe('phone-b')
+ expect((await third)?.registrationId).toBe('phone-c')
+ }
+)
+
+it('leases exactly one delivery per device across concurrent claimers', async () => {
+ const { db, store, clock, advance } = await fixture()
+ for (let seq = 1; seq <= 5; seq++) {
+ await store.accept('host', 'phone', notification(seq))
+ advance(1)
+ }
+ const claims = await Promise.all(
+ Array.from({ length: 8 }, () => new DurablePushStore(db, clock).claim())
+ )
+ const leased = claims.filter((claim) => claim !== null)
+ expect(leased).toHaveLength(1)
+ expect(leased[0]?.notification.notificationSeq).toBe(1)
+})
+
+it.skipIf(!durablePushTestDatabaseUrl)(
+ 'does not lease the row behind a head another claimer holds',
+ async () => {
+ const { db, store, clock, advance } = await fixture()
+ await store.accept('host', 'phone', notification(1))
+ advance(1)
+ await store.accept('host', 'phone', notification(2))
+ const paused = pauseAfter(db)
+ const first = new DurablePushStore(paused.wrapped, clock).claim()
+ await paused.atCandidate
+ try {
+ expect(await within(store.claim(), 2_000)).toBeNull()
+ } finally {
+ paused.release()
+ }
+ expect((await first)?.notification.notificationSeq).toBe(1)
+ expect(await store.claim()).toBeNull()
+ }
+)
+
+it.skipIf(!durablePushTestDatabaseUrl)(
+ 'claims another device while one claim transaction is still open',
+ async () => {
+ const { db, store, clock, advance } = await fixture()
+ await store.accept('host', 'phone-a', notification(1))
+ advance(1)
+ await store.accept('host', 'phone-b', notification(2))
+ const paused = pauseAfter(db)
+ const first = new DurablePushStore(paused.wrapped, clock).claim()
+ await paused.atCandidate
+ try {
+ expect((await within(store.claim(), 2_000))?.registrationId).toBe('phone-b')
+ } finally {
+ paused.release()
+ }
+ expect((await first)?.registrationId).toBe('phone-a')
+ }
+)
+
+it.skipIf(!durablePushTestDatabaseUrl)(
+ 'keeps a device exclusive when an earlier-sorting row lands mid-claim',
+ async () => {
+ const { db, store, clock } = await fixture()
+ await store.accept('host', 'phone', notification(1))
+ const paused = pauseAfter(db, DEVICE_HEAD_SQL)
+ const first = new DurablePushStore(paused.wrapped, clock).claim()
+ await paused.atCandidate
+ try {
+ // Another instance with a slower clock queues a row that now sorts first.
+ await db.query(
+ `INSERT INTO push_delivery_batches(batch_id, host_fingerprint, registration_id, kind, payload_json, state, due_at, expires_at, lease_until, attempts, created_at)
+ VALUES ('skewed', 'host', 'phone', 'alert', ?, 'pending', ?, ?, 0, 0, ?)`,
+ [JSON.stringify(notification(2)), clock() - 10, clock() + 60_000, clock() - 10]
+ )
+ expect(await within(store.claim(), 2_000)).toBeNull()
+ } finally {
+ paused.release()
+ }
+ expect((await first)?.notification.notificationSeq).toBe(1)
+ }
+)
+
+// Only the TTL term keeps the candidate scan off an unpruned backlog; expires_at is not indexed first.
+
+it('frees a device held by a crashed worker once its lease lapses', async () => {
+ const { db, store, clock, advance } = await fixture()
+ await store.accept('host', 'phone', notification(1))
+ advance(1)
+ await store.accept('host', 'phone', notification(2))
+ const crashed = (await new DurablePushStore(db, clock).claim())!
+ advance(DELIVERY_LEASE_MS - 1)
+ expect(await store.claim()).toBeNull()
+ advance(1)
+ const reclaimed = (await store.claim())!
+ expect(reclaimed.id).toBe(crashed.id)
+ expect(reclaimed.attempts).toBe(2)
+ await store.finish(reclaimed)
+ expect((await store.claim())?.notification.notificationSeq).toBe(2)
+})
diff --git a/cloud/apps/push/src/delivery/durable-push-retention.test.ts b/cloud/apps/push/src/delivery/durable-push-retention.test.ts
new file mode 100644
index 00000000000..4304bcce3f4
--- /dev/null
+++ b/cloud/apps/push/src/delivery/durable-push-retention.test.ts
@@ -0,0 +1,60 @@
+import { afterEach, expect, it } from 'vitest'
+import {
+ cleanupDurablePushFixtures,
+ durablePushTestDatabaseUrl,
+ fixture,
+ within
+} from './durable-push-store.test-fixture.js'
+
+afterEach(cleanupDurablePushFixtures)
+
+const retentionTables = [
+ {
+ table: 'push_dismissed_events',
+ columns: 'host_fingerprint, notification_epoch, notification_id, notification_seq, created_at',
+ values: "'host', 'epoch-' || n, 'notification', n, created_at"
+ },
+ {
+ table: 'push_event_recipients',
+ columns: 'event_id, registration_id, created_at',
+ values: "'event', 'phone-' || n, created_at"
+ },
+ {
+ table: 'push_events',
+ columns: 'event_id, host_fingerprint, kind, fingerprint, created_at, expires_at',
+ values: "'event-' || n, 'host', 'alert', 'fingerprint', created_at, created_at"
+ }
+] as const
+
+it.skipIf(!durablePushTestDatabaseUrl).each(retentionTables)(
+ 'skips a locked oldest $table row until its transaction releases it',
+ async ({ table, columns, values }) => {
+ const { db, store, clock } = await fixture()
+ const cutoff = clock() - 24 * 60 * 60_000
+ await db.query(
+ `INSERT INTO ${table} (${columns})
+ WITH rows(n, created_at) AS (VALUES (1, ?::bigint), (2, ?::bigint), (3, ?::bigint))
+ SELECT ${values} FROM rows`,
+ [cutoff - 2, cutoff - 1, cutoff]
+ )
+ const locked = Promise.withResolvers()
+ const release = Promise.withResolvers()
+ const holding = db.transaction(async (tx) => {
+ await tx.query(`SELECT * FROM ${table} WHERE created_at = ? FOR UPDATE`, [cutoff - 2])
+ locked.resolve()
+ await release.promise
+ })
+ try {
+ await locked.promise
+ expect(await within(store.prune(), 1000)).toEqual({ deleted: 1, saturated: false })
+ const preserved = await db.query(`SELECT created_at FROM ${table} ORDER BY created_at`)
+ expect(preserved.map((row) => Number(row.created_at))).toEqual([cutoff - 2, cutoff])
+ } finally {
+ release.resolve()
+ await holding
+ }
+ expect(await store.prune()).toEqual({ deleted: 1, saturated: false })
+ const preserved = await db.query(`SELECT created_at FROM ${table}`)
+ expect(preserved.map((row) => Number(row.created_at))).toEqual([cutoff])
+ }
+)
diff --git a/cloud/apps/push/src/durable-push-store.test-fixture.ts b/cloud/apps/push/src/delivery/durable-push-store.test-fixture.ts
similarity index 96%
rename from cloud/apps/push/src/durable-push-store.test-fixture.ts
rename to cloud/apps/push/src/delivery/durable-push-store.test-fixture.ts
index 67ef6999db1..c9aa565db9b 100644
--- a/cloud/apps/push/src/durable-push-store.test-fixture.ts
+++ b/cloud/apps/push/src/delivery/durable-push-store.test-fixture.ts
@@ -1,7 +1,8 @@
import { randomUUID } from 'node:crypto'
import pg from 'pg'
-import type { PushNotification } from '@orca-cloud/push-contract'
-import { openInMemoryPushDatabase, openPushDatabase, type PushDatabase } from './push-database.js'
+import type { PushNotification } from '@orca-cloud/push-contract/send-messages'
+import { openInMemoryPushDatabase, openPushDatabase } from '../database/push-database.js'
+import type { CloudDatabase as PushDatabase } from '@orca-cloud/cloud-database/cloud-database'
import { DurablePushStore } from './durable-push-store.js'
export const durablePushTestDatabaseUrl =
diff --git a/cloud/apps/push/src/durable-push-store.test.ts b/cloud/apps/push/src/delivery/durable-push-store.test.ts
similarity index 99%
rename from cloud/apps/push/src/durable-push-store.test.ts
rename to cloud/apps/push/src/delivery/durable-push-store.test.ts
index d8387793d45..9be0e32ec8f 100644
--- a/cloud/apps/push/src/durable-push-store.test.ts
+++ b/cloud/apps/push/src/delivery/durable-push-store.test.ts
@@ -1,5 +1,5 @@
import { afterEach, describe, expect, it } from 'vitest'
-import { openPushDatabase } from './push-database.js'
+import { openPushDatabase } from '../database/push-database.js'
import { DurablePushStore, DELIVERY_LEASE_MS } from './durable-push-store.js'
import {
cleanupDurablePushFixtures,
@@ -89,8 +89,6 @@ describe('durable push acceptance', () => {
await store.finish(fresh!)
})
-
-
it('rolls quota and payload back together if persistence fails', async () => {
const { db, store } = await fixture()
await db.query('ALTER TABLE push_delivery_batches RENAME TO push_delivery_batches_unavailable')
diff --git a/cloud/apps/push/src/durable-push-store.ts b/cloud/apps/push/src/delivery/durable-push-store.ts
similarity index 97%
rename from cloud/apps/push/src/durable-push-store.ts
rename to cloud/apps/push/src/delivery/durable-push-store.ts
index 1bcdda0bdc7..9d9151e584a 100644
--- a/cloud/apps/push/src/durable-push-store.ts
+++ b/cloud/apps/push/src/delivery/durable-push-store.ts
@@ -1,10 +1,14 @@
import { isDismissedAlert, reconcileQueuedDismissal } from './push-queued-dismissal.js'
import { parsePushDeliveryPayload } from './push-delivery-payload.js'
import { createHash, randomUUID } from 'node:crypto'
-import { PUSH_LIMITS, type PushNotification } from '@orca-cloud/push-contract'
+import { PUSH_LIMITS } from '@orca-cloud/push-contract/push-limits'
+import type { PushNotification } from '@orca-cloud/push-contract/send-messages'
import { WORKER_DRAINS } from './push-worker-concurrency.js'
-import type { PushDatabase, SqlRow } from './push-database.js'
-import { limitPushDatabaseConcurrency } from './push-background-database.js'
+import type {
+ CloudDatabase as PushDatabase,
+ SqlRow
+} from '@orca-cloud/cloud-database/cloud-database'
+import { limitPushDatabaseConcurrency } from '../database/push-background-database.js'
const RETENTION_MS = 24 * 60 * 60_000
// accept() caps expires_at at due_at + TTL, so older due_at is expired: scans skip an unpruned backlog.
diff --git a/cloud/apps/push/src/delivery/durable-push-worker.test.ts b/cloud/apps/push/src/delivery/durable-push-worker.test.ts
new file mode 100644
index 00000000000..78303de18e6
--- /dev/null
+++ b/cloud/apps/push/src/delivery/durable-push-worker.test.ts
@@ -0,0 +1,164 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import type { PushNotification } from '@orca-cloud/push-contract/send-messages'
+import { DurablePushStore } from './durable-push-store.js'
+import { DurablePushWorker } from './durable-push-worker.js'
+import { PushDispatcher } from './push-dispatcher.js'
+import { PushDeviceRegistryStore } from '../devices/device-registry-store.js'
+import { openInMemoryPushDatabase } from '../database/push-database.js'
+import type { PushDelivery } from './push-delivery-message.js'
+import type { PushProviderOutcome } from '../providers/push-provider-outcome.js'
+
+import { pauseAfter, within } from './durable-push-store.test-fixture.js'
+
+const cleanups: (() => Promise)[] = []
+afterEach(async () => {
+ for (const cleanup of cleanups.splice(0)) await cleanup()
+ vi.useRealTimers()
+ vi.restoreAllMocks()
+})
+const note = (seq: number, overrides: Partial = {}): PushNotification => ({
+ notificationId: `note-${seq}`,
+ notificationSeq: seq,
+ notificationEpoch: 'epoch',
+ source: 'agent-task-complete',
+ agentState: 'finished',
+ title: 'Done',
+ body: 'Finished task',
+ ...overrides
+})
+async function fixture() {
+ const db = await openInMemoryPushDatabase()
+ let time = 1_000_000
+ const now = () => time
+ const store = new DurablePushStore(db, now)
+ const devices = new PushDeviceRegistryStore(db, now)
+ const device = await devices.upsert({
+ hostFingerprint: 'host',
+ deviceId: 'phone',
+ platform: 'android',
+ token: 'test-token'
+ })
+ if (!device.ok) throw new Error('registration failed')
+ const send = vi.fn(async (_delivery: PushDelivery): Promise => ({
+ status: 'sent'
+ }))
+ const onRetry = vi.fn()
+ const dispatcher = new PushDispatcher({ devices, fcm: { send } as never })
+ const worker = new DurablePushWorker(store, dispatcher, { now, onRetry })
+ cleanups.push(async () => {
+ await worker.stop()
+ await db.close()
+ })
+ vi.spyOn(console, 'warn').mockImplementation(() => {})
+ return {
+ db,
+ store,
+ devices,
+ worker,
+ dispatcher,
+ send,
+ onRetry,
+ now,
+ registrationId: device.registrationId,
+ accept: (notification: PushNotification) =>
+ store.accept('host', device.registrationId, notification),
+ advance: (ms: number) => {
+ time += ms
+ }
+ }
+}
+
+it('rechecks the device before a persisted retry and does not send after unregistration', async () => {
+ const h = await fixture()
+ h.send.mockResolvedValue({ status: 'error', reason: 'timeout', retryable: true })
+ await h.accept(note(1))
+ await h.worker.runDue()
+ await h.devices.deleteOwned('host', h.registrationId)
+ h.advance(3000)
+ await h.worker.runDue()
+ expect(h.send).toHaveBeenCalledOnce()
+ expect(await h.store.pendingCount(h.registrationId)).toBe(0)
+})
+
+it('stops queued claim admissions without leasing the remaining device', async () => {
+ const h = await fixture()
+ const other = await h.devices.upsert({
+ hostFingerprint: 'host',
+ deviceId: 'phone-queued',
+ platform: 'android',
+ token: 'queued-token'
+ })
+ if (!other.ok) throw new Error('registration failed')
+ await h.accept(note(1))
+ h.advance(1)
+ await h.store.accept('host', other.registrationId, note(2))
+ const paused = pauseAfter(h.db)
+ const store = new DurablePushStore(h.db, h.now, paused.wrapped)
+ const worker = new DurablePushWorker(store, h.dispatcher, { now: h.now })
+ const pending = worker.runDue()
+ try {
+ await paused.atCandidate
+ const stopping = worker.stop()
+ paused.release()
+ await within(Promise.all([pending, stopping]), 2_000)
+ expect(h.send).toHaveBeenCalledOnce()
+ expect(h.send.mock.calls[0]?.[0].orca.notificationSeq).toBe(1)
+ const [remaining] = await h.db.query(
+ 'SELECT attempts, lease_until FROM push_delivery_batches WHERE registration_id = ?',
+ [other.registrationId]
+ )
+ expect(Number(remaining?.attempts)).toBe(0)
+ expect(Number(remaining?.lease_until)).toBe(0)
+ } finally {
+ paused.release()
+ await worker.stop()
+ await pending
+ }
+})
+
+it('claims new devices while an earlier provider response is still pending', async () => {
+ const h = await fixture()
+ const second = await h.devices.upsert({
+ hostFingerprint: 'host',
+ deviceId: 'phone-second',
+ platform: 'android',
+ token: 'second-token'
+ })
+ const third = await h.devices.upsert({
+ hostFingerprint: 'host',
+ deviceId: 'phone-third',
+ platform: 'android',
+ token: 'third-token'
+ })
+ if (!second.ok || !third.ok) throw new Error('registration failed')
+ const held = Promise.withResolvers()
+ const entered = Promise.withResolvers()
+ const secondSent = Promise.withResolvers()
+ const thirdSent = Promise.withResolvers()
+ h.send.mockImplementation(async (delivery) => {
+ if (delivery.orca.notificationSeq === 1) {
+ entered.resolve()
+ return await held.promise
+ }
+ if (delivery.orca.notificationSeq === 2) secondSent.resolve()
+ if (delivery.orca.notificationSeq === 3) thirdSent.resolve()
+ return { status: 'sent' }
+ })
+ await h.accept(note(1))
+ h.worker.start()
+ h.worker.wake()
+ try {
+ await within(entered.promise, 2_000)
+ await h.store.accept('host', second.registrationId, note(2))
+ h.worker.wake()
+ await within(secondSent.promise, 2_000)
+ await h.store.accept('host', third.registrationId, note(3))
+ h.worker.wake()
+ await within(thirdSent.promise, 2_000)
+ expect(await h.store.pendingCount(h.registrationId)).toBe(1)
+ expect(h.send).toHaveBeenCalledTimes(3)
+ } finally {
+ held.resolve({ status: 'sent' })
+ await h.worker.stop()
+ }
+})
diff --git a/cloud/apps/push/src/durable-push-worker.ts b/cloud/apps/push/src/delivery/durable-push-worker.ts
similarity index 100%
rename from cloud/apps/push/src/durable-push-worker.ts
rename to cloud/apps/push/src/delivery/durable-push-worker.ts
diff --git a/cloud/apps/push/src/push-delivery-message.ts b/cloud/apps/push/src/delivery/push-delivery-message.ts
similarity index 96%
rename from cloud/apps/push/src/push-delivery-message.ts
rename to cloud/apps/push/src/delivery/push-delivery-message.ts
index 1d37f621573..200d4c78908 100644
--- a/cloud/apps/push/src/push-delivery-message.ts
+++ b/cloud/apps/push/src/delivery/push-delivery-message.ts
@@ -1,5 +1,5 @@
import { createHash } from 'node:crypto'
-import { type PushNotification } from '@orca-cloud/push-contract'
+import type { PushNotification } from '@orca-cloud/push-contract/send-messages'
export type PushOrcaData = {
kind?: 'alert' | 'dismiss'
diff --git a/cloud/apps/push/src/push-delivery-payload.ts b/cloud/apps/push/src/delivery/push-delivery-payload.ts
similarity index 95%
rename from cloud/apps/push/src/push-delivery-payload.ts
rename to cloud/apps/push/src/delivery/push-delivery-payload.ts
index 825286125b7..3ce1541facf 100644
--- a/cloud/apps/push/src/push-delivery-payload.ts
+++ b/cloud/apps/push/src/delivery/push-delivery-payload.ts
@@ -1,4 +1,4 @@
-import type { PushNotification } from '@orca-cloud/push-contract'
+import type { PushNotification } from '@orca-cloud/push-contract/send-messages'
export function parsePushDeliveryPayload(payload: string): PushNotification {
const value: unknown = JSON.parse(payload)
diff --git a/cloud/apps/push/src/push-dispatcher.ts b/cloud/apps/push/src/delivery/push-dispatcher.ts
similarity index 81%
rename from cloud/apps/push/src/push-dispatcher.ts
rename to cloud/apps/push/src/delivery/push-dispatcher.ts
index ca9006bc435..68ae5ae5b1d 100644
--- a/cloud/apps/push/src/push-dispatcher.ts
+++ b/cloud/apps/push/src/delivery/push-dispatcher.ts
@@ -1,9 +1,9 @@
-import type { ApnsClient } from './apns-client.js'
-import type { PushDeviceRegistryStore } from './device-registry-store.js'
-import type { FcmClient } from './fcm-client.js'
-import { fingerprintLogPrefix } from './host-fingerprint.js'
+import type { ApnsClient } from '../providers/apns/apns-client.js'
+import type { PushDeviceRegistryStore } from '../devices/device-registry-store.js'
+import type { FcmClient } from '../providers/fcm/fcm-client.js'
+import { fingerprintLogPrefix } from '../host-auth/host-fingerprint.js'
import type { PushDelivery } from './push-delivery-message.js'
-import type { PushProviderOutcome } from './push-provider-outcome.js'
+import type { PushProviderOutcome } from '../providers/push-provider-outcome.js'
export type PushDispatcherOptions = {
devices: PushDeviceRegistryStore
diff --git a/cloud/apps/push/src/push-queued-dismissal.ts b/cloud/apps/push/src/delivery/push-queued-dismissal.ts
similarity index 96%
rename from cloud/apps/push/src/push-queued-dismissal.ts
rename to cloud/apps/push/src/delivery/push-queued-dismissal.ts
index e1b48bcac53..6056974b0e4 100644
--- a/cloud/apps/push/src/push-queued-dismissal.ts
+++ b/cloud/apps/push/src/delivery/push-queued-dismissal.ts
@@ -1,5 +1,5 @@
-import type { PushNotification } from '@orca-cloud/push-contract'
-import type { PushDatabase } from './push-database.js'
+import type { PushNotification } from '@orca-cloud/push-contract/send-messages'
+import type { CloudDatabase as PushDatabase } from '@orca-cloud/cloud-database/cloud-database'
import { parsePushDeliveryPayload } from './push-delivery-payload.js'
export async function reconcileQueuedDismissal(
diff --git a/cloud/apps/push/src/push-worker-concurrency.ts b/cloud/apps/push/src/delivery/push-worker-concurrency.ts
similarity index 100%
rename from cloud/apps/push/src/push-worker-concurrency.ts
rename to cloud/apps/push/src/delivery/push-worker-concurrency.ts
diff --git a/cloud/apps/push/src/device-registration-delete-race.test.ts b/cloud/apps/push/src/device-registration-delete-race.test.ts
deleted file mode 100644
index 2e2bdbdc7fa..00000000000
--- a/cloud/apps/push/src/device-registration-delete-race.test.ts
+++ /dev/null
@@ -1,92 +0,0 @@
-import { expect, it, vi } from 'vitest'
-import { openPushDatabase, type PushDatabase } from './push-database.js'
-import { PushDeviceRegistryStore } from './device-registry-store.js'
-
-const databaseUrl = process.env.ORCA_PUSH_TEST_DATABASE_URL
-it.skipIf(!databaseUrl)(
- 'serializes deletion with a registration that has already read its row',
- async () => {
- if (!process.env.CI && new URL(databaseUrl!).port !== '55440')
- throw new Error('isolated_postgres_port_required')
- const database = await openPushDatabase({
- databaseUrl,
- dataDir: '',
- poolMax: 4,
- applicationName: 'push-delete-race'
- })
- let release!: () => void
- const paused = new Promise((resolve) => {
- release = resolve
- })
- let read = false
- let pause = false
- const wrapped: PushDatabase = {
- dialect: database.dialect,
- query: database.query.bind(database),
- close: database.close.bind(database),
- lockQuotaScope: database.lockQuotaScope.bind(database),
- tryLockScope: database.tryLockScope.bind(database),
- tryLockSharedScope: database.tryLockSharedScope.bind(database),
- transaction: (run) =>
- database.transaction((tx) =>
- run({
- dialect: tx.dialect,
- close: tx.close.bind(tx),
- transaction: tx.transaction.bind(tx),
- lockQuotaScope: tx.lockQuotaScope.bind(tx),
- tryLockScope: tx.tryLockScope.bind(tx),
- tryLockSharedScope: tx.tryLockSharedScope.bind(tx),
- query: async (sql, params) => {
- const rows = await tx.query(sql, params)
- if (pause && sql.startsWith('SELECT registration_id FROM push_devices')) {
- read = true
- await paused
- }
- return rows
- }
- })
- )
- }
- const devices = new PushDeviceRegistryStore(wrapped)
- const input = {
- hostFingerprint: 'delete-race-host',
- deviceId: 'phone',
- platform: 'android' as const,
- token: 'synthetic'
- }
- let registration: Promise | undefined
- let deletion: Promise | undefined
- try {
- await database.query('DELETE FROM push_devices WHERE host_fingerprint = ?', [
- input.hostFingerprint
- ])
- const first = await devices.upsert(input)
- if (!first.ok) throw new Error('registration refused')
- pause = true
- registration = devices.upsert(input)
- await vi.waitFor(() => expect(read).toBe(true))
- let deleted = false
- deletion = devices.deleteOwned(input.hostFingerprint, first.registrationId).then((value) => {
- deleted = true
- return value
- })
- await vi.waitFor(async () => {
- const rows = await database.query(
- "SELECT 1 FROM pg_stat_activity WHERE application_name = 'push-delete-race' AND wait_event_type = 'Lock'"
- )
- expect(deleted || rows.length > 0).toBe(true)
- })
- expect(deleted).toBe(false)
- release()
- expect(await registration).toEqual(first)
- expect(await deletion).toBe(true)
- } finally {
- release()
- await Promise.allSettled([registration, deletion])
- await database.query('DELETE FROM push_devices WHERE host_fingerprint = ?', [
- input.hostFingerprint
- ])
- await database.close()
- }
- }
-)
diff --git a/cloud/apps/push/src/device-registry-store.test.ts b/cloud/apps/push/src/device-registry-store.test.ts
deleted file mode 100644
index 97f3e47acc5..00000000000
--- a/cloud/apps/push/src/device-registry-store.test.ts
+++ /dev/null
@@ -1,151 +0,0 @@
-import { PUSH_LIMITS } from '@orca-cloud/push-contract'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { PushDeviceRegistryStore, type PushDeviceUpsert } from './device-registry-store.js'
-import { openInMemoryPushDatabase, type PushDatabase } from './push-database.js'
-
-const OWNER = 'abcdefghijklmnop'
-const OTHER = 'ponmlkjihgfedcba'
-
-describe('push device registry store', () => {
- let database: PushDatabase
- let clock = 1_700_000_000_000
- let devices: PushDeviceRegistryStore
-
- beforeEach(async () => {
- database = await openInMemoryPushDatabase()
- clock = 1_700_000_000_000
- devices = new PushDeviceRegistryStore(database, () => clock)
- })
-
- afterEach(async () => {
- await database.close()
- })
-
- async function upsertOk(input: PushDeviceUpsert): Promise {
- const result = await devices.upsert(input)
- if (!result.ok) throw new Error(`unexpected upsert refusal: ${result.reason}`)
- return result.registrationId
- }
-
- function androidDevice(deviceId: string): PushDeviceUpsert {
- return {
- hostFingerprint: OWNER,
- deviceId,
- platform: 'android',
- token: `token-${deviceId}`
- }
- }
-
- it('keeps one registration per host and device while replacing the token', async () => {
- const first = await upsertOk({
- hostFingerprint: OWNER,
- deviceId: 'device-1',
- platform: 'ios',
- token: 'a'.repeat(64),
- apnsEnvironment: 'sandbox'
- })
- clock += 1_000
- const second = await upsertOk({
- hostFingerprint: OWNER,
- deviceId: 'device-1',
- platform: 'ios',
- token: 'b'.repeat(64),
- apnsEnvironment: 'production'
- })
- expect(second).toBe(first)
- const registration = await devices.findById(first)
- expect(registration).toMatchObject({
- token: 'b'.repeat(64),
- apnsEnvironment: 'production',
- dead: false
- })
- expect(await devices.list(OWNER)).toHaveLength(1)
- })
-
- it('revives a registration that a re-registered token replaces', async () => {
- const registrationId = await upsertOk({
- hostFingerprint: OWNER,
- deviceId: 'device-1',
- platform: 'android',
- token: 'token-one'
- })
- await devices.markDead((await devices.findById(registrationId))!)
- expect((await devices.findById(registrationId))?.dead).toBe(true)
- await upsertOk({
- hostFingerprint: OWNER,
- deviceId: 'device-1',
- platform: 'android',
- token: 'token-two'
- })
- expect(await devices.findById(registrationId)).toMatchObject({
- token: 'token-two',
- dead: false
- })
- })
-
- it('lets only the owning host delete a registration', async () => {
- const registrationId = await upsertOk({
- hostFingerprint: OWNER,
- deviceId: 'device-1',
- platform: 'android',
- token: 'token-one'
- })
- expect(await devices.deleteOwned(OTHER, registrationId)).toBe(false)
- expect(await devices.findById(registrationId)).not.toBeNull()
- expect(await devices.deleteOwned(OWNER, registrationId)).toBe(true)
- expect(await devices.findById(registrationId)).toBeNull()
- })
-
- it('scopes lookups and listings to the owning host', async () => {
- const owned = await upsertOk({
- hostFingerprint: OWNER,
- deviceId: 'device-1',
- platform: 'android',
- token: 'token-one'
- })
- const foreign = await upsertOk({
- hostFingerprint: OTHER,
- deviceId: 'device-2',
- platform: 'android',
- token: 'token-two'
- })
- const found = await devices.findOwned(OWNER, [owned, foreign])
- expect([...found.keys()]).toEqual([owned])
- expect(await devices.list(OTHER)).toEqual([
- { registrationId: foreign, deviceId: 'device-2', platform: 'android', dead: false }
- ])
- expect(await devices.findOwned(OWNER, [])).toEqual(new Map())
- })
-
- it('refuses a new device once the host reaches its registration cap', async () => {
- for (let index = 0; index < PUSH_LIMITS.maxDevicesPerHost; index++) {
- await upsertOk(androidDevice(`device-${index}`))
- }
- expect(await devices.upsert(androidDevice('one-too-many'))).toEqual({
- ok: false,
- reason: 'too_many_devices'
- })
- expect(await devices.list(OWNER)).toHaveLength(PUSH_LIMITS.maxDevicesPerHost)
- })
-
- it('still lets a capped host re-register a device it already owns', async () => {
- for (let index = 0; index < PUSH_LIMITS.maxDevicesPerHost; index++) {
- await upsertOk(androidDevice(`device-${index}`))
- }
- const rotated = await devices.upsert({ ...androidDevice('device-0'), token: 'rotated-token' })
- expect(rotated.ok).toBe(true)
- expect(await devices.list(OWNER)).toHaveLength(PUSH_LIMITS.maxDevicesPerHost)
- })
-
-
-
- it('counts the cap per host, not across the whole table', async () => {
- for (let index = 0; index < PUSH_LIMITS.maxDevicesPerHost; index++) {
- await upsertOk(androidDevice(`device-${index}`))
- }
- expect((await devices.upsert(androidDevice('extra'))).ok).toBe(false)
- expect(
- (await devices.upsert({ ...androidDevice('device-0'), hostFingerprint: OTHER })).ok
- ).toBe(true)
- })
-})
diff --git a/cloud/apps/push/src/device-registry-store.ts b/cloud/apps/push/src/devices/device-registry-store.ts
similarity index 95%
rename from cloud/apps/push/src/device-registry-store.ts
rename to cloud/apps/push/src/devices/device-registry-store.ts
index a4061189e35..1db88954d62 100644
--- a/cloud/apps/push/src/device-registry-store.ts
+++ b/cloud/apps/push/src/devices/device-registry-store.ts
@@ -1,11 +1,14 @@
import { randomUUID } from 'node:crypto'
-import {
- PUSH_LIMITS,
- type ApnsEnvironment,
- type PushDeviceSummary,
- type PushPlatform
-} from '@orca-cloud/push-contract'
-import type { PushDatabase, SqlRow } from './push-database.js'
+import { PUSH_LIMITS } from '@orca-cloud/push-contract/push-limits'
+import type {
+ ApnsEnvironment,
+ PushDeviceSummary,
+ PushPlatform
+} from '@orca-cloud/push-contract/device-registration-messages'
+import type {
+ CloudDatabase as PushDatabase,
+ SqlRow
+} from '@orca-cloud/cloud-database/cloud-database'
const DEVICE_CAP_LOCK_PREFIX = 'orca-push-device-cap:'
diff --git a/cloud/apps/push/src/durable-push-claim-mixed-revision.test.ts b/cloud/apps/push/src/durable-push-claim-mixed-revision.test.ts
deleted file mode 100644
index 869160c3591..00000000000
--- a/cloud/apps/push/src/durable-push-claim-mixed-revision.test.ts
+++ /dev/null
@@ -1,103 +0,0 @@
-import { afterEach, expect, it, vi } from 'vitest'
-import type { PushDatabase } from './push-database.js'
-import { DELIVERY_LEASE_MS, DurablePushStore } from './durable-push-store.js'
-import {
- cleanupDurablePushFixtures,
- durablePushTestDatabaseUrl,
- fixture,
- notification,
- pauseAfter,
- within
-} from './durable-push-store.test-fixture.js'
-
-afterEach(cleanupDurablePushFixtures)
-
-const LEASE_SQL = 'UPDATE push_delivery_batches SET lease_token'
-
-// The previous revision's claim statements, in order, with a hook between its candidate scan and re-read.
-function previousRevisionClaim(
- db: PushDatabase,
- clock: () => number,
- afterCandidate: () => Promise
-): Promise {
- return db.transaction(async (tx) => {
- await tx.lockQuotaScope('push-worker-claim')
- const now = clock()
- const [candidate] = await tx.query(
- `SELECT * FROM push_delivery_batches WHERE state = 'pending' AND lease_until <= ? AND expires_at > ? AND due_at <= ? AND NOT EXISTS (SELECT 1 FROM push_delivery_batches busy WHERE busy.registration_id = push_delivery_batches.registration_id AND busy.lease_until > ?)
- ORDER BY due_at, created_at, batch_id LIMIT 1`,
- [now, now, now, now]
- )
- await afterCandidate()
- if (!candidate) return null
- await tx.lockQuotaScope(`push-events:${String(candidate.host_fingerprint)}`)
- const [row] = await tx.query('SELECT * FROM push_delivery_batches WHERE batch_id = ?', [
- candidate.batch_id
- ])
- if (!row || row.state !== 'pending' || Number(row.expires_at) <= now) return null
- await tx.query(
- 'UPDATE push_delivery_batches SET lease_token = ?, lease_until = ?, attempts = attempts + 1 WHERE batch_id = ?',
- ['previous', now + DELIVERY_LEASE_MS, row.batch_id]
- )
- return 'previous'
- })
-}
-
-it.skipIf(!durablePushTestDatabaseUrl)(
- 'keeps a previous-revision claim from re-leasing a delivery this revision leased',
- async () => {
- const { db, store, clock } = await fixture({ ownDatabase: true })
- await store.accept('host', 'phone', notification(1))
- const paused = pauseAfter(db, LEASE_SQL)
- const current = new DurablePushStore(paused.wrapped, clock).claim()
- await paused.atCandidate
- let committed!: () => void
- const currentCommitted = new Promise((resolve) => (committed = resolve))
- const previous = previousRevisionClaim(db, clock, () => currentCommitted)
- try {
- await vi.waitFor(async () => {
- const waiting = await db.query(
- "SELECT 1 FROM pg_stat_activity WHERE datname = current_database() AND wait_event_type = 'Lock' AND wait_event = 'advisory'"
- )
- expect(waiting).toHaveLength(1)
- })
- } finally {
- paused.release()
- try {
- await current
- } finally {
- committed()
- await previous
- }
- }
- const leased = await current
- expect(await previous).toBeNull()
- const [row] = await db.query('SELECT lease_token FROM push_delivery_batches')
- expect(leased?.lease).toBeTruthy()
- expect(row?.lease_token).toBe(leased?.lease)
- }
-)
-
-it.skipIf(!durablePushTestDatabaseUrl)(
- 'yields to a previous-revision claim that already holds the claim lock',
- async () => {
- const { db, store, clock } = await fixture({ ownDatabase: true })
- await store.accept('host', 'phone', notification(1))
- let scanned!: () => void
- const atCandidate = new Promise((resolve) => (scanned = resolve))
- let release!: () => void
- const released = new Promise((resolve) => (release = resolve))
- const previous = previousRevisionClaim(db, clock, async () => {
- scanned()
- await released
- })
- await atCandidate
- try {
- expect(await within(store.claim(), 2_000)).toBeNull()
- } finally {
- release()
- }
- expect(await previous).toBe('previous')
- expect(await store.claim()).toBeNull()
- }
-)
diff --git a/cloud/apps/push/src/durable-push-claim.test.ts b/cloud/apps/push/src/durable-push-claim.test.ts
deleted file mode 100644
index 2d5e91d4000..00000000000
--- a/cloud/apps/push/src/durable-push-claim.test.ts
+++ /dev/null
@@ -1,219 +0,0 @@
-import { afterEach, expect, it } from 'vitest'
-import type { PushDatabase } from './push-database.js'
-import { DELIVERY_LEASE_MS, DurablePushStore } from './durable-push-store.js'
-
-import { reserveRequestConnection } from './push-background-database.js'
-import { cleanupDurablePushFixtures, DEVICE_HEAD_SQL, durablePushTestDatabaseUrl, fixture, notification, pauseAfter, within } from './durable-push-store.test-fixture.js'
-
-afterEach(cleanupDurablePushFixtures)
-
-it.skipIf(!durablePushTestDatabaseUrl)(
- 'leaves completion, renewal, requests and another store independent of queued claims',
- async () => {
- const { db, store, clock, advance } = await fixture({ poolMax: 6 })
- await store.accept('host', 'finished', notification(1))
- const finished = await store.claim()
- await store.accept('host', 'renewed', notification(2))
- const renewed = await store.claim()
- if (!finished || !renewed) throw new Error('setup_claim_missing')
- await store.accept('host', 'phone-a', notification(3))
- advance(1)
- await store.accept('host', 'phone-b', notification(4))
- advance(1)
- await store.accept('host', 'phone-c', notification(5))
- advance(1)
- await store.accept('host', 'phone-d', notification(6))
- const background = reserveRequestConnection(db, 6)
- const held = [pauseAfter(background), pauseAfter(background), pauseAfter(background)] as const
- let admitted = 0
- const observed: PushDatabase = {
- ...background,
- transaction: (run) => (held[admitted++]?.wrapped ?? background).transaction(run)
- }
- const limited = new DurablePushStore(db, clock, observed)
- const first = limited.claim()
- await held[0].atCandidate
- const second = limited.claim()
- await held[1].atCandidate
- const third = limited.claim()
- await held[2].atCandidate
- const waiting = Array.from({ length: 3 }, () => limited.claim())
- try {
- advance(10)
- const [, , rows, other] = await within(
- Promise.all([
- limited.finish(finished),
- limited.renew(renewed),
- db.query('SELECT COUNT(*) AS total FROM push_devices'),
- store.claim()
- ]),
- 2_000
- )
- expect(Number(rows[0]?.total)).toBe(0)
- expect(other?.registrationId).toBe('phone-d')
- const [lease] = await db.query(
- 'SELECT lease_until FROM push_delivery_batches WHERE batch_id = ?',
- [renewed.id]
- )
- expect(Number(lease?.lease_until)).toBe(clock() + DELIVERY_LEASE_MS)
- expect(await store.pendingCount('finished')).toBe(0)
- } finally {
- for (const pause of held) pause.release()
- await Promise.allSettled([first, second, third, ...waiting])
- }
- expect((await first)?.registrationId).toBe('phone-a')
- expect((await second)?.registrationId).toBe('phone-b')
- expect((await third)?.registrationId).toBe('phone-c')
- expect(await Promise.all(waiting)).toEqual([null, null, null])
- }
-)
-
-it.skipIf(!durablePushTestDatabaseUrl)(
- 'rolls back a failed claim and admits a fourth waiter while the other claims stay held',
- async () => {
- const { db, store, clock, advance } = await fixture({ poolMax: 6 })
- await store.accept('host', 'phone-a', notification(1))
- advance(1)
- await store.accept('host', 'phone-b', notification(2))
- advance(1)
- await store.accept('host', 'phone-c', notification(3))
- const held = [pauseAfter(db), pauseAfter(db), pauseAfter(db)] as const
- let admitted = 0
- const failing: PushDatabase = {
- ...held[0].wrapped,
- transaction: (run) => {
- const position = admitted++
- return (held[position]?.wrapped ?? db).transaction(async (tx) => {
- const result = await run(tx)
- if (position === 0) throw new Error('claim_commit_failed')
- return result
- })
- }
- }
- const limited = new DurablePushStore(db, clock, failing)
- const first = limited.claim()
- const rejected = expect(first).rejects.toThrow('claim_commit_failed')
- await held[0].atCandidate
- const second = limited.claim()
- await held[1].atCandidate
- const third = limited.claim()
- await held[2].atCandidate
- const next = limited.claim()
- try {
- held[0].release()
- await rejected
- const delivery = await within(next, 2_000)
- expect(delivery?.notification.notificationSeq).toBe(1)
- expect(delivery?.attempts).toBe(1)
- if (!delivery) throw new Error('queued_claim_missing')
- await limited.finish(delivery)
- expect(await limited.pendingCount('phone-a')).toBe(0)
- } finally {
- for (const pause of held) pause.release()
- await Promise.allSettled([first, second, third, next])
- }
- expect((await second)?.registrationId).toBe('phone-b')
- expect((await third)?.registrationId).toBe('phone-c')
- }
-)
-
-
-
-it('leases exactly one delivery per device across concurrent claimers', async () => {
- const { db, store, clock, advance } = await fixture()
- for (let seq = 1; seq <= 5; seq++) {
- await store.accept('host', 'phone', notification(seq))
- advance(1)
- }
- const claims = await Promise.all(
- Array.from({ length: 8 }, () => new DurablePushStore(db, clock).claim())
- )
- const leased = claims.filter((claim) => claim !== null)
- expect(leased).toHaveLength(1)
- expect(leased[0]?.notification.notificationSeq).toBe(1)
-})
-
-it.skipIf(!durablePushTestDatabaseUrl)(
- 'does not lease the row behind a head another claimer holds',
- async () => {
- const { db, store, clock, advance } = await fixture()
- await store.accept('host', 'phone', notification(1))
- advance(1)
- await store.accept('host', 'phone', notification(2))
- const paused = pauseAfter(db)
- const first = new DurablePushStore(paused.wrapped, clock).claim()
- await paused.atCandidate
- try {
- expect(await within(store.claim(), 2_000)).toBeNull()
- } finally {
- paused.release()
- }
- expect((await first)?.notification.notificationSeq).toBe(1)
- expect(await store.claim()).toBeNull()
- }
-)
-
-it.skipIf(!durablePushTestDatabaseUrl)(
- 'claims another device while one claim transaction is still open',
- async () => {
- const { db, store, clock, advance } = await fixture()
- await store.accept('host', 'phone-a', notification(1))
- advance(1)
- await store.accept('host', 'phone-b', notification(2))
- const paused = pauseAfter(db)
- const first = new DurablePushStore(paused.wrapped, clock).claim()
- await paused.atCandidate
- try {
- expect((await within(store.claim(), 2_000))?.registrationId).toBe('phone-b')
- } finally {
- paused.release()
- }
- expect((await first)?.registrationId).toBe('phone-a')
- }
-)
-
-it.skipIf(!durablePushTestDatabaseUrl)(
- 'keeps a device exclusive when an earlier-sorting row lands mid-claim',
- async () => {
- const { db, store, clock } = await fixture()
- await store.accept('host', 'phone', notification(1))
- const paused = pauseAfter(db, DEVICE_HEAD_SQL)
- const first = new DurablePushStore(paused.wrapped, clock).claim()
- await paused.atCandidate
- try {
- // Another instance with a slower clock queues a row that now sorts first.
- await db.query(
- `INSERT INTO push_delivery_batches(batch_id, host_fingerprint, registration_id, kind, payload_json, state, due_at, expires_at, lease_until, attempts, created_at)
- VALUES ('skewed', 'host', 'phone', 'alert', ?, 'pending', ?, ?, 0, 0, ?)`,
- [JSON.stringify(notification(2)), clock() - 10, clock() + 60_000, clock() - 10]
- )
- expect(await within(store.claim(), 2_000)).toBeNull()
- } finally {
- paused.release()
- }
- expect((await first)?.notification.notificationSeq).toBe(1)
- }
-)
-
-// Only the TTL term keeps the candidate scan off an unpruned backlog; expires_at is not indexed first.
-
-
-
-
-
-
-it('frees a device held by a crashed worker once its lease lapses', async () => {
- const { db, store, clock, advance } = await fixture()
- await store.accept('host', 'phone', notification(1))
- advance(1)
- await store.accept('host', 'phone', notification(2))
- const crashed = (await new DurablePushStore(db, clock).claim())!
- advance(DELIVERY_LEASE_MS - 1)
- expect(await store.claim()).toBeNull()
- advance(1)
- const reclaimed = (await store.claim())!
- expect(reclaimed.id).toBe(crashed.id)
- expect(reclaimed.attempts).toBe(2)
- await store.finish(reclaimed)
- expect((await store.claim())?.notification.notificationSeq).toBe(2)
-})
diff --git a/cloud/apps/push/src/durable-push-retention.test.ts b/cloud/apps/push/src/durable-push-retention.test.ts
deleted file mode 100644
index 72dcc225b79..00000000000
--- a/cloud/apps/push/src/durable-push-retention.test.ts
+++ /dev/null
@@ -1,81 +0,0 @@
-import { afterEach, expect, it } from 'vitest'
-import {
- cleanupDurablePushFixtures,
- durablePushTestDatabaseUrl,
- fixture,
- within
-} from './durable-push-store.test-fixture.js'
-import { PRUNE_BATCH_ROWS } from './durable-push-store.js'
-
-afterEach(cleanupDurablePushFixtures)
-
-const retentionTables = [
- {
- table: 'push_dismissed_events',
- columns: 'host_fingerprint, notification_epoch, notification_id, notification_seq, created_at',
- values: "'host', 'epoch-' || n, 'notification', n, created_at"
- },
- {
- table: 'push_event_recipients',
- columns: 'event_id, registration_id, created_at',
- values: "'event', 'phone-' || n, created_at"
- },
- {
- table: 'push_events',
- columns: 'event_id, host_fingerprint, kind, fingerprint, created_at, expires_at',
- values: "'event-' || n, 'host', 'alert', 'fingerprint', created_at, created_at"
- }
-] as const
-
-it.each(retentionTables)(
- 'prunes expired $table rows across batches and preserves the cutoff',
- async ({ table, columns, values }) => {
- const { db, store, clock } = await fixture()
- const cutoff = clock() - 24 * 60 * 60_000
- const expired = PRUNE_BATCH_ROWS + 3
- await db.query(
- `INSERT INTO ${table} (${columns})
- WITH RECURSIVE seq(n) AS (SELECT 1 UNION ALL SELECT n + 1 FROM seq WHERE n < ?),
- rows AS (SELECT n, CASE WHEN n <= ? THEN ? ELSE ? + n - ? - 1 END AS created_at FROM seq)
- SELECT ${values} FROM rows`,
- [expired + 2, expired, cutoff - 1, cutoff, expired]
- )
- expect(await store.prune()).toEqual({ deleted: expired, saturated: false })
- const preserved = await db.query(`SELECT created_at FROM ${table} ORDER BY created_at`)
- expect(preserved.map((row) => Number(row.created_at))).toEqual([cutoff, cutoff + 1])
- expect(await store.prune()).toEqual({ deleted: 0, saturated: false })
- }
-)
-
-it.skipIf(!durablePushTestDatabaseUrl).each(retentionTables)(
- 'skips a locked oldest $table row until its transaction releases it',
- async ({ table, columns, values }) => {
- const { db, store, clock } = await fixture()
- const cutoff = clock() - 24 * 60 * 60_000
- await db.query(
- `INSERT INTO ${table} (${columns})
- WITH rows(n, created_at) AS (VALUES (1, ?::bigint), (2, ?::bigint), (3, ?::bigint))
- SELECT ${values} FROM rows`,
- [cutoff - 2, cutoff - 1, cutoff]
- )
- const locked = Promise.withResolvers()
- const release = Promise.withResolvers()
- const holding = db.transaction(async (tx) => {
- await tx.query(`SELECT * FROM ${table} WHERE created_at = ? FOR UPDATE`, [cutoff - 2])
- locked.resolve()
- await release.promise
- })
- try {
- await locked.promise
- expect(await within(store.prune(), 1000)).toEqual({ deleted: 1, saturated: false })
- const preserved = await db.query(`SELECT created_at FROM ${table} ORDER BY created_at`)
- expect(preserved.map((row) => Number(row.created_at))).toEqual([cutoff - 2, cutoff])
- } finally {
- release.resolve()
- await holding
- }
- expect(await store.prune()).toEqual({ deleted: 1, saturated: false })
- const preserved = await db.query(`SELECT created_at FROM ${table}`)
- expect(preserved.map((row) => Number(row.created_at))).toEqual([cutoff])
- }
-)
diff --git a/cloud/apps/push/src/durable-push-worker.test.ts b/cloud/apps/push/src/durable-push-worker.test.ts
deleted file mode 100644
index 5eb84f35110..00000000000
--- a/cloud/apps/push/src/durable-push-worker.test.ts
+++ /dev/null
@@ -1,251 +0,0 @@
-
-import { afterEach, expect, it, vi } from 'vitest'
-import type { PushNotification } from '@orca-cloud/push-contract'
-import { DurablePushStore } from './durable-push-store.js'
-import { DurablePushWorker } from './durable-push-worker.js'
-import { PushDispatcher } from './push-dispatcher.js'
-import { PushDeviceRegistryStore } from './device-registry-store.js'
-import { openInMemoryPushDatabase } from './push-database.js'
-import type { PushDelivery } from './push-delivery-message.js'
-import type { PushProviderOutcome } from './push-provider-outcome.js'
-
-import { pauseAfter, within } from './durable-push-store.test-fixture.js'
-
-const cleanups: (() => Promise)[] = []
-afterEach(async () => {
- for (const cleanup of cleanups.splice(0)) await cleanup()
- vi.useRealTimers()
- vi.restoreAllMocks()
-})
-const note = (seq: number, overrides: Partial = {}): PushNotification => ({
- notificationId: `note-${seq}`,
- notificationSeq: seq,
- notificationEpoch: 'epoch',
- source: 'agent-task-complete',
- agentState: 'finished',
- title: 'Done',
- body: 'Finished task',
- ...overrides
-})
-async function fixture() {
- const db = await openInMemoryPushDatabase()
- let time = 1_000_000
- const now = () => time
- const store = new DurablePushStore(db, now)
- const devices = new PushDeviceRegistryStore(db, now)
- const device = await devices.upsert({
- hostFingerprint: 'host',
- deviceId: 'phone',
- platform: 'android',
- token: 'test-token'
- })
- if (!device.ok) throw new Error('registration failed')
- const send = vi.fn(async (_delivery: PushDelivery): Promise => ({
- status: 'sent'
- }))
- const onRetry = vi.fn()
- const dispatcher = new PushDispatcher({ devices, fcm: { send } as never })
- const worker = new DurablePushWorker(store, dispatcher, { now, onRetry })
- cleanups.push(async () => {
- await worker.stop()
- await db.close()
- })
- vi.spyOn(console, 'warn').mockImplementation(() => {})
- return {
- db,
- store,
- devices,
- worker,
- dispatcher,
- send,
- onRetry,
- now,
- registrationId: device.registrationId,
- accept: (notification: PushNotification) =>
- store.accept('host', device.registrationId, notification),
- advance: (ms: number) => {
- time += ms
- }
- }
-}
-
-it('preserves provider retry delay when waking a restarted worker', async () => {
- const h = await fixture()
- vi.useFakeTimers()
- h.send.mockResolvedValueOnce({
- status: 'error',
- reason: 'busy',
- retryable: true,
- retryAfterMs: 10000
- })
- await h.accept(note(1))
- await h.worker.runDue()
- expect(h.send).toHaveBeenCalledOnce()
- await h.worker.stop()
- const restarted = new DurablePushWorker(h.store, h.dispatcher, { now: h.now, onRetry: h.onRetry })
- restarted.start()
- h.advance(9999)
- restarted.wake()
- await restarted.runDue()
- expect(h.send).toHaveBeenCalledOnce()
- h.advance(1)
- restarted.wake()
- await restarted.runDue()
- expect(h.send).toHaveBeenCalledTimes(2)
- expect(h.send.mock.calls.map(([delivery]) => delivery.expiresAt)).toEqual([1_300_000, 1_300_000])
- expect(h.onRetry).toHaveBeenCalledOnce()
- expect(await h.store.pendingCount(h.registrationId)).toBe(0)
- await restarted.stop()
-})
-
-it('expires instead of shortening a provider delay beyond the delivery lifetime', async () => {
- const h = await fixture()
- h.send.mockResolvedValue({
- status: 'error',
- reason: 'busy',
- retryable: true,
- retryAfterMs: 600000
- })
- await h.accept(note(1))
- await h.worker.runDue()
- h.advance(600000)
- await h.worker.runDue()
- expect(h.send).toHaveBeenCalledOnce()
- expect(await h.store.pendingCount(h.registrationId)).toBe(0)
- expect(h.onRetry).not.toHaveBeenCalled()
-})
-
-it('rechecks the device before a persisted retry and does not send after unregistration', async () => {
- const h = await fixture()
- h.send.mockResolvedValue({ status: 'error', reason: 'timeout', retryable: true })
- await h.accept(note(1))
- await h.worker.runDue()
- await h.devices.deleteOwned('host', h.registrationId)
- h.advance(3000)
- await h.worker.runDue()
- expect(h.send).toHaveBeenCalledOnce()
- expect(await h.store.pendingCount(h.registrationId)).toBe(0)
-})
-
-it('joins active work on shutdown and leaves unclaimed work for the next instance', async () => {
- const h = await fixture()
- vi.useFakeTimers()
- let finish!: (outcome: PushProviderOutcome) => void
- let started!: () => void
- const entered = new Promise((resolve) => {
- started = resolve
- })
- h.send.mockImplementationOnce(() => {
- started()
- return new Promise((resolve) => {
- finish = resolve
- })
- })
- await h.accept(note(1))
- h.worker.start()
- h.worker.wake()
- const pending = h.worker.runDue()
- await entered
- await h.accept(note(2))
- h.worker.wake()
- let stopped = false
- const stopping = h.worker.stop().then(() => {
- stopped = true
- })
- await Promise.resolve()
- expect(stopped).toBe(false)
- finish({ status: 'sent' })
- await Promise.all([pending, stopping])
- expect(stopped).toBe(true)
- expect(h.send).toHaveBeenCalledOnce()
- expect(vi.getTimerCount()).toBe(0)
- const resumed = new DurablePushWorker(h.store, h.dispatcher, { now: h.now })
- resumed.start()
- await vi.advanceTimersByTimeAsync(1000)
- await resumed.runDue()
- expect(h.send).toHaveBeenCalledTimes(2)
- await resumed.stop()
-})
-
-it('stops queued claim admissions without leasing the remaining device', async () => {
- const h = await fixture()
- const other = await h.devices.upsert({
- hostFingerprint: 'host',
- deviceId: 'phone-queued',
- platform: 'android',
- token: 'queued-token'
- })
- if (!other.ok) throw new Error('registration failed')
- await h.accept(note(1))
- h.advance(1)
- await h.store.accept('host', other.registrationId, note(2))
- const paused = pauseAfter(h.db)
- const store = new DurablePushStore(h.db, h.now, paused.wrapped)
- const worker = new DurablePushWorker(store, h.dispatcher, { now: h.now })
- const pending = worker.runDue()
- try {
- await paused.atCandidate
- const stopping = worker.stop()
- paused.release()
- await within(Promise.all([pending, stopping]), 2_000)
- expect(h.send).toHaveBeenCalledOnce()
- expect(h.send.mock.calls[0]?.[0].orca.notificationSeq).toBe(1)
- const [remaining] = await h.db.query(
- 'SELECT attempts, lease_until FROM push_delivery_batches WHERE registration_id = ?',
- [other.registrationId]
- )
- expect(Number(remaining?.attempts)).toBe(0)
- expect(Number(remaining?.lease_until)).toBe(0)
- } finally {
- paused.release()
- await worker.stop()
- await pending
- }
-})
-
-it('claims new devices while an earlier provider response is still pending', async () => {
- const h = await fixture()
- const second = await h.devices.upsert({
- hostFingerprint: 'host',
- deviceId: 'phone-second',
- platform: 'android',
- token: 'second-token'
- })
- const third = await h.devices.upsert({
- hostFingerprint: 'host',
- deviceId: 'phone-third',
- platform: 'android',
- token: 'third-token'
- })
- if (!second.ok || !third.ok) throw new Error('registration failed')
- const held = Promise.withResolvers()
- const entered = Promise.withResolvers()
- const secondSent = Promise.withResolvers()
- const thirdSent = Promise.withResolvers()
- h.send.mockImplementation(async (delivery) => {
- if (delivery.orca.notificationSeq === 1) {
- entered.resolve()
- return await held.promise
- }
- if (delivery.orca.notificationSeq === 2) secondSent.resolve()
- if (delivery.orca.notificationSeq === 3) thirdSent.resolve()
- return { status: 'sent' }
- })
- await h.accept(note(1))
- h.worker.start()
- h.worker.wake()
- try {
- await within(entered.promise, 2_000)
- await h.store.accept('host', second.registrationId, note(2))
- h.worker.wake()
- await within(secondSent.promise, 2_000)
- await h.store.accept('host', third.registrationId, note(3))
- h.worker.wake()
- await within(thirdSent.promise, 2_000)
- expect(await h.store.pendingCount(h.registrationId)).toBe(1)
- expect(h.send).toHaveBeenCalledTimes(3)
- } finally {
- held.resolve({ status: 'sent' })
- await h.worker.stop()
- }
-})
diff --git a/cloud/apps/push/src/fcm-client.test.ts b/cloud/apps/push/src/fcm-client.test.ts
deleted file mode 100644
index 107ef8c648d..00000000000
--- a/cloud/apps/push/src/fcm-client.test.ts
+++ /dev/null
@@ -1,132 +0,0 @@
-
-import { describe, expect, it } from 'vitest'
-import { FcmClient, type FcmRequest, type FcmResponse } from './fcm-client.js'
-import { buildPushDelivery } from './push-delivery-message.js'
-
-const NOW = 1_700_000_000_000
-const HOST = 'abcdefghijklmnop'
-const TOKEN = 'cQ1abcDEF_gh:APA91bZZ-zz0123456789abcdefghijklmnopqrstuvwxyz'
-
-function delivery(agentState: 'needs-input' | null = 'needs-input') {
- return buildPushDelivery({
- expiresAt: NOW + 300_000,
- registrationId: 'reg-1',
- hostFingerprint: HOST,
- notification: {
- notificationId: 'note-1',
- notificationSeq: 7,
- notificationEpoch: 'epoch-1',
- source: 'agent-task-complete',
- agentState,
- title: 'Agent needs input',
- body: 'Waiting on your answer',
- paneKey: 'tab-b:pane-1',
- worktreeId: 'wt-1'
- }
- })
-}
-
-function fakeTransport(response: FcmResponse) {
- const requests: FcmRequest[] = []
- return {
- requests,
- transport: async (request: FcmRequest): Promise => {
- requests.push(request)
- return response
- }
- }
-}
-
-function client(response: FcmResponse) {
- const fake = fakeTransport(response)
- return {
- fake,
- client: new FcmClient({
- projectId: 'onorca-cloud',
- now: () => NOW,
- accessToken: async () => 'access-token',
- transport: fake.transport
- })
- }
-}
-
-describe('fcm client', () => {
-
-
-
- it('marks an invalid-argument that names the token dead, and others an error', async () => {
- const named = client({
- status: 400,
- body: JSON.stringify({
- error: { status: 'INVALID_ARGUMENT', message: 'The registration token is not valid.' }
- })
- })
- await expect(named.client.send(delivery(), { token: TOKEN })).resolves.toEqual({
- status: 'dead',
- reason: 'INVALID_ARGUMENT'
- })
- const unnamed = client({
- status: 400,
- body: JSON.stringify({
- error: { status: 'INVALID_ARGUMENT', message: 'Invalid value at message.android.ttl' }
- })
- })
- await expect(unnamed.client.send(delivery(), { token: TOKEN })).resolves.toEqual({
- status: 'error',
- reason: 'INVALID_ARGUMENT',
- retryable: false,
- retryAfterMs: 10000
- })
- })
-
-
-})
-
-it('does not send when credential refresh crosses the absolute expiry', async () => {
- let now = 1000
- const fake = fakeTransport({ status: 200, body: '{}' })
- const fcm = new FcmClient({
- projectId: 'test',
- now: () => now,
- accessToken: async () => {
- now = 3000
- return 'test-token'
- },
- transport: fake.transport
- })
- await expect(fcm.send({ ...delivery(), expiresAt: 2000 }, { token: TOKEN })).resolves.toEqual({
- status: 'error',
- reason: 'expired'
- })
- expect(fake.requests).toHaveLength(0)
-})
-
-it('decreases retry TTL and refuses expired delivery before refreshing credentials', async () => {
- let now = NOW
- let refreshes = 0
- const fake = fakeTransport({ status: 503, body: '{}' })
- const fcm = new FcmClient({
- projectId: 'test',
- now: () => now,
- accessToken: async () => {
- refreshes++
- return 'test-token'
- },
- transport: fake.transport
- })
- const pending = delivery()
- await fcm.send(pending, { token: TOKEN })
- now += 60_000
- await fcm.send(pending, { token: TOKEN })
- expect(fake.requests.map((request) => JSON.parse(request.body).message.android.ttl)).toEqual([
- '300s',
- '240s'
- ])
- now = pending.expiresAt
- await expect(fcm.send(pending, { token: TOKEN })).resolves.toEqual({
- status: 'error',
- reason: 'expired'
- })
- expect(fake.requests).toHaveLength(2)
- expect(refreshes).toBe(2)
-})
diff --git a/cloud/apps/push/src/canonical-base64.ts b/cloud/apps/push/src/host-auth/canonical-base64.ts
similarity index 100%
rename from cloud/apps/push/src/canonical-base64.ts
rename to cloud/apps/push/src/host-auth/canonical-base64.ts
diff --git a/cloud/apps/push/src/host-challenge-answering.test-fixture.ts b/cloud/apps/push/src/host-auth/host-challenge-answering.test-fixture.ts
similarity index 90%
rename from cloud/apps/push/src/host-challenge-answering.test-fixture.ts
rename to cloud/apps/push/src/host-auth/host-challenge-answering.test-fixture.ts
index ac5320cd1ab..b9d5eba99d5 100644
--- a/cloud/apps/push/src/host-challenge-answering.test-fixture.ts
+++ b/cloud/apps/push/src/host-auth/host-challenge-answering.test-fixture.ts
@@ -2,9 +2,9 @@ import { createHmac, timingSafeEqual } from 'node:crypto'
import {
PUSH_HOST_CHALLENGE_PLAINTEXT_DOMAIN,
PUSH_HOST_PROOF_TRANSCRIPT_DOMAIN,
- PUSH_HOST_PROOF_TRANSCRIPT_FIELD_COUNT,
- PUSH_LIMITS
-} from '@orca-cloud/push-contract'
+ PUSH_HOST_PROOF_TRANSCRIPT_FIELD_COUNT
+} from '@orca-cloud/push-contract/push-host-proof-transcript'
+import { PUSH_LIMITS } from '@orca-cloud/push-contract/push-limits'
import nacl from 'tweetnacl'
import { decodeCanonicalBase64 } from './canonical-base64.js'
import { deriveHostFingerprint } from './host-fingerprint.js'
@@ -63,7 +63,10 @@ function parseTranscript(transcript: Uint8Array): Map | null
function readUint64(value: Uint8Array | undefined): number | null {
if (!value || value.byteLength !== 8) return null
- const parsed = new DataView(value.buffer, value.byteOffset, value.byteLength).getBigUint64(0, false)
+ const parsed = new DataView(value.buffer, value.byteOffset, value.byteLength).getBigUint64(
+ 0,
+ false
+ )
return parsed <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(parsed) : null
}
@@ -98,14 +101,17 @@ function validateTranscript(
],
['not-expired', now - PUSH_LIMITS.clockSkewToleranceMs <= challenge.expiresAt],
['issuedAt-before-expiry', issuedAt === null || issuedAt <= challenge.expiresAt],
- [
- 'window',
- issuedAt === null || challenge.expiresAt - issuedAt <= PUSH_LIMITS.challengeTtlMs
- ],
+ ['window', issuedAt === null || challenge.expiresAt - issuedAt <= PUSH_LIMITS.challengeTtlMs],
['expiry-consistent', expiresAt === challenge.expiresAt],
- ['protocol', equal(fields.get('protocol'), textEncoder.encode(PUSH_HOST_PROOF_TRANSCRIPT_DOMAIN))],
+ [
+ 'protocol',
+ equal(fields.get('protocol'), textEncoder.encode(PUSH_HOST_PROOF_TRANSCRIPT_DOMAIN))
+ ],
['version', equal(fields.get('version'), new Uint8Array([1]))],
- ['gatewayOrigin', equal(fields.get('gatewayOrigin'), textEncoder.encode(context.gatewayOrigin))],
+ [
+ 'gatewayOrigin',
+ equal(fields.get('gatewayOrigin'), textEncoder.encode(context.gatewayOrigin))
+ ],
['gatewayEphemeralPublicKey', equal(fields.get('gatewayEphemeralPublicKey'), gatewayKey)],
['challengeNonce', equal(fields.get('challengeNonce'), nonce)],
['challengeId', equal(fields.get('challengeId'), textEncoder.encode(challenge.challengeId))],
@@ -125,7 +131,9 @@ export function answerPushHostChallenge(
const gatewayKey = decodeCanonicalBase64(challenge.gatewayEphemeralPublicKeyB64, 32)
const nonce = decodeCanonicalBase64(challenge.nonceB64, 24)
const ciphertext = Buffer.from(challenge.ciphertextB64, 'base64')
- if (!gatewayKey || !nonce || ciphertext.toString('base64') !== challenge.ciphertextB64) return null
+ if (!gatewayKey || !nonce || ciphertext.toString('base64') !== challenge.ciphertextB64) {
+ return null
+ }
const plaintext = nacl.box.open(ciphertext, nonce, gatewayKey, context.keypair.secretKey)
if (!plaintext) {
context.onInvalid?.('challenge-box-open')
diff --git a/cloud/apps/push/src/host-auth/host-challenge-store.test.ts b/cloud/apps/push/src/host-auth/host-challenge-store.test.ts
new file mode 100644
index 00000000000..5995067941c
--- /dev/null
+++ b/cloud/apps/push/src/host-auth/host-challenge-store.test.ts
@@ -0,0 +1,52 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+ answerPushHostChallenge,
+ createPushHostKeypair,
+ hostPublicKeyB64
+} from './host-challenge-answering.test-fixture.js'
+import { PushHostChallengeStore } from './host-challenge-store.js'
+
+import { openInMemoryPushDatabase } from '../database/push-database.js'
+import type { CloudDatabase as PushDatabase } from '@orca-cloud/cloud-database/cloud-database'
+
+const GATEWAY_ORIGIN = 'https://push.onorca.dev'
+
+describe('push host challenge store', () => {
+ let database: PushDatabase
+ let clock = 1_700_000_000_000
+ let store: PushHostChallengeStore
+
+ beforeEach(async () => {
+ database = await openInMemoryPushDatabase()
+ clock = 1_700_000_000_000
+ store = new PushHostChallengeStore(database, GATEWAY_ORIGIN, () => clock)
+ })
+
+ afterEach(async () => {
+ await database.close()
+ })
+
+ it('refuses a wrong host: the box will not open and a foreign proof will not match', async () => {
+ const owner = createPushHostKeypair(6)
+ const intruder = createPushHostKeypair(7)
+ const ownerChallenge = await store.issue(hostPublicKeyB64(owner))
+ expect(
+ answerPushHostChallenge(ownerChallenge!, {
+ gatewayOrigin: GATEWAY_ORIGIN,
+ keypair: intruder,
+ now: () => clock
+ })
+ ).toBeNull()
+
+ const intruderChallenge = await store.issue(hostPublicKeyB64(intruder))
+ const intruderProof = answerPushHostChallenge(intruderChallenge!, {
+ gatewayOrigin: GATEWAY_ORIGIN,
+ keypair: intruder,
+ now: () => clock
+ })!
+ await expect(store.verify(ownerChallenge!.challengeId, intruderProof)).resolves.toEqual({
+ ok: false,
+ reason: 'proof_mismatch'
+ })
+ })
+})
diff --git a/cloud/apps/push/src/host-challenge-store.ts b/cloud/apps/push/src/host-auth/host-challenge-store.ts
similarity index 95%
rename from cloud/apps/push/src/host-challenge-store.ts
rename to cloud/apps/push/src/host-auth/host-challenge-store.ts
index fd12af85983..5cfb68d2f12 100644
--- a/cloud/apps/push/src/host-challenge-store.ts
+++ b/cloud/apps/push/src/host-auth/host-challenge-store.ts
@@ -2,13 +2,13 @@ import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from
import {
buildPushHostChallengePlaintext,
buildPushHostProofMacInput,
- buildPushHostProofTranscript,
- PUSH_LIMITS
-} from '@orca-cloud/push-contract'
+ buildPushHostProofTranscript
+} from '@orca-cloud/push-contract/push-host-proof-transcript'
+import { PUSH_LIMITS } from '@orca-cloud/push-contract/push-limits'
import nacl from 'tweetnacl'
import { decodeCanonicalBase64 } from './canonical-base64.js'
import { deriveHostFingerprint } from './host-fingerprint.js'
-import type { PushDatabase } from './push-database.js'
+import type { CloudDatabase as PushDatabase } from '@orca-cloud/cloud-database/cloud-database'
export type IssuedPushChallenge = {
challengeId: string
diff --git a/cloud/apps/push/src/host-fingerprint.ts b/cloud/apps/push/src/host-auth/host-fingerprint.ts
similarity index 96%
rename from cloud/apps/push/src/host-fingerprint.ts
rename to cloud/apps/push/src/host-auth/host-fingerprint.ts
index 955b1ac8ecb..b0cee6ca15b 100644
--- a/cloud/apps/push/src/host-fingerprint.ts
+++ b/cloud/apps/push/src/host-auth/host-fingerprint.ts
@@ -1,5 +1,5 @@
import { createHash } from 'node:crypto'
-import { PUSH_HOST_FINGERPRINT_LENGTH } from '@orca-cloud/push-contract'
+import { PUSH_HOST_FINGERPRINT_LENGTH } from '@orca-cloud/push-contract/push-limits'
// Identical derivation to deriveRelayHostId on the desktop, so a host and a
// phone reach the same fingerprint from the same X25519 public key.
diff --git a/cloud/apps/push/src/host-proof-concurrency.test.ts b/cloud/apps/push/src/host-auth/host-proof-concurrency.test.ts
similarity index 95%
rename from cloud/apps/push/src/host-proof-concurrency.test.ts
rename to cloud/apps/push/src/host-auth/host-proof-concurrency.test.ts
index 031ca61c7fd..8e64ab10165 100644
--- a/cloud/apps/push/src/host-proof-concurrency.test.ts
+++ b/cloud/apps/push/src/host-auth/host-proof-concurrency.test.ts
@@ -1,5 +1,5 @@
import { expect, it } from 'vitest'
-import { openInMemoryPushDatabase, openPushDatabase } from './push-database.js'
+import { openInMemoryPushDatabase, openPushDatabase } from '../database/push-database.js'
import { PushHostChallengeStore } from './host-challenge-store.js'
import {
answerPushHostChallenge,
diff --git a/cloud/apps/push/src/host-session-store.ts b/cloud/apps/push/src/host-auth/host-session-store.ts
similarity index 93%
rename from cloud/apps/push/src/host-session-store.ts
rename to cloud/apps/push/src/host-auth/host-session-store.ts
index 5ee1f2aa6a0..6841bb4c633 100644
--- a/cloud/apps/push/src/host-session-store.ts
+++ b/cloud/apps/push/src/host-auth/host-session-store.ts
@@ -1,6 +1,6 @@
import { createHash, randomBytes } from 'node:crypto'
-import { PUSH_LIMITS } from '@orca-cloud/push-contract'
-import type { PushDatabase } from './push-database.js'
+import { PUSH_LIMITS } from '@orca-cloud/push-contract/push-limits'
+import type { CloudDatabase as PushDatabase } from '@orca-cloud/cloud-database/cloud-database'
export type IssuedPushSession = {
sessionToken: string
diff --git a/cloud/apps/push/src/host-auth/push-session-concurrency.test.ts b/cloud/apps/push/src/host-auth/push-session-concurrency.test.ts
new file mode 100644
index 00000000000..221a5c91ab4
--- /dev/null
+++ b/cloud/apps/push/src/host-auth/push-session-concurrency.test.ts
@@ -0,0 +1,44 @@
+import { randomUUID } from 'node:crypto'
+import { tmpdir } from 'node:os'
+import { afterEach, describe, expect, it } from 'vitest'
+import { openInMemoryPushDatabase, openPushDatabase } from '../database/push-database.js'
+import type { CloudDatabase as PushDatabase } from '@orca-cloud/cloud-database/cloud-database'
+import { PushHostSessionStore } from './host-session-store.js'
+const databases: PushDatabase[] = []
+afterEach(async () => {
+ await Promise.all(databases.splice(0).map((db) => db.close()))
+})
+
+async function concurrentSessions(db: PushDatabase) {
+ databases.push(db)
+ const host = randomUUID()
+ const store = new PushHostSessionStore(db)
+ try {
+ const sessions = await Promise.all(Array.from({ length: 20 }, () => store.create(host)))
+ const decisions = await Promise.all(
+ sessions.map((session) => store.resolve(session.sessionToken))
+ )
+ expect(decisions.filter((decision) => decision.ok)).toHaveLength(1)
+ const [row] = await db.query(
+ 'SELECT COUNT(*) AS count FROM push_sessions WHERE host_fingerprint = ?',
+ [host]
+ )
+ expect(Number(row?.count)).toBe(1)
+ } finally {
+ await db.query('DELETE FROM push_sessions WHERE host_fingerprint = ?', [host])
+ }
+}
+it('serializes sessions on SQLite', async () => {
+ await concurrentSessions(await openInMemoryPushDatabase())
+})
+
+describe.skipIf(!process.env.ORCA_PUSH_TEST_DATABASE_URL)('PostgreSQL push sessions', () => {
+ it('leaves exactly one live token after concurrent creates', async () => {
+ await concurrentSessions(
+ await openPushDatabase({
+ databaseUrl: process.env.ORCA_PUSH_TEST_DATABASE_URL!,
+ dataDir: tmpdir()
+ })
+ )
+ })
+})
diff --git a/cloud/apps/push/src/host-challenge-store.test.ts b/cloud/apps/push/src/host-challenge-store.test.ts
deleted file mode 100644
index f73a4f53ea8..00000000000
--- a/cloud/apps/push/src/host-challenge-store.test.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-import { PUSH_LIMITS } from '@orca-cloud/push-contract'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import {
- answerPushHostChallenge,
- createPushHostKeypair,
- hostPublicKeyB64
-} from './host-challenge-answering.test-fixture.js'
-import { PushHostChallengeStore } from './host-challenge-store.js'
-
-import { openInMemoryPushDatabase, type PushDatabase } from './push-database.js'
-
-const GATEWAY_ORIGIN = 'https://push.onorca.dev'
-
-describe('push host challenge store', () => {
- let database: PushDatabase
- let clock = 1_700_000_000_000
- let store: PushHostChallengeStore
-
- beforeEach(async () => {
- database = await openInMemoryPushDatabase()
- clock = 1_700_000_000_000
- store = new PushHostChallengeStore(database, GATEWAY_ORIGIN, () => clock)
- })
-
- afterEach(async () => {
- await database.close()
- })
-
-
-
-
-
-
-
- it('rejects a challenge the moment its own ttl elapses', async () => {
- const host = createPushHostKeypair(4)
- const challenge = await store.issue(hostPublicKeyB64(host))
- const proof = answerPushHostChallenge(challenge!, {
- gatewayOrigin: GATEWAY_ORIGIN,
- keypair: host,
- now: () => clock
- })!
- clock += PUSH_LIMITS.challengeTtlMs + 1
- await expect(store.verify(challenge!.challengeId, proof)).resolves.toEqual({
- ok: false,
- reason: 'expired'
- })
- })
-
-
-
-
-
- it('refuses a wrong host: the box will not open and a foreign proof will not match', async () => {
- const owner = createPushHostKeypair(6)
- const intruder = createPushHostKeypair(7)
- const ownerChallenge = await store.issue(hostPublicKeyB64(owner))
- expect(
- answerPushHostChallenge(ownerChallenge!, {
- gatewayOrigin: GATEWAY_ORIGIN,
- keypair: intruder,
- now: () => clock
- })
- ).toBeNull()
-
- const intruderChallenge = await store.issue(hostPublicKeyB64(intruder))
- const intruderProof = answerPushHostChallenge(intruderChallenge!, {
- gatewayOrigin: GATEWAY_ORIGIN,
- keypair: intruder,
- now: () => clock
- })!
- await expect(store.verify(ownerChallenge!.challengeId, intruderProof)).resolves.toEqual({
- ok: false,
- reason: 'proof_mismatch'
- })
- })
-
-
-})
diff --git a/cloud/apps/push/src/host-session-store.test.ts b/cloud/apps/push/src/host-session-store.test.ts
deleted file mode 100644
index ad90407164d..00000000000
--- a/cloud/apps/push/src/host-session-store.test.ts
+++ /dev/null
@@ -1,66 +0,0 @@
-import { PUSH_LIMITS } from '@orca-cloud/push-contract'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { PushHostSessionStore } from './host-session-store.js'
-import { openInMemoryPushDatabase, type PushDatabase } from './push-database.js'
-
-const HOST = 'abcdefghijklmnop'
-
-describe('push host session store', () => {
- let database: PushDatabase
- let clock = 1_700_000_000_000
- let sessions: PushHostSessionStore
-
- beforeEach(async () => {
- database = await openInMemoryPushDatabase()
- clock = 1_700_000_000_000
- sessions = new PushHostSessionStore(database, () => clock)
- })
-
- afterEach(async () => {
- await database.close()
- })
-
- it('mints a 24 hour session and stores only its hash', async () => {
- const session = await sessions.create(HOST)
- expect(session.expiresAt).toBe(clock + PUSH_LIMITS.sessionTtlMs)
- expect(Buffer.from(session.sessionToken, 'base64url').byteLength).toBe(32)
- const [row] = await database.query('SELECT token_hash FROM push_sessions')
- expect(String(row?.token_hash)).not.toBe(session.sessionToken)
- await expect(sessions.resolve(session.sessionToken)).resolves.toMatchObject({
- ok: true,
- hostFingerprint: HOST
- })
- })
-
- it('reports expiry separately from an unknown token', async () => {
- const session = await sessions.create(HOST)
- clock += PUSH_LIMITS.sessionTtlMs + 1
- await expect(sessions.resolve(session.sessionToken)).resolves.toEqual({
- ok: false,
- reason: 'session_expired'
- })
- await expect(sessions.resolve('not-a-session')).resolves.toEqual({
- ok: false,
- reason: 'unknown_session'
- })
- })
-
-
-
- it('keeps one live session per host and prunes it once expired', async () => {
- const first = await sessions.create(HOST)
- const second = await sessions.create(HOST)
- // The earlier session is gone the moment its host proves again, so a flood
- // of proofs leaves one row per host rather than one per proof.
- await expect(sessions.resolve(first.sessionToken)).resolves.toEqual({
- ok: false,
- reason: 'unknown_session'
- })
- await expect(sessions.resolve(second.sessionToken)).resolves.toMatchObject({ ok: true })
- const other = await sessions.create('ponmlkjihgfedcba')
- await expect(sessions.resolve(second.sessionToken)).resolves.toMatchObject({ ok: true })
- clock += PUSH_LIMITS.sessionTtlMs + 1
- expect(await sessions.pruneExpired()).toBe(2)
- await expect(sessions.resolve(other.sessionToken)).resolves.toMatchObject({ ok: false })
- })
-})
diff --git a/cloud/apps/push/src/client-ip-rate-limit.ts b/cloud/apps/push/src/http/client-ip-rate-limit.ts
similarity index 97%
rename from cloud/apps/push/src/client-ip-rate-limit.ts
rename to cloud/apps/push/src/http/client-ip-rate-limit.ts
index 6ac3e4d3c15..d13794b7095 100644
--- a/cloud/apps/push/src/client-ip-rate-limit.ts
+++ b/cloud/apps/push/src/http/client-ip-rate-limit.ts
@@ -1,4 +1,4 @@
-import { PUSH_LIMITS } from '@orca-cloud/push-contract'
+import { PUSH_LIMITS } from '@orca-cloud/push-contract/push-limits'
import type { Context, MiddlewareHandler } from 'hono'
const REFILL_WINDOW_MS = 60_000
diff --git a/cloud/apps/push/src/push-auth-admission.ts b/cloud/apps/push/src/http/push-auth-admission.ts
similarity index 100%
rename from cloud/apps/push/src/push-auth-admission.ts
rename to cloud/apps/push/src/http/push-auth-admission.ts
diff --git a/cloud/apps/push/src/push-authenticated-ip-limit.test.ts b/cloud/apps/push/src/http/push-authenticated-ip-limit.test.ts
similarity index 91%
rename from cloud/apps/push/src/push-authenticated-ip-limit.test.ts
rename to cloud/apps/push/src/http/push-authenticated-ip-limit.test.ts
index a626b80060a..01b68073dad 100644
--- a/cloud/apps/push/src/push-authenticated-ip-limit.test.ts
+++ b/cloud/apps/push/src/http/push-authenticated-ip-limit.test.ts
@@ -1,6 +1,6 @@
-import { PUSH_LIMITS } from '@orca-cloud/push-contract'
+import { PUSH_LIMITS } from '@orca-cloud/push-contract/push-limits'
import { expect, it } from 'vitest'
-import { createPushHostKeypair } from './host-challenge-answering.test-fixture.js'
+import { createPushHostKeypair } from '../host-auth/host-challenge-answering.test-fixture.js'
import { createPushServerHarness, FCM_TOKEN } from './push-server-harness.test-fixture.js'
it('bounds valid hosts together across routes without letting key rotation reset the IP budget', async () => {
diff --git a/cloud/apps/push/src/push-readiness.ts b/cloud/apps/push/src/http/push-readiness.ts
similarity index 90%
rename from cloud/apps/push/src/push-readiness.ts
rename to cloud/apps/push/src/http/push-readiness.ts
index c071a0750e4..c1751ef72f6 100644
--- a/cloud/apps/push/src/push-readiness.ts
+++ b/cloud/apps/push/src/http/push-readiness.ts
@@ -1,4 +1,4 @@
-import type { PushDatabase } from './push-database.js'
+import type { CloudDatabase as PushDatabase } from '@orca-cloud/cloud-database/cloud-database'
export type PushReadinessOptions = {
cacheMs?: number
diff --git a/cloud/apps/push/src/push-request-drain.ts b/cloud/apps/push/src/http/push-request-drain.ts
similarity index 100%
rename from cloud/apps/push/src/push-request-drain.ts
rename to cloud/apps/push/src/http/push-request-drain.ts
diff --git a/cloud/apps/push/src/http/push-send-idempotency.test.ts b/cloud/apps/push/src/http/push-send-idempotency.test.ts
new file mode 100644
index 00000000000..b061eef3040
--- /dev/null
+++ b/cloud/apps/push/src/http/push-send-idempotency.test.ts
@@ -0,0 +1,36 @@
+import { afterEach, expect, it } from 'vitest'
+import { createPushServerHarness, notification } from './push-server-harness.test-fixture.js'
+import { createPushHostKeypair } from '../host-auth/host-challenge-answering.test-fixture.js'
+const harnesses: Awaited>[] = []
+afterEach(async () => {
+ await Promise.all(harnesses.splice(0).map((h) => h.close()))
+})
+
+it('returns queued for concurrent retries without double quota or delivery', async () => {
+ const h = await createPushServerHarness()
+ harnesses.push(h)
+ const token = await h.signIn(createPushHostKeypair(2))
+ const registrationId = await h.registerAndroid(token)
+ const body = { v: 1, registrationIds: [registrationId], notification: notification() }
+ const responses = await Promise.all(
+ Array.from({ length: 10 }, () => h.post('/v1/send', body, token))
+ )
+ for (const response of responses)
+ expect(await response.json()).toEqual({ results: [{ registrationId, status: 'queued' }] })
+ expect(await h.server.deliveryStore.pendingCount(registrationId)).toBe(1)
+ await h.flushDeliveries()
+ await h.post('/v1/send', body, token)
+ await h.flushDeliveries()
+ expect(h.fcmRequests).toHaveLength(1)
+ expect(JSON.parse(h.fcmRequests[0]!.body).message.data.coalescedCount).toBeUndefined()
+ expect(
+ Number((await h.database.query('SELECT COUNT(*) AS count FROM push_events'))[0]?.count)
+ ).toBe(1)
+ await h.post(
+ '/v1/send',
+ { ...body, notification: notification({ notificationEpoch: 'new-epoch' }) },
+ token
+ )
+ await h.flushDeliveries()
+ expect(h.fcmRequests).toHaveLength(2)
+})
diff --git a/cloud/apps/push/src/http/push-server-auth.test.ts b/cloud/apps/push/src/http/push-server-auth.test.ts
new file mode 100644
index 00000000000..7c06e9c0d5d
--- /dev/null
+++ b/cloud/apps/push/src/http/push-server-auth.test.ts
@@ -0,0 +1,30 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { createPushHostKeypair } from '../host-auth/host-challenge-answering.test-fixture.js'
+import { createPushServerHarness } from './push-server-harness.test-fixture.js'
+
+describe('push gateway authentication and device routes', () => {
+ let harness: Awaited>
+
+ beforeEach(async () => {
+ harness = await createPushServerHarness()
+ })
+
+ afterEach(async () => {
+ await harness.close()
+ })
+
+ it('lets only the owning host delete a registration', async () => {
+ const ownerToken = await harness.signIn(createPushHostKeypair(14))
+ const intruderToken = await harness.signIn(createPushHostKeypair(15))
+ const registrationId = await harness.registerAndroid(ownerToken)
+
+ const forbidden = await harness.authorized(
+ `/v1/devices/${registrationId}`,
+ { method: 'DELETE' },
+ intruderToken
+ )
+ expect(forbidden.status).toBe(404)
+ expect(await forbidden.json()).toEqual({ error: 'not_found' })
+ expect(await harness.server.devices.findById(registrationId)).not.toBeNull()
+ })
+})
diff --git a/cloud/apps/push/src/push-server-harness.test-fixture.ts b/cloud/apps/push/src/http/push-server-harness.test-fixture.ts
similarity index 89%
rename from cloud/apps/push/src/push-server-harness.test-fixture.ts
rename to cloud/apps/push/src/http/push-server-harness.test-fixture.ts
index f1567dd9ab7..2d7c403c19a 100644
--- a/cloud/apps/push/src/push-server-harness.test-fixture.ts
+++ b/cloud/apps/push/src/http/push-server-harness.test-fixture.ts
@@ -1,15 +1,17 @@
import { generateKeyPairSync } from 'node:crypto'
import { expect } from 'vitest'
-import type { ApnsRequest, ApnsResponse } from './apns-http2-transport.js'
-import type { PushConfig } from './config.js'
-import type { FcmRequest, FcmResponse } from './fcm-client.js'
+import type { ApnsRequest } from '../providers/apns/apns-http2-transport.js'
+import type { ApnsResponse } from '../providers/apns/apns-stream-response.js'
+import type { PushConfig } from '../config.js'
+import type { FcmRequest, FcmResponse } from '../providers/fcm/fcm-client.js'
import {
answerPushHostChallenge,
hostPublicKeyB64,
type PushHostKeypair
-} from './host-challenge-answering.test-fixture.js'
-import { openInMemoryPushDatabase, type PushDatabase } from './push-database.js'
-import { createPushServer } from './push-server.js'
+} from '../host-auth/host-challenge-answering.test-fixture.js'
+import { openInMemoryPushDatabase } from '../database/push-database.js'
+import type { CloudDatabase as PushDatabase } from '@orca-cloud/cloud-database/cloud-database'
+import { createPushServer } from '../push-server.js'
export const GATEWAY_ORIGIN = 'https://push.onorca.dev'
export const APNS_TOKEN = 'a'.repeat(64)
diff --git a/cloud/apps/push/src/http/push-server-limits.test.ts b/cloud/apps/push/src/http/push-server-limits.test.ts
new file mode 100644
index 00000000000..301ce0b011e
--- /dev/null
+++ b/cloud/apps/push/src/http/push-server-limits.test.ts
@@ -0,0 +1,121 @@
+import { PUSH_LIMITS } from '@orca-cloud/push-contract/push-limits'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+ createPushHostKeypair,
+ hostPublicKeyB64
+} from '../host-auth/host-challenge-answering.test-fixture.js'
+import { createPushServerHarness } from './push-server-harness.test-fixture.js'
+
+const CLIENT_IP = '203.0.113.7'
+const OTHER_CLIENT_IP = '198.51.100.9'
+
+function oversizedChallengeBody(): string {
+ return JSON.stringify({ v: 1, filler: 'x'.repeat(PUSH_LIMITS.maxHttpBodyBytes) })
+}
+
+function chunkedRequest(path: string, body: string): Request {
+ const stream = new ReadableStream({
+ start(controller) {
+ controller.enqueue(new TextEncoder().encode(body))
+ controller.close()
+ }
+ })
+ return new Request(`http://push.test${path}`, {
+ method: 'POST',
+ headers: { 'content-type': 'application/json' },
+ body: stream,
+ duplex: 'half'
+ } as RequestInit)
+}
+
+describe('push gateway request limits', () => {
+ let harness: Awaited>
+
+ beforeEach(async () => {
+ harness = await createPushServerHarness()
+ })
+
+ afterEach(async () => {
+ await harness.close()
+ })
+
+ it('refuses an oversized chunked body that declares no content length', async () => {
+ const request = chunkedRequest('/v1/host/challenge', oversizedChallengeBody())
+ expect(request.headers.get('content-length')).toBeNull()
+
+ const response = await harness.server.app.request(request)
+ expect(response.status).toBe(413)
+ expect(await response.json()).toEqual({ error: 'request_too_large' })
+ })
+
+ it('rate limits one client ip across both unauthenticated routes', async () => {
+ const body = JSON.stringify({
+ v: 1,
+ hostPublicKeyB64: hostPublicKeyB64(createPushHostKeypair(62))
+ })
+ // Cloud Run appends the peer, so the caller's own IP is the last value.
+ const headers = {
+ 'content-type': 'application/json',
+ 'x-forwarded-for': `10.0.0.1, ${CLIENT_IP}`
+ }
+ for (let index = 0; index < PUSH_LIMITS.unauthenticatedRequestsPerMinutePerIp; index++) {
+ const allowed = await harness.server.app.request('/v1/host/challenge', {
+ method: 'POST',
+ headers,
+ body
+ })
+ expect(allowed.status).toBe(200)
+ }
+
+ const limited = await harness.server.app.request('/v1/host/challenge', {
+ method: 'POST',
+ headers,
+ body
+ })
+ expect(limited.status).toBe(429)
+ expect(await limited.json()).toEqual({ error: 'rate_limited' })
+
+ // The session route draws on the same bucket, so a flood cannot simply move.
+ const session = await harness.server.app.request('/v1/host/session', {
+ method: 'POST',
+ headers,
+ body: JSON.stringify({ v: 1, challengeId: 'anything', proofB64: 'x'.repeat(44) })
+ })
+ expect(session.status).toBe(429)
+
+ const other = await harness.server.app.request('/v1/host/challenge', {
+ method: 'POST',
+ headers: { ...headers, 'x-forwarded-for': `10.0.0.1, ${OTHER_CLIENT_IP}` },
+ body
+ })
+ expect(other.status).toBe(200)
+
+ // A caller rewriting the left of the chain lands in its own bucket anyway.
+ const spoofed = await harness.server.app.request('/v1/host/challenge', {
+ method: 'POST',
+ headers: { ...headers, 'x-forwarded-for': `198.51.100.250, ${CLIENT_IP}` },
+ body
+ })
+ expect(spoofed.status).toBe(429)
+ })
+
+ it('limits authenticated hosts independently behind the same IP', async () => {
+ const sessionToken = await harness.signIn(createPushHostKeypair(64))
+ const headers = { 'x-forwarded-for': CLIENT_IP }
+ for (let index = 0; index < 600; index++) {
+ const listed = await harness.authorized('/v1/devices', { headers }, sessionToken)
+ expect(listed.status).toBe(200)
+ }
+ const limited = await harness.authorized('/v1/devices', { headers }, sessionToken)
+ expect(limited.status).toBe(429)
+ const otherToken = await harness.signIn(createPushHostKeypair(68))
+ expect((await harness.authorized('/v1/devices', { headers }, otherToken)).status).toBe(200)
+ // The handshake bucket is untouched by any of that.
+ const challenge = await harness.server.app.request('/v1/host/challenge', {
+ method: 'POST',
+ headers: { ...headers, 'content-type': 'application/json' },
+ body: JSON.stringify({ v: 1, hostPublicKeyB64: hostPublicKeyB64(createPushHostKeypair(67)) })
+ })
+ expect(challenge.status).toBe(200)
+ })
+})
diff --git a/cloud/apps/push/src/http/push-server-send.test.ts b/cloud/apps/push/src/http/push-server-send.test.ts
new file mode 100644
index 00000000000..146b9a9c496
--- /dev/null
+++ b/cloud/apps/push/src/http/push-server-send.test.ts
@@ -0,0 +1,75 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { createPushHostKeypair } from '../host-auth/host-challenge-answering.test-fixture.js'
+import {
+ createPushServerHarness,
+ FCM_TOKEN,
+ notification
+} from './push-server-harness.test-fixture.js'
+
+describe('push gateway send route', () => {
+ let harness: Awaited>
+
+ beforeEach(async () => {
+ harness = await createPushServerHarness()
+ })
+
+ afterEach(async () => {
+ await harness.close()
+ })
+
+ it('queues a send, delivers it to fcm, and reports a dead token on the next send', async () => {
+ const sessionToken = await harness.signIn(createPushHostKeypair(17))
+ const registrationId = await harness.registerAndroid(sessionToken)
+
+ const queued = await harness.post(
+ '/v1/send',
+ { v: 1, registrationIds: [registrationId], notification: notification() },
+ sessionToken
+ )
+ expect(await queued.json()).toEqual({ results: [{ registrationId, status: 'queued' }] })
+
+ harness.setFcmResponse({
+ status: 404,
+ body: JSON.stringify({ error: { status: 'UNREGISTERED', message: 'gone' } })
+ })
+ await harness.flushDeliveries()
+ expect(harness.fcmRequests).toHaveLength(1)
+ expect(JSON.parse(harness.fcmRequests[0]!.body)).toMatchObject({
+ message: {
+ token: FCM_TOKEN,
+ data: { title: 'Agent needs input', tag: expect.stringMatching(/^[a-f0-9]{64}$/) }
+ }
+ })
+
+ const afterDeath = await harness.post(
+ '/v1/send',
+ { v: 1, registrationIds: [registrationId], notification: notification() },
+ sessionToken
+ )
+ expect(await afterDeath.json()).toEqual({ results: [{ registrationId, status: 'dead' }] })
+
+ const listed = await harness.authorized('/v1/devices', {}, sessionToken)
+ expect(await listed.json()).toEqual({
+ devices: [{ registrationId, deviceId: 'device-1', platform: 'android', dead: true }]
+ })
+ })
+
+ it('reports an error for a registration the host does not own', async () => {
+ const ownerToken = await harness.signIn(createPushHostKeypair(19))
+ const intruderToken = await harness.signIn(createPushHostKeypair(20))
+ const registrationId = await harness.registerAndroid(ownerToken)
+
+ const foreign = await harness.post(
+ '/v1/send',
+ { v: 1, registrationIds: [registrationId, 'made-up'], notification: notification() },
+ intruderToken
+ )
+ expect(await foreign.json()).toEqual({
+ results: [
+ { registrationId, status: 'error' },
+ { registrationId: 'made-up', status: 'error' }
+ ]
+ })
+ expect(await harness.server.deliveryStore.pendingCount(registrationId)).toBe(0)
+ })
+})
diff --git a/cloud/apps/push/src/index.ts b/cloud/apps/push/src/index.ts
index d44148874c7..e9abf51c78a 100644
--- a/cloud/apps/push/src/index.ts
+++ b/cloud/apps/push/src/index.ts
@@ -1,6 +1,6 @@
import { startPushBackground } from './push-background.js'
import { loadPushConfig } from './config.js'
-import { openPushDatabase } from './push-database.js'
+import { openPushDatabase } from './database/push-database.js'
import { createPushServer } from './push-server.js'
const config = loadPushConfig()
diff --git a/cloud/apps/push/src/apns-authentication-token.ts b/cloud/apps/push/src/providers/apns/apns-authentication-token.ts
similarity index 96%
rename from cloud/apps/push/src/apns-authentication-token.ts
rename to cloud/apps/push/src/providers/apns/apns-authentication-token.ts
index 34def16e86e..751c7279f17 100644
--- a/cloud/apps/push/src/apns-authentication-token.ts
+++ b/cloud/apps/push/src/providers/apns/apns-authentication-token.ts
@@ -1,5 +1,5 @@
import { createPrivateKey, type KeyObject, sign } from 'node:crypto'
-import type { ApnsCredentials } from './config.js'
+import type { ApnsCredentials } from '../../config.js'
// Apple rejects a provider token older than an hour and throttles reissue
// under about 20 minutes, so 50 minutes is the safe rotation point.
diff --git a/cloud/apps/push/src/apns-client.ts b/cloud/apps/push/src/providers/apns/apns-client.ts
similarity index 91%
rename from cloud/apps/push/src/apns-client.ts
rename to cloud/apps/push/src/providers/apns/apns-client.ts
index 827efdfea79..e49f593b83b 100644
--- a/cloud/apps/push/src/apns-client.ts
+++ b/cloud/apps/push/src/providers/apns/apns-client.ts
@@ -1,9 +1,9 @@
-import type { ApnsEnvironment } from '@orca-cloud/push-contract'
+import type { ApnsEnvironment } from '@orca-cloud/push-contract/device-registration-messages'
import { ApnsAuthenticationToken } from './apns-authentication-token.js'
import type { ApnsTransport } from './apns-http2-transport.js'
-import type { ApnsCredentials } from './config.js'
-import type { PushDelivery } from './push-delivery-message.js'
-import type { PushProviderOutcome } from './push-provider-outcome.js'
+import type { ApnsCredentials } from '../../config.js'
+import type { PushDelivery } from '../../delivery/push-delivery-message.js'
+import type { PushProviderOutcome } from '../push-provider-outcome.js'
const APNS_HOSTS: Record = {
production: 'api.push.apple.com',
diff --git a/cloud/apps/push/src/apns-http2-transport.ts b/cloud/apps/push/src/providers/apns/apns-http2-transport.ts
similarity index 98%
rename from cloud/apps/push/src/apns-http2-transport.ts
rename to cloud/apps/push/src/providers/apns/apns-http2-transport.ts
index d6cbc9b0b13..bf37ece50b7 100644
--- a/cloud/apps/push/src/apns-http2-transport.ts
+++ b/cloud/apps/push/src/providers/apns/apns-http2-transport.ts
@@ -8,7 +8,6 @@ export type ApnsRequest = {
body: string
}
-export type { ApnsResponse }
export type ApnsTransport = (request: ApnsRequest) => Promise
// Cache APNs HTTP/2 sessions per host until socket loss; long-lived connections avoid reconnect overhead.
diff --git a/cloud/apps/push/src/apns-stream-response.test.ts b/cloud/apps/push/src/providers/apns/apns-stream-response.test.ts
similarity index 99%
rename from cloud/apps/push/src/apns-stream-response.test.ts
rename to cloud/apps/push/src/providers/apns/apns-stream-response.test.ts
index 0cf8b3554be..e8fb3ad6f6c 100644
--- a/cloud/apps/push/src/apns-stream-response.test.ts
+++ b/cloud/apps/push/src/providers/apns/apns-stream-response.test.ts
@@ -28,8 +28,6 @@ function fakeApnsStream(): FakeStream {
}
describe('apns stream response', () => {
-
-
it('rejects when the peer resets the stream without an end or an error', async () => {
const stream = fakeApnsStream()
const pending = readApnsStreamResponse(stream, 'body')
@@ -38,12 +36,4 @@ describe('apns stream response', () => {
stream.emit('close')
await expect(pending).rejects.toThrow('apns_stream_closed')
})
-
-
-
-
-
-
-
-
})
diff --git a/cloud/apps/push/src/apns-stream-response.ts b/cloud/apps/push/src/providers/apns/apns-stream-response.ts
similarity index 96%
rename from cloud/apps/push/src/apns-stream-response.ts
rename to cloud/apps/push/src/providers/apns/apns-stream-response.ts
index 8ea0c1b1a21..18f27c425c8 100644
--- a/cloud/apps/push/src/apns-stream-response.ts
+++ b/cloud/apps/push/src/providers/apns/apns-stream-response.ts
@@ -1,5 +1,5 @@
import type { EventEmitter } from 'node:events'
-import { providerRetryAfter } from './provider-retry-delay.js'
+import { providerRetryAfter } from '../provider-retry-delay.js'
import { constants } from 'node:http2'
export type ApnsResponse = { status: number; body: string; retryAfterMs?: number }
diff --git a/cloud/apps/push/src/apns-topic-recovery.test.ts b/cloud/apps/push/src/providers/apns/apns-topic-recovery.test.ts
similarity index 90%
rename from cloud/apps/push/src/apns-topic-recovery.test.ts
rename to cloud/apps/push/src/providers/apns/apns-topic-recovery.test.ts
index 583d4536b5a..2697564792c 100644
--- a/cloud/apps/push/src/apns-topic-recovery.test.ts
+++ b/cloud/apps/push/src/providers/apns/apns-topic-recovery.test.ts
@@ -1,10 +1,10 @@
import { expect, it } from 'vitest'
-import { createPushHostKeypair } from './host-challenge-answering.test-fixture.js'
+import { createPushHostKeypair } from '../../host-auth/host-challenge-answering.test-fixture.js'
import {
APNS_TOKEN,
createPushServerHarness,
notification
-} from './push-server-harness.test-fixture.js'
+} from '../../http/push-server-harness.test-fixture.js'
it('delivers again after a topic error without re-registering the phone', async () => {
const h = await createPushServerHarness()
diff --git a/cloud/apps/push/src/fcm-access-token.ts b/cloud/apps/push/src/providers/fcm/fcm-access-token.ts
similarity index 100%
rename from cloud/apps/push/src/fcm-access-token.ts
rename to cloud/apps/push/src/providers/fcm/fcm-access-token.ts
diff --git a/cloud/apps/push/src/providers/fcm/fcm-client.test.ts b/cloud/apps/push/src/providers/fcm/fcm-client.test.ts
new file mode 100644
index 00000000000..8aeeba07af6
--- /dev/null
+++ b/cloud/apps/push/src/providers/fcm/fcm-client.test.ts
@@ -0,0 +1,96 @@
+import { describe, expect, it } from 'vitest'
+import { FcmClient, type FcmRequest, type FcmResponse } from './fcm-client.js'
+import { buildPushDelivery } from '../../delivery/push-delivery-message.js'
+
+const NOW = 1_700_000_000_000
+const HOST = 'abcdefghijklmnop'
+const TOKEN = 'cQ1abcDEF_gh:APA91bZZ-zz0123456789abcdefghijklmnopqrstuvwxyz'
+
+function delivery(agentState: 'needs-input' | null = 'needs-input') {
+ return buildPushDelivery({
+ expiresAt: NOW + 300_000,
+ registrationId: 'reg-1',
+ hostFingerprint: HOST,
+ notification: {
+ notificationId: 'note-1',
+ notificationSeq: 7,
+ notificationEpoch: 'epoch-1',
+ source: 'agent-task-complete',
+ agentState,
+ title: 'Agent needs input',
+ body: 'Waiting on your answer',
+ paneKey: 'tab-b:pane-1',
+ worktreeId: 'wt-1'
+ }
+ })
+}
+
+function fakeTransport(response: FcmResponse) {
+ const requests: FcmRequest[] = []
+ return {
+ requests,
+ transport: async (request: FcmRequest): Promise => {
+ requests.push(request)
+ return response
+ }
+ }
+}
+
+function client(response: FcmResponse) {
+ const fake = fakeTransport(response)
+ return {
+ fake,
+ client: new FcmClient({
+ projectId: 'onorca-cloud',
+ now: () => NOW,
+ accessToken: async () => 'access-token',
+ transport: fake.transport
+ })
+ }
+}
+
+describe('fcm client', () => {
+ it('marks an invalid-argument that names the token dead, and others an error', async () => {
+ const named = client({
+ status: 400,
+ body: JSON.stringify({
+ error: { status: 'INVALID_ARGUMENT', message: 'The registration token is not valid.' }
+ })
+ })
+ await expect(named.client.send(delivery(), { token: TOKEN })).resolves.toEqual({
+ status: 'dead',
+ reason: 'INVALID_ARGUMENT'
+ })
+ const unnamed = client({
+ status: 400,
+ body: JSON.stringify({
+ error: { status: 'INVALID_ARGUMENT', message: 'Invalid value at message.android.ttl' }
+ })
+ })
+ await expect(unnamed.client.send(delivery(), { token: TOKEN })).resolves.toEqual({
+ status: 'error',
+ reason: 'INVALID_ARGUMENT',
+ retryable: false,
+ retryAfterMs: 10000
+ })
+ })
+})
+
+it('does not send when credential refresh crosses the absolute expiry', async () => {
+ let now = 1000
+ const fake = fakeTransport({ status: 200, body: '{}' })
+ const fcm = new FcmClient({
+ projectId: 'test',
+ now: () => now,
+ accessToken: async () => {
+ now = 3000
+ return 'test-token'
+ },
+ transport: fake.transport
+ })
+ await expect(fcm.send({ ...delivery(), expiresAt: 2000 }, { token: TOKEN })).resolves.toEqual({
+ status: 'error',
+ reason: 'expired'
+ })
+ expect(fake.requests).toHaveLength(0)
+})
diff --git a/cloud/apps/push/src/fcm-client.ts b/cloud/apps/push/src/providers/fcm/fcm-client.ts
similarity index 93%
rename from cloud/apps/push/src/fcm-client.ts
rename to cloud/apps/push/src/providers/fcm/fcm-client.ts
index 0b58aae80f5..66ef292bd18 100644
--- a/cloud/apps/push/src/fcm-client.ts
+++ b/cloud/apps/push/src/providers/fcm/fcm-client.ts
@@ -1,7 +1,7 @@
-import { providerRetryAfter } from './provider-retry-delay.js'
-import { PUSH_DEFAULTS } from '@orca-cloud/push-contract'
-import { orcaDataStrings, type PushDelivery } from './push-delivery-message.js'
-import type { PushProviderOutcome } from './push-provider-outcome.js'
+import { providerRetryAfter } from '../provider-retry-delay.js'
+import { PUSH_DEFAULTS } from '@orca-cloud/push-contract/push-limits'
+import { orcaDataStrings, type PushDelivery } from '../../delivery/push-delivery-message.js'
+import type { PushProviderOutcome } from '../push-provider-outcome.js'
export const FCM_SCOPE = 'https://www.googleapis.com/auth/firebase.messaging'
diff --git a/cloud/apps/push/src/provider-retry-delay.ts b/cloud/apps/push/src/providers/provider-retry-delay.ts
similarity index 100%
rename from cloud/apps/push/src/provider-retry-delay.ts
rename to cloud/apps/push/src/providers/provider-retry-delay.ts
diff --git a/cloud/apps/push/src/push-provider-outcome.ts b/cloud/apps/push/src/providers/push-provider-outcome.ts
similarity index 100%
rename from cloud/apps/push/src/push-provider-outcome.ts
rename to cloud/apps/push/src/providers/push-provider-outcome.ts
diff --git a/cloud/apps/push/src/push-background.ts b/cloud/apps/push/src/push-background.ts
index 25b98d0d467..fec2f121117 100644
--- a/cloud/apps/push/src/push-background.ts
+++ b/cloud/apps/push/src/push-background.ts
@@ -1,5 +1,5 @@
import type { PushConfig } from './config.js'
-import type { PushPruneSweep } from './durable-push-store.js'
+import type { PushPruneSweep } from './delivery/durable-push-store.js'
import type { createPushServer } from './push-server.js'
const CHALLENGE_PRUNE_INTERVAL_MS = 60_000
@@ -45,9 +45,10 @@ function prune(label: string, run: () => Promise, intervalMs: nu
}
// One DELETE under a statement timeout: there is no batch budget for it to exhaust.
-const unbatchedSweep =
- (run: () => Promise) =>
- async (): Promise => ({ deleted: await run(), saturated: false })
+const unbatchedSweep = (run: () => Promise) => async (): Promise => ({
+ deleted: await run(),
+ saturated: false
+})
export function startPushBackground(
config: Pick,
diff --git a/cloud/apps/push/src/push-database-postgres-startup.test.ts b/cloud/apps/push/src/push-database-postgres-startup.test.ts
deleted file mode 100644
index 08be1dad766..00000000000
--- a/cloud/apps/push/src/push-database-postgres-startup.test.ts
+++ /dev/null
@@ -1,101 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { randomUUID } from 'node:crypto'
-
-const fakes = vi.hoisted(() => ({
- configs: [] as Array>,
- lifecycle: [] as string[],
- query: vi.fn(async (_sql: string) => ({ rows: [], rowCount: 0 })),
- release: vi.fn()
-}))
-
-vi.mock('pg', () => ({
- default: {
- Pool: class {
- on = vi.fn()
- connect = vi.fn(async () => ({ query: fakes.query, release: fakes.release }))
- private readonly label: string
-
- constructor(config: Record) {
- fakes.configs.push(config)
- this.label = `max=${String(config.max)} statement_timeout=${String(config.statement_timeout)}`
- fakes.lifecycle.push(`open ${this.label}`)
- }
-
- async end(): Promise {
- fakes.lifecycle.push(`end ${this.label}`)
- }
- }
- }
-}))
-
-import { openPushDatabase } from './push-database.js'
-import { pushSchemaStatements } from './push-schema.js'
-
-describe('PostgreSQL push gateway startup', () => {
- beforeEach(() => {
- fakes.configs.length = 0
- fakes.lifecycle.length = 0
- fakes.query.mockClear()
- })
-
- afterEach(() => {
- vi.restoreAllMocks()
- })
-
- const socketPassword = `${randomUUID()}@/`
- const socketUrl = `postgresql://push:${encodeURIComponent(socketPassword)}@/orca_push?host=/cloudsql/test:region:instance`
-
- it('passes the Terraform socket URL unchanged to both active pools', async () => {
- const database = await openPushDatabase({ databaseUrl: socketUrl, dataDir: '/unused' })
- expect(fakes.configs.map((config) => config.connectionString)).toEqual([socketUrl, socketUrl])
- await database.close()
- })
-
- it('parses socket credentials and query options before enforcing validation read-only', async () => {
- const options = '-c search_path=validation -c default_transaction_read_only=off'
- const database = await openPushDatabase({
- databaseUrl: `${socketUrl}&port=5433&sslmode=disable&options=${encodeURIComponent(options)}`,
- dataDir: '/unused',
- readOnly: true
- })
- expect(fakes.configs).toHaveLength(1)
- expect(fakes.configs[0]).toMatchObject({
- host: '/cloudsql/test:region:instance',
- user: 'push',
- password: socketPassword,
- database: 'orca_push',
- port: 5433,
- ssl: false,
- options: `${options} -c default_transaction_read_only=on`
- })
- expect(fakes.configs[0]).not.toHaveProperty('connectionString')
- expect(fakes.query).not.toHaveBeenCalled()
- await database.close()
- })
-
- // Growing-table CREATE INDEX can exceed request deadlines; inheriting them makes startup fail forever at the same DDL.
- it('applies the schema on an untimed pool that is gone before the serving pool opens', async () => {
- const database = await openPushDatabase({
- databaseUrl: 'postgresql://push@localhost:55440/orca_push',
- dataDir: '/unused',
- poolMax: 2,
- applicationName: 'orca-push'
- })
- expect(fakes.lifecycle).toEqual([
- 'open max=1 statement_timeout=0',
- 'end max=1 statement_timeout=0',
- 'open max=2 statement_timeout=5000'
- ])
- expect(fakes.configs[0]).toMatchObject({
- application_name: 'orca-push/schema',
- lock_timeout: 1_000,
- idle_in_transaction_session_timeout: 5_000
- })
- expect(
- fakes.query.mock.calls.map(([sql]) => sql).slice(0, pushSchemaStatements().length)
- ).toEqual(pushSchemaStatements())
- await database.close()
- })
-
-
-})
diff --git a/cloud/apps/push/src/push-database.ts b/cloud/apps/push/src/push-database.ts
deleted file mode 100644
index 0684d1a3f66..00000000000
--- a/cloud/apps/push/src/push-database.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import {
- openCloudDatabase,
- openInMemoryCloudDatabase,
- type CloudDatabase,
- type OpenCloudDatabaseInput
-} from '@orca-cloud/cloud-database'
-import { pushSchemaStatements } from './push-schema.js'
-
-export type { CloudDatabase as PushDatabase, SqlRow } from '@orca-cloud/cloud-database'
-
-export async function openPushDatabase(
- input: Omit
-): Promise {
- return await openCloudDatabase({ ...input, service: 'push', schemaStatements: pushSchemaStatements() })
-}
-
-export async function openInMemoryPushDatabase(): Promise {
- return await openInMemoryCloudDatabase(pushSchemaStatements())
-}
diff --git a/cloud/apps/push/src/push-delivery-lifecycle.test.ts b/cloud/apps/push/src/push-delivery-lifecycle.test.ts
index c94108e459c..ef845cc0811 100644
--- a/cloud/apps/push/src/push-delivery-lifecycle.test.ts
+++ b/cloud/apps/push/src/push-delivery-lifecycle.test.ts
@@ -1,12 +1,13 @@
import { afterEach, expect, it, vi } from 'vitest'
import { Hono } from 'hono'
-import { PushRequestDrain } from './push-request-drain.js'
-import { PushDispatcher } from './push-dispatcher.js'
-import { PushDeviceRegistryStore } from './device-registry-store.js'
-import { openInMemoryPushDatabase, type PushDatabase } from './push-database.js'
-import { buildPushDelivery } from './push-delivery-message.js'
-import { PushNotificationSchema } from '@orca-cloud/push-contract'
-import { notification } from './push-server-harness.test-fixture.js'
+import { PushRequestDrain } from './http/push-request-drain.js'
+import { PushDispatcher } from './delivery/push-dispatcher.js'
+import { PushDeviceRegistryStore } from './devices/device-registry-store.js'
+import { openInMemoryPushDatabase } from './database/push-database.js'
+import type { CloudDatabase as PushDatabase } from '@orca-cloud/cloud-database/cloud-database'
+import { buildPushDelivery } from './delivery/push-delivery-message.js'
+import { PushNotificationSchema } from '@orca-cloud/push-contract/send-messages'
+import { notification } from './http/push-server-harness.test-fixture.js'
const databases: PushDatabase[] = []
afterEach(async () => {
diff --git a/cloud/apps/push/src/push-dismissal-provider.test.ts b/cloud/apps/push/src/push-dismissal-provider.test.ts
deleted file mode 100644
index 65572e8401c..00000000000
--- a/cloud/apps/push/src/push-dismissal-provider.test.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-import { expect, it } from 'vitest'
-import { apnsBody } from './apns-client.js'
-import { fcmMessageBody } from './fcm-client.js'
-import { buildPushDelivery } from './push-delivery-message.js'
-
-it('dismissal provider payloads cannot display a new alert or play a sound', () => {
- const delivery = buildPushDelivery({
- expiresAt: Date.now() + 300_000,
- registrationId: 'reg',
- hostFingerprint: 'host',
- notification: {
- kind: 'dismiss',
- notificationId: 'note',
- notificationSeq: 2,
- notificationEpoch: 'epoch',
- source: 'agent-task-complete',
- agentState: null,
- title: 'Orca',
- body: ''
- }
- })
- expect(JSON.parse(apnsBody(delivery)).aps).toEqual({ 'content-available': 1 })
- const android = JSON.parse(fcmMessageBody({ delivery, token: 'test', channelId: 'test' })).message
- expect(android).not.toHaveProperty('notification')
- expect(android.android).not.toHaveProperty('notification')
- expect(android.android).not.toHaveProperty('collapse_key')
- expect(android.data).not.toHaveProperty('title')
- expect(android.data).not.toHaveProperty('message')
- expect(android.data).not.toHaveProperty('sound')
- expect(android.data.kind).toBe('dismiss')
-})
diff --git a/cloud/apps/push/src/push-notification-sound.test.ts b/cloud/apps/push/src/push-notification-sound.test.ts
deleted file mode 100644
index ede4dcd3291..00000000000
--- a/cloud/apps/push/src/push-notification-sound.test.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import { expect, it } from 'vitest'
-import { apnsBody } from './apns-client.js'
-import { fcmMessageBody } from './fcm-client.js'
-import { buildPushDelivery } from './push-delivery-message.js'
-import { PushNotificationSchema } from '@orca-cloud/push-contract'
-
-it('carries a silent preference through validation to APNs and Android payloads', () => {
- const notification = PushNotificationSchema.parse({
- notificationSeq: 1,
- notificationEpoch: 'epoch',
- source: 'terminal-bell',
- agentState: null,
- title: 'Bell',
- body: '',
- sound: false
- })
- const delivery = buildPushDelivery({
- expiresAt: Date.now() + 300_000,
- registrationId: 'reg',
- hostFingerprint: 'host',
- notification
- })
- expect(JSON.parse(apnsBody(delivery)).aps).not.toHaveProperty('sound')
- expect(
- JSON.parse(fcmMessageBody({ delivery, token: 'test-token', channelId: 'orca-desktop' })).message
- .data.channelId
- ).toBe('orca-desktop-silent')
- expect(
- JSON.parse(fcmMessageBody({ delivery, token: 'test-token', channelId: 'orca-desktop' })).message
- .data.sound
- ).toBe('')
- expect(JSON.parse(apnsBody({ ...delivery, sound: undefined })).aps.sound).toBe('default')
-})
diff --git a/cloud/apps/push/src/push-schema-boot-lock.test.ts b/cloud/apps/push/src/push-schema-boot-lock.test.ts
deleted file mode 100644
index 1c08fab56d1..00000000000
--- a/cloud/apps/push/src/push-schema-boot-lock.test.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import { randomUUID } from 'node:crypto'
-import pg from 'pg'
-import { afterEach, expect, it, vi } from 'vitest'
-import { openPushDatabase } from './push-database.js'
-import { durablePushTestDatabaseUrl } from './durable-push-store.test-fixture.js'
-
-const QUEUE_INDEXES = ['push_batches_pending_device']
-const cleanups: (() => Promise)[] = []
-afterEach(async () => {
- vi.restoreAllMocks()
- for (const cleanup of cleanups.splice(0).reverse()) await cleanup()
-})
-
-// Push applies its schema with retryLockTimeout, so a lock timeout is retried, never deferred:
-// the new revision either boots with every index or does not boot at all.
-it.skipIf(!durablePushTestDatabaseUrl)(
- 'creates the queue index after waiting out a writer that holds the table',
- async () => {
- const admin = new pg.Client({ connectionString: durablePushTestDatabaseUrl })
- await admin.connect()
- const schema = `boot_${randomUUID().replaceAll('-', '')}`
- cleanups.push(async () => {
- await admin.query(`DROP SCHEMA IF EXISTS ${schema} CASCADE`)
- await admin.end()
- })
- await admin.query(`CREATE SCHEMA ${schema}`)
- const url = new URL(durablePushTestDatabaseUrl!)
- url.searchParams.set('options', `-c search_path=${schema}`)
- await (await openPushDatabase({ databaseUrl: url.toString(), dataDir: '' })).close()
- await admin.query(
- `DROP INDEX ${QUEUE_INDEXES.map((name) => `${schema}.${name}`).join(', ')}`
- )
-
- const writer = new pg.Client({ connectionString: url.toString() })
- await writer.connect()
- cleanups.push(() => writer.end())
- await writer.query('BEGIN')
- await writer.query('LOCK TABLE push_delivery_batches IN ROW EXCLUSIVE MODE')
- const warnings: string[] = []
- vi.spyOn(console, 'warn').mockImplementation((line: string) => warnings.push(line))
- vi.spyOn(console, 'log').mockImplementation(() => undefined)
- const held = setTimeout(() => void writer.query('COMMIT'), 2_500)
- cleanups.push(async () => clearTimeout(held))
-
- const booted = await openPushDatabase({ databaseUrl: url.toString(), dataDir: '' })
- await booted.close()
- const { rows } = await admin.query(
- 'SELECT indexname FROM pg_indexes WHERE schemaname = $1 AND indexname = ANY($2) ORDER BY 1',
- [schema, QUEUE_INDEXES]
- )
- expect(rows.map((row) => row.indexname)).toEqual(QUEUE_INDEXES)
- const events = warnings.map((line) => JSON.parse(line).event)
- expect(events).toContain('orca_push_postgres_schema_retry')
- expect(events).not.toContain('orca_push_postgres_schema_object_deferred')
- }
-)
diff --git a/cloud/apps/push/src/push-send-idempotency.test.ts b/cloud/apps/push/src/push-send-idempotency.test.ts
deleted file mode 100644
index 1a687a35449..00000000000
--- a/cloud/apps/push/src/push-send-idempotency.test.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-import { afterEach, expect, it } from 'vitest'
-import { createPushServerHarness, notification } from './push-server-harness.test-fixture.js'
-import { createPushHostKeypair } from './host-challenge-answering.test-fixture.js'
-const harnesses: Awaited>[] = []
-afterEach(async () => {
- await Promise.all(harnesses.splice(0).map((h) => h.close()))
-})
-
-it('returns queued for concurrent retries without double quota or delivery', async () => {
- const h = await createPushServerHarness()
- harnesses.push(h)
- const token = await h.signIn(createPushHostKeypair(2))
- const registrationId = await h.registerAndroid(token)
- const body = { v: 1, registrationIds: [registrationId], notification: notification() }
- const responses = await Promise.all(
- Array.from({ length: 10 }, () => h.post('/v1/send', body, token))
- )
- for (const response of responses)
- expect(await response.json()).toEqual({ results: [{ registrationId, status: 'queued' }] })
- expect(await h.server.deliveryStore.pendingCount(registrationId)).toBe(1)
- await h.flushDeliveries()
- await h.post('/v1/send', body, token)
- await h.flushDeliveries()
- expect(h.fcmRequests).toHaveLength(1)
- expect(JSON.parse(h.fcmRequests[0]!.body).message.data.coalescedCount).toBeUndefined()
- expect(
- Number((await h.database.query('SELECT COUNT(*) AS count FROM push_events'))[0]?.count)
- ).toBe(1)
- await h.post(
- '/v1/send',
- { ...body, notification: notification({ notificationEpoch: 'new-epoch' }) },
- token
- )
- await h.flushDeliveries()
- expect(h.fcmRequests).toHaveLength(2)
-})
-
-it.each([false, true])(
- 'accepts default alert kind equivalently through the API (explicit first: %s)',
- async (explicitFirst) => {
- const h = await createPushServerHarness()
- harnesses.push(h)
- const token = await h.signIn(createPushHostKeypair(3))
- const registrationId = await h.registerAndroid(token)
- const implicit = notification()
- const explicit = { kind: 'alert', ...implicit }
- for (const event of explicitFirst ? [explicit, implicit] : [implicit, explicit]) {
- const response = await h.post(
- '/v1/send',
- { v: 1, registrationIds: [registrationId], notification: event },
- token
- )
- expect(await response.json()).toEqual({ results: [{ registrationId, status: 'queued' }] })
- }
- await h.flushDeliveries()
- expect(h.fcmRequests).toHaveLength(1)
- const changed = await h.post(
- '/v1/send',
- { v: 1, registrationIds: [registrationId], notification: { ...explicit, body: 'changed' } },
- token
- )
- expect(await changed.json()).toEqual({ results: [{ registrationId, status: 'error' }] })
- }
-)
diff --git a/cloud/apps/push/src/push-server-auth.test.ts b/cloud/apps/push/src/push-server-auth.test.ts
deleted file mode 100644
index 50ad8add4f9..00000000000
--- a/cloud/apps/push/src/push-server-auth.test.ts
+++ /dev/null
@@ -1,120 +0,0 @@
-import { PUSH_LIMITS } from '@orca-cloud/push-contract'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { createPushHostKeypair } from './host-challenge-answering.test-fixture.js'
-import type { PushDatabase } from './push-database.js'
-import { createPushServer } from './push-server.js'
-import { createPushServerHarness, testPushConfig } from './push-server-harness.test-fixture.js'
-
-describe('push gateway authentication and device routes', () => {
- let harness: Awaited>
-
- beforeEach(async () => {
- harness = await createPushServerHarness()
- })
-
- afterEach(async () => {
- await harness.close()
- })
-
- it('reports not ready when the database is unreachable', async () => {
- const unreachable: PushDatabase = {
- dialect: 'sqlite',
- query: async () => {
- throw new Error('no connection')
- },
- transaction: async (operation) => await operation(unreachable),
- lockQuotaScope: async () => undefined,
- tryLockScope: async () => true,
- tryLockSharedScope: async () => true,
- close: async () => undefined
- }
- const broken = createPushServer(testPushConfig(), unreachable, {
- fcmAccessToken: async () => 'token',
- fcmTransport: async () => ({ status: 200, body: '{}' })
- })
- expect((await broken.app.request('/health')).status).toBe(200)
- expect((await broken.app.request('/ready')).status).toBe(503)
- await broken.worker.stop()
- })
-
- it('completes challenge, session, register, list, delete', async () => {
- const sessionToken = await harness.signIn(createPushHostKeypair(11))
- const registrationId = await harness.registerAndroid(sessionToken)
-
- const list = await harness.authorized('/v1/devices', {}, sessionToken)
- expect(await list.json()).toEqual({
- devices: [{ registrationId, deviceId: 'device-1', platform: 'android', dead: false }]
- })
-
- const deleted = await harness.authorized(
- `/v1/devices/${registrationId}`,
- { method: 'DELETE' },
- sessionToken
- )
- expect(deleted.status).toBe(204)
- expect(await harness.server.devices.findById(registrationId)).toBeNull()
- })
-
- it('refuses a request with no bearer, a bogus bearer, and an expired session', async () => {
- const sessionToken = await harness.signIn(createPushHostKeypair(12))
- expect((await harness.server.app.request('/v1/devices')).status).toBe(401)
- const bogus = await harness.authorized('/v1/devices', {}, 'nonsense')
- expect(bogus.status).toBe(401)
- expect(await bogus.json()).toEqual({ error: 'invalid_token' })
-
- harness.advanceClock(PUSH_LIMITS.sessionTtlMs + 1)
- const expired = await harness.authorized('/v1/devices', {}, sessionToken)
- expect(expired.status).toBe(401)
- expect(await expired.json()).toEqual({ error: 'session_expired' })
- })
-
- it('never returns the host fingerprint on the challenge itself', async () => {
- const challenge = await harness.issueChallenge(createPushHostKeypair(22))
- expect(challenge).not.toHaveProperty('hostFingerprint')
- })
-
- it('lets only the owning host delete a registration', async () => {
- const ownerToken = await harness.signIn(createPushHostKeypair(14))
- const intruderToken = await harness.signIn(createPushHostKeypair(15))
- const registrationId = await harness.registerAndroid(ownerToken)
-
- const forbidden = await harness.authorized(
- `/v1/devices/${registrationId}`,
- { method: 'DELETE' },
- intruderToken
- )
- expect(forbidden.status).toBe(404)
- expect(await forbidden.json()).toEqual({ error: 'not_found' })
- expect(await harness.server.devices.findById(registrationId)).not.toBeNull()
- })
-
- it('replaces the token on a re-registration and keeps one registration id', async () => {
- const sessionToken = await harness.signIn(createPushHostKeypair(23))
- const first = await harness.registerAndroid(sessionToken)
- const again = await harness.post(
- '/v1/devices',
- {
- v: 1,
- deviceId: 'device-1',
- platform: 'android',
- token: 'rotated_token:APA91b-newnewnewnewnewnewnewnewnewnew'
- },
- sessionToken
- )
- expect(await again.json()).toEqual({ registrationId: first })
- expect(await harness.server.devices.findById(first)).toMatchObject({
- token: 'rotated_token:APA91b-newnewnewnewnewnewnewnewnewnew'
- })
- })
-
- it('rejects a malformed registration body', async () => {
- const sessionToken = await harness.signIn(createPushHostKeypair(16))
- const bad = await harness.post(
- '/v1/devices',
- { v: 1, deviceId: 'device-1', platform: 'ios', token: 'not-hex' },
- sessionToken
- )
- expect(bad.status).toBe(400)
- expect(await bad.json()).toEqual({ error: 'invalid_request' })
- })
-})
diff --git a/cloud/apps/push/src/push-server-limits.test.ts b/cloud/apps/push/src/push-server-limits.test.ts
deleted file mode 100644
index a46384d0d3c..00000000000
--- a/cloud/apps/push/src/push-server-limits.test.ts
+++ /dev/null
@@ -1,263 +0,0 @@
-import { PUSH_LIMITS } from '@orca-cloud/push-contract'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { createPushHostKeypair, hostPublicKeyB64 } from './host-challenge-answering.test-fixture.js'
-import {
- createPushServerHarness,
- FCM_TOKEN,
- notification
-} from './push-server-harness.test-fixture.js'
-
-const CLIENT_IP = '203.0.113.7'
-const OTHER_CLIENT_IP = '198.51.100.9'
-
-function oversizedChallengeBody(): string {
- return JSON.stringify({ v: 1, filler: 'x'.repeat(PUSH_LIMITS.maxHttpBodyBytes) })
-}
-
-function chunkedRequest(path: string, body: string): Request {
- const stream = new ReadableStream({
- start(controller) {
- controller.enqueue(new TextEncoder().encode(body))
- controller.close()
- }
- })
- return new Request(`http://push.test${path}`, {
- method: 'POST',
- headers: { 'content-type': 'application/json' },
- body: stream,
- duplex: 'half'
- } as RequestInit)
-}
-
-describe('push gateway request limits', () => {
- let harness: Awaited>
-
- beforeEach(async () => {
- harness = await createPushServerHarness()
- })
-
- afterEach(async () => {
- await harness.close()
- })
-
- it('refuses an oversized chunked body that declares no content length', async () => {
- const request = chunkedRequest('/v1/host/challenge', oversizedChallengeBody())
- expect(request.headers.get('content-length')).toBeNull()
-
- const response = await harness.server.app.request(request)
- expect(response.status).toBe(413)
- expect(await response.json()).toEqual({ error: 'request_too_large' })
- })
-
- it('still refuses an oversized body that declares a content length', async () => {
- const body = oversizedChallengeBody()
- const response = await harness.server.app.request('/v1/host/challenge', {
- method: 'POST',
- headers: {
- 'content-type': 'application/json',
- 'content-length': String(Buffer.byteLength(body))
- },
- body
- })
- expect(response.status).toBe(413)
- expect(await response.json()).toEqual({ error: 'request_too_large' })
- })
-
- it('caps an authenticated oversized send as well', async () => {
- const sessionToken = await harness.signIn(createPushHostKeypair(61))
- const response = await harness.server.app.request(
- new Request('http://push.test/v1/send', {
- method: 'POST',
- headers: {
- 'content-type': 'application/json',
- authorization: `Bearer ${sessionToken}`
- },
- body: new ReadableStream({
- start(controller) {
- controller.enqueue(new TextEncoder().encode(oversizedChallengeBody()))
- controller.close()
- }
- }),
- duplex: 'half'
- } as RequestInit)
- )
- expect(response.status).toBe(413)
- expect(await response.json()).toEqual({ error: 'request_too_large' })
- })
-
- it('rate limits one client ip across both unauthenticated routes', async () => {
- const body = JSON.stringify({
- v: 1,
- hostPublicKeyB64: hostPublicKeyB64(createPushHostKeypair(62))
- })
- // Cloud Run appends the peer, so the caller's own IP is the last value.
- const headers = {
- 'content-type': 'application/json',
- 'x-forwarded-for': `10.0.0.1, ${CLIENT_IP}`
- }
- for (let index = 0; index < PUSH_LIMITS.unauthenticatedRequestsPerMinutePerIp; index++) {
- const allowed = await harness.server.app.request('/v1/host/challenge', {
- method: 'POST',
- headers,
- body
- })
- expect(allowed.status).toBe(200)
- }
-
- const limited = await harness.server.app.request('/v1/host/challenge', {
- method: 'POST',
- headers,
- body
- })
- expect(limited.status).toBe(429)
- expect(await limited.json()).toEqual({ error: 'rate_limited' })
-
- // The session route draws on the same bucket, so a flood cannot simply move.
- const session = await harness.server.app.request('/v1/host/session', {
- method: 'POST',
- headers,
- body: JSON.stringify({ v: 1, challengeId: 'anything', proofB64: 'x'.repeat(44) })
- })
- expect(session.status).toBe(429)
-
- const other = await harness.server.app.request('/v1/host/challenge', {
- method: 'POST',
- headers: { ...headers, 'x-forwarded-for': `10.0.0.1, ${OTHER_CLIENT_IP}` },
- body
- })
- expect(other.status).toBe(200)
-
- // A caller rewriting the left of the chain lands in its own bucket anyway.
- const spoofed = await harness.server.app.request('/v1/host/challenge', {
- method: 'POST',
- headers: { ...headers, 'x-forwarded-for': `198.51.100.250, ${CLIENT_IP}` },
- body
- })
- expect(spoofed.status).toBe(429)
- })
-
- it('lets a throttled client back in once the window refills', async () => {
- const body = JSON.stringify({
- v: 1,
- hostPublicKeyB64: hostPublicKeyB64(createPushHostKeypair(63))
- })
- const headers = { 'content-type': 'application/json', 'x-forwarded-for': CLIENT_IP }
- for (let index = 0; index < PUSH_LIMITS.unauthenticatedRequestsPerMinutePerIp; index++) {
- await harness.server.app.request('/v1/host/challenge', { method: 'POST', headers, body })
- }
- expect(
- (await harness.server.app.request('/v1/host/challenge', { method: 'POST', headers, body }))
- .status
- ).toBe(429)
-
- harness.advanceClock(60_000)
- expect(
- (await harness.server.app.request('/v1/host/challenge', { method: 'POST', headers, body }))
- .status
- ).toBe(200)
- })
-
- it('limits authenticated hosts independently behind the same IP', async () => {
- const sessionToken = await harness.signIn(createPushHostKeypair(64))
- const headers = { 'x-forwarded-for': CLIENT_IP }
- for (let index = 0; index < 600; index++) {
- const listed = await harness.authorized('/v1/devices', { headers }, sessionToken)
- expect(listed.status).toBe(200)
- }
- const limited = await harness.authorized('/v1/devices', { headers }, sessionToken)
- expect(limited.status).toBe(429)
- const otherToken = await harness.signIn(createPushHostKeypair(68))
- expect((await harness.authorized('/v1/devices', { headers }, otherToken)).status).toBe(200)
- // The handshake bucket is untouched by any of that.
- const challenge = await harness.server.app.request('/v1/host/challenge', {
- method: 'POST',
- headers: { ...headers, 'content-type': 'application/json' },
- body: JSON.stringify({ v: 1, hostPublicKeyB64: hostPublicKeyB64(createPushHostKeypair(67)) })
- })
- expect(challenge.status).toBe(200)
- })
-
- it('stops repeated forged bearers after the invalid-auth budget is exhausted', async () => {
- const headers = { 'x-forwarded-for': CLIENT_IP }
- const [before] = await harness.database.query('SELECT COUNT(*) AS sessions FROM push_sessions')
- for (let index = 0; index < PUSH_LIMITS.unauthenticatedRequestsPerMinutePerIp; index++) {
- const refused = await harness.authorized('/v1/send', { method: 'POST', headers }, 'forged')
- expect(refused.status).toBe(401)
- }
- const limited = await harness.authorized('/v1/send', { method: 'POST', headers }, 'forged')
- expect(limited.status).toBe(429)
- expect(await limited.json()).toEqual({ error: 'rate_limited' })
- expect(harness.server.unauthenticatedIps.trackedIpCount()).toBe(0)
- const [after] = await harness.database.query('SELECT COUNT(*) AS sessions FROM push_sessions')
- expect(Number(after?.sessions)).toBe(Number(before?.sessions))
- })
-
- it('answers 409 once a host has registered its device allowance', async () => {
- const sessionToken = await harness.signIn(createPushHostKeypair(66))
- for (let index = 0; index < PUSH_LIMITS.maxDevicesPerHost; index++) {
- const accepted = await harness.post(
- '/v1/devices',
- {
- v: 1,
- deviceId: `device-${index}`,
- platform: 'android',
- token: FCM_TOKEN
- },
- sessionToken
- )
- expect(accepted.status).toBe(200)
- }
-
- const refused = await harness.post(
- '/v1/devices',
- { v: 1, deviceId: 'one-too-many', platform: 'android', token: FCM_TOKEN },
- sessionToken
- )
- expect(refused.status).toBe(409)
- expect(await refused.json()).toEqual({ error: 'too_many_devices' })
-
- const listed = await harness.authorized('/v1/devices', {}, sessionToken)
- expect(((await listed.json()) as { devices: unknown[] }).devices).toHaveLength(
- PUSH_LIMITS.maxDevicesPerHost
- )
- })
-
- // Why: a database error carries the failing row in its message. The response
- // and the log must both stop at the error's name.
- it('answers an unexpected route failure with a bare 500 and logs only the name', async () => {
- const sessionToken = await harness.signIn(createPushHostKeypair(66))
- const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
- try {
- await harness.database.close()
- const response = await harness.authorized('/v1/devices', {}, sessionToken)
- expect(response.status).toBe(500)
- expect(await response.json()).toEqual({ error: 'internal' })
- const logged = warn.mock.calls.map((call) => String(call[0])).join('\n')
- expect(logged).toContain('"event":"orca_push_request_failed"')
- expect(logged).not.toContain('SELECT')
- expect(logged).not.toContain('push_devices')
- expect(harness.server.observability.consume().request_error).toBe(1)
- } finally {
- warn.mockRestore()
- }
- })
-
- it('charges a repeated registration id once and returns one result', async () => {
- const sessionToken = await harness.signIn(createPushHostKeypair(65))
- const registrationId = await harness.registerAndroid(sessionToken)
-
- const response = await harness.post(
- '/v1/send',
- {
- v: 1,
- registrationIds: [registrationId, registrationId, registrationId],
- notification: notification()
- },
- sessionToken
- )
- expect(await response.json()).toEqual({ results: [{ registrationId, status: 'queued' }] })
- expect(await harness.server.deliveryStore.pendingCount(registrationId)).toBe(1)
- const [row] = await harness.database.query('SELECT COUNT(*) AS sends FROM push_events')
- expect(Number(row?.sends)).toBe(1)
- })
-})
diff --git a/cloud/apps/push/src/push-server-send.test.ts b/cloud/apps/push/src/push-server-send.test.ts
deleted file mode 100644
index 9536bed841e..00000000000
--- a/cloud/apps/push/src/push-server-send.test.ts
+++ /dev/null
@@ -1,216 +0,0 @@
-import { PushNotificationSchema } from '@orca-cloud/push-contract'
-import { PUSH_LIMITS } from '@orca-cloud/push-contract'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { createPushHostKeypair } from './host-challenge-answering.test-fixture.js'
-import {
- APNS_TOKEN,
- createPushServerHarness,
- FCM_TOKEN,
- notification
-} from './push-server-harness.test-fixture.js'
-
-describe('push gateway send route', () => {
- let harness: Awaited>
-
- beforeEach(async () => {
- harness = await createPushServerHarness()
- })
-
- afterEach(async () => {
- await harness.close()
- })
-
- it('rejects a batch over the registration cap', async () => {
- const sessionToken = await harness.signIn(createPushHostKeypair(16))
- const oversized = await harness.post(
- '/v1/send',
- {
- v: 1,
- registrationIds: Array.from(
- { length: PUSH_LIMITS.maxRegistrationIdsPerSend + 1 },
- (_, index) => `reg-${index}`
- ),
- notification: notification()
- },
- sessionToken
- )
- expect(oversized.status).toBe(400)
- expect(await oversized.json()).toEqual({ error: 'invalid_request' })
- })
-
- it('queues a send, delivers it to fcm, and reports a dead token on the next send', async () => {
- const sessionToken = await harness.signIn(createPushHostKeypair(17))
- const registrationId = await harness.registerAndroid(sessionToken)
-
- const queued = await harness.post(
- '/v1/send',
- { v: 1, registrationIds: [registrationId], notification: notification() },
- sessionToken
- )
- expect(await queued.json()).toEqual({ results: [{ registrationId, status: 'queued' }] })
-
- harness.setFcmResponse({
- status: 404,
- body: JSON.stringify({ error: { status: 'UNREGISTERED', message: 'gone' } })
- })
- await harness.flushDeliveries()
- expect(harness.fcmRequests).toHaveLength(1)
- expect(JSON.parse(harness.fcmRequests[0]!.body)).toMatchObject({
- message: {
- token: FCM_TOKEN,
- data: { title: 'Agent needs input', tag: expect.stringMatching(/^[a-f0-9]{64}$/) }
- }
- })
-
- const afterDeath = await harness.post(
- '/v1/send',
- { v: 1, registrationIds: [registrationId], notification: notification() },
- sessionToken
- )
- expect(await afterDeath.json()).toEqual({ results: [{ registrationId, status: 'dead' }] })
-
- const listed = await harness.authorized('/v1/devices', {}, sessionToken)
- expect(await listed.json()).toEqual({
- devices: [{ registrationId, deviceId: 'device-1', platform: 'android', dead: true }]
- })
- })
-
- it('leaves a live registration alone when the provider reports a transient failure', async () => {
- const sessionToken = await harness.signIn(createPushHostKeypair(24))
- const registrationId = await harness.registerAndroid(sessionToken)
- await harness.post(
- '/v1/send',
- { v: 1, registrationIds: [registrationId], notification: notification() },
- sessionToken
- )
- harness.setFcmResponse({
- status: 503,
- body: JSON.stringify({ error: { status: 'UNAVAILABLE', message: 'backend busy' } })
- })
- await harness.flushDeliveries()
- expect(await harness.server.devices.findById(registrationId)).toMatchObject({ dead: false })
- })
-
- it('reports retries from the durable worker after the provider delay', async () => {
- const token = await harness.signIn(createPushHostKeypair(26))
- const registrationId = await harness.registerAndroid(token)
- await harness.post(
- '/v1/send',
- {
- v: 1,
- registrationIds: [registrationId],
- notification: notification()
- },
- token
- )
- harness.setFcmResponse({ status: 503, body: '{}' })
- await harness.flushDeliveries()
- expect(harness.server.observability.consume()).toMatchObject({
- delivery_error: 1,
- delivery_retry: 0
- })
- harness.advanceClock(10_000)
- harness.setFcmResponse({ status: 200, body: '{}' })
- await harness.server.worker.runDue()
- expect(harness.server.observability.consume()).toMatchObject({
- delivery_sent: 1,
- delivery_retry: 1
- })
- })
-
- it('sends a burst as individual APNs alerts grouped by the host thread', async () => {
- const sessionToken = await harness.signIn(createPushHostKeypair(18))
- const registration = await harness.post(
- '/v1/devices',
- {
- v: 1,
- deviceId: 'iphone-1',
- platform: 'ios',
- token: APNS_TOKEN,
- apnsEnvironment: 'sandbox'
- },
- sessionToken
- )
- const { registrationId } = (await registration.json()) as { registrationId: string }
- for (const seq of [1, 2, 3]) {
- await harness.post(
- '/v1/send',
- {
- v: 1,
- registrationIds: [registrationId],
- notification: notification({ notificationId: `note-${seq}`, notificationSeq: seq })
- },
- sessionToken
- )
- }
- await harness.flushDeliveries()
- expect(harness.apnsRequests).toHaveLength(3)
- const bodies = harness.apnsRequests.map(
- (request) =>
- JSON.parse(request.body) as {
- aps: { alert: { title: string; body: string }; 'thread-id': string }
- orca: Record & { notificationSeq: number }
- }
- )
- expect(
- harness.apnsRequests.every((request) => request.host === 'api.sandbox.push.apple.com')
- ).toBe(true)
- expect(bodies.map((body) => body.aps.alert)).toEqual(
- Array.from({ length: 3 }, () => ({
- title: 'Agent needs input',
- body: 'Waiting on your answer'
- }))
- )
- expect(new Set(bodies.map((body) => body.aps['thread-id'])).size).toBe(1)
- expect(bodies.map((body) => body.orca.notificationSeq).sort((a, b) => a - b)).toEqual([1, 2, 3])
- expect(bodies.every((body) => !('coalescedCount' in body.orca))).toBe(true)
- expect(bodies.every((body) => !('summaryMembers' in body.orca))).toBe(true)
- expect(
- new Set(harness.apnsRequests.map((request) => request.headers['apns-collapse-id'])).size
- ).toBe(3)
- })
-
- it('reports an error for a registration the host does not own', async () => {
- const ownerToken = await harness.signIn(createPushHostKeypair(19))
- const intruderToken = await harness.signIn(createPushHostKeypair(20))
- const registrationId = await harness.registerAndroid(ownerToken)
-
- const foreign = await harness.post(
- '/v1/send',
- { v: 1, registrationIds: [registrationId, 'made-up'], notification: notification() },
- intruderToken
- )
- expect(await foreign.json()).toEqual({
- results: [
- { registrationId, status: 'error' },
- { registrationId: 'made-up', status: 'error' }
- ]
- })
- expect(await harness.server.deliveryStore.pendingCount(registrationId)).toBe(0)
- })
-
- it('rate limits a host that exhausted its 15-minute allowance', async () => {
- const sessionToken = await harness.signIn(createPushHostKeypair(21))
- const registrationId = await harness.registerAndroid(sessionToken)
- const hostFingerprint = (await harness.server.devices.findById(registrationId))!.hostFingerprint
- for (let index = 0; index < PUSH_LIMITS.hostEventsPerWindow; index++) {
- expect(
- await harness.server.deliveryStore.accept(
- hostFingerprint,
- registrationId,
- PushNotificationSchema.parse(
- notification({ notificationId: `note-${index + 1000}`, notificationSeq: index + 1000 })
- )
- )
- ).toBe('queued')
- }
- const limited = await harness.post(
- '/v1/send',
- { v: 1, registrationIds: [registrationId], notification: notification() },
- sessionToken
- )
- expect(limited.status).toBe(200)
- expect(await limited.json()).toEqual({ results: [{ registrationId, status: 'rate_limited' }] })
- expect(await harness.server.deliveryStore.pendingCount(registrationId)).toBe(300)
- })
-})
diff --git a/cloud/apps/push/src/push-server-wake.test.ts b/cloud/apps/push/src/push-server-wake.test.ts
deleted file mode 100644
index 8a5442df9c5..00000000000
--- a/cloud/apps/push/src/push-server-wake.test.ts
+++ /dev/null
@@ -1,111 +0,0 @@
-import { afterEach, expect, it, vi } from 'vitest'
-import { startPushBackground } from './push-background.js'
-import { createPushHostKeypair } from './host-challenge-answering.test-fixture.js'
-import { createPushServerHarness, notification } from './push-server-harness.test-fixture.js'
-
-const cleanups: (() => Promise)[] = []
-afterEach(async () => {
- for (const cleanup of cleanups.splice(0)) await cleanup()
- vi.useRealTimers()
- vi.restoreAllMocks()
-})
-
-async function fixture() {
- const h = await createPushServerHarness()
- const token = await h.signIn(createPushHostKeypair(31))
- const registrationId = await h.registerAndroid(token)
- let stop = async () => {}
- cleanups.push(async () => {
- await stop()
- await h.close()
- })
- vi.useFakeTimers()
- return {
- ...h,
- registrationId,
- start: () => {
- stop = startPushBackground({ mode: 'active' }, h.server)
- },
- send: (event = notification(), ids = [registrationId]) =>
- h.post('/v1/send', { v: 1, registrationIds: ids, notification: event }, token),
- invalid: () => h.post('/v1/send', { v: 1 }, token)
- }
-}
-
-it('delivers a committed send before the next poll without waiting in the HTTP handler', async () => {
- const h = await fixture()
- h.start()
- const startedAt = Date.now()
- const claim = h.server.deliveryStore.claim.bind(h.server.deliveryStore)
- const release = Promise.withResolvers()
- vi.spyOn(h.server.deliveryStore, 'claim').mockImplementation(async () => {
- await release.promise
- return claim()
- })
- try {
- const response = await h.send()
- expect(await response.json()).toEqual({
- results: [{ registrationId: h.registrationId, status: 'queued' }]
- })
- expect(h.fcmRequests).toHaveLength(0)
- release.resolve()
- await vi.waitFor(() => expect(h.fcmRequests).toHaveLength(1))
- expect(Date.now() - startedAt).toBeLessThan(1000)
- expect(JSON.parse(h.fcmRequests[0]!.body).message.data.notificationSeq).toBe('1')
- } finally {
- release.resolve()
- }
-})
-
-it('keeps concurrent accepted retries idempotent while automatic delivery runs', async () => {
- const h = await fixture()
- h.start()
- await Promise.all(Array.from({ length: 10 }, () => h.send()))
- await vi.waitFor(() => expect(h.fcmRequests).toHaveLength(1))
- await h.send()
- await h.server.worker.runDue()
- expect(h.fcmRequests).toHaveLength(1)
- expect(await h.server.deliveryStore.pendingCount(h.registrationId)).toBe(0)
-})
-
-it('does not wake for invalid, unowned or dead registrations', async () => {
- const h = await fixture()
- h.start()
- const wake = vi.spyOn(h.server.worker, 'wake')
- expect((await h.invalid()).status).toBe(400)
- expect(await (await h.send(notification(), ['unknown'])).json()).toEqual({
- results: [{ registrationId: 'unknown', status: 'error' }]
- })
- const device = await h.server.devices.findById(h.registrationId)
- if (!device) throw new Error('registration missing')
- await h.server.devices.markDead(device)
- expect(await (await h.send()).json()).toEqual({
- results: [{ registrationId: h.registrationId, status: 'dead' }]
- })
- expect(wake).not.toHaveBeenCalled()
- expect(h.fcmRequests).toHaveLength(0)
-})
-
-it.each(['queued', 'sent'] as const)(
- 'preserves dismissal of an already %s alert',
- async (phase) => {
- const h = await fixture()
- if (phase === 'sent') h.start()
- await h.send()
- if (phase === 'sent') await vi.waitFor(() => expect(h.fcmRequests).toHaveLength(1))
- await h.send(notification({ kind: 'dismiss', notificationSeq: 2, sound: false }))
- if (phase === 'queued') {
- h.start()
- await vi.advanceTimersByTimeAsync(1000)
- }
- await vi.waitFor(() => expect(h.fcmRequests).toHaveLength(phase === 'sent' ? 2 : 1))
- const last = h.fcmRequests.at(-1)
- if (!last) throw new Error('dismissal missing')
- const message = JSON.parse(last.body).message
- expect(message.data.kind).toBe('dismiss')
- expect(message.data.notificationId).toBe('note-1')
- expect(message.data.notificationSeq).toBe('2')
- expect(message.data.title).toBeUndefined()
- expect(message.data.sound).toBeUndefined()
- }
-)
diff --git a/cloud/apps/push/src/push-server.ts b/cloud/apps/push/src/push-server.ts
index a174a3994f1..5889f811df9 100644
--- a/cloud/apps/push/src/push-server.ts
+++ b/cloud/apps/push/src/push-server.ts
@@ -1,32 +1,42 @@
-import { PushAuthAdmission } from './push-auth-admission.js'
+import { PushAuthAdmission } from './http/push-auth-admission.js'
import { createAdaptorServer } from '@hono/node-server'
+import { PUSH_LIMITS } from '@orca-cloud/push-contract/push-limits'
+import { PushDeviceRegistrationRequestSchema } from '@orca-cloud/push-contract/device-registration-messages'
import {
- PUSH_LIMITS,
- PushDeviceRegistrationRequestSchema,
PushHostChallengeRequestSchema,
- PushHostSessionRequestSchema,
- PushSendRequestSchema,
- type PushSendResult
-} from '@orca-cloud/push-contract'
+ PushHostSessionRequestSchema
+} from '@orca-cloud/push-contract/host-auth-messages'
+import { PushSendRequestSchema, type PushSendResult } from '@orca-cloud/push-contract/send-messages'
import { Hono, type MiddlewareHandler } from 'hono'
import { bodyLimit } from 'hono/body-limit'
-import { ApnsClient } from './apns-client.js'
-import { createApnsHttp2Transport, type ApnsTransport } from './apns-http2-transport.js'
-import { clientIpRateLimit, ClientIpRateLimiter, readClientIp } from './client-ip-rate-limit.js'
-import { DurablePushStore } from './durable-push-store.js'
-import { DurablePushWorker } from './durable-push-worker.js'
+import { ApnsClient } from './providers/apns/apns-client.js'
+import {
+ createApnsHttp2Transport,
+ type ApnsTransport
+} from './providers/apns/apns-http2-transport.js'
+import {
+ clientIpRateLimit,
+ ClientIpRateLimiter,
+ readClientIp
+} from './http/client-ip-rate-limit.js'
+import { DurablePushStore } from './delivery/durable-push-store.js'
+import { DurablePushWorker } from './delivery/durable-push-worker.js'
import type { PushConfig } from './config.js'
-import { PushDeviceRegistryStore } from './device-registry-store.js'
-import { createFcmAccessTokenProvider } from './fcm-access-token.js'
-import { createFcmFetchTransport, FcmClient, type FcmTransport } from './fcm-client.js'
-import { PushHostChallengeStore } from './host-challenge-store.js'
-import { PushHostSessionStore } from './host-session-store.js'
-import type { PushDatabase } from './push-database.js'
-import { PushDispatcher } from './push-dispatcher.js'
+import { PushDeviceRegistryStore } from './devices/device-registry-store.js'
+import { createFcmAccessTokenProvider } from './providers/fcm/fcm-access-token.js'
+import {
+ createFcmFetchTransport,
+ FcmClient,
+ type FcmTransport
+} from './providers/fcm/fcm-client.js'
+import { PushHostChallengeStore } from './host-auth/host-challenge-store.js'
+import { PushHostSessionStore } from './host-auth/host-session-store.js'
+import type { CloudDatabase as PushDatabase } from '@orca-cloud/cloud-database/cloud-database'
+import { PushDispatcher } from './delivery/push-dispatcher.js'
import { PushObservability } from './push-observability.js'
-import { reserveRequestConnection } from './push-background-database.js'
-import { createPushReadiness } from './push-readiness.js'
-import { PushRequestDrain } from './push-request-drain.js'
+import { reserveRequestConnection } from './database/push-background-database.js'
+import { createPushReadiness } from './http/push-readiness.js'
+import { PushRequestDrain } from './http/push-request-drain.js'
export type PushServerOptions = {
now?: () => number
diff --git a/cloud/apps/push/src/push-session-concurrency.test.ts b/cloud/apps/push/src/push-session-concurrency.test.ts
deleted file mode 100644
index 4c6944255f8..00000000000
--- a/cloud/apps/push/src/push-session-concurrency.test.ts
+++ /dev/null
@@ -1,65 +0,0 @@
-import { randomUUID } from 'node:crypto'
-import { tmpdir } from 'node:os'
-import { afterEach, describe, expect, it } from 'vitest'
-import { openInMemoryPushDatabase, openPushDatabase, type PushDatabase } from './push-database.js'
-import { PushHostSessionStore } from './host-session-store.js'
-const databases: PushDatabase[] = []
-afterEach(async () => {
- await Promise.all(databases.splice(0).map((db) => db.close()))
-})
-
-async function concurrentSessions(db: PushDatabase) {
- databases.push(db)
- const host = randomUUID()
- const store = new PushHostSessionStore(db)
- try {
- const sessions = await Promise.all(Array.from({ length: 20 }, () => store.create(host)))
- const decisions = await Promise.all(
- sessions.map((session) => store.resolve(session.sessionToken))
- )
- expect(decisions.filter((decision) => decision.ok)).toHaveLength(1)
- const [row] = await db.query(
- 'SELECT COUNT(*) AS count FROM push_sessions WHERE host_fingerprint = ?',
- [host]
- )
- expect(Number(row?.count)).toBe(1)
- } finally {
- await db.query('DELETE FROM push_sessions WHERE host_fingerprint = ?', [host])
- }
-}
-it('serializes sessions on SQLite', async () => {
- await concurrentSessions(await openInMemoryPushDatabase())
-})
-
-it('enforces one session per host directly in the schema', async () => {
- const db = await openInMemoryPushDatabase()
- databases.push(db)
- await db.query('INSERT INTO push_sessions VALUES (?, ?, ?, ?)', ['first', 'host', 100, 1])
- await expect(
- db.query('INSERT INTO push_sessions VALUES (?, ?, ?, ?)', ['second', 'host', 100, 2])
- ).rejects.toThrow()
- expect(await db.query('SELECT token_hash FROM push_sessions')).toEqual([{ token_hash: 'first' }])
-})
-
-describe.skipIf(!process.env.ORCA_PUSH_TEST_DATABASE_URL)('PostgreSQL push sessions', () => {
- it('leaves exactly one live token after concurrent creates', async () => {
- await concurrentSessions(
- await openPushDatabase({
- databaseUrl: process.env.ORCA_PUSH_TEST_DATABASE_URL!,
- dataDir: tmpdir()
- })
- )
- })
- it('allows concurrent schema startup', async () => {
- const opened = await Promise.all(
- Array.from({ length: 4 }, () =>
- openPushDatabase({
- databaseUrl: process.env.ORCA_PUSH_TEST_DATABASE_URL!,
- dataDir: tmpdir()
- })
- )
- )
- databases.push(...opened)
- for (const db of opened) expect(await db.query('SELECT 1 AS ok')).toEqual([{ ok: 1 }])
- })
-})
diff --git a/cloud/apps/push/src/push-validation.test.ts b/cloud/apps/push/src/push-validation.test.ts
deleted file mode 100644
index afb6906e423..00000000000
--- a/cloud/apps/push/src/push-validation.test.ts
+++ /dev/null
@@ -1,90 +0,0 @@
-import { expect, it, vi } from 'vitest'
-import { loadPushConfig } from './config.js'
-import { openPushDatabase } from './push-database.js'
-import { createPushServer } from './push-server.js'
-import { startPushBackground } from './push-background.js'
-
-it('fails closed on an invalid validation mode', () => {
- for (const mode of ['typo', '', ' ']) {
- expect(() =>
- loadPushConfig({
- ORCA_PUSH_FCM_PROJECT_ID: 'onorca-cloud',
- ORCA_PUSH_PUBLIC_URL: 'https://push.onorca.dev',
- ORCA_PUSH_MODE: mode
- })
- ).toThrow()
- }
-})
-
-const databaseUrl = process.env.ORCA_PUSH_TEST_DATABASE_URL
-it.skipIf(!databaseUrl)(
- 'validation cannot write PostgreSQL and starts no consumers or pruners',
- async () => {
- if (!process.env.CI && new URL(databaseUrl!).port !== '55440')
- throw new Error('isolated_postgres_port_required')
- const active = await openPushDatabase({ databaseUrl, dataDir: '' })
- const schema = `validation_${Date.now()}`
- await active.query(`CREATE SCHEMA ${schema}`)
- const isolatedUrl = new URL(databaseUrl!)
- isolatedUrl.searchParams.set(
- 'options',
- `-c search_path=${schema} -c default_transaction_read_only=off`
- )
- isolatedUrl.searchParams.set('host', isolatedUrl.hostname)
- isolatedUrl.searchParams.set('port', isolatedUrl.port)
- const hostlessUrl = `postgresql://${isolatedUrl.username}:${isolatedUrl.password}@${isolatedUrl.pathname}?${isolatedUrl.searchParams}`
- const database = await openPushDatabase({
- databaseUrl: hostlessUrl,
- dataDir: '',
- readOnly: true
- })
- const config = loadPushConfig({
- ORCA_PUSH_FCM_PROJECT_ID: 'onorca-cloud',
- ORCA_PUSH_PUBLIC_URL: 'https://push.onorca.dev',
- ORCA_PUSH_MODE: 'validation'
- })
- const runtime = createPushServer(config, database)
- let stop: (() => Promise) | undefined
- try {
- const [setting] = await database.query(
- "SELECT current_setting('default_transaction_read_only') AS default_transaction_read_only"
- )
- expect(setting!.default_transaction_read_only).toBe('on')
- await expect(
- database.query(`CREATE TABLE ${schema}.forbidden (id integer)`)
- ).rejects.toMatchObject({ code: '25006' })
- // An empty schema stays empty: validation must not run startup DDL.
- expect(
- await active.query('SELECT tablename FROM pg_tables WHERE schemaname = ?', [schema])
- ).toEqual([])
- const calls = vi.spyOn(database, 'query')
- const claim = vi.spyOn(runtime.deliveryStore, 'claim')
- const send = vi.spyOn(runtime.worker, 'start')
- vi.useFakeTimers()
- stop = startPushBackground(config, runtime)
- await vi.advanceTimersByTimeAsync(31 * 60_000)
- expect(calls).not.toHaveBeenCalled()
- expect(claim).not.toHaveBeenCalled()
- expect(send).not.toHaveBeenCalled()
- vi.useRealTimers()
- expect(await (await runtime.app.request('/health')).json()).toMatchObject({
- mode: 'validation'
- })
- expect((await runtime.app.request('/ready')).status).toBe(200)
- expect((await runtime.app.request('/v1/host/challenge', { method: 'POST' })).status).toBe(503)
- expect((await runtime.app.request('/v1/send', { method: 'POST' })).status).toBe(503)
- expect(calls.mock.calls.map(([sql]) => sql)).toEqual(['SELECT 1 AS ready'])
- await expect(
- database.query('DELETE FROM public.push_challenges WHERE false')
- ).rejects.toMatchObject({ code: '25006' })
- } finally {
- vi.useRealTimers()
- await stop?.()
- runtime.closeTransports()
- await database.close()
- await active.query(`DROP SCHEMA ${schema} CASCADE`)
- await active.close()
- vi.restoreAllMocks()
- }
- }
-)
diff --git a/cloud/apps/push/src/sqlite-transaction-queue.test.ts b/cloud/apps/push/src/sqlite-transaction-queue.test.ts
deleted file mode 100644
index 1ee5e8b3d52..00000000000
--- a/cloud/apps/push/src/sqlite-transaction-queue.test.ts
+++ /dev/null
@@ -1,101 +0,0 @@
-import { mkdtempSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { DatabaseSync } from 'node:sqlite'
-import { setImmediate } from 'node:timers/promises'
-import { expect, it, vi } from 'vitest'
-import { openPushDatabase } from './push-database.js'
-
-it('releases queued work and close after a SQLite transaction cannot acquire its lock', async () => {
- const dataDir = mkdtempSync(join(tmpdir(), 'orca-push-sqlite-queue-'))
- let connection: DatabaseSync | undefined
- const prepare = DatabaseSync.prototype.prepare
- // Keep the native handle reachable for cleanup even if a queue regression strands close().
- const capture = vi
- .spyOn(DatabaseSync.prototype, 'prepare')
- .mockImplementation(function (this: DatabaseSync, sql) {
- connection = this
- return prepare.call(this, sql)
- })
- const database = await openPushDatabase({ dataDir })
- capture.mockRestore()
- const blocker = new DatabaseSync(join(dataDir, 'orca-push.sqlite'))
- try {
- await database.query('CREATE TABLE queue_progress (value INTEGER)')
- await database.query('INSERT INTO queue_progress VALUES (0)')
- blocker.exec('BEGIN IMMEDIATE')
- const operation = vi.fn(async () => undefined)
- await expect(database.transaction(operation)).rejects.toThrow('database is locked')
- let lockFailures = 0
- const blocked = Array.from({ length: 5 }, () =>
- database.transaction(operation).catch(() => {
- lockFailures += 1
- })
- )
- await setImmediate()
- expect(lockFailures).toBe(5)
- await Promise.all(blocked)
- expect(operation).not.toHaveBeenCalled()
- blocker.exec('ROLLBACK')
- let completed = 0
- const pending = Array.from({ length: 100 }, () =>
- database.transaction(async (transaction) => {
- await transaction.query('UPDATE queue_progress SET value = value + 1')
- completed += 1
- })
- )
- for (const request of pending) void request.catch(() => undefined)
- await setImmediate()
- expect(completed).toBe(100)
- await Promise.all(pending)
- expect(await database.query('SELECT value FROM queue_progress')).toEqual([{ value: 100 }])
- let closed = false
- const closing = database.close().then(() => {
- closed = true
- })
- await setImmediate()
- expect(closed).toBe(true)
- await closing
- } finally {
- capture.mockRestore()
- blocker.close()
- if (connection?.isOpen) connection.close()
- rmSync(dataDir, { recursive: true, force: true })
- }
-})
-
-it('does not roll back a transaction when BEGIN failed before taking ownership', async () => {
- const dataDir = mkdtempSync(join(tmpdir(), 'orca-push-sqlite-owner-'))
- let connection: DatabaseSync | undefined
- const prepare = DatabaseSync.prototype.prepare
- const capture = vi
- .spyOn(DatabaseSync.prototype, 'prepare')
- .mockImplementation(function (this: DatabaseSync, sql) {
- connection = this
- return prepare.call(this, sql)
- })
- const database = await openPushDatabase({ dataDir })
- capture.mockRestore()
- try {
- await database.query('CREATE TABLE queue_owner (value INTEGER)')
- await database.query('BEGIN IMMEDIATE')
- await database.query('INSERT INTO queue_owner VALUES (7)')
- await expect(database.transaction(async () => undefined)).rejects.toThrow(
- 'cannot start a transaction within a transaction'
- )
- expect(connection?.isTransaction).toBe(true)
- let rows: unknown
- void database.query('SELECT value FROM queue_owner').then((result) => {
- rows = result
- })
- await setImmediate()
- expect(rows).toEqual([{ value: 7 }])
- await database.query('ROLLBACK')
- expect(await database.query('SELECT value FROM queue_owner')).toEqual([])
- await database.close()
- } finally {
- capture.mockRestore()
- if (connection?.isOpen) connection.close()
- rmSync(dataDir, { recursive: true, force: true })
- }
-})
diff --git a/cloud/apps/relay-edge/package.json b/cloud/apps/relay-edge/package.json
index f91ee38f3f7..946df722bad 100644
--- a/cloud/apps/relay-edge/package.json
+++ b/cloud/apps/relay-edge/package.json
@@ -13,7 +13,7 @@
},
"dependencies": {
"@types/pg": "^8.23.1",
- "jose": "^6.2.13",
+ "jose": "^6.2.16",
"pg": "^8.23.1",
"tweetnacl": "^1.0.3",
"zod": "^4.6.7"
@@ -26,7 +26,7 @@
"typescript": "^5.9.3",
"vitest": "^5.0.5",
"wrangler": "^4.157.0",
- "ws": "^8.22.0"
+ "ws": "^8.22.2"
},
"allowScripts": {
"workerd@1.20261103.1": true,
diff --git a/cloud/apps/relay-edge/spike/lib.ts b/cloud/apps/relay-edge/spike/lib.ts
index 2572a4703f0..4ea68543ac0 100644
--- a/cloud/apps/relay-edge/spike/lib.ts
+++ b/cloud/apps/relay-edge/spike/lib.ts
@@ -5,8 +5,8 @@ import { appendFileSync, existsSync, readFileSync, writeFileSync } from 'node:fs
import { SignJWT, exportJWK, generateKeyPair, importJWK, type JWK } from 'jose'
import nacl from 'tweetnacl'
import WebSocket from 'ws'
-import { RelayControlClient } from '../../../../src/main/runtime/mobile-cloud-relay/relay-control-client'
-import { CloudRelayTransport } from '../../../../src/main/runtime/rpc/relay-transport'
+import { RelayControlClient } from '../../../../src/main/runtime/mobile-cloud-relay/control-channel/relay-control-client'
+import { CloudRelayTransport } from '../../../../src/main/runtime/rpc/transports/relay-transport'
export const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms))
diff --git a/cloud/apps/relay-edge/spike/run-all-harness.ts b/cloud/apps/relay-edge/spike/run-all-harness.ts
index 6b9956a0c5c..050c9a81be2 100644
--- a/cloud/apps/relay-edge/spike/run-all-harness.ts
+++ b/cloud/apps/relay-edge/spike/run-all-harness.ts
@@ -2,8 +2,8 @@
// client wrapper, the echo service, phone sockets and workerd memory sampling.
import { execSync } from 'node:child_process'
import WebSocket from 'ws'
-import { RelayControlClient } from '../../../../src/main/runtime/mobile-cloud-relay/relay-control-client'
-import { CloudRelayTransport } from '../../../../src/main/runtime/rpc/relay-transport'
+import { RelayControlClient } from '../../../../src/main/runtime/mobile-cloud-relay/control-channel/relay-control-client'
+import { CloudRelayTransport } from '../../../../src/main/runtime/rpc/transports/relay-transport'
export const PORT = 8787
export const ORIGIN = `http://127.0.0.1:${PORT}`
diff --git a/cloud/apps/relay-edge/spike/run-all-lifecycle.ts b/cloud/apps/relay-edge/spike/run-all-lifecycle.ts
index a4e00c9fc29..8c7814db282 100644
--- a/cloud/apps/relay-edge/spike/run-all-lifecycle.ts
+++ b/cloud/apps/relay-edge/spike/run-all-lifecycle.ts
@@ -39,7 +39,7 @@ export async function runLifecycleChecks(ctx: Ctx, main: Control, mainAck: Ack):
mute.on('close', (c) => (muteClose = c))
await new Promise((res) => mute.on('open', res))
// Complete the handshake by hand with the shipped proof answerer, then never pong.
- const { answerRelayHostChallenge } = await import('../../../../src/main/runtime/mobile-cloud-relay/relay-host-proof')
+ const { answerRelayHostChallenge } = await import('../../../../src/main/runtime/mobile-cloud-relay/control-channel/relay-host-proof')
mute.send(JSON.stringify({ type: 'host-hello', v: 1, relayHostId: ctx.relayHostId, assignmentEpoch: 7,
hostPublicKeyB64: ctx.keypair.publicKeyB64, appVersion: 'spike' }))
mute.on('message', (raw) => {
diff --git a/cloud/apps/relay-edge/test/harness-mvp-object.ts b/cloud/apps/relay-edge/test/harness-mvp-object.ts
index 69530b07307..579814d0b42 100644
--- a/cloud/apps/relay-edge/test/harness-mvp-object.ts
+++ b/cloud/apps/relay-edge/test/harness-mvp-object.ts
@@ -5,8 +5,8 @@ import { readFileSync } from 'node:fs'
import { SignJWT, type KeyLike } from 'jose'
import nacl from 'tweetnacl'
import WebSocket from 'ws'
-import { RelayControlClient } from '../../../../src/main/runtime/mobile-cloud-relay/relay-control-client'
-import { CloudRelayTransport } from '../../../../src/main/runtime/rpc/relay-transport'
+import { RelayControlClient } from '../../../../src/main/runtime/mobile-cloud-relay/control-channel/relay-control-client'
+import { CloudRelayTransport } from '../../../../src/main/runtime/rpc/transports/relay-transport'
export const PORT = 8789
export const REMOTE = process.env.MVP_URL?.replace(/\/$/, '')
diff --git a/cloud/apps/relay-edge/test/harness-roundtrip.ts b/cloud/apps/relay-edge/test/harness-roundtrip.ts
index 123c485a339..a9fd304e8d4 100644
--- a/cloud/apps/relay-edge/test/harness-roundtrip.ts
+++ b/cloud/apps/relay-edge/test/harness-roundtrip.ts
@@ -8,8 +8,8 @@ import { join } from 'node:path'
import { SignJWT, type KeyLike } from 'jose'
import nacl from 'tweetnacl'
import WebSocket from 'ws'
-import { RelayControlClient } from '../../../../src/main/runtime/mobile-cloud-relay/relay-control-client'
-import { CloudRelayTransport } from '../../../../src/main/runtime/rpc/relay-transport'
+import { RelayControlClient } from '../../../../src/main/runtime/mobile-cloud-relay/control-channel/relay-control-client'
+import { CloudRelayTransport } from '../../../../src/main/runtime/rpc/transports/relay-transport'
import { RelayPhoneHelloSchema } from '../../../../src/shared/remote-runtime/relay/mobile-relay-phone-protocol'
export const DIRECTOR_APP = process.env.DIRECTOR_APP ?? ''
diff --git a/cloud/apps/relay-edge/test/mvp.ts b/cloud/apps/relay-edge/test/mvp.ts
index d0f915a7fb2..0fd34352f55 100644
--- a/cloud/apps/relay-edge/test/mvp.ts
+++ b/cloud/apps/relay-edge/test/mvp.ts
@@ -15,8 +15,8 @@ import { SignJWT, exportJWK, generateKeyPair, type KeyLike } from 'jose'
import nacl from 'tweetnacl'
import pg from 'pg'
import WebSocket from 'ws'
-import { RelayControlClient } from '../../../../src/main/runtime/mobile-cloud-relay/relay-control-client'
-import { CloudRelayTransport } from '../../../../src/main/runtime/rpc/relay-transport'
+import { RelayControlClient } from '../../../../src/main/runtime/mobile-cloud-relay/control-channel/relay-control-client'
+import { CloudRelayTransport } from '../../../../src/main/runtime/rpc/transports/relay-transport'
import { RelayPhoneHelloSchema } from '../../../../src/shared/remote-runtime/relay/mobile-relay-phone-protocol'
const PORT = 8788
diff --git a/cloud/apps/relay-fence-broker/package.json b/cloud/apps/relay-fence-broker/package.json
index b80f52b1843..4ba1ebedcc8 100644
--- a/cloud/apps/relay-fence-broker/package.json
+++ b/cloud/apps/relay-fence-broker/package.json
@@ -14,8 +14,8 @@
"typecheck": "tsc -p tsconfig.json --noEmit"
},
"dependencies": {
- "@hono/node-server": "^2.1.5",
- "hono": "^4.13.13",
+ "@hono/node-server": "^2.1.6",
+ "hono": "^4.13.17",
"zod": "^4.6.7"
},
"devDependencies": {
diff --git a/cloud/apps/relay/package.json b/cloud/apps/relay/package.json
index ff18d5ea368..fda66985704 100644
--- a/cloud/apps/relay/package.json
+++ b/cloud/apps/relay/package.json
@@ -15,14 +15,14 @@
"typecheck": "pnpm --dir ../.. build:process-host && tsc -p tsconfig.json --noEmit"
},
"dependencies": {
- "@hono/node-server": "^2.1.5",
+ "@hono/node-server": "^2.1.6",
"@orca-cloud/postgres-schema": "workspace:*",
"@orca-cloud/relay-contract": "workspace:*",
- "hono": "^4.13.13",
- "jose": "^6.2.13",
+ "hono": "^4.13.17",
+ "jose": "^6.2.16",
"pg": "^8.23.1",
"tweetnacl": "^1.0.3",
- "ws": "^8.22.0",
+ "ws": "^8.22.2",
"zod": "^4.6.7"
},
"devDependencies": {
diff --git a/cloud/apps/relay/src/assignment/assignment-connection-headroom-postgres.test.ts b/cloud/apps/relay/src/assignment/assignment-connection-headroom-postgres.test.ts
index 07f91d60f9d..b073ef3f539 100644
--- a/cloud/apps/relay/src/assignment/assignment-connection-headroom-postgres.test.ts
+++ b/cloud/apps/relay/src/assignment/assignment-connection-headroom-postgres.test.ts
@@ -1,6 +1,4 @@
-import pg from 'pg'
import { afterAll, beforeAll, describe, expect, it } from 'vitest'
-import { ASSIGNMENT_CONNECTION_HEADROOM_QUERY } from './assignment-connection-headroom-query.js'
import { RelayAssignmentStore } from './assignment-store.js'
import {
openRelayDatabase,
@@ -9,7 +7,6 @@ import {
const databaseUrl = process.env.ORCA_RELAY_TEST_POSTGRES_URL
const describePostgres = databaseUrl ? describe : describe.skip
-const headroomIndexName = 'relay_control_connection_reservation_headroom'
const cell = {
id: 'connection-headroom-postgres',
url: 'https://connection-headroom-postgres.example.com',
@@ -160,39 +157,6 @@ describePostgres('PostgreSQL assignment connection headroom', () => {
expect(Number(reservations[0]!.count)).toBe(1)
}, 15_000)
- it('uses the composite headroom index when released history dominates', async () => {
- await databases[0]!.query(
- `INSERT INTO relay_control_connection_reservations
- (reservation_id, idempotency_key, user_id, relay_host_id,
- assignment_epoch, cell_id, state, created_at, timeout_at, updated_at)
- SELECT 'headroom-plan-' || value, 'headroom-plan-' || value,
- 'connection-headroom-postgres-plan', 'plan-host-' || value,
- 1, ?, 'released', 1, 2, 1
- FROM generate_series(1, 50000) AS value`,
- [cell.id]
- )
- await databases[0]!.query(`ANALYZE relay_control_connection_reservations`)
-
- const client = new pg.Client({ connectionString: databaseUrl })
- await client.connect()
- let reservationIndexPlan: Record | undefined
- try {
- const plan = await client.query(
- `EXPLAIN (FORMAT JSON) ${ASSIGNMENT_CONNECTION_HEADROOM_QUERY}`
- )
- reservationIndexPlan = findReservationHeadroomIndexPlan(
- plan.rows[0]?.['QUERY PLAN']
- )
- } finally {
- await client.end()
- }
-
- expect(reservationIndexPlan).toBeDefined()
- expect(String(reservationIndexPlan?.['Index Cond'])).toContain('cell_id')
- expect(String(reservationIndexPlan?.['Index Cond'])).toContain('state = ANY')
- expect(reservationIndexPlan?.['Filter']).toBeUndefined()
- })
-
it('deduplicates expired debt after a fresh PostgreSQL snapshot', async () => {
const now = 200
const store = new RelayAssignmentStore(databases[0]!, () => now, {
@@ -337,16 +301,3 @@ describePostgres('PostgreSQL assignment connection headroom', () => {
).toEqual([{ state: 'released' }])
})
})
-
-function findReservationHeadroomIndexPlan(
- value: unknown
-): Record | undefined {
- if (value === null || typeof value !== 'object') return undefined
- const record = value as Record
- if (!Array.isArray(value) && record['Index Name'] === headroomIndexName) return record
- for (const child of Object.values(value)) {
- const match = findReservationHeadroomIndexPlan(child)
- if (match) return match
- }
- return undefined
-}
diff --git a/cloud/apps/relay/src/assignment/assignment-dead-reserve-cell-postgres.test.ts b/cloud/apps/relay/src/assignment/assignment-dead-reserve-cell-postgres.test.ts
index a0a98088877..04c62668610 100644
--- a/cloud/apps/relay/src/assignment/assignment-dead-reserve-cell-postgres.test.ts
+++ b/cloud/apps/relay/src/assignment/assignment-dead-reserve-cell-postgres.test.ts
@@ -157,14 +157,6 @@ describePostgres('a host leaving a dead reserve cell, on PostgreSQL', () => {
expect(await reservedOn(dead)).toEqual(reservedBefore)
})
- it('hard crash with no dead-man trip: a ledger-only row moves too', async () => {
- const host = nextHost()
- await ledgerRow(host, 7)
- await store.setCellAdmitMode(dead.id, 'reserve')
- await killDeadCell()
- expect(await hostAssign(host)).toMatchObject({ cellId: live.id, assignmentEpoch: 8 })
- })
-
it('a seat ahead of the row: the move mints above it, and the revived cell\'s seat never wins the row back', async () => {
const host = nextHost()
await ledgerRow(host, 4)
diff --git a/cloud/apps/relay/src/assignment/migrations/migration-recovery-postgres.test.ts b/cloud/apps/relay/src/assignment/migrations/migration-recovery-postgres.test.ts
index 1cb85261395..5d6a099ddc4 100644
--- a/cloud/apps/relay/src/assignment/migrations/migration-recovery-postgres.test.ts
+++ b/cloud/apps/relay/src/assignment/migrations/migration-recovery-postgres.test.ts
@@ -6,7 +6,6 @@ import {
type RelayAssignmentMigration
} from '../assignment-store.js'
import { openRelayDatabase, type RelayDatabase } from '../../database/database.js'
-import { readRegisteredMigrationInventory } from './registered-migration-inventory.js'
const databaseUrl = process.env.ORCA_RELAY_TEST_POSTGRES_URL
const describePostgres = databaseUrl ? describe : describe.skip
@@ -245,39 +244,6 @@ describePostgres('PostgreSQL migration recovery', () => {
)
}
- it('reaps an abandoned registered migration onto its healthy target', async () => {
- const input = await fixture()
- await input.store.releaseActivity(input.identity, input.sourceControlId)
- await input.store.releaseActivity(input.identity, input.targetControlId)
- input.advance(
- ASSIGNMENT_LIMITS.migrationLeaseMs + STRANDED_MIGRATION_ABANDON_MS + 1
- )
-
- await expect(input.store.abortExpiredEvacuations()).resolves.toBe(1)
- expect(
- await database.query(
- `SELECT assignment.cell_id, assignment.assignment_epoch,
- migration.completed_at, migration.aborted_at
- FROM relay_assignments assignment
- JOIN relay_assignment_migrations migration
- ON migration.user_id = assignment.user_id
- AND migration.relay_host_id = assignment.relay_host_id
- AND migration.assignment_epoch = assignment.assignment_epoch
- WHERE assignment.user_id = ? AND assignment.relay_host_id = ?`,
- [input.identity.userId, input.identity.relayHostId]
- )
- ).toEqual([
- {
- cell_id: input.cells.failed.id,
- assignment_epoch: '2',
- completed_at: String(
- 100 + ASSIGNMENT_LIMITS.migrationLeaseMs + STRANDED_MIGRATION_ABANDON_MS + 1
- ),
- aborted_at: null
- }
- ])
- })
-
it('reaps immediately after the retired source has a durable completed fence', async () => {
const input = await fixture()
await input.store.releaseActivity(input.identity, input.sourceControlId)
@@ -309,171 +275,6 @@ describePostgres('PostgreSQL migration recovery', () => {
])
})
- it('reaps immediately after the retired source has an adopted legacy fence', async () => {
- const input = await fixture()
- await input.store.releaseActivity(input.identity, input.sourceControlId)
- await input.store.releaseActivity(input.identity, input.targetControlId)
- input.advancePastHeartbeat()
- await input.store.adoptLegacyCellFence(
- input.cells.source.id,
- input.cellIncarnation
- )
- await input.store.commitLegacyCellFenceAdoption(
- input.cells.source.id,
- input.cellIncarnation
- )
- input.advance(ASSIGNMENT_LIMITS.migrationLeaseMs + 1)
-
- expect(
- (
- await readRegisteredMigrationInventory(
- database,
- 100 + 45_001 + ASSIGNMENT_LIMITS.migrationLeaseMs + 1
- )
- ).abandoned
- ).toBe(1)
-
- await expect(input.store.abortExpiredEvacuations()).resolves.toBe(1)
- expect(
- await database.query(
- `SELECT assignment.cell_id, assignment.assignment_epoch,
- migration.completed_at, migration.aborted_at
- FROM relay_assignments assignment
- JOIN relay_assignment_migrations migration
- ON migration.user_id = assignment.user_id
- AND migration.relay_host_id = assignment.relay_host_id
- AND migration.assignment_epoch = assignment.assignment_epoch
- WHERE assignment.user_id = ? AND assignment.relay_host_id = ?`,
- [input.identity.userId, input.identity.relayHostId]
- )
- ).toEqual([
- {
- cell_id: input.cells.failed.id,
- assignment_epoch: '2',
- completed_at: String(100 + 45_001 + ASSIGNMENT_LIMITS.migrationLeaseMs + 1),
- aborted_at: null
- }
- ])
- })
-
- it('does not reap after temporary legacy adoption without durable commit', async () => {
- const input = await fixture()
- await input.store.releaseActivity(input.identity, input.sourceControlId)
- await input.store.releaseActivity(input.identity, input.targetControlId)
- input.advancePastHeartbeat()
- await input.store.adoptLegacyCellFence(
- input.cells.source.id,
- input.cellIncarnation
- )
- input.advance(ASSIGNMENT_LIMITS.migrationLeaseMs + 1)
-
- expect(
- (
- await readRegisteredMigrationInventory(
- database,
- 100 + 45_001 + ASSIGNMENT_LIMITS.migrationLeaseMs + 1
- )
- ).abandoned
- ).toBe(0)
- await expect(input.store.abortExpiredEvacuations()).resolves.toBe(0)
- input.advance(STRANDED_MIGRATION_ABANDON_MS)
- await expect(input.store.abortExpiredEvacuations()).resolves.toBe(1)
- })
-
- it('invalidates an adopted legacy fence when the source heartbeats', async () => {
- const input = await fixture()
- await input.store.releaseActivity(input.identity, input.sourceControlId)
- await input.store.releaseActivity(input.identity, input.targetControlId)
- input.advancePastHeartbeat()
- await input.store.adoptLegacyCellFence(
- input.cells.source.id,
- input.cellIncarnation
- )
- await input.store.commitLegacyCellFenceAdoption(
- input.cells.source.id,
- input.cellIncarnation
- )
- input.advance(ASSIGNMENT_LIMITS.migrationLeaseMs + 1)
- await input.heartbeat(input.cells.source)
-
- expect(
- await database.query(
- `SELECT cell_id FROM relay_cell_legacy_fence_adoptions WHERE cell_id = ?`,
- [input.cells.source.id]
- )
- ).toEqual([])
- await expect(input.store.abortExpiredEvacuations()).resolves.toBe(0)
- input.advance(STRANDED_MIGRATION_ABANDON_MS)
- await expect(input.store.abortExpiredEvacuations()).resolves.toBe(1)
- })
-
- it('invalidates an adopted legacy fence when the source restarts', async () => {
- const input = await fixture()
- await input.store.releaseActivity(input.identity, input.sourceControlId)
- await input.store.releaseActivity(input.identity, input.targetControlId)
- input.advancePastHeartbeat()
- await input.store.adoptLegacyCellFence(
- input.cells.source.id,
- input.cellIncarnation
- )
- await input.store.commitLegacyCellFenceAdoption(
- input.cells.source.id,
- input.cellIncarnation
- )
- input.advance(ASSIGNMENT_LIMITS.migrationLeaseMs + 1)
- await input.store.recordCellHeartbeat({
- cellId: input.cells.source.id,
- cellUrl: input.cells.source.url,
- cellIncarnation: '99999999-9999-4999-8999-999999999999',
- startedAt: 51,
- ready: true,
- observedRequests: 0
- })
-
- expect(
- await database.query(
- `SELECT cell_id FROM relay_cell_legacy_fence_adoptions WHERE cell_id = ?`,
- [input.cells.source.id]
- )
- ).toEqual([])
- await expect(input.store.abortExpiredEvacuations()).resolves.toBe(0)
- input.advance(STRANDED_MIGRATION_ABANDON_MS)
- await expect(input.store.abortExpiredEvacuations()).resolves.toBe(1)
- })
-
- it('serializes legacy adoption with a returning source heartbeat', async () => {
- const input = await fixture()
- await input.store.releaseActivity(input.identity, input.sourceControlId)
- await input.store.releaseActivity(input.identity, input.targetControlId)
- input.advancePastHeartbeat()
- await input.store.adoptLegacyCellFence(
- input.cells.source.id,
- input.cellIncarnation
- )
-
- const [commit, heartbeatResult] = await Promise.allSettled([
- input.store.commitLegacyCellFenceAdoption(
- input.cells.source.id,
- input.cellIncarnation
- ),
- input.heartbeat(input.cells.source)
- ])
- expect(heartbeatResult.status).toBe('fulfilled')
- if (commit.status === 'rejected') {
- expect(commit.reason).toMatchObject({ message: 'legacy_cell_fence_not_active' })
- }
- expect(
- await database.query(
- `SELECT cell_id FROM relay_cell_legacy_fence_adoptions WHERE cell_id = ?`,
- [input.cells.source.id]
- )
- ).toEqual([])
- input.advance(
- ASSIGNMENT_LIMITS.migrationLeaseMs + STRANDED_MIGRATION_ABANDON_MS + 1
- )
- await expect(input.store.abortExpiredEvacuations()).resolves.toBe(1)
- })
-
it('restores the 24-hour guard when the fenced source heartbeats again', async () => {
const input = await fixture()
await input.store.releaseActivity(input.identity, input.sourceControlId)
@@ -495,83 +296,6 @@ describePostgres('PostgreSQL migration recovery', () => {
await expect(input.store.abortExpiredEvacuations()).resolves.toBe(1)
})
- it('restores the 24-hour guard when the fenced source restarts', async () => {
- const input = await fixture()
- await input.store.releaseActivity(input.identity, input.sourceControlId)
- await input.store.releaseActivity(input.identity, input.targetControlId)
- input.advancePastHeartbeat()
- await completeSourceFence(input)
- input.advance(ASSIGNMENT_LIMITS.migrationLeaseMs + 1)
- await input.store.recordCellHeartbeat({
- cellId: input.cells.source.id,
- cellUrl: input.cells.source.url,
- cellIncarnation: '99999999-9999-4999-8999-999999999999',
- startedAt: 51,
- ready: true,
- observedRequests: 0
- })
-
- await expect(input.store.abortExpiredEvacuations()).resolves.toBe(0)
- expect(
- await database.query(
- `SELECT completed_at, aborted_at FROM relay_assignment_migrations
- WHERE user_id = ? AND relay_host_id = ?`,
- [input.identity.userId, input.identity.relayHostId]
- )
- ).toEqual([{ completed_at: null, aborted_at: null }])
- input.advance(STRANDED_MIGRATION_ABANDON_MS)
- await expect(input.store.abortExpiredEvacuations()).resolves.toBe(1)
- })
-
- it('serializes fenced cleanup with a returning source heartbeat', async () => {
- const input = await fixture()
- await input.store.releaseActivity(input.identity, input.sourceControlId)
- await input.store.releaseActivity(input.identity, input.targetControlId)
- input.advancePastHeartbeat()
- await completeSourceFence(input)
- input.advance(ASSIGNMENT_LIMITS.migrationLeaseMs + 1)
-
- const [cleanup, heartbeatResult] = await Promise.allSettled([
- input.store.abortExpiredEvacuations(),
- input.heartbeat(input.cells.source)
- ])
- expect(cleanup.status).toBe('fulfilled')
- expect(heartbeatResult.status).toBe('fulfilled')
- if (cleanup.status !== 'fulfilled') throw cleanup.reason
- if (heartbeatResult.status !== 'fulfilled') throw heartbeatResult.reason
- expect([0, 1]).toContain(cleanup.value)
- const migrations = await database.query(
- `SELECT completed_at, aborted_at FROM relay_assignment_migrations
- WHERE user_id = ? AND relay_host_id = ?`,
- [input.identity.userId, input.identity.relayHostId]
- )
- if (cleanup.value === 1) {
- expect(migrations[0]?.completed_at).not.toBeNull()
- } else {
- expect(migrations).toEqual([{ completed_at: null, aborted_at: null }])
- input.advance(STRANDED_MIGRATION_ABANDON_MS)
- await expect(input.store.abortExpiredEvacuations()).resolves.toBe(1)
- }
- })
-
- it('keeps a freshly retired source protected without a durable fence', async () => {
- const input = await fixture()
- await input.store.releaseActivity(input.identity, input.sourceControlId)
- await input.store.releaseActivity(input.identity, input.targetControlId)
- input.advance(ASSIGNMENT_LIMITS.migrationLeaseMs + 1)
-
- await expect(input.store.abortExpiredEvacuations()).resolves.toBe(0)
- expect(
- await database.query(
- `SELECT completed_at, aborted_at FROM relay_assignment_migrations
- WHERE user_id = ? AND relay_host_id = ?`,
- [input.identity.userId, input.identity.relayHostId]
- )
- ).toEqual([{ completed_at: null, aborted_at: null }])
- input.advance(STRANDED_MIGRATION_ABANDON_MS)
- await expect(input.store.abortExpiredEvacuations()).resolves.toBe(1)
- })
-
it('rolls an abandoned disabled target back to its source', async () => {
const input = await fixture()
await input.store.releaseActivity(input.identity, input.sourceControlId)
@@ -606,96 +330,6 @@ describePostgres('PostgreSQL migration recovery', () => {
])
})
- it('serializes cleanup against supersession without reporting a false target', async () => {
- const input = await fixture()
- await input.store.releaseActivity(input.identity, input.sourceControlId)
- await input.store.releaseActivity(input.identity, input.targetControlId)
- await input.store.setCellEnabled(input.cells.failed.id, false)
- input.advance(
- ASSIGNMENT_LIMITS.migrationLeaseMs + STRANDED_MIGRATION_ABANDON_MS + 1
- )
- await input.heartbeat(input.cells.source)
- await input.heartbeat(input.cells.replacement)
- await input.store.attestCellFence(input.cells.failed.id, input.cellIncarnation)
-
- const [cleanup, supersession] = await Promise.allSettled([
- input.store.abortExpiredEvacuations(),
- input.store.supersedeRegisteredCellEvacuations(
- input.cells.source.id,
- input.cells.failed.id,
- input.cells.replacement.id,
- 100
- )
- ])
- expect(cleanup.status).toBe('fulfilled')
- if (cleanup.status !== 'fulfilled') throw cleanup.reason
- if (supersession.status === 'fulfilled') {
- expect([0, 1]).toContain(supersession.value)
- const assignment = await database.query(
- `SELECT cell_id FROM relay_assignments WHERE user_id = ?`,
- [input.identity.userId]
- )
- expect(assignment).toEqual([{
- cell_id:
- supersession.value === 1
- ? input.cells.replacement.id
- : input.cells.source.id
- }])
- if (supersession.value === 0) expect(cleanup.value).toBeGreaterThanOrEqual(1)
- } else {
- expect(cleanup.value).toBeGreaterThanOrEqual(1)
- expect(supersession.reason).toMatchObject({ message: 'migration_already_superseded' })
- expect(
- await database.query(
- `SELECT cell_id FROM relay_assignments WHERE user_id = ?`,
- [input.identity.userId]
- )
- ).toEqual([{ cell_id: input.cells.source.id }])
- }
- })
-
- it('completes a registered migration from a dead source idempotently', async () => {
- const input = await fixture()
- await input.store.releaseActivity(input.identity, input.sourceControlId)
- input.advancePastHeartbeat()
- await input.heartbeat(input.cells.failed)
- await input.store.attestCellFence(
- input.cells.source.id,
- input.cellIncarnation
- )
- const completion = {
- assignmentEpoch: input.migration.assignmentEpoch,
- sourceCellId: input.cells.source.id,
- targetCellId: input.cells.failed.id
- }
-
- await expect(
- input.store.cellEvacuationStatus(
- input.cells.source.id,
- input.cells.failed.id,
- true
- )
- ).resolves.toMatchObject({ inProgress: 0, completed: 1 })
- await expect(
- input.store.completeEvacuationFromDeadSource(input.identity, completion)
- ).resolves.toMatchObject({ changed: false })
- expect(await reservations(input.cells)).toEqual({ source: 0, failed: 1, replacement: 0 })
- })
-
- it('requires fence evidence for dead-source completion', async () => {
- const input = await fixture()
- await input.store.releaseActivity(input.identity, input.sourceControlId)
-
- await expect(
- input.store.completeEvacuationFromDeadSource(input.identity, {
- assignmentEpoch: input.migration.assignmentEpoch,
- sourceCellId: input.cells.source.id,
- targetCellId: input.cells.failed.id
- })
- ).rejects.toThrow('cell_fence_attestation_missing')
- expect(await reservations(input.cells)).toEqual({ source: 0, failed: 2, replacement: 0 })
- })
-
it('supersedes a registered migration with exact accounting and idempotency', async () => {
const input = await fixture()
await database.query(
@@ -760,359 +394,6 @@ describePostgres('PostgreSQL migration recovery', () => {
])
})
- it('reconciles durable cell accounting before aggregate supersession', async () => {
- const input = await fixture()
- await input.store.setCellEnabled(input.cells.failed.id, false)
- input.advancePastHeartbeat()
- await input.heartbeat(input.cells.source)
- await input.heartbeat(input.cells.replacement)
- await input.store.attestCellFence(
- input.cells.failed.id,
- input.cellIncarnation
- )
- await database.query(
- `UPDATE relay_cells
- SET reserved_requests = CASE WHEN cell_id = ? THEN 1 ELSE 0 END
- WHERE cell_id IN (?, ?)`,
- [input.cells.replacement.id, input.cells.source.id, input.cells.replacement.id]
- )
-
- await expect(
- input.store.supersedeRegisteredCellEvacuations(
- input.cells.source.id,
- input.cells.failed.id,
- input.cells.replacement.id,
- 100
- )
- ).resolves.toBe(1)
- expect(await reservations(input.cells)).toEqual({
- source: 1,
- failed: 0,
- replacement: 2
- })
- })
-
- it('rebuilds an expired registered migration lease before supersession', async () => {
- const input = await fixture()
- await pinMigration(input, input.migration.assignmentEpoch)
- await clearActivities(input)
- await database.query(
- `UPDATE relay_assignment_migrations SET expires_at = 0
- WHERE user_id = ? AND relay_host_id = ? AND assignment_epoch = ?`,
- [input.identity.userId, input.identity.relayHostId, input.migration.assignmentEpoch]
- )
- await fenceFailedCell(input)
-
- await expect(supersedeAggregate(input)).resolves.toBe(1)
- expect(await reservations(input.cells)).toEqual({
- source: 0,
- failed: 0,
- replacement: 1
- })
- expect(
- await database.query(
- `SELECT assignment_epoch, source_request_units, target_reserved_units, aborted_at
- FROM relay_assignment_migrations WHERE user_id = ? ORDER BY assignment_epoch`,
- [input.identity.userId]
- )
- ).toEqual([
- {
- assignment_epoch: '2',
- source_request_units: '1',
- target_reserved_units: '2',
- aborted_at: '45101'
- },
- {
- assignment_epoch: '3',
- source_request_units: '0',
- target_reserved_units: '1',
- aborted_at: null
- }
- ])
- })
-
- it('retires an obsolete row without discarding replacement activity', async () => {
- const input = await fixture()
- await pinMigration(input, input.migration.assignmentEpoch)
- await fenceFailedCell(input)
- await input.store.supersedeRegisteredEvacuation(input.identity, {
- assignmentEpoch: input.migration.assignmentEpoch,
- sourceCellId: input.cells.source.id,
- currentTargetCellId: input.cells.failed.id,
- replacementTargetCellId: input.cells.replacement.id
- })
- await database.query(
- `UPDATE relay_assignment_migrations SET aborted_at = NULL
- WHERE user_id = ? AND relay_host_id = ? AND assignment_epoch = ?`,
- [input.identity.userId, input.identity.relayHostId, input.migration.assignmentEpoch]
- )
- const activityBefore = await assignmentActivities(input)
-
- await expect(supersedeAggregate(input)).resolves.toBe(1)
- expect(await assignmentActivities(input)).toEqual(activityBefore)
- expect(await reservations(input.cells)).toEqual({
- source: 1,
- failed: 0,
- replacement: 2
- })
- expect(
- await database.query(
- `SELECT assignment_epoch, aborted_at FROM relay_assignment_migrations
- WHERE user_id = ? ORDER BY assignment_epoch`,
- [input.identity.userId]
- )
- ).toEqual([
- { assignment_epoch: '2', aborted_at: '45101' },
- { assignment_epoch: '3', aborted_at: null }
- ])
- })
-
- it('anchors a newer dormant failed-cell epoch and preserves drain evidence', async () => {
- const input = await fixture()
- const drainAttemptId = await pinMigration(input, input.migration.assignmentEpoch)
- await clearActivities(input)
- await database.query(
- `UPDATE relay_assignments SET assignment_epoch = 4
- WHERE user_id = ? AND relay_host_id = ?`,
- [input.identity.userId, input.identity.relayHostId]
- )
- await database.query(
- `UPDATE relay_assignment_migrations SET expires_at = 0
- WHERE user_id = ? AND relay_host_id = ? AND assignment_epoch = ?`,
- [input.identity.userId, input.identity.relayHostId, input.migration.assignmentEpoch]
- )
- await fenceFailedCell(input)
-
- await expect(supersedeAggregate(input)).resolves.toBe(1)
- expect(await reservations(input.cells)).toEqual({
- source: 0,
- failed: 0,
- replacement: 1
- })
- expect(
- await database.query(
- `SELECT assignment_epoch, source_request_units, target_reserved_units, aborted_at
- FROM relay_assignment_migrations WHERE user_id = ? ORDER BY assignment_epoch`,
- [input.identity.userId]
- )
- ).toEqual([
- {
- assignment_epoch: '2',
- source_request_units: '1',
- target_reserved_units: '2',
- aborted_at: '45101'
- },
- {
- assignment_epoch: '4',
- source_request_units: '0',
- target_reserved_units: '1',
- aborted_at: '45101'
- },
- {
- assignment_epoch: '5',
- source_request_units: '0',
- target_reserved_units: '1',
- aborted_at: null
- }
- ])
- expect(
- await database.query(
- `SELECT assignment_epoch, drain_attempt_id, source_request_units,
- target_reserved_units
- FROM relay_post_drain_migration_pins
- WHERE user_id = ? ORDER BY assignment_epoch`,
- [input.identity.userId]
- )
- ).toEqual([
- {
- assignment_epoch: '2',
- drain_attempt_id: drainAttemptId,
- source_request_units: '1',
- target_reserved_units: '2'
- },
- {
- assignment_epoch: '4',
- drain_attempt_id: drainAttemptId,
- source_request_units: '0',
- target_reserved_units: '1'
- },
- {
- assignment_epoch: '5',
- drain_attempt_id: drainAttemptId,
- source_request_units: '0',
- target_reserved_units: '1'
- }
- ])
- })
-
- it('uses an existing current-epoch migration once when retiring an older row', async () => {
- const input = await fixture()
- await pinMigration(input, input.migration.assignmentEpoch)
- await clearActivities(input)
- await database.query(
- `UPDATE relay_assignments SET assignment_epoch = 4
- WHERE user_id = ? AND relay_host_id = ?`,
- [input.identity.userId, input.identity.relayHostId]
- )
- await database.query(
- `INSERT INTO relay_assignment_migrations
- (user_id, relay_host_id, source_cell_id, target_cell_id,
- previous_epoch, assignment_epoch, source_request_units,
- target_reserved_units, expires_at, target_registered_at,
- completed_at, aborted_at, created_at, updated_at)
- VALUES (?, ?, ?, ?, 2, 4, 0, 1, 0, 100, NULL, NULL, 100, 100)`,
- [
- input.identity.userId,
- input.identity.relayHostId,
- input.cells.source.id,
- input.cells.failed.id
- ]
- )
- await database.query(
- `INSERT INTO relay_assignment_migration_incarnations
- (user_id, relay_host_id, assignment_epoch, source_cell_incarnation,
- target_cell_incarnation)
- VALUES (?, ?, 4, ?, ?)`,
- [
- input.identity.userId,
- input.identity.relayHostId,
- input.cellIncarnation,
- input.cellIncarnation
- ]
- )
- await pinMigration(input, 4)
- await fenceFailedCell(input)
-
- await expect(supersedeAggregate(input)).resolves.toBe(1)
- expect(
- await database.query(
- `SELECT assignment_epoch, aborted_at FROM relay_assignment_migrations
- WHERE user_id = ? ORDER BY assignment_epoch`,
- [input.identity.userId]
- )
- ).toEqual([
- { assignment_epoch: '2', aborted_at: '45101' },
- { assignment_epoch: '4', aborted_at: '45101' },
- { assignment_epoch: '5', aborted_at: null }
- ])
- expect(await reservations(input.cells)).toEqual({
- source: 0,
- failed: 0,
- replacement: 1
- })
- })
-
- it('rejects a newer failed-cell epoch with ambiguous activity', async () => {
- const input = await fixture()
- await database.query(
- `UPDATE relay_assignments SET assignment_epoch = 4
- WHERE user_id = ? AND relay_host_id = ?`,
- [input.identity.userId, input.identity.relayHostId]
- )
- await fenceFailedCell(input)
-
- await expect(supersedeAggregate(input)).rejects.toThrow(
- 'migration_activity_topology_mismatch'
- )
- expect(
- await database.query(
- `SELECT assignment_epoch, aborted_at FROM relay_assignment_migrations
- WHERE user_id = ?`,
- [input.identity.userId]
- )
- ).toEqual([{ assignment_epoch: '2', aborted_at: null }])
- expect(await reservations(input.cells)).toEqual({
- source: 1,
- failed: 2,
- replacement: 0
- })
- })
-
- it('leaves lease repair retryable when supersession later fails', async () => {
- const input = await fixture(1)
- await database.query(
- `DELETE FROM relay_assignment_activity_leases
- WHERE user_id = ? AND relay_host_id = ? AND activity_kind = 'migration'`,
- [input.identity.userId, input.identity.relayHostId]
- )
- await database.query(
- `UPDATE relay_assignments SET migration_leases = 0
- WHERE user_id = ? AND relay_host_id = ?`,
- [input.identity.userId, input.identity.relayHostId]
- )
- await database.query(
- `UPDATE relay_cells SET reserved_requests = reserved_requests - 1
- WHERE cell_id = ?`,
- [input.cells.failed.id]
- )
- await database.query(
- `UPDATE relay_assignment_migrations SET expires_at = 0
- WHERE user_id = ? AND relay_host_id = ? AND assignment_epoch = ?`,
- [input.identity.userId, input.identity.relayHostId, input.migration.assignmentEpoch]
- )
- await fenceFailedCell(input)
-
- await expect(supersedeAggregate(input)).rejects.toThrow(
- 'relay_capacity_exhausted'
- )
- expect(
- await database.query(
- `SELECT activity_id FROM relay_assignment_activity_leases
- WHERE user_id = ? AND activity_kind = 'migration'`,
- [input.identity.userId]
- )
- ).toEqual([{ activity_id: 'migration:2' }])
- expect(
- await database.query(
- `SELECT aborted_at FROM relay_assignment_migrations
- WHERE user_id = ? AND assignment_epoch = 2`,
- [input.identity.userId]
- )
- ).toEqual([{ aborted_at: null }])
-
- await database.query(
- `UPDATE relay_cells SET capacity_requests = 2 WHERE cell_id = ?`,
- [input.cells.replacement.id]
- )
- await expect(supersedeAggregate(input)).resolves.toBe(1)
- expect(await reservations(input.cells)).toEqual({
- source: 1,
- failed: 0,
- replacement: 2
- })
- })
-
- it('serializes concurrent supersession retries without duplicating capacity', async () => {
- const input = await fixture()
- await input.store.setCellEnabled(input.cells.failed.id, false)
- input.advancePastHeartbeat()
- await input.heartbeat(input.cells.source)
- await input.heartbeat(input.cells.replacement)
- await input.store.attestCellFence(
- input.cells.failed.id,
- input.cellIncarnation
- )
- const supersession = {
- assignmentEpoch: input.migration.assignmentEpoch,
- sourceCellId: input.cells.source.id,
- currentTargetCellId: input.cells.failed.id,
- replacementTargetCellId: input.cells.replacement.id
- }
-
- const results = await Promise.all([
- input.store.supersedeRegisteredEvacuation(input.identity, supersession),
- input.store.supersedeRegisteredEvacuation(input.identity, supersession)
- ])
- expect(results[0]).toEqual(results[1])
- expect(await reservations(input.cells)).toEqual({ source: 1, failed: 0, replacement: 2 })
- expect(
- await database.query(
- `SELECT COUNT(*) AS count FROM relay_assignment_migrations WHERE user_id = ?`,
- [input.identity.userId]
- )
- ).toEqual([{ count: '2' }])
- })
-
it('fails a competing aggregate supersession instead of reporting the wrong target', async () => {
const input = await fixture()
const alternate = {
@@ -1205,153 +486,6 @@ describePostgres('PostgreSQL migration recovery', () => {
).toEqual([{ assignment_epoch: '2', aborted_at: null }])
})
- it('rolls back supersession when migration request-unit shape drifted', async () => {
- const input = await fixture()
- await input.store.setCellEnabled(input.cells.failed.id, false)
- input.advancePastHeartbeat()
- await input.heartbeat(input.cells.source)
- await input.heartbeat(input.cells.replacement)
- await input.store.attestCellFence(input.cells.failed.id, input.cellIncarnation)
- await database.query(
- `UPDATE relay_assignment_activity_leases
- SET request_units = request_units + 1
- WHERE user_id = ? AND activity_kind = 'migration'`,
- [input.identity.userId]
- )
- await database.query(
- `UPDATE relay_cells SET reserved_requests = reserved_requests + 1 WHERE cell_id = ?`,
- [input.cells.failed.id]
- )
-
- await expect(
- input.store.supersedeRegisteredEvacuation(input.identity, {
- assignmentEpoch: input.migration.assignmentEpoch,
- sourceCellId: input.cells.source.id,
- currentTargetCellId: input.cells.failed.id,
- replacementTargetCellId: input.cells.replacement.id
- })
- ).rejects.toThrow('migration_activity_lease_shape_mismatch')
- expect(await reservations(input.cells)).toEqual({ source: 1, failed: 3, replacement: 0 })
- expect(
- await database.query(
- `SELECT cell_id, assignment_epoch FROM relay_assignments WHERE user_id = ?`,
- [input.identity.userId]
- )
- ).toEqual([{ cell_id: input.cells.failed.id, assignment_epoch: '2' }])
- })
-
- it('rolls back supersession when locked cell reservation accounting drifted', async () => {
- const input = await fixture()
- await input.store.setCellEnabled(input.cells.failed.id, false)
- input.advancePastHeartbeat()
- await input.heartbeat(input.cells.source)
- await input.heartbeat(input.cells.replacement)
- await input.store.attestCellFence(input.cells.failed.id, input.cellIncarnation)
- await database.query(
- `UPDATE relay_cells SET reserved_requests = 1 WHERE cell_id = ?`,
- [input.cells.replacement.id]
- )
-
- await expect(
- input.store.supersedeRegisteredEvacuation(input.identity, {
- assignmentEpoch: input.migration.assignmentEpoch,
- sourceCellId: input.cells.source.id,
- currentTargetCellId: input.cells.failed.id,
- replacementTargetCellId: input.cells.replacement.id
- })
- ).rejects.toThrow('migration_cell_reservation_accounting_mismatch')
- expect(await reservations(input.cells)).toEqual({ source: 1, failed: 2, replacement: 1 })
- expect(
- await database.query(
- `SELECT assignment_epoch, aborted_at FROM relay_assignment_migrations
- WHERE user_id = ?`,
- [input.identity.userId]
- )
- ).toEqual([{ assignment_epoch: '2', aborted_at: null }])
- })
-
- async function fenceFailedCell(input: RecoveryFixture): Promise {
- await input.store.setCellEnabled(input.cells.failed.id, false)
- input.advancePastHeartbeat()
- await input.heartbeat(input.cells.source)
- await input.heartbeat(input.cells.replacement)
- await input.store.attestCellFence(
- input.cells.failed.id,
- input.cellIncarnation
- )
- }
-
- async function supersedeAggregate(input: RecoveryFixture): Promise {
- return await input.store.supersedeRegisteredCellEvacuations(
- input.cells.source.id,
- input.cells.failed.id,
- input.cells.replacement.id,
- 100
- )
- }
-
- async function clearActivities(input: RecoveryFixture): Promise {
- await database.query(
- `DELETE FROM relay_assignment_activity_leases
- WHERE user_id = ? AND relay_host_id = ?`,
- [input.identity.userId, input.identity.relayHostId]
- )
- await database.query(
- `UPDATE relay_assignments SET reserved_controls = 0, reserved_splices = 0,
- reserved_invites = 0, pending_installs = 0, pending_confirmations = 0,
- migration_leases = 0
- WHERE user_id = ? AND relay_host_id = ?`,
- [input.identity.userId, input.identity.relayHostId]
- )
- await database.query(
- `UPDATE relay_cells SET reserved_requests = 0
- WHERE cell_id IN (?, ?, ?)`,
- [input.cells.source.id, input.cells.failed.id, input.cells.replacement.id]
- )
- }
-
- async function pinMigration(
- input: RecoveryFixture,
- assignmentEpoch: number
- ): Promise {
- const drainAttemptId = `${input.identity.userId}-drain-${assignmentEpoch}`
- await database.query(
- `INSERT INTO relay_post_drain_migration_pins
- (user_id, relay_host_id, assignment_epoch, drain_attempt_id,
- source_cell_id, source_cell_incarnation, target_cell_id,
- target_cell_incarnation, source_request_units, target_reserved_units,
- pinned_at)
- SELECT migration.user_id, migration.relay_host_id,
- migration.assignment_epoch, ?, migration.source_cell_id,
- incarnation.source_cell_incarnation, migration.target_cell_id,
- incarnation.target_cell_incarnation, migration.source_request_units,
- migration.target_reserved_units, 100
- FROM relay_assignment_migrations migration
- JOIN relay_assignment_migration_incarnations incarnation
- ON incarnation.user_id = migration.user_id
- AND incarnation.relay_host_id = migration.relay_host_id
- AND incarnation.assignment_epoch = migration.assignment_epoch
- WHERE migration.user_id = ? AND migration.relay_host_id = ?
- AND migration.assignment_epoch = ?`,
- [
- drainAttemptId,
- input.identity.userId,
- input.identity.relayHostId,
- assignmentEpoch
- ]
- )
- return drainAttemptId
- }
-
- async function assignmentActivities(input: RecoveryFixture): Promise {
- return await database.query(
- `SELECT activity_id, activity_kind, cell_id, request_units
- FROM relay_assignment_activity_leases
- WHERE user_id = ? AND relay_host_id = ? ORDER BY activity_id`,
- [input.identity.userId, input.identity.relayHostId]
- )
- }
-
async function reservations(cells: RecoveryFixture['cells']): Promise> {
const rows = await database.query(
`SELECT cell_id, reserved_requests FROM relay_cells
diff --git a/cloud/apps/relay/src/assignment/regional-rehome/regional-rehome-store.test.ts b/cloud/apps/relay/src/assignment/regional-rehome/regional-rehome-store.test.ts
index 9b14e2a4764..7a66cba3a91 100644
--- a/cloud/apps/relay/src/assignment/regional-rehome/regional-rehome-store.test.ts
+++ b/cloud/apps/relay/src/assignment/regional-rehome/regional-rehome-store.test.ts
@@ -1,22 +1,12 @@
import { describe, expect, it } from 'vitest'
-import { readAssignmentInventorySnapshot } from '../assignment-inventory-snapshot.js'
-import { REGIONAL_REHOME_ARRIVAL_WINDOW_MS } from './regional-rehome-abort-reason.js'
import {
RelayAssignmentStore as BaseRelayAssignmentStore,
- type RegionalRehomeAttempt,
- REGIONAL_REHOME_QUARANTINE_FAILURES,
- REGIONAL_REHOME_QUARANTINE_MS
+ type RegionalRehomeAttempt
} from '../assignment-store.js'
import {
openInMemoryRelayDatabase,
- type RelayDatabase,
- type RelayLockOptions
+ type RelayDatabase
} from '../../database/database.js'
-import {
- REGIONAL_REHOME_SQL_FAILURES_LIMIT,
- REGIONAL_REHOME_SQL_FAILURES_PER_CELL_LIMIT,
- REGIONAL_REHOME_SQL_FAILURES_SUSTAIN_MS
-} from './regional-rehome-safety.js'
import type { RegionalRehomeSafetySnapshot } from '../../observability/relay-observability.js'
const source = {
@@ -35,129 +25,11 @@ const target = {
connectionHardCap: 1_000 as const,
connectionUnobservedBound: 60
}
-// Bystander participates only in fleet safety.
-const bystander = { ...source, id: 'us-c2', url: 'https://us-c2.relay.example.test' }
const sourceIncarnation = '11111111-1111-4111-8111-111111111111'
const targetIncarnation = '22222222-2222-4222-8222-222222222222'
-const bystanderIncarnation = '33333333-3333-4333-8333-333333333333'
describe('regional rehome assignment state', () => {
- it('defaults optional correction off even with enabled durable control', async () => {
- const context = await setup()
- await activatePreferredSource(context, { userId: 'cohort', relayHostId: 'abcdefghijklmnop' })
- const defaultStore = new IdleRehomeTestStore(context.database, context.now, {
- requireLiveCells: true
- })
- expect(await defaultStore.tryIdleRehome()).toBeNull()
- expect(
- await context.database.query('SELECT attempt_id FROM relay_region_rehome_attempts')
- ).toEqual([])
- expect(await context.store.tryIdleRehome()).not.toBeNull()
- await context.database.close()
- })
-
- it('counts pre-existing generic migrations against the eight-migration cap', async () => {
- const context = await setup()
- await activatePreferredSource(context, { userId: 'cap', relayHostId: 'abcdefghijklmnop' })
- for (let i = 0; i < 8; i++) {
- await context.database.query(
- `INSERT INTO relay_assignment_migrations
- (user_id, relay_host_id, source_cell_id, target_cell_id, previous_epoch, assignment_epoch,
- source_request_units, target_reserved_units, expires_at, created_at, updated_at)
- VALUES (?, ?, ?, ?, 1, 2, 1, 1, ?, ?, ?)`,
- [
- 'generic',
- `synthetic-migration-${i}`,
- source.id,
- target.id,
- context.now() + 60_000,
- context.now(),
- context.now()
- ]
- )
- }
- expect(await context.store.tryIdleRehome()).toBeNull()
- await context.database.query(
- `UPDATE relay_assignment_migrations SET completed_at = ?
- WHERE user_id = 'generic' AND relay_host_id = 'synthetic-migration-0'`,
- [context.now()]
- )
- expect(await context.store.tryIdleRehome()).not.toBeNull()
- const open = await context.database
- .query(`SELECT COUNT(*) AS count FROM relay_assignment_migrations
- WHERE completed_at IS NULL AND aborted_at IS NULL`)
- expect(Number(open[0]?.count)).toBe(8)
- await context.database.close()
- })
-
- it('does not let legacy hints certify a move', async () => {
- const context = await setup()
- await activatePreferredSource(context, { userId: 'legacy', relayHostId: 'abcdefghijklmnop' })
- await context.database.query('DELETE FROM relay_region_decisions')
- expect(await context.store.tryIdleRehome()).toBeNull()
- await context.database.close()
- })
-
- it('refreshes later open attempts when an older attempt occupies the first page', async () => {
- const context = await setup()
- await activatePreferredSource(context, { userId: 'page-1', relayHostId: 'abcdefghijklmnop' })
- const first = await context.store.tryIdleRehome()
- context.advance(10_000)
- await freshHeartbeats(context)
- await activatePreferredSource(context, { userId: 'page-2', relayHostId: 'abcdefghijklmnop' })
- const second = await context.store.tryIdleRehome()
- expect(second).not.toBeNull()
- context.advance(1_000)
- expect(await context.store.refreshRegionalRehomeLeases(1)).toBe(1)
- context.advance(1_000)
- expect(await context.store.refreshRegionalRehomeLeases(1)).toBe(1)
- const rows = await context.database.query(
- `SELECT attempt_id, updated_at FROM relay_region_rehome_attempts
- WHERE attempt_id = ?`,
- [second!.attemptId]
- )
- expect(Number(rows[0]?.updated_at)).toBe(context.now())
- await context.database.close()
- })
-
- it('uses a generation-bound durable kill switch', async () => {
- const context = await setup()
- expect(await context.store.inspectRegionalRehomeControl()).toMatchObject({
- generation: 1,
- enabled: true,
- ratePerMinute: 10
- })
- expect(await context.store.disableRegionalRehomeControl()).toBe(true)
- expect(await context.store.inspectRegionalRehomeControl()).toMatchObject({
- generation: 2,
- enabled: false
- })
- await expect(
- context.store.applyRegionalRehomeControl({
- expectedGeneration: 1,
- enabled: true,
- notBefore: context.now(),
- ratePerMinute: 10,
- preferenceMaxAgeMs: 24 * 60 * 60_000,
- hostCooldownMs: 7 * 24 * 60 * 60_000,
- drainGraceMs: 60_000
- })
- ).rejects.toThrow('regional_rehome_generation_mismatch')
- await expect(
- context.store.applyRegionalRehomeControl({
- expectedGeneration: 2,
- enabled: true,
- notBefore: context.now(),
- ratePerMinute: 10,
- preferenceMaxAgeMs: 24 * 60 * 60_000,
- hostCooldownMs: 7 * 24 * 60 * 60_000,
- drainGraceMs: 60_000
- })
- ).resolves.toMatchObject({ generation: 3, enabled: true })
- await context.database.close()
- })
-
it('moves one live preferred host and completes without disabling its source cell', async () => {
const context = await setup()
const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
@@ -220,563 +92,6 @@ describe('regional rehome assignment state', () => {
await context.database.close()
})
- it('requires an advertised source capability', async () => {
- const context = await setup({ sourceProtocol: 0 })
- await activatePreferredSource(context, {
- userId: 'user-1',
- relayHostId: 'abcdefghijklmnop'
- })
- expect(await context.store.tryIdleRehome()).toBeNull()
- expect(await context.database.query(`SELECT * FROM relay_assignment_migrations`)).toEqual([])
- await context.database.close()
- })
-
- it('claims through the measured healthy baseline of pool micro-waits and churn', async () => {
- const context = await setup()
- const baseline = {
- observedAt: context.now(),
- sqlFailures: 0,
- reconnects: 42,
- controlActivityRecoveryFailures: 0,
- databasePoolWaiting: 2,
- databasePoolWaitersMax: 2,
- databasePoolWaitMsMax: 1
- }
- await heartbeat(context.store, source, sourceIncarnation, 3, 2, baseline)
- await heartbeat(context.store, target, targetIncarnation, 3, 2, baseline)
- await activatePreferredSource(context, {
- userId: 'user-1',
- relayHostId: 'abcdefghijklmnop'
- })
-
- expect(await context.store.tryIdleRehome()).toMatchObject({
- sourceCellId: source.id,
- targetCellId: target.id
- })
- expect(await context.store.inspectRegionalRehomeControl()).toMatchObject({
- enabled: true
- })
- await context.database.close()
- })
-
- it('latches off on a per-cell reconnect storm even when the fleet sum is low', async () => {
- const context = await setup()
- await activatePreferredSource(context, {
- userId: 'user-1',
- relayHostId: 'abcdefghijklmnop'
- })
- const safety: RegionalRehomeSafetySnapshot = {
- observedAt: context.now(),
- sqlFailures: 0,
- reconnects: 0,
- controlActivityRecoveryFailures: 0,
- databasePoolWaiting: 0,
- databasePoolWaitersMax: 0,
- databasePoolWaitMsMax: 0
- }
- const [candidate] = await context.store.selectIdleRegionalRehomeCandidates(safety)
- expect(candidate).toBeDefined()
- await context.database.query(
- `UPDATE relay_cell_rehome_safety SET reconnects = 251 WHERE cell_id = ?`,
- [source.id]
- )
-
- const warnings = collectDisableWarnings()
- try {
- expect(await context.store.commitIdleRegionalRehome(candidate!, safety)).toEqual({
- outcome: 'deferred',
- reason: 'fleet-safety'
- })
- } finally {
- warnings.restore()
- }
- expect(await context.store.inspectRegionalRehomeControl()).toMatchObject({
- generation: 2,
- enabled: false
- })
- expect(warnings.entries).toMatchObject([
- { reason: 'elevated_reconnects', maxReconnects: 251, controlGeneration: 2 }
- ])
- await context.database.close()
- })
-
- it('defers on target pool pressure without disabling, and claims once it clears', async () => {
- const context = await setup()
- await activatePreferredSource(context, {
- userId: 'user-1',
- relayHostId: 'abcdefghijklmnop'
- })
- const safety: RegionalRehomeSafetySnapshot = {
- observedAt: context.now(),
- sqlFailures: 0,
- reconnects: 0,
- controlActivityRecoveryFailures: 0,
- databasePoolWaiting: 0,
- databasePoolWaitersMax: 0,
- databasePoolWaitMsMax: 0
- }
- const [candidate] = await context.store.selectIdleRegionalRehomeCandidates(safety)
- expect(candidate).toBeDefined()
- await context.database.query(
- `UPDATE relay_cell_rehome_safety SET database_pool_waiters_max = 17 WHERE cell_id = ?`,
- [target.id]
- )
-
- const warnings = collectDisableWarnings()
- try {
- expect(await context.store.commitIdleRegionalRehome(candidate!, safety)).toEqual({
- outcome: 'deferred',
- reason: 'candidate-ineligible'
- })
- } finally {
- warnings.restore()
- }
- // A scan-to-commit pool breach must skip without permanently disabling the worker.
- expect(await context.store.inspectRegionalRehomeControl()).toMatchObject({
- generation: 1,
- enabled: true
- })
- expect(warnings.entries).toEqual([])
-
- await context.database.query(
- `UPDATE relay_cell_rehome_safety SET database_pool_waiters_max = 0 WHERE cell_id = ?`,
- [target.id]
- )
- expect(await context.store.tryIdleRehome()).toMatchObject({
- userId: 'user-1',
- sourceCellId: source.id,
- targetCellId: target.id
- })
- await context.database.close()
- })
-
- it('keeps selecting candidates while an unrelated cell is over the pool bar', async () => {
- // Fleet Math.max once let one narrow client pool empty every page.
- const context = await setup()
- await activatePreferredSource(context, {
- userId: 'user-1',
- relayHostId: 'abcdefghijklmnop'
- })
- await context.store.reconcileCells([source, target, bystander])
- await heartbeat(context.store, bystander, bystanderIncarnation, 3, 2, {
- observedAt: context.now(),
- sqlFailures: 0,
- reconnects: 0,
- controlActivityRecoveryFailures: 0,
- databasePoolWaiting: 150,
- databasePoolWaitersMax: 150,
- databasePoolWaitMsMax: 2_005
- })
-
- const safety: RegionalRehomeSafetySnapshot = {
- observedAt: context.now(),
- sqlFailures: 0,
- reconnects: 0,
- controlActivityRecoveryFailures: 0,
- databasePoolWaiting: 0,
- databasePoolWaitersMax: 0,
- databasePoolWaitMsMax: 0
- }
- expect(await context.store.selectIdleRegionalRehomeCandidates(safety)).toMatchObject([
- { sourceCellId: source.id, targetCellId: target.id }
- ])
- await context.database.close()
- })
-
- it('claims through ambient per-cell sql retry noise', async () => {
- const context = await setup()
- await activatePreferredSource(context, {
- userId: 'user-1',
- relayHostId: 'abcdefghijklmnop'
- })
- await context.database.query(
- `UPDATE relay_cell_rehome_safety SET sql_failures = ${REGIONAL_REHOME_SQL_FAILURES_PER_CELL_LIMIT}`
- )
-
- expect(await context.store.tryIdleRehome()).not.toBeNull()
- await context.database.close()
- })
-
- it('moves a live host on an asia-east2 cell back to its preferred us-central1 cell', async () => {
- const context = await setup()
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- await activateReversePreferredSource(context, identity)
-
- const attempt = await context.store.tryIdleRehome()
- expect(attempt).toMatchObject({
- userId: identity.userId,
- relayHostId: identity.relayHostId,
- preferredRegion: 'us-central1',
- sourceCellId: target.id,
- sourceCellIncarnation: targetIncarnation,
- targetCellId: source.id,
- targetCellIncarnation: sourceIncarnation,
- previousEpoch: 1,
- assignmentEpoch: 2,
- sendAttempts: 1
- })
- expect(
- await context.database.query(
- `SELECT preferred_region, source_cell_id, target_cell_id
- FROM relay_region_rehome_attempts`
- )
- ).toEqual([
- {
- preferred_region: 'us-central1',
- source_cell_id: target.id,
- target_cell_id: source.id
- }
- ])
- expect(await context.store.resolve(identity)).toMatchObject({ cellId: source.id })
- await context.database.close()
- })
-
- it('drops a candidate at scan time when no cell in the preferred region is usable', async () => {
- const context = await setup()
- await activatePreferredSource(context, {
- userId: 'user-1',
- relayHostId: 'abcdefghijklmnop'
- })
- // Exclude certain skips during selection or they consume candidate-page slots.
- await context.database.query(`UPDATE relay_cells SET enabled = 0 WHERE cell_id = ?`, [
- target.id
- ])
-
- const warnings = collectEventWarnings('orca_relay_regional_rehome_candidates_skipped')
- try {
- expect(await context.store.tryIdleRehome()).toBeNull()
- } finally {
- warnings.restore()
- }
- expect(warnings.entries).toEqual([])
- expect(
- await context.database.query(`SELECT next_dispatch_at FROM relay_region_rehome_worker_state`)
- ).toEqual([{ next_dispatch_at: 0 }])
- expect(await context.database.query(`SELECT * FROM relay_assignment_migrations`)).toEqual([])
- await context.database.close()
- })
-
- it('does not migrate when the last target is lost between selection and commit', async () => {
- const database = await openInMemoryRelayDatabase()
- const context = await setup({
- database,
- wrap: (delegate) =>
- hookAfterCandidateScan(delegate, async (transaction) => {
- await transaction.query(`UPDATE relay_cells SET enabled = 0 WHERE cell_id = ?`, [
- target.id
- ])
- })
- })
- await activatePreferredSource(context, {
- userId: 'user-1',
- relayHostId: 'abcdefghijklmnop'
- })
-
- expect(await context.store.tryIdleRehome()).toBeNull()
-
- expect(await context.store.inspectRegionalRehomeControl()).toMatchObject({
- generation: 1,
- enabled: true
- })
- expect(await database.query(`SELECT * FROM relay_assignment_migrations`)).toEqual([])
- await database.close()
- })
-
- it('leaves a host alone until its cooldown expires, then moves it back', async () => {
- const context = await setup({ hostCooldownMs: 3 * 24 * 60 * 60_000 })
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- const targetControl = await completeRehomeToTarget(context, identity)
- // Pass dispatch interval so only cooldown prevents another claim.
- context.advance(10_000)
- await activateReversePreferredSource(context, identity)
-
- const warnings = collectEventWarnings('orca_relay_regional_rehome_candidates_skipped')
- try {
- expect(await context.store.tryIdleRehome()).toBeNull()
- } finally {
- warnings.restore()
- }
- expect(warnings.entries).toEqual([])
- expect(await context.store.resolve(identity)).toMatchObject({ cellId: target.id })
-
- context.advance(3 * 24 * 60 * 60_000)
- await freshHeartbeats(context)
- await context.store.renewControlActivity(identity, {
- activityId: targetControl,
- cellId: target.id,
- expiresAt: context.now() + 90_000
- })
- await activateReversePreferredSource(context, identity)
-
- const attempt = await context.store.tryIdleRehome()
- expect(attempt).toMatchObject({
- preferredRegion: 'us-central1',
- sourceCellId: target.id,
- targetCellId: source.id
- })
- await context.database.close()
- })
-
- it('rejects a host whose attempt lands between the scan and the claim', async () => {
- const database = await openInMemoryRelayDatabase()
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- const context = await setup({
- database,
- wrap: (delegate) =>
- hookAfterCandidateScan(delegate, async (transaction) => {
- await transaction.query(
- `INSERT INTO relay_region_rehome_attempts
- (attempt_id, user_id, relay_host_id, preferred_region, source_cell_id,
- source_cell_incarnation, target_cell_id, target_cell_incarnation,
- previous_epoch, assignment_epoch, drain_grace_ms, send_attempts,
- created_at, updated_at)
- VALUES ('raced', ?, ?, 'asia-east2', ?, ?, ?, ?, 0, 1, 0, 0, ?, ?)`,
- [
- identity.userId,
- identity.relayHostId,
- source.id,
- sourceIncarnation,
- target.id,
- targetIncarnation,
- context.now(),
- context.now()
- ]
- )
- })
- })
- await activatePreferredSource(context, identity)
-
- expect(await context.store.tryIdleRehome()).toBeNull()
-
- expect(await database.query(`SELECT * FROM relay_assignment_migrations`)).toEqual([])
- await database.close()
- })
-
- it('does not scan a candidate whose preferred region has no drainable cell', async () => {
- // Without drain protocol the target could never rehome hosts back out; exclude before inventory scans.
- const context = await setup({ targetProtocol: 0 })
- await activatePreferredSource(context, {
- userId: 'user-1',
- relayHostId: 'abcdefghijklmnop'
- })
-
- const warnings = collectEventWarnings('orca_relay_regional_rehome_candidates_skipped')
- try {
- expect(await context.store.tryIdleRehome()).toBeNull()
- } finally {
- warnings.restore()
- }
- expect(warnings.entries).toEqual([])
- expect(
- await context.database.query(`SELECT next_dispatch_at FROM relay_region_rehome_worker_state`)
- ).toEqual([{ next_dispatch_at: 0 }])
- expect(await context.database.query(`SELECT * FROM relay_assignment_migrations`)).toEqual([])
- await context.database.close()
- })
-
- it('skips an unclean cell without latching the control off', async () => {
- const context = await setup()
- await activatePreferredSource(context, {
- userId: 'user-1',
- relayHostId: 'abcdefghijklmnop'
- })
- await activatePreferredSource(context, {
- userId: 'user-2',
- relayHostId: 'ponmlkjihgfedcba'
- })
- // Per-cell bar can skip a candidate while fleet safety keeps the worker enabled.
- await context.database.query(
- `UPDATE relay_cell_rehome_safety SET sql_failures = ${REGIONAL_REHOME_SQL_FAILURES_PER_CELL_LIMIT + 1} WHERE cell_id = ?`,
- [target.id]
- )
-
- expect(await context.store.tryIdleRehome()).toBeNull()
- expect(await context.store.inspectRegionalRehomeControl()).toMatchObject({
- generation: 1,
- enabled: true
- })
-
- expect(
- await context.database.query(`SELECT next_dispatch_at FROM relay_region_rehome_worker_state`)
- ).toEqual([{ next_dispatch_at: 0 }])
- expect(await context.database.query(`SELECT * FROM relay_assignment_migrations`)).toEqual([])
- await context.database.close()
- })
-
- it('pauses the claim without latching when a sql spike lands between selection and commit', async () => {
- const context = await setup()
- await activatePreferredSource(context, {
- userId: 'user-1',
- relayHostId: 'abcdefghijklmnop'
- })
- const safety: RegionalRehomeSafetySnapshot = {
- observedAt: context.now(),
- sqlFailures: 0,
- reconnects: 0,
- controlActivityRecoveryFailures: 0,
- databasePoolWaiting: 0,
- databasePoolWaitersMax: 0,
- databasePoolWaitMsMax: 0
- }
- const [candidate] = await context.store.selectIdleRegionalRehomeCandidates(safety)
- expect(candidate).toBeDefined()
- await context.database.query(
- `UPDATE relay_cell_rehome_safety SET sql_failures = ${REGIONAL_REHOME_SQL_FAILURES_LIMIT + 1} WHERE cell_id = ?`,
- [target.id]
- )
-
- expect(await context.store.commitIdleRegionalRehome(candidate!, safety)).toEqual({
- outcome: 'deferred',
- reason: 'fleet-safety'
- })
- expect(await context.store.inspectRegionalRehomeControl()).toMatchObject({
- generation: 1,
- enabled: true
- })
- expect(
- await context.database.query(
- `SELECT consecutive_failures FROM relay_region_rehome_worker_state`
- )
- ).toEqual([{ consecutive_failures: 0 }])
- expect(await context.database.query(`SELECT * FROM relay_assignment_migrations`)).toEqual([])
- await context.database.close()
- })
-
- it('rides out a single-stall sql spike without latching the control off', async () => {
- const context = await setup()
- // 10-06 06:16Z: one stall put the fleet sum at 396 for about a minute.
- for (let elapsed = 0; elapsed <= 90_000; elapsed += 6_000) {
- await sqlFailuresHeartbeats(context, 396)
- expect(await context.store.selectIdleRegionalRehomeCandidates(cleanSafety(context))).toEqual(
- []
- )
- context.advance(6_000)
- }
- await sqlFailuresHeartbeats(context, 0)
- await activatePreferredSource(context, { userId: 'user-1', relayHostId: 'abcdefghijklmnop' })
- expect(
- await context.store.selectIdleRegionalRehomeCandidates(cleanSafety(context))
- ).toHaveLength(1)
- // The next stall, ~610 s later, starts its own breach rather than extending the last one.
- context.advance(500_000)
- for (let elapsed = 0; elapsed <= 90_000; elapsed += 6_000) {
- await sqlFailuresHeartbeats(context, 396)
- await context.store.selectIdleRegionalRehomeCandidates(cleanSafety(context))
- context.advance(6_000)
- }
- expect(await context.store.inspectRegionalRehomeControl()).toMatchObject({
- generation: 1,
- enabled: true
- })
- await context.database.close()
- })
-
- it('latches the control off when the sql breach outlasts a stall', async () => {
- const context = await setup()
- await activatePreferredSource(context, { userId: 'user-1', relayHostId: 'abcdefghijklmnop' })
- const warnings = collectEventWarnings('orca_relay_regional_rehome_safety_disabled')
- try {
- for (let elapsed = 0; elapsed < REGIONAL_REHOME_SQL_FAILURES_SUSTAIN_MS; elapsed += 6_000) {
- await sqlFailuresHeartbeats(context, REGIONAL_REHOME_SQL_FAILURES_LIMIT + 1)
- await context.store.selectIdleRegionalRehomeCandidates(cleanSafety(context))
- context.advance(6_000)
- }
- expect(await context.store.inspectRegionalRehomeControl()).toMatchObject({ enabled: true })
- await sqlFailuresHeartbeats(context, REGIONAL_REHOME_SQL_FAILURES_LIMIT + 1)
- expect(await context.store.selectIdleRegionalRehomeCandidates(cleanSafety(context))).toEqual(
- []
- )
- } finally {
- warnings.restore()
- }
- expect(await context.store.inspectRegionalRehomeControl()).toMatchObject({
- generation: 2,
- enabled: false
- })
- expect(warnings.entries).toMatchObject([
- { reason: 'sql_failures', controlGeneration: 2, sustainedMs: 150_000 }
- ])
- await context.database.close()
- })
-
- it('still latches on a non-sql reason that fails alongside a sql spike', async () => {
- const context = await setup()
- await activatePreferredSource(context, { userId: 'user-1', relayHostId: 'abcdefghijklmnop' })
- const [candidate] = await context.store.selectIdleRegionalRehomeCandidates(cleanSafety(context))
- expect(candidate).toBeDefined()
- await context.database.query(
- `UPDATE relay_cell_rehome_safety
- SET sql_failures = ${REGIONAL_REHOME_SQL_FAILURES_LIMIT + 1}, control_activity_recovery_failures = 1
- WHERE cell_id = ?`,
- [target.id]
- )
- expect(await context.store.commitIdleRegionalRehome(candidate!, cleanSafety(context))).toEqual({
- outcome: 'deferred',
- reason: 'fleet-safety'
- })
- expect(await context.store.inspectRegionalRehomeControl()).toMatchObject({
- generation: 2,
- enabled: false
- })
- await context.database.close()
- })
-
- it('refreshes only the migration leases while source splices drain', async () => {
- const context = await setup()
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- await activatePreferredSource(context, identity)
- await context.store.acquireActivity(identity, {
- activityId: 'splice:source',
- kind: 'splice',
- cellId: source.id
- })
- await context.store.tryIdleRehome()
- const before = await context.database.query(
- `SELECT activity_id, expires_at FROM relay_assignment_activity_leases
- WHERE user_id = ? AND relay_host_id = ? ORDER BY activity_id`,
- [identity.userId, identity.relayHostId]
- )
- context.advance(60_000)
- expect(await context.store.refreshRegionalRehomeLeases()).toBe(1)
- const after = await context.database.query(
- `SELECT activity_id, expires_at FROM relay_assignment_activity_leases
- WHERE user_id = ? AND relay_host_id = ? ORDER BY activity_id`,
- [identity.userId, identity.relayHostId]
- )
- const beforeById = new Map(before.map((row) => [row.activity_id, row.expires_at]))
- const afterById = new Map(after.map((row) => [row.activity_id, row.expires_at]))
- expect(Number(afterById.get('migration:2'))).toBeGreaterThan(
- Number(beforeById.get('migration:2'))
- )
- expect(Number(afterById.get('control-pending:2'))).toBeGreaterThan(
- Number(beforeById.get('control-pending:2'))
- )
- expect(afterById.get('splice:source')).toBe(beforeById.get('splice:source'))
- await context.database.close()
- })
-
- it('stops refreshing an unregistered target and lets normal rollback retire it', async () => {
- const context = await setup()
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- await activatePreferredSource(context, identity)
- await context.store.tryIdleRehome()
- context.advance(6 * 60_000)
- expect(await context.store.refreshRegionalRehomeLeases()).toBe(0)
- await heartbeat(context.store, source, sourceIncarnation, 3, 2)
- expect(await context.store.abortExpiredEvacuations()).toBe(1)
- expect(await context.store.reapRegionalRehomeAttempts()).toBe(0)
- expect(await context.store.resolve(identity)).toMatchObject({
- cellId: source.id,
- assignmentEpoch: 3
- })
- expect(
- await context.database.query(
- `SELECT completed_at, aborted_at FROM relay_region_rehome_attempts`
- )
- ).toEqual([{ completed_at: null, aborted_at: context.now() }])
- await context.database.close()
- })
-
it('does not roll an unregistered target back to a stale regional source', async () => {
const context = await setup()
const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
@@ -797,286 +112,6 @@ describe('regional rehome assignment state', () => {
await context.database.close()
})
- // Two contended candidates expose an erroneous break; the redrain lane reaches inventory through its separate fleet-safety read.
- it('completes a candidate behind two contended ones', async () => {
- const probe = new CellInventoryLockProbe()
- const context = await setup({ wrap: (database) => probe.wrap(database) })
- const identities = [
- { userId: 'user-1', relayHostId: 'abcdefghijklmnop' },
- { userId: 'user-2', relayHostId: 'ponmlkjihgfedcba' },
- { userId: 'user-3', relayHostId: 'aaaabbbbccccdddd' }
- ]
- for (const identity of identities) {
- // Dispatch is rate limited, so each claim needs its own interval.
- context.advance(60_000)
- await freshHeartbeats(context)
- const sourceControl = await activatePreferredSource(context, identity)
- const attempt = await context.store.tryIdleRehome()
- await context.store.activateControl(identity, {
- cellId: target.id,
- assignmentEpoch: 2,
- generation: 1
- })
- await context.store.markMigrationTargetRegistered(identity, {
- cellId: target.id,
- assignmentEpoch: 2
- })
- await context.store.releaseActivity(identity, sourceControl)
- }
- probe.reset()
- probe.failNoWaitTimes = 2
- const busy = collectEventWarnings('orca_relay_sweep_cell_inventory_busy')
-
- let completed: number
- try {
- completed = await context.store.completeReadyRegionalRehomes()
- } finally {
- busy.restore()
- }
-
- expect(completed).toBe(1)
- expect(busy.entries).toEqual([
- {
- event: 'orca_relay_sweep_cell_inventory_busy',
- sweep: 'complete-ready-regional-rehomes',
- skipped: 2
- }
- ])
- await context.database.close()
- })
-
- // Only inventory contention is ordinary; other failures must propagate and count against dispatch.
-
- // One inventory failure abandons the transaction’s whole candidate page, so count all candidates skipped.
-
- it('skips a completion tick on a contended cell inventory without quarantining it', async () => {
- const probe = new CellInventoryLockProbe()
- const context = await setup({ wrap: (database) => probe.wrap(database) })
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- const sourceControl = await activatePreferredSource(context, identity)
- const attempt = await context.store.tryIdleRehome()
- await context.store.activateControl(identity, {
- cellId: target.id,
- assignmentEpoch: 2,
- generation: 1
- })
- await context.store.markMigrationTargetRegistered(identity, {
- cellId: target.id,
- assignmentEpoch: 2
- })
- await context.store.releaseActivity(identity, sourceControl)
- probe.reset()
- probe.failNoWait = true
- const busy = collectEventWarnings('orca_relay_sweep_cell_inventory_busy')
- const failures = collectCandidateFailureWarnings()
-
- let completed: number
- try {
- completed = await context.store.completeReadyRegionalRehomes()
- } finally {
- failures.restore()
- busy.restore()
- }
-
- expect(completed).toBe(0)
- expect(probe.locks).not.toEqual([])
- expect(probe.locks.every((options) => options?.failIfUnavailable === true)).toBe(true)
- expect(failures.entries).toEqual([])
- expect(busy.entries).toEqual([
- {
- event: 'orca_relay_sweep_cell_inventory_busy',
- sweep: 'complete-ready-regional-rehomes',
- skipped: 1
- }
- ])
-
- probe.failNoWait = false
- expect(await context.store.completeReadyRegionalRehomes()).toBe(1)
- await context.database.close()
- })
-
- // Inventory contention is temporary; quarantining it would hide healthy attempts from LIMIT pages for 15min.
- it('skips an abort tick on a contended cell inventory without quarantining it', async () => {
- const probe = new CellInventoryLockProbe()
- const context = await setup({ wrap: (database) => probe.wrap(database) })
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- const sourceControl = await activatePreferredSource(context, identity)
- const attempt = await context.store.tryIdleRehome()
- const targetControl = await context.store.activateControl(identity, {
- cellId: target.id,
- assignmentEpoch: 2,
- generation: 1
- })
- await context.store.markMigrationTargetRegistered(identity, {
- cellId: target.id,
- assignmentEpoch: 2
- })
- await context.store.releaseActivity(identity, sourceControl)
- await context.store.releaseActivity(identity, targetControl)
- context.advance(24 * 60 * 60_000)
- await heartbeat(context.store, source, sourceIncarnation, 3, 2)
- probe.reset()
- probe.failNoWait = true
- const busy = collectEventWarnings('orca_relay_sweep_cell_inventory_busy')
- const failures = collectCandidateFailureWarnings()
-
- let aborted: number
- try {
- aborted = await context.store.abortExpiredRegionalRehomes()
- } finally {
- failures.restore()
- busy.restore()
- }
-
- expect(aborted).toBe(0)
- expect(probe.locks).not.toEqual([])
- expect(probe.locks.every((options) => options?.failIfUnavailable === true)).toBe(true)
- expect(failures.entries).toEqual([])
- expect(busy.entries).toEqual([
- {
- event: 'orca_relay_sweep_cell_inventory_busy',
- sweep: 'abort-expired-regional-rehomes',
- skipped: 1
- }
- ])
-
- probe.failNoWait = false
- expect(await context.store.abortExpiredRegionalRehomes()).toBe(1)
- await context.database.close()
- })
-
- it('rolls a host that never reached its target back to the source at the arrival window', async () => {
- const context = await setup()
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- const sourceControl = await activatePreferredSource(context, identity)
- expect(await context.store.tryIdleRehome()).not.toBeNull()
- await context.store.releaseActivity(identity, sourceControl)
- await context.store.markMigrationTargetRegistered(identity, {
- cellId: target.id,
- assignmentEpoch: 2
- })
-
- context.advance(REGIONAL_REHOME_ARRIVAL_WINDOW_MS - 1)
- await freshHeartbeats(context)
- expect(await context.store.abortUnarrivedRegionalRehomes()).toBe(0)
-
- context.advance(1)
- await freshHeartbeats(context)
- expect(await context.store.abortUnarrivedRegionalRehomes()).toBe(1)
- expect(await context.store.resolve(identity)).toMatchObject({
- cellId: source.id,
- assignmentEpoch: 3
- })
- expect(await context.store.abortUnarrivedRegionalRehomes()).toBe(0)
- await context.database.close()
- })
-
- it('leaves the durable switch alone when it rolls back an unarrived host', async () => {
- const context = await setup()
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- const sourceControl = await activatePreferredSource(context, identity)
- expect(await context.store.tryIdleRehome()).not.toBeNull()
- await context.store.releaseActivity(identity, sourceControl)
- await context.store.markMigrationTargetRegistered(identity, {
- cellId: target.id,
- assignmentEpoch: 2
- })
- const before = await context.store.inspectRegionalRehomeControl()
- context.advance(REGIONAL_REHOME_ARRIVAL_WINDOW_MS)
- await freshHeartbeats(context)
-
- expect(await context.store.abortUnarrivedRegionalRehomes()).toBe(1)
-
- expect(await context.store.inspectRegionalRehomeControl()).toMatchObject({
- generation: before.generation,
- enabled: true
- })
- const [attempt] = await context.database.query(
- 'SELECT abort_reason FROM relay_region_rehome_attempts'
- )
- expect(attempt!.abort_reason).toBe('host_not_arrived')
- const preview = await context.store.previewRegionalRehomeEligibility()
- expect(preview.abortedLast24Hours).toEqual({ host_not_arrived: 1 })
- expect(
- (await readAssignmentInventorySnapshot(context.database, context.now())).regionalRehomes
- ).toMatchObject({ abortedLast24Hours: 1, hostNotArrivedLast24Hours: 1 })
- await context.database.close()
- })
-
- it('leaves a host that did reach its target for the completion sweep', async () => {
- const context = await setup()
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- const sourceControl = await activatePreferredSource(context, identity)
- expect(await context.store.tryIdleRehome()).not.toBeNull()
- // Age alone cannot abort an attempt whose target already owns the host.
- context.advance(REGIONAL_REHOME_ARRIVAL_WINDOW_MS)
- await freshHeartbeats(context)
- await context.store.activateControl(identity, {
- cellId: target.id,
- assignmentEpoch: 2,
- generation: 1,
- cellIncarnation: targetIncarnation
- })
- await context.store.markMigrationTargetRegistered(identity, {
- cellId: target.id,
- assignmentEpoch: 2
- })
- await context.store.releaseActivity(identity, sourceControl)
-
- expect(await context.store.abortUnarrivedRegionalRehomes()).toBe(0)
- expect(await context.store.completeReadyRegionalRehomes()).toBe(1)
- expect(await context.store.resolve(identity)).toMatchObject({ cellId: target.id })
- await context.database.close()
- })
-
- it('names the 24-hour latch in its own abort reason', async () => {
- const context = await setup()
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- const sourceControl = await activatePreferredSource(context, identity)
- expect(await context.store.tryIdleRehome()).not.toBeNull()
- await context.store.releaseActivity(identity, sourceControl)
- context.advance(24 * 60 * 60_000)
- await heartbeat(context.store, source, sourceIncarnation, 3, 2)
-
- expect(await context.store.abortExpiredRegionalRehomes()).toBe(1)
-
- const [attempt] = await context.database.query(
- 'SELECT abort_reason FROM relay_region_rehome_attempts'
- )
- expect(attempt!.abort_reason).toBe('max_refresh_expired')
- expect(await context.store.inspectRegionalRehomeControl()).toMatchObject({ enabled: false })
- await context.database.close()
- })
-
- it('rolls back an inactive registered target only after the 24-hour bound', async () => {
- const context = await setup()
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- const sourceControl = await activatePreferredSource(context, identity)
- const attempt = await context.store.tryIdleRehome()
- const targetControl = await context.store.activateControl(identity, {
- cellId: target.id,
- assignmentEpoch: 2,
- generation: 1
- })
- await context.store.markMigrationTargetRegistered(identity, {
- cellId: target.id,
- assignmentEpoch: 2
- })
- await context.store.releaseActivity(identity, sourceControl)
- await context.store.releaseActivity(identity, targetControl)
- context.advance(24 * 60 * 60_000 - 1)
- await freshHeartbeats(context)
- expect(await context.store.abortExpiredRegionalRehomes()).toBe(0)
- context.advance(1)
- await heartbeat(context.store, source, sourceIncarnation, 3, context.now())
- expect(await context.store.abortExpiredRegionalRehomes()).toBe(1)
- expect(await context.store.resolve(identity)).toMatchObject({
- cellId: source.id,
- assignmentEpoch: 3
- })
- await context.database.close()
- })
-
it('completes healthy candidates past a poisoned attempt and logs it', async () => {
const context = await setup()
const poisoned = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
@@ -1132,115 +167,6 @@ describe('regional rehome assignment state', () => {
await context.database.close()
})
- it('quarantines a repeatedly failing candidate and redacts free-form errors', async () => {
- const context = await setup()
- const poisoned = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- const source1 = await activatePreferredSource(context, poisoned)
- const attempt = await context.store.tryIdleRehome()
- await context.store.activateControl(poisoned, {
- cellId: target.id,
- assignmentEpoch: attempt!.assignmentEpoch,
- generation: 1
- })
- await context.store.markMigrationTargetRegistered(poisoned, {
- cellId: target.id,
- assignmentEpoch: attempt!.assignmentEpoch
- })
- await context.store.releaseActivity(poisoned, source1)
- await context.database.query(
- `UPDATE relay_assignments SET assignment_epoch = assignment_epoch + 5
- WHERE user_id = ?`,
- [poisoned.userId]
- )
- const warnings = collectCandidateFailureWarnings()
- try {
- for (let round = 0; round < REGIONAL_REHOME_QUARANTINE_FAILURES; round++) {
- expect(await context.store.completeReadyRegionalRehomes()).toBe(0)
- }
- expect(warnings.entries).toHaveLength(REGIONAL_REHOME_QUARANTINE_FAILURES)
- expect(await context.store.completeReadyRegionalRehomes()).toBe(0)
- expect(warnings.entries).toHaveLength(REGIONAL_REHOME_QUARANTINE_FAILURES)
- context.advance(REGIONAL_REHOME_QUARANTINE_MS + 1)
- await context.store.completeReadyRegionalRehomes()
- expect(warnings.entries).toHaveLength(REGIONAL_REHOME_QUARANTINE_FAILURES + 1)
- expect(
- warnings.entries.every((entry) => entry.reason === 'regional_rehome_assignment_mismatch')
- ).toBe(true)
- context.advance(REGIONAL_REHOME_QUARANTINE_MS + 1)
- const database = context.database
- const original = database.transaction.bind(database)
- database.transaction = () => {
- throw new Error('postgresql://secret@database.invalid/relay')
- }
- try {
- await context.store.completeReadyRegionalRehomes()
- } finally {
- database.transaction = original
- }
- const last = warnings.entries.at(-1)!
- expect(last.reason).toBe('redacted')
- expect(JSON.stringify(last)).not.toContain('secret')
- } finally {
- warnings.restore()
- }
- await context.database.close()
- })
-
- it('aborts healthy expired candidates past a poisoned attempt', async () => {
- const context = await setup()
- const poisoned = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- const healthy = { userId: 'user-2', relayHostId: 'ponmlkjihgfedcba' }
- const poisonedSource = await activatePreferredSource(context, poisoned)
- const healthySource = await activatePreferredSource(context, healthy)
- const first = await context.store.tryIdleRehome()
- context.advance(6_000)
- const second = await context.store.tryIdleRehome()
- for (const [identity, attempt, sourceControl] of [
- [poisoned, first, poisonedSource],
- [healthy, second, healthySource]
- ] as const) {
- const targetControl = await context.store.activateControl(identity, {
- cellId: target.id,
- assignmentEpoch: attempt!.assignmentEpoch,
- generation: 1
- })
- await context.store.markMigrationTargetRegistered(identity, {
- cellId: target.id,
- assignmentEpoch: attempt!.assignmentEpoch
- })
- await context.store.releaseActivity(identity, sourceControl)
- await context.store.releaseActivity(identity, targetControl)
- }
- await context.database.query(
- `UPDATE relay_assignments SET assignment_epoch = assignment_epoch + 5
- WHERE user_id = ?`,
- [poisoned.userId]
- )
- context.advance(24 * 60 * 60_000)
- await freshHeartbeats(context)
- const warnings = collectCandidateFailureWarnings()
- try {
- expect(await context.store.abortExpiredRegionalRehomes()).toBe(1)
- } finally {
- warnings.restore()
- }
- expect(warnings.entries).toEqual([
- {
- event: 'orca_relay_regional_rehome_candidate_failed',
- operation: 'abort',
- attemptId: first!.attemptId,
- reason: 'regional_rehome_assignment_mismatch'
- }
- ])
- expect(
- await context.database.query(
- `SELECT aborted_at FROM relay_region_rehome_attempts WHERE attempt_id = ?`,
- [second!.attemptId]
- )
- ).toEqual([{ aborted_at: context.now() }])
- await context.database.close()
- })
-
it('keeps dual-control accounting when the drained host re-resolves mid-rehome', async () => {
const context = await setup()
const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
@@ -1286,146 +212,10 @@ describe('regional rehome assignment state', () => {
await context.database.close()
})
- it('grants a host whose counter was skewed without duplicating its control', async () => {
- const context = await setup()
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- const sourceControl = await activatePreferredSource(context, identity)
- const attempt = await context.store.tryIdleRehome()
- await context.store.activateControl(identity, {
- cellId: target.id,
- assignmentEpoch: attempt!.assignmentEpoch,
- generation: 1
- })
- await context.store.releaseActivity(identity, sourceControl)
- // Damage already written by a pre-fix sticky grant.
- await context.database.query(
- `UPDATE relay_assignments SET reserved_controls = 0
- WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
-
- await context.store.assign(identity, 'asia-east2')
- expect(
- await context.database.query(
- `SELECT activity_id FROM relay_assignment_activity_leases
- WHERE user_id = ? AND relay_host_id = ? AND activity_kind = 'control'`,
- [identity.userId, identity.relayHostId]
- )
- ).toEqual([{ activity_id: `control:${target.id}:1` }])
- expect(await cellReservations(context)).toEqual({ [source.id]: 0, [target.id]: 2 })
- await context.database.close()
- })
-
- it('repairs a skewed control counter before completing the rehome', async () => {
- const context = await setup()
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- const sourceControl = await activatePreferredSource(context, identity)
- const attempt = await context.store.tryIdleRehome()
- await context.store.activateControl(identity, {
- cellId: target.id,
- assignmentEpoch: attempt!.assignmentEpoch,
- generation: 1
- })
- await context.store.markMigrationTargetRegistered(identity, {
- cellId: target.id,
- assignmentEpoch: attempt!.assignmentEpoch
- })
- await context.store.releaseActivity(identity, sourceControl)
- // Damage already written by a pre-fix sticky grant.
- await context.database.query(
- `UPDATE relay_assignments SET reserved_controls = 0
- WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
-
- expect(await context.store.completeReadyRegionalRehomes()).toBe(1)
- expect(await controlAccounting(context, identity)).toEqual({
- reservedControls: 1,
- controlLeases: 1
- })
- expect(
- await context.database.query(
- `SELECT migration_leases FROM relay_assignments
- WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- ).toEqual([{ migration_leases: 0 }])
- await context.database.close()
- })
-
- it('never repairs past a migration lease whose shape is wrong', async () => {
- const context = await setup()
- const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
- const sourceControl = await activatePreferredSource(context, identity)
- const attempt = await context.store.tryIdleRehome()
- await context.store.activateControl(identity, {
- cellId: target.id,
- assignmentEpoch: attempt!.assignmentEpoch,
- generation: 1
- })
- await context.store.markMigrationTargetRegistered(identity, {
- cellId: target.id,
- assignmentEpoch: attempt!.assignmentEpoch
- })
- await context.store.releaseActivity(identity, sourceControl)
- await context.database.query(
- `UPDATE relay_assignments SET reserved_controls = 0
- WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- await context.database.query(
- `UPDATE relay_assignment_migrations SET target_reserved_units = 9
- WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
-
- const warnings = collectCandidateFailureWarnings()
- try {
- expect(await context.store.completeReadyRegionalRehomes()).toBe(0)
- } finally {
- warnings.restore()
- }
- expect(warnings.entries).toEqual([
- {
- event: 'orca_relay_regional_rehome_candidate_failed',
- operation: 'complete',
- attemptId: attempt!.attemptId,
- reason: 'migration_activity_lease_shape_mismatch'
- }
- ])
- expect(await controlAccounting(context, identity)).toEqual({
- reservedControls: 0,
- controlLeases: 1
- })
- await context.database.close()
- })
})
type Context = Awaited>
-function collectDisableWarnings() {
- const entries: Record[] = []
- const original = console.warn
- console.warn = (line: unknown, ...rest: unknown[]) => {
- try {
- const parsed = JSON.parse(line as string) as Record
- if (parsed.event === 'orca_relay_regional_rehome_safety_disabled') {
- entries.push(parsed)
- return
- }
- } catch {
- // fall through to the real console for non-JSON lines
- }
- original(line, ...rest)
- }
- return {
- entries,
- restore: () => {
- console.warn = original
- }
- }
-}
-
async function setup(
options: {
sourceProtocol?: number
@@ -1466,29 +256,6 @@ async function setup(
}
}
-function collectEventWarnings(event: string) {
- const entries: Record[] = []
- const original = console.warn
- console.warn = (line: unknown, ...rest: unknown[]) => {
- try {
- const parsed = JSON.parse(line as string) as Record
- if (parsed.event === event) {
- entries.push(parsed)
- return
- }
- } catch {
- // fall through to the real console for non-JSON lines
- }
- original(line, ...rest)
- }
- return {
- entries,
- restore: () => {
- console.warn = original
- }
- }
-}
-
function collectCandidateFailureWarnings(
events: string[] = ['orca_relay_regional_rehome_candidate_failed']
) {
@@ -1543,47 +310,6 @@ async function cellReservations(context: Context): Promise [String(row.cell_id), Number(row.reserved_requests)]))
}
-async function freshHeartbeats(context: Context): Promise {
- const safety = {
- observedAt: context.now(),
- sqlFailures: 0,
- reconnects: 0,
- controlActivityRecoveryFailures: 0,
- databasePoolWaiting: 0,
- databasePoolWaitersMax: 0,
- databasePoolWaitMsMax: 0
- }
- // The clock doubles as a strictly-increasing connection inclusion watermark.
- await heartbeat(context.store, source, sourceIncarnation, 3, context.now(), safety)
- await heartbeat(context.store, target, targetIncarnation, 3, context.now(), safety)
-}
-
-function cleanSafety(context: Context): RegionalRehomeSafetySnapshot {
- return {
- observedAt: context.now(),
- sqlFailures: 0,
- reconnects: 0,
- controlActivityRecoveryFailures: 0,
- databasePoolWaiting: 0,
- databasePoolWaitersMax: 0,
- databasePoolWaitMsMax: 0
- }
-}
-
-// Splits the fleet sum across both cells, each under the per-cell bar's scale.
-async function sqlFailuresHeartbeats(context: Context, fleetSqlFailures: number): Promise {
- const half = Math.floor(fleetSqlFailures / 2)
- const safety = cleanSafety(context)
- await heartbeat(context.store, source, sourceIncarnation, 3, context.now(), {
- ...safety,
- sqlFailures: half
- })
- await heartbeat(context.store, target, targetIncarnation, 3, context.now(), {
- ...safety,
- sqlFailures: fleetSqlFailures - half
- })
-}
-
async function activatePreferredSource(
context: Context,
identity: { userId: string; relayHostId: string }
@@ -1618,88 +344,6 @@ async function activatePreferredSource(
return control
}
-// Hook after scan inside the claim transaction makes scan/claim races deterministic.
-function hookAfterCandidateScan(
- database: RelayDatabase,
- hook: (transaction: RelayDatabase) => Promise
-): RelayDatabase {
- let fired = false
- const decorate = (delegate: RelayDatabase): RelayDatabase => ({
- dialect: delegate.dialect,
- query: async (sql, params) => {
- const rows = await delegate.query(sql, params)
- if (!fired && sql.includes('SELECT d.user_id, d.relay_host_id')) {
- fired = true
- await hook(delegate)
- }
- return rows
- },
- queryLocked: async (sql, params, lockOptions) =>
- await delegate.queryLocked(sql, params, lockOptions),
- transaction: async (operation, transactionOptions) =>
- await delegate.transaction(
- async (transaction) => await operation(decorate(transaction)),
- transactionOptions
- ),
- close: async () => undefined
- })
- return decorate(database)
-}
-
-async function completeRehomeToTarget(
- context: Context,
- identity: { userId: string; relayHostId: string }
-): Promise {
- const sourceControl = await activatePreferredSource(context, identity)
- const attempt = await context.store.tryIdleRehome()
- const targetControl = await context.store.activateControl(identity, {
- cellId: target.id,
- assignmentEpoch: attempt!.assignmentEpoch,
- generation: 1
- })
- await context.store.markMigrationTargetRegistered(identity, {
- cellId: target.id,
- assignmentEpoch: attempt!.assignmentEpoch
- })
- await context.store.releaseActivity(identity, sourceControl)
- await context.store.completeReadyRegionalRehomes()
- return targetControl
-}
-
-async function activateReversePreferredSource(
- context: Context,
- identity: { userId: string; relayHostId: string }
-): Promise {
- const assignment = await context.store.assign(identity, undefined, 'asia-east2')
- const control = await context.store.activateControl(identity, {
- cellId: target.id,
- assignmentEpoch: assignment.assignmentEpoch,
- generation: 1,
- idleRegionalRehome: true,
- cellIncarnation: targetIncarnation
- })
- await context.store.assign(identity, 'us-central1')
- const issued = await context.store.exchangeRegionCorrection(
- identity,
- { v: 1, action: 'issue-window' },
- assignment.assignmentEpoch
- )
- await context.store.exchangeRegionCorrection(
- identity,
- {
- v: 1,
- action: 'report',
- generation: issued.window!.generation,
- assignmentEpoch: assignment.assignmentEpoch,
- policyVersion: 1,
- outcome: 'conclusive',
- measurements: { 'us-central1': 50, 'asia-east2': 150 }
- },
- assignment.assignmentEpoch
- )
- return control
-}
-
async function activateSource(
context: Context,
identity: { userId: string; relayHostId: string }
@@ -1752,51 +396,6 @@ async function heartbeat(
})
}
-class CellInventoryLockProbe {
- readonly locks: (RelayLockOptions | undefined)[] = []
- failNoWait = false
- // Contends the first N candidates only, so the sweep must carry on past them.
- failNoWaitTimes = 0
- failWith: Error | null = null
-
- reset(): void {
- this.locks.length = 0
- }
-
- wrap(database: RelayDatabase): RelayDatabase {
- const probe = this
- const decorate = (delegate: RelayDatabase): RelayDatabase => ({
- dialect: delegate.dialect,
- query: async (sql, params) => await delegate.query(sql, params),
- queryLocked: async (sql, params, options) => {
- // The idle commit's only cell lock is its target row, so it counts too.
- if (
- sql.trim() === 'SELECT * FROM relay_cells ORDER BY cell_id ASC' ||
- sql.includes('FROM relay_cells cell')
- ) {
- probe.locks.push(options)
- if (probe.failWith) throw probe.failWith
- if (options?.failIfUnavailable && probe.failNoWaitTimes > 0) {
- probe.failNoWaitTimes--
- throw new Error('database_lock_unavailable')
- }
- if (probe.failNoWait && options?.failIfUnavailable) {
- throw new Error('database_lock_unavailable')
- }
- }
- return await delegate.queryLocked(sql, params, options)
- },
- transaction: async (operation, options) =>
- await delegate.transaction(
- async (transaction) => await operation(decorate(transaction)),
- options
- ),
- close: async () => undefined
- })
- return decorate(database)
- }
-}
-
class IdleRehomeTestStore extends BaseRelayAssignmentStore {
private readonly fixtureDatabase: RelayDatabase
private readonly fixtureNow: () => number
diff --git a/cloud/apps/relay/src/assignment/reserve-placement/reserve-assignment.test.ts b/cloud/apps/relay/src/assignment/reserve-placement/reserve-assignment.test.ts
index 860d5e5b356..fe541e29046 100644
--- a/cloud/apps/relay/src/assignment/reserve-placement/reserve-assignment.test.ts
+++ b/cloud/apps/relay/src/assignment/reserve-placement/reserve-assignment.test.ts
@@ -111,25 +111,6 @@ function seated(epoch: number, joinedAt = 0) {
describe('reserve assignment on a director', () => {
- it('reads what each cell acts on: a tripped dead-man is db, a flip back still leasing is reserve', async () => {
- const tripped = setup({
- feeds: [feed('c1', { admitModeEffective: 'db' }), feed('c2', { admitModeEffective: 'db' })]
- })
- expect(await tripped.assignment.plan(HOST, { reconnect: false, region: US })).toEqual({ kind: 'database' })
- const leasing = setup({ feeds: [feed('c1', { admitMode: 'db', admitModeEffective: 'reserve' }), feed('c2')] })
- expect(leasing.directory.admitModeOf('c1')).toBe('reserve')
- // Raw db must immediately stop booking/pacing even while effective mode stays reserve during re-registration.
- const reregistering = setup({
- feeds: [
- feed('c1', { admitModeEffective: 'reserve', admitModeRaw: 'db' }),
- feed('c2', { admitModeEffective: 'reserve', admitModeRaw: 'db' })
- ]
- })
- expect(await reregistering.assignment.plan(HOST, { reconnect: false, region: US })).toEqual({ kind: 'database' })
- expect(reregistering.reserved).toEqual([])
- expect(reregistering.directory.admitModeOf('c1')).toBe('reserve')
- })
-
it('before every live cell has answered, holds back only hosts that may be on an unheard cell', async () => {
const cells = cellList(['c1', 'c2'])
const onUnheard = { ...HOST, relayHostId: 'qrstuvwxyzabcdef' }
@@ -153,18 +134,6 @@ describe('reserve assignment on a director', () => {
expect((await gated.assignment.plan(onUnheard, { reconnect: true, region: US })).kind).not.toBe('retry')
})
- it('answers a reconnect from memory at the same epoch with no booking and no database read', async () => {
- const row = vi.fn(async () => null)
- const { assignment, reserved } = setup({
- feeds: [feed('c1', { full: [seated(7)] }), feed('c2')],
- row
- })
- const plan = await assignment.plan(HOST, { reconnect: true, region: US })
- expect(plan).toMatchObject({ kind: 'answer', lane: 'sticky', assignment: { cellId: 'c1', assignmentEpoch: 7 } })
- expect(reserved).toEqual([])
- expect(row).not.toHaveBeenCalled()
- })
-
it('re-books a host on a cell that restarted since its seat, and only then answers it', async () => {
const { assignment, directory, reserved, now } = setup({
feeds: [feed('c1', { full: [seated(7)] }), feed('c2')]
@@ -198,57 +167,6 @@ describe('reserve assignment on a director', () => {
})
})
- it('never sends a drained or demoted host back, and books it elsewhere above every known epoch', async () => {
- const { assignment, directory, reserved, now } = setup()
- directory.apply(
- 'c1',
- feed('c1', {
- full: undefined,
- seq: 3,
- changes: [
- { seq: 2, kind: 'join', ...HOST, epoch: 7, generation: 1, at: 1 },
- { seq: 3, kind: 'leave', ...HOST, epoch: 7, generation: 1, closeCode: 4503, at: 2 }
- ]
- }),
- now.value,
- now.value
- )
- const plan = await assignment.plan(HOST, { reconnect: true, region: US })
- expect(plan).toMatchObject({
- kind: 'answer',
- lane: 'placement',
- assignment: { assignmentEpoch: 8 }
- })
- expect(reserved.length).toBeGreaterThan(0)
- expect(reserved.every((call) => !call.sticky && call.epoch === 8)).toBe(true)
- })
-
- it('leaves a cell without a feed (c17/c18) on today’s path without starving the reserve pool', async () => {
- const cells = cellList(['c1', 'c2', 'c17'])
- let rowOnOld = false
- const { assignment, directory, reserved, now } = setup({
- cells,
- feeds: [feed('c1'), feed('c2', { admitMode: 'db' })],
- row: async () => (rowOnOld ? { cellId: 'c17', assignmentEpoch: 5 } : null)
- })
- directory.markNoFeed('c17', now.value)
- expect(directory.isComplete()).toBe(true)
- // An old image reports no ceiling; counting it as a database cell would zero the share.
- expect(await assignment.plan(HOST, { reconnect: false, region: US })).toMatchObject({
- kind: 'answer',
- lane: 'placement',
- assignment: { cellId: 'c1' }
- })
- expect(reserved.map((call) => call.cellId)).not.toContain('c17')
- rowOnOld = true
- expect(
- await assignment.plan({ ...HOST, relayHostId: 'qrstuvwxyzabcdef' }, { reconnect: true, region: US })
- ).toMatchObject({ kind: 'database', epochFloor: 5 })
- directory.markNoFeed('c1', now.value)
- expect(directory.cellState('c1')?.ceiling).toBeUndefined()
- expect(assignment.placementCells().find((cell) => cell.cellId === 'c1')?.general).toBe(false)
- })
-
it('reads the row once for a host the map never saw, and refuses it while the database is down', async () => {
const down = setup({ row: async () => Promise.reject(new Error('timeout')) })
expect(await down.assignment.plan(HOST, { reconnect: false, region: US })).toMatchObject({
@@ -318,95 +236,6 @@ describe('reserve assignment on a director', () => {
}
})
- describe('for a share-draw loser', () => {
- const ASIA = 'asia-east2' as const
- const OTHER = { ...HOST, relayHostId: 'qrstuvwxyzabcdef' }
- const setupAsia = (reserveCell = feed('c1'), reserve?: (cellId: string) => ReserveAttempt) =>
- setup({
- ...(reserve ? { reserve } : {}),
- cells: [...cellList(['c1', 'c2'], ASIA), ...cellList(['c3'])],
- feeds: [
- reserveCell,
- // Database room far above the reserve cell's, so the 0.25 draw loses.
- feed('c2', {
- admitMode: 'db',
- counts: { seats: 0, controls: 0, bookings: 0, units: 0, ceiling: 5_000 }
- }),
- feed('c3')
- ]
- })
- const regionReserveOf = async (assignment: ReserveAssignment, identity = HOST) => {
- const plan = await assignment.plan(identity, { reconnect: false, region: ASIA })
- expect(plan).toMatchObject({ kind: 'database', epochFloor: 0 })
- return plan.kind === 'database' ? plan.regionReserve : undefined
- }
-
- it('offers the reserve cell in its region only, only while it has a seat', async () => {
- const { assignment, reserved, directory, now } = setupAsia()
- const regionReserve = await regionReserveOf(assignment)
- expect(reserved).toEqual([])
- await expect(regionReserve?.()).resolves.toMatchObject({ cellId: 'c1', region: ASIA })
- expect(reserved.map((call) => call.cellId)).toEqual(['c1'])
- const full = feed('c1', { counts: { seats: 500, controls: 500, bookings: 0, units: 500, ceiling: 500 } })
- directory.apply('c1', full, now.value, now.value)
- expect(await regionReserveOf(assignment, OTHER)).toBeUndefined()
- expect(reserved.map((call) => call.cellId)).toEqual(['c1'])
- })
-
- it('paces when the reserve cell has seats but no intake budget, rather than give up the region', async () => {
- const { assignment, reserved } = setupAsia(feed('c1', { intake: { perSec: 1, burst: 20, tokens: 0 } }))
- const regionReserve = await regionReserveOf(assignment)
- await expect(regionReserve?.()).rejects.toBeInstanceOf(ReservePaceError)
- expect(reserved).toEqual([])
- })
-
- it('gives the region up when the reserve cell refuses with a seat still on the map', async () => {
- for (const outcome of ['full', 'unreachable']) {
- const { assignment, reserved } = setupAsia(feed('c1'), (cellId) =>
- cellId === 'c1' ? { outcome } : { outcome: 'ok' }
- )
- const regionReserve = await regionReserveOf(assignment)
- // Null sends the host to the database lane's cross-region fallback, not a 1 s retry.
- await expect(regionReserve?.()).resolves.toBeNull()
- expect(reserved.map((call) => call.cellId)).toEqual(['c1'])
- }
- })
- })
-
- describe('for a region-correction request', () => {
- const request = { reconnect: true, region: US, regionCorrection: true }
-
- it('leaves the answer to the database lane, offering only the in-region reserve fallback and the spill', async () => {
- const row = vi.fn(async () => null)
- // A memory answer would skip the window exchange; the share draw is not offered either.
- const { assignment, reserved } = setup({ feeds: [feed('c1', { full: [seated(7)] }), feed('c2')], row })
- const plan = await assignment.plan(HOST, request)
- expect(plan).toEqual({
- kind: 'database',
- regionReserve: expect.any(Function),
- reserveSpill: expect.any(Function)
- })
- expect(reserved).toEqual([])
- expect(row).not.toHaveBeenCalled()
- await expect(plan.kind === 'database' ? plan.regionReserve?.() : null).resolves.toMatchObject({
- assignmentEpoch: 8
- })
- })
-
- it('keeps today’s path for a host the map never saw, without reading its row, but may spill', async () => {
- const row = vi.fn(async () => ({ cellId: 'c1', assignmentEpoch: 3 }))
- const { assignment, reserved } = setup({ row })
- const plan = await assignment.plan(HOST, request)
- expect(plan).toEqual({ kind: 'database', reserveSpill: expect.any(Function) })
- expect(row).not.toHaveBeenCalled()
- expect(reserved).toEqual([])
- await expect(
- plan.kind === 'database' ? plan.reserveSpill?.({ skipOwnRegion: false, rowEpoch: 3 }) : null
- ).resolves.toMatchObject({ assignmentEpoch: 4 })
- })
-
- })
-
describe('after the database lane found no cell anywhere', () => {
const ASIA = 'asia-east2' as const
const paced = { intake: { perSec: 1, burst: 20, tokens: 0 } }
@@ -428,31 +257,6 @@ describe('reserve assignment on a director', () => {
return plan.kind === 'database' ? plan.reserveSpill : undefined
}
- it('books its own region first, minting above the row the database lane read', async () => {
- const harness = setupSpill({})
- const spill = await spillOf(harness)
- await expect(spill?.({ skipOwnRegion: false, rowEpoch: 9 })).resolves.toMatchObject({
- cellId: 'asia-r',
- region: ASIA,
- assignmentEpoch: 10
- })
- expect(harness.reserved).toEqual([{ cellId: 'asia-r', epoch: 10, sticky: false, dryRun: false }])
- })
-
- it('books the other region when its own is full, or already tried', async () => {
- const full = setupSpill(fullCounts)
- await expect((await spillOf(full))?.({ skipOwnRegion: false, rowEpoch: 0 })).resolves.toMatchObject({
- cellId: 'us-r',
- region: US,
- assignmentEpoch: 5
- })
- const tried = setupSpill({})
- await expect((await spillOf(tried))?.({ skipOwnRegion: true, rowEpoch: 0 })).resolves.toMatchObject({
- cellId: 'us-r'
- })
- expect(tried.reserved.map((call) => call.cellId)).toEqual(['us-r'])
- })
-
it('tries the other region after a pace, and answers the pace only if nothing places', async () => {
const abroad = setupSpill(paced)
await expect((await spillOf(abroad))?.({ skipOwnRegion: false, rowEpoch: 0 })).resolves.toMatchObject({
@@ -464,39 +268,10 @@ describe('reserve assignment on a director', () => {
)
})
- it('returns null with no reserve seat anywhere, so the refusal stands', async () => {
- const harness = setupSpill(fullCounts, fullCounts)
- await expect((await spillOf(harness))?.({ skipOwnRegion: false, rowEpoch: 0 })).resolves.toBeNull()
- expect(harness.reserved).toEqual([])
- })
-
- it('is not offered while the map is incomplete', async () => {
- const gated = setup({
- cells: [...cellList(['asia-r', 'asia-db'], ASIA), ...cellList(['us-r'])],
- feeds: [feed('asia-r'), feed('asia-db', { admitMode: 'db', full: [seated(4)] })],
- startedAt: 100_500
- })
- const plan = await gated.assignment.plan(HOST, { reconnect: true, region: ASIA })
- expect(plan).toMatchObject({ kind: 'database' })
- expect(plan.kind === 'database' && plan.reserveSpill).toBeUndefined()
- const correction = await gated.assignment.plan(HOST, { reconnect: true, region: ASIA, regionCorrection: true })
- expect(correction).toEqual({ kind: 'database' })
- })
-
- it('answers the shortest pace when every region paces', async () => {
- const harness = setupSpill(paced, { intake: { perSec: 2, burst: 20, tokens: 0 } })
- const spill = await spillOf(harness)
- // Asia refills its token in 4 s, US in 2 s.
- await expect(spill?.({ skipOwnRegion: false, rowEpoch: 0 })).rejects.toSatisfy(
- (error) => error instanceof ReservePaceError && error.retryAfterSeconds === 2
- )
- })
-
})
describe('rehome on reconnect', () => {
const ASIA = 'asia-east2' as const
- const OTHER = { ...HOST, relayHostId: 'qrstuvwxyzabcdef' }
const ask = { reconnect: true, region: ASIA, preferred: true }
// 2,000 controls on the US cell refill its move budget once a minute.
const usCounts = { counts: { seats: 1, controls: 2_000, bookings: 0, units: 1, ceiling: 4_000 } }
@@ -546,107 +321,6 @@ describe('reserve assignment on a director', () => {
expect(demoted).toEqual([{ cellId: 'us-r', epoch: 5, joinedAt: 1_000 }])
})
- it('answers a region-correction request on the rehome lane', async () => {
- const { assignment, warm } = setupRehome()
- await warm()
- expect(await assignment.plan(HOST, { ...ask, regionCorrection: true })).toMatchObject({
- kind: 'answer',
- lane: 'rehome'
- })
- })
-
- it('moves no one into Asia at 98% full, or anywhere under 10% free', async () => {
- for (const share of [0.98, 0.91]) {
- const { assignment, reserved, warm } = setupRehome({ asia: asiaFull(share) })
- await warm()
- expect(await assignment.plan(HOST, ask), String(share)).toMatchObject({
- kind: 'answer',
- lane: 'sticky',
- assignment: { cellId: 'us-r' }
- })
- expect(reserved.filter((call) => call.cellId === 'asia-r')).toEqual([])
- }
- const { assignment, warm } = setupRehome({ asia: asiaFull(0.9) })
- await warm()
- expect(await assignment.plan(HOST, ask)).toMatchObject({ lane: 'rehome' })
- })
-
- // 10% rehome headroom above the 0% spill line prevents spilled hosts bouncing back.
- it('keeps a gap above the spill line: 5% free takes placements, not rehomes', async () => {
- const { assignment, warm } = setupRehome({ asia: asiaFull(0.95) })
- await warm()
- expect(await assignment.plan(HOST, ask)).toMatchObject({ lane: 'sticky', assignment: { cellId: 'us-r' } })
- expect(await assignment.plan(OTHER, { reconnect: false, region: ASIA })).toMatchObject({
- lane: 'placement',
- assignment: { cellId: 'asia-r' }
- })
- })
-
- it('keeps today’s answer when any rule fails', async () => {
- const sticky = { kind: 'answer', lane: 'sticky', assignment: { cellId: 'us-r' } }
- const unhinted = setupRehome()
- await unhinted.warm()
- expect(await unhinted.assignment.plan(HOST, { ...ask, preferred: false })).toMatchObject(sticky)
- const off = setupRehome({ percent: 0 })
- await off.warm()
- expect(await off.assignment.plan(HOST, ask)).toMatchObject(sticky)
- const closed = setupRehome({ switchOpen: false })
- await closed.warm()
- expect(await closed.assignment.plan(HOST, ask)).toMatchObject(sticky)
- const cold = setupRehome()
- expect(await cold.assignment.plan(HOST, ask)).toMatchObject(sticky)
- const sameRegion = setupRehome()
- await sameRegion.warm()
- expect(await sameRegion.assignment.plan(HOST, { ...ask, region: US })).toMatchObject(sticky)
- })
-
- it('never runs for a fresh ask, an unknown host, a database-mode source, or an incomplete map', async () => {
- const fresh = setupRehome()
- await fresh.warm()
- expect(await fresh.assignment.plan(HOST, { ...ask, reconnect: false })).toMatchObject({ lane: 'placement' })
- expect(await fresh.assignment.plan(OTHER, ask)).toMatchObject({ kind: 'answer', lane: 'placement' })
- const onDatabase = setup({
- cells: [...cellList(['us-db']), ...cellList(['asia-r'], ASIA)],
- feeds: [feed('us-db', { admitMode: 'db', ...usCounts, full: [seated(5, 1_000)] }), feed('asia-r', asiaFull(0.5))],
- rehome: new ReserveRehome({ percent: 100, switchOpen: () => true })
- })
- expect(await onDatabase.assignment.plan(HOST, ask)).toMatchObject({ kind: 'database' })
- const gated = setup({
- cells: [...cellList(['us-r']), ...cellList(['asia-r', 'asia-unheard'], ASIA)],
- feeds: [feed('us-r', { ...usCounts, full: [seated(5, 1_000)] }), feed('asia-r', asiaFull(0.5))],
- startedAt: 100_500,
- rehome: new ReserveRehome({ percent: 100, switchOpen: () => true })
- })
- expect(await gated.assignment.plan(HOST, ask)).toMatchObject({ lane: 'sticky' })
- expect(gated.reserved).toEqual([])
- })
-
- it('falls through to the sticky answer when the rehome booking is paced', async () => {
- const { assignment, reserved, warm } = setupRehome({
- reserve: (cellId) => (cellId === 'asia-r' ? { outcome: 'intake' } : { outcome: 'ok' })
- })
- await warm()
- expect(await assignment.plan(HOST, ask)).toMatchObject({ kind: 'answer', lane: 'sticky' })
- expect(reserved.map((call) => call.cellId)).toEqual(['asia-r'])
- })
-
- it('leaves a host another install keeps dropping', async () => {
- const { assignment, directory, now, warm } = setupRehome()
- await warm()
- directory.apply(
- 'us-r',
- feed('us-r', {
- ...usCounts,
- full: undefined,
- seq: 3,
- changes: [{ seq: 3, kind: 'leave', ...HOST, epoch: 4, generation: 1, closeCode: 4408, at: now.value - 1 }]
- }),
- now.value,
- now.value
- )
- expect(await assignment.plan(HOST, ask)).toMatchObject({ lane: 'sticky' })
- })
-
it('falls through to the sticky answer when the booking is refused, and gives the move back', async () => {
let refuse = true
const { assignment, warm } = setupRehome({
@@ -657,52 +331,6 @@ describe('reserve assignment on a director', () => {
refuse = false
expect(await assignment.plan(HOST, ask)).toMatchObject({ lane: 'rehome' })
})
-
- it('moves one host per source budget a minute, and logs moves and skips per region pair', async () => {
- const lines: Record[] = []
- const { assignment, now, warm } = setupRehome({
- usSeats: [seated(5, 1_000), { ...OTHER, epoch: 5, generation: 1, state: 'active', joinedAt: 1_000 }],
- log: (line) => lines.push(JSON.parse(line))
- })
- await warm()
- expect(await assignment.plan(HOST, ask)).toMatchObject({ lane: 'rehome' })
- expect(await assignment.plan(OTHER, ask)).toMatchObject({ lane: 'sticky' })
- now.value += 60_000
- await assignment.plan({ ...HOST, relayHostId: 'flushflushflush1' }, ask)
- expect(lines.filter((line) => line.event === 'orca_relay_reserve_rehome')).toEqual([
- { event: 'orca_relay_reserve_rehome', fromRegion: US, toRegion: ASIA, count: 0, skippedByRule: { 'source-budget': 1 } },
- { event: 'orca_relay_reserve_rehome', fromRegion: US, toRegion: ASIA, count: 1, skippedByRule: { 'source-budget': 1 } }
- ])
- })
- })
-
- it('paces with Retry-After when every reserve cell is out of budget and no database cell exists', async () => {
- const { assignment } = setup({ reserve: () => ({ outcome: 'intake' }) })
- await expect(assignment.plan(HOST, { reconnect: false, region: US })).rejects.toMatchObject({
- message: 'reserve_cells_paced',
- retryAfterSeconds: expect.any(Number)
- })
- })
-
- it('tells the old reserve seat to go when it books the host elsewhere, naming that seat exactly', async () => {
- const { assignment, directory, demoted, now } = setup({
- feeds: [feed('c1', { full: [seated(5, 1_000)] }), feed('c2')],
- reserve: (cellId) => (cellId === 'c1' ? { outcome: 'full' } : { outcome: 'ok' })
- })
- // The host left c1 for a reason that moves it: its next placement is fresh, above 5.
- directory.apply(
- 'c1',
- feed('c1', {
- full: undefined,
- seq: 2,
- changes: [{ seq: 2, kind: 'drain-only', ...HOST, epoch: 5, generation: 1, at: 2 }]
- }),
- now.value,
- now.value
- )
- const plan = await assignment.plan(HOST, { reconnect: true, region: US })
- expect(plan).toMatchObject({ kind: 'answer', lane: 'placement', assignment: { assignmentEpoch: 6 } })
- expect(demoted).toEqual([{ cellId: 'c1', epoch: 5, joinedAt: 1_000 }])
})
// A half-open seat missed by the booking map must be demoted by the feed, before its 75s silence close.
@@ -714,91 +342,4 @@ describe('reserve assignment on a director', () => {
directory.apply('c1', feed('c1', { full: [seated(5, 1_000)] }), now.value, now.value)
expect(demoted).toEqual([{ cellId: 'c1', epoch: 5, joinedAt: 1_000 }])
})
-
- it('answers a reconnect at the newest epoch even when an older epoch joined later', async () => {
- const { assignment, reserved } = setup({
- feeds: [feed('c1', { full: [seated(6, 1_000)] }), feed('c2', { full: [seated(5, 3_000)] })]
- })
- expect(await assignment.plan(HOST, { reconnect: true, region: US })).toMatchObject({
- kind: 'answer',
- lane: 'sticky',
- assignment: { cellId: 'c1', assignmentEpoch: 6 }
- })
- expect(reserved).toEqual([])
- })
-
- it('in dry run only asks a cell to check a booking, and never changes the answer', async () => {
- const { assignment, reserved } = setup({ mode: 'dry-run' })
- const plan = await assignment.plan(HOST, { reconnect: false, region: US })
- expect(plan.kind).toBe('database')
- expect(plan.kind === 'database' && (await plan.placeFresh?.())).toBeNull()
- expect(reserved).toMatchObject([{ dryRun: true }])
- })
-
- describe('when a cell answers a demotion', () => {
- const outcomes = (lines: string[]) =>
- lines
- .map((line) => JSON.parse(line))
- .filter((entry) => entry.event === 'orca_relay_reserve_demote_outcome')
-
- it('logs the answer by host digest and leaves the seat to the feed', async () => {
- const lines: string[] = []
- const logged = Promise.withResolvers()
- const { assignment, directory } = setup({
- feeds: [feed('c1', { full: [seated(10, 1_000)] }), feed('c2')],
- demote: () => 'not-seated',
- log: (line) => {
- lines.push(line)
- if (JSON.parse(line).event === 'orca_relay_reserve_demote_outcome') {
- logged.resolve()
- }
- }
- })
- assignment.demoteSeat({ ...HOST, cellId: 'c1', epoch: 10, joinedAt: 1_000 }, 'reconcile')
- await logged.promise
- expect(outcomes(lines)).toMatchObject([
- { via: 'reconcile', cellId: 'c1', epoch: 10, outcome: 'not-seated' }
- ])
- expect(outcomes(lines)[0].relayHostIdDigest).toMatch(/^[0-9a-f]{12}$/)
- expect(lines.join('\n')).not.toContain(HOST.relayHostId)
- expect(directory.seatsOnCell('c1')).toHaveLength(1)
- })
-
- })
-
- describe('for a host re-asking off a draining cell', () => {
- const events = (lines: string[], event: string) =>
- lines.map((line) => JSON.parse(line)).filter((entry) => entry.event === event)
-
- it('marks its pace as the drain’s, on the reserve lane, in the region fallback and in the spill', async () => {
- const { assignment } = setup({
- feeds: [feed('c1', { draining: true, full: [seated(7)] }), feed('c2')],
- reserve: () => ({ outcome: 'intake' })
- })
- await expect(assignment.plan(HOST, { reconnect: true, region: US })).rejects.toMatchObject({ drained: true })
- const plan = await assignment.plan(HOST, { reconnect: true, region: US, regionCorrection: true })
- await expect(plan.kind === 'database' ? plan.regionReserve?.() : null).rejects.toMatchObject({ drained: true })
- await expect(
- plan.kind === 'database' ? plan.reserveSpill?.({ skipOwnRegion: false, rowEpoch: 0 }) : null
- ).rejects.toMatchObject({ drained: true })
- })
-
- it('leaves every other host as today: no drain count, and a plain pace', async () => {
- const lines: string[] = []
- const { assignment } = setup({ feeds: [feed('c1', { full: [seated(7)] }), feed('c2')], log: (line) => lines.push(line) })
- const paced = setup({
- feeds: [feed('c1', { full: [seated(7)] }), feed('c2', { draining: true, full: [seated(6)] })],
- reserve: () => ({ outcome: 'intake' })
- })
- expect(await assignment.plan({ ...HOST, relayHostId: 'qrstuvwxyzabcdef' }, { reconnect: false, region: US })).toMatchObject({
- kind: 'answer',
- lane: 'placement'
- })
- await expect(
- paced.assignment.plan(HOST, { reconnect: false, region: US })
- ).rejects.toMatchObject({ drained: false })
- expect(events(lines, 'orca_relay_reserve_drain_replaced')).toEqual([])
- })
-
- })
})
diff --git a/cloud/apps/relay/src/connections/host-session-registry.test.ts b/cloud/apps/relay/src/connections/host-session-registry.test.ts
index 0b9e41651b7..845c20ab49f 100644
--- a/cloud/apps/relay/src/connections/host-session-registry.test.ts
+++ b/cloud/apps/relay/src/connections/host-session-registry.test.ts
@@ -1,31 +1,22 @@
import { EventEmitter } from 'node:events'
-import { ASSIGNMENT_LIMITS } from '@orca-cloud/relay-contract/assignment-invariants'
import { CONTROL_CONTINUITY_LIMITS } from '@orca-cloud/relay-contract/control-continuity'
import { RELAY_CLOSE_CODE } from '@orca-cloud/relay-contract/close-codes'
import { RELAY_HOST_CAPABILITY_IDLE_REGIONAL_REHOME } from '@orca-cloud/relay-contract/control-messages'
-import { RELAY_PROTOCOL_LIMITS } from '@orca-cloud/relay-contract/protocol-limits'
-import { afterEach, beforeEach, describe, expect, it, vi, type MockInstance } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
import type WebSocket from 'ws'
import type { RelayAssignmentStore } from '../assignment/assignment-store.js'
import type { RelayConfig } from '../config.js'
import type { RelayCredentialStore } from '../credentials/credential-store.js'
import { CONTROL_RENEWAL_BATCH_INTERVAL_MS } from '../control-leases/control-renewal-batch.js'
import type {
- ControlRenewalOutcome,
- ControlRenewalRequest
+ ControlRenewalOutcome
} from '../control-leases/control-renewal-statement.js'
import {
HostSessionRegistry,
IDLE_REHOME_MIN_CONTROL_AGE_MS,
type HostSession
} from './host-session-registry.js'
-import { relayHostLogDigest } from '../observability/relay-host-log-digest.js'
import type { RelayRuntimeObserver } from '../observability/relay-observability.js'
-import {
- REGIONAL_REHOME_TRUST_PROBE_ATTEMPT_ID,
- REGIONAL_REHOME_TRUST_PROBE_HOST_ID,
- REGIONAL_REHOME_TRUST_PROBE_USER_ID
-} from '../assignment/regional-rehome/regional-rehome-trust-probe.js'
import type { RelayTokenClaims } from '../authentication/relay-token-verifier.js'
import { ProcessQueuedByteBudget } from './splice-forwarder.js'
@@ -204,277 +195,6 @@ describe('host session cleanup races', () => {
vi.useRealTimers()
})
- it('logs control closes with a host digest and counts them, never the raw id', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:1')
- const { activate, observer } = createRegistry(activateControl)
- const socket = new FakeSocket()
- const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
- try {
- await activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
- socket.emit('error', new RangeError('Max payload size exceeded'))
- socket.close(1006, 'network reset')
-
- expect(observer.recordControlClose).toHaveBeenCalledWith(1006)
- const line = warn.mock.calls
- .map((call) => String(call[0]))
- .find((entry) => entry.includes('control closed'))
- expect(line).toContain(`host=${relayHostLogDigest(identity.relayHostId)}`)
- expect(line).toContain('code=1006')
- expect(line).toContain('Max payload size exceeded')
- expect(line).not.toContain(identity.relayHostId)
- } finally {
- warn.mockRestore()
- }
- })
-
- it('contains a dependency failure to one socket instead of the process', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:1')
- // The same rejection shape as a pg-pool connect timeout; unguarded, it
- // became an unhandled rejection that crashed whole production cells.
- const verifyRelayToken = vi.fn(async (): Promise => {
- throw new Error('Connection terminated due to connection timeout')
- })
- const { activate } = createRegistry(activateControl, {}, verifyRelayToken)
- const socket = new FakeSocket()
- const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
- try {
- await activate(socket as unknown as WebSocket, identity, null, 1, false, 7)
- socket.emit(
- 'message',
- Buffer.from(JSON.stringify({ type: 'auth-refresh', relayJwt: 'refreshed' })),
- false
- )
- await vi.waitFor(() =>
- expect(socket.close).toHaveBeenCalledWith(
- RELAY_CLOSE_CODE.LIMIT_EXCEEDED,
- 'relay temporarily unavailable'
- )
- )
- expect(warn).toHaveBeenCalledWith(
- '[orca-relay] auth refresh failed: Connection terminated due to connection timeout'
- )
- } finally {
- warn.mockRestore()
- }
- })
-
- it('attributes a control close to its client build without trusting the version string', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:1')
- const { activate } = createRegistry(activateControl)
- const socket = new FakeSocket()
- const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
- try {
- // A client controls this string, so it must be bounded and stripped like any close reason.
- await activate(
- socket as unknown as WebSocket,
- identity,
- null,
- 1,
- false,
- 1,
- `1.4.173\n${'x'.repeat(200)}`
- )
- socket.close(4408, 'replaced by a newer generation')
-
- const line = warn.mock.calls
- .map((call) => String(call[0]))
- .find((entry) => entry.includes('control closed'))
- expect(line).toContain('app="1.4.173')
- // The raw newline is escaped by JSON.stringify either way; only its escaped
- // form proves the strip ran, so assert on that.
- expect(line).not.toContain('\\n')
- expect(line).toMatch(/app="[^"]{1,80}"/)
- } finally {
- warn.mockRestore()
- }
- })
-
- it('keeps the first drain snapshot when a drain is retried', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:1')
- const { registry, activate } = createRegistry(activateControl)
- const socket = new FakeSocket()
- await activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
- // Captured before draining, because teardown removes the session from the map.
- const session = registry.get({
- userId: identity.sub,
- relayHostId: identity.relayHostId
- })!
- session.activeSplices.set('conn-a', () => session.activeSplices.delete('conn-a'))
-
- // Drain retries/signals must re-arm, not stack teardown; a paced 800-host cell otherwise leaks 800 timers holding exit open each retry.
- registry.drain(0)
- const scheduled = vi.getTimerCount()
- registry.drain(0)
- // Compare against the count before the retry rather than an absolute, since the
- // session's heartbeat interval is also pending.
- expect(vi.getTimerCount()).toBe(scheduled)
- vi.advanceTimersByTime(1)
-
- // Check state: synchronous FakeSocket close logs before second teardown, so log-only assertions miss corruption.
- expect(session.closingCounts).toEqual({ splices: 1, pending: 0 })
- })
-
- it('drains only the incarnation-bound host and makes replay idempotent', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:1')
- const { registry, activate } = createRegistry(
- activateControl,
- {},
- vi.fn(async () => identity)
- )
- const firstSocket = new FakeSocket()
- const secondSocket = new FakeSocket()
- const secondIdentity = {
- ...identity,
- sub: 'user-2',
- relayHostId: 'ponmlkjihgfedcba'
- }
- await activate(firstSocket as unknown as WebSocket, identity, null, 1, false, 7)
- await activate(secondSocket as unknown as WebSocket, secondIdentity, null, 1, false, 3)
- const trustProbe = {
- attemptId: REGIONAL_REHOME_TRUST_PROBE_ATTEMPT_ID,
- userId: REGIONAL_REHOME_TRUST_PROBE_USER_ID,
- relayHostId: REGIONAL_REHOME_TRUST_PROBE_HOST_ID,
- sourceAssignmentEpoch: 1,
- graceMs: 0
- }
- expect(registry.get(trustProbe)).toBeNull()
- expect(registry.drainHost(trustProbe)).toBe('host-not-connected')
- expect(registry.drainHost(trustProbe)).toBe('host-not-connected')
- expect(firstSocket.send).not.toHaveBeenCalledWith(expect.stringContaining('"drain"'))
- expect(secondSocket.send).not.toHaveBeenCalledWith(expect.stringContaining('"drain"'))
- const request = {
- attemptId: '11111111-1111-4111-8111-111111111111',
- userId: identity.sub,
- relayHostId: identity.relayHostId,
- sourceAssignmentEpoch: 7,
- graceMs: 30_000
- }
-
- expect(registry.drainHost(request)).toBe('accepted')
- expect(firstSocket.send).toHaveBeenCalledWith(
- JSON.stringify({ type: 'drain', graceMs: 30_000, recovery: 'resolve-director' })
- )
- expect(secondSocket.send).not.toHaveBeenCalledWith(expect.stringContaining('"drain"'))
- firstSocket.emit(
- 'message',
- Buffer.from(JSON.stringify({ type: 'auth-refresh', relayJwt: 'refreshed' })),
- false
- )
- await vi.waitFor(() => expect(registry.get(request)?.state).toBe('drain-only'))
- const timers = vi.getTimerCount()
- expect(registry.drainHost(request)).toBe('already-accepted')
- expect(vi.getTimerCount()).toBe(timers)
- expect(() =>
- registry.drainHost({
- ...request,
- attemptId: '22222222-2222-4222-8222-222222222222'
- })
- ).toThrow('regional_rehome_attempt_conflict')
- expect(() => registry.drainHost({ ...request, sourceAssignmentEpoch: 8 })).toThrow(
- 'regional_rehome_assignment_epoch_mismatch'
- )
-
- const rebound = new FakeSocket()
- await activate(rebound as unknown as WebSocket, identity, registry.get(request), 1, true, 7)
- expect(registry.get(request)?.state).toBe('drain-only')
- expect(rebound.send).toHaveBeenCalledWith(expect.stringContaining('"type":"drain"'))
-
- await vi.advanceTimersByTimeAsync(30_000)
- expect(registry.get(request)).toBeNull()
- expect(
- registry.get({ userId: secondIdentity.sub, relayHostId: secondIdentity.relayHostId })
- ).not.toBeNull()
- expect(secondSocket.close).not.toHaveBeenCalled()
- })
-
- it('keeps every live control socket indexed when first activations overlap', async () => {
- const firstControl = deferred()
- const secondControl = deferred()
- const activateControl = vi
- .fn()
- .mockReturnValueOnce(firstControl.promise)
- .mockReturnValueOnce(secondControl.promise)
- const { registry, activate } = createRegistry(activateControl)
- const firstSocket = new FakeSocket()
- const secondSocket = new FakeSocket()
-
- const first = activate(firstSocket as unknown as WebSocket, identity, null, 1, false, 1)
- const second = activate(secondSocket as unknown as WebSocket, identity, null, 1, false, 1)
- secondControl.resolve('control:production-gce-c3:1')
- await Promise.resolve()
- firstControl.resolve('control:production-gce-c3:1')
- await Promise.all([first, second])
-
- const liveSockets = [firstSocket, secondSocket].filter(
- (socket) => socket.readyState === socket.OPEN
- )
- const session = registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })
- expect(liveSockets).toHaveLength(1)
- expect(session?.socket).toBe(liveSockets[0])
- })
-
- it('does not publish a control that closes during activation', async () => {
- const blocked = deferred()
- const activateControl = vi
- .fn()
- .mockReturnValueOnce(blocked.promise)
- const { registry, activate, releaseActivity } = createRegistry(activateControl)
- const socket = new FakeSocket()
-
- const activation = activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
- await vi.advanceTimersByTimeAsync(0)
- expect(activateControl).toHaveBeenCalledOnce()
- socket.close()
- blocked.resolve('control:production-gce-c3:1')
- await activation
-
- expect(registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })).toBeNull()
- expect(releaseActivity).toHaveBeenCalledWith(
- { userId: identity.sub, relayHostId: identity.relayHostId },
- 'control:production-gce-c3:1'
- )
- })
-
- it('does not rebind a control that closes during activation', async () => {
- const blocked = deferred()
- const activateControl = vi
- .fn()
- .mockResolvedValueOnce('control:production-gce-c3:1')
- .mockReturnValueOnce(blocked.promise)
- const { registry, activate, releaseActivity } = createRegistry(activateControl)
- const originalSocket = new FakeSocket()
- await activate(originalSocket as unknown as WebSocket, identity, null, 1, false, 1)
- const original = registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })
- expect(original).not.toBeNull()
-
- const rebindSocket = new FakeSocket()
- const rebinding = activate(rebindSocket as unknown as WebSocket, identity, original, 1, true, 1)
- await vi.advanceTimersByTimeAsync(0)
- expect(activateControl).toHaveBeenCalledTimes(2)
- rebindSocket.close()
- blocked.resolve('control:production-gce-c3:1')
- await rebinding
-
- const session = registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })
- expect(session).toBe(original)
- expect(session?.socket).toBe(originalSocket)
- expect(session?.state).toBe('active')
- expect(releaseActivity).toHaveBeenCalledWith(
- { userId: identity.sub, relayHostId: identity.relayHostId },
- 'control:production-gce-c3:1'
- )
- })
-
// c34 ghost seat came from activation outliving orphan grace and reviving a removed session outside the map.
it('refuses a rebind whose session left the map while its activation was in flight', async () => {
const blocked = deferred()
@@ -513,30 +233,6 @@ describe('host session cleanup races', () => {
expect(releaseActivity).toHaveBeenCalledWith(key, 'control:production-gce-c3:1')
})
- // Two hellos proven against the same empty map could take the same generation; an activation at
- // a generation this host already had here is refused, so a late leave cannot share it.
- it('refuses a fresh activation at a generation this host already had here', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:2')
- const { registry, activate } = createRegistry(activateControl)
- const key = { userId: identity.sub, relayHostId: identity.relayHostId }
- const first = new FakeSocket()
- // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: FakeSocket implements the registry's WebSocket event and lifecycle surface.
- await activate(first as unknown as WebSocket, identity, null, 2, false, 1)
- first.close(1006, 'network reset')
- await vi.advanceTimersByTimeAsync(CONTROL_CONTINUITY_LIMITS.orphanGraceMs)
- expect(registry.get(key)).toBeNull()
- const reused = new FakeSocket()
- // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: FakeSocket implements the registry's WebSocket event and lifecycle surface.
- await activate(reused as unknown as WebSocket, identity, null, 2, false, 1)
- expect(reused.close).toHaveBeenCalledWith(
- RELAY_CLOSE_CODE.PEER_DROPPED,
- 'control activation superseded'
- )
- expect(registry.get(key)).toBeNull()
- })
-
it('skips a closed queued control so its live retry avoids abandoned database work', async () => {
const stalled = deferred()
const activateControl = vi
@@ -586,176 +282,6 @@ describe('host session cleanup races', () => {
)
})
- it('rejects client lookup when the indexed control socket is not open', async () => {
- const reservation = {
- userId: identity.sub,
- relayHostId: identity.relayHostId,
- credentialKind: 'resume',
- relayDeviceId: 'device-1',
- leaseExpiresAt: Date.now() + 60_000
- }
- const store = {
- resolveResume: vi.fn().mockResolvedValue({ userId: identity.sub }),
- reserveCredential: vi.fn().mockResolvedValue(reservation),
- failReservation: vi.fn().mockResolvedValue(undefined)
- }
- const activateControl = vi
- .fn()
- .mockResolvedValueOnce('control:production-gce-c3:1')
- const { registry, activate } = createRegistry(activateControl, store)
- const controlSocket = new FakeSocket()
- await activate(controlSocket as unknown as WebSocket, identity, null, 1, false, 1)
- const session = registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })
- expect(session?.state).toBe('active')
- // A dead socket that never delivered its close event: state stays active,
- // so only the readyState guard can protect the lookup.
- controlSocket.readyState = controlSocket.CLOSED
-
- const client = new FakeSocket()
- await registry.acceptClient(client as unknown as WebSocket, identity.relayHostId, 'credential')
-
- expect(store.failReservation).toHaveBeenCalledWith(reservation)
- expect(client.send).toHaveBeenCalledWith(
- JSON.stringify({ type: 'relay-hello', ok: false, code: RELAY_CLOSE_CODE.HOST_OFFLINE })
- )
- expect(session?.pendingConns.size).toBe(0)
- })
-
- it('fails a control waiting behind a stalled activation without breaking serialization', async () => {
- const stalled = deferred()
- const activateControl = vi
- .fn()
- .mockReturnValueOnce(stalled.promise)
- const { registry, activate } = createRegistry(activateControl)
- const stalledSocket = new FakeSocket()
- const first = activate(stalledSocket as unknown as WebSocket, identity, null, 1, false, 1)
- const waitingSocket = new FakeSocket()
- const second = activate(waitingSocket as unknown as WebSocket, identity, null, 1, false, 1)
-
- // Let the first activation reach the store (clearing its own queue timer)
- // before the waiting control's deadline elapses.
- await Promise.resolve()
- await Promise.resolve()
- vi.advanceTimersByTime(30_000)
- expect(waitingSocket.close).toHaveBeenCalledWith(
- RELAY_CLOSE_CODE.LIMIT_EXCEEDED,
- 'control activation queue stalled'
- )
- // The waiting control never reached the store; serialization held.
- expect(activateControl).toHaveBeenCalledOnce()
-
- stalled.resolve('control:production-gce-c3:1')
- await Promise.all([first, second])
- const session = registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })
- expect(session?.socket).toBe(stalledSocket)
- expect(session?.state).toBe('active')
- })
-
- it('rejects an activation that returns after drain begins', async () => {
- const blocked = deferred()
- const activateControl = vi
- .fn()
- .mockResolvedValueOnce('control:production-gce-c3:1')
- .mockReturnValueOnce(blocked.promise)
- const { registry, activate, renewControlActivities, releaseActivity } =
- createRegistry(activateControl)
- const originalSocket = new FakeSocket()
- await activate(originalSocket as unknown as WebSocket, identity, null, 1, false, 1)
- const original = registry.get({
- userId: identity.sub,
- relayHostId: identity.relayHostId
- })
- expect(original).not.toBeNull()
-
- const replacementSocket = new FakeSocket()
- const replacement = activate(
- replacementSocket as unknown as WebSocket,
- identity,
- original,
- 2,
- false,
- 1
- )
- registry.drain(100)
- blocked.resolve('control:production-gce-c3:2')
- await replacement
- vi.advanceTimersByTime(100)
- vi.advanceTimersByTime(15_000)
-
- expect(replacementSocket.close).toHaveBeenCalledWith(
- RELAY_CLOSE_CODE.DRAINING,
- 'relay draining'
- )
- expect(registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })).toBeNull()
- expect(renewControlActivities).not.toHaveBeenCalled()
- expect(releaseActivity).toHaveBeenCalledWith(
- { userId: identity.sub, relayHostId: identity.relayHostId },
- 'control:production-gce-c3:2'
- )
- })
-
- it('keeps a replacement mapped after stale orphan cleanup', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValueOnce('control:production-gce-c3:1')
- .mockResolvedValueOnce('control:production-gce-c3:2')
- const { registry, activate } = createRegistry(activateControl)
- const originalSocket = new FakeSocket()
- await activate(originalSocket as unknown as WebSocket, identity, null, 1, false, 1)
- const original = registry.get({
- userId: identity.sub,
- relayHostId: identity.relayHostId
- })
- expect(original).not.toBeNull()
- originalSocket.close()
-
- const replacementSocket = new FakeSocket()
- await activate(replacementSocket as unknown as WebSocket, identity, original, 2, false, 1)
- const replacement = registry.get({
- userId: identity.sub,
- relayHostId: identity.relayHostId
- })
- vi.advanceTimersByTime(CONTROL_CONTINUITY_LIMITS.orphanGraceMs)
-
- expect(replacement).not.toBeNull()
- expect(registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })).toBe(
- replacement
- )
- expect(registry.runtimeCounts().controls).toBe(1)
- registry.drain(0)
- vi.advanceTimersByTime(0)
- })
-
- it('stops the heartbeat of an actively replaced generation', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValueOnce('control:production-gce-c3:1')
- .mockResolvedValueOnce('control:production-gce-c3:2')
- const { registry, activate, renewControlActivities } = createRegistry(activateControl)
- const originalSocket = new FakeSocket()
- await activate(originalSocket as unknown as WebSocket, identity, null, 1, false, 1)
- const original = registry.get({
- userId: identity.sub,
- relayHostId: identity.relayHostId
- })
- expect(original).not.toBeNull()
-
- await activate(new FakeSocket() as unknown as WebSocket, identity, original, 2, false, 1)
- await vi.advanceTimersByTimeAsync(15_000)
- await closeRenewalWindow()
-
- expect(renewControlActivities).toHaveBeenCalledOnce()
- expect(renewControlActivities).toHaveBeenCalledWith([
- expect.objectContaining({
- identity: { userId: identity.sub, relayHostId: identity.relayHostId },
- activityId: 'control:production-gce-c3:2',
- cellId: 'production-gce-c3'
- })
- ])
- registry.drain(0)
- vi.advanceTimersByTime(0)
- })
-
it('ignores a denial belonging to the socket before a same-generation rebind', async () => {
const h = createRegistry(vi.fn().mockResolvedValue('control:production-gce-c3:1'))
const oldSocket = new FakeSocket()
@@ -778,338 +304,6 @@ describe('host session cleanup races', () => {
expect(session.generation).toBe(1)
})
- it('ignores missing-activity recovery denial after an authority transition', async () => {
- const h = createRegistry(vi.fn().mockResolvedValue('control:production-gce-c3:1'))
- const socket = new FakeSocket()
- await h.activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
- const session = h.registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })!
- h.renewControlActivities.mockResolvedValueOnce(['control_activity_not_found'])
- let reject!: (error: Error) => void
- h.acquireActivity.mockReturnValueOnce(
- new Promise((_, fail) => {
- reject = fail
- })
- )
- await vi.advanceTimersByTimeAsync(15_000)
- await closeRenewalWindow()
- h.registry.drainHost({
- attemptId: 'attempt',
- userId: identity.sub,
- relayHostId: identity.relayHostId,
- sourceAssignmentEpoch: 1,
- graceMs: 60_000
- })
- reject(new Error('activity_cell_not_authoritative'))
- await vi.advanceTimersByTimeAsync(0)
- expect(socket.close).not.toHaveBeenCalled()
- expect(session.state).toBe('drain-only')
- })
-
- it('keeps 15s pings while halving steady-state control renewals', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:1')
- const { registry, activate, renewControlActivities } = createRegistry(activateControl)
- const socket = new FakeSocket()
- const activatedAt = Date.now()
- await activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
-
- for (let interval = 0; interval < 4; interval++) {
- await vi.advanceTimersByTimeAsync(RELAY_PROTOCOL_LIMITS.controlPingIntervalMs)
- socket.emit('message', Buffer.from(JSON.stringify({ type: 'pong' })), false)
- await closeRenewalWindow()
- }
-
- const pings = socket.send.mock.calls.filter((call) => String(call[0]).includes('"ping"'))
- expect(pings).toHaveLength(4)
- expect(renewControlActivities).toHaveBeenCalledTimes(2)
- const firstExpiry = Number(renewControlActivities.mock.calls[0]![0][0]!.expiresAt)
- const secondExpiry = Number(renewControlActivities.mock.calls[1]![0][0]!.expiresAt)
- expect(firstExpiry).toBe(
- activatedAt +
- RELAY_PROTOCOL_LIMITS.controlPingIntervalMs +
- ASSIGNMENT_LIMITS.activityLeaseMs +
- RELAY_PROTOCOL_LIMITS.controlPingIntervalMs
- )
- expect(secondExpiry - firstExpiry).toBe(RELAY_PROTOCOL_LIMITS.controlPingIntervalMs * 2)
- registry.drain(0)
- vi.advanceTimersByTime(0)
- })
-
- it('retries a failed control renewal on the next ping', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:1')
- const { registry, activate, renewControlActivities } = createRegistry(activateControl)
- renewControlActivities.mockRejectedValueOnce(new Error('pool timeout'))
- const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
- const socket = new FakeSocket()
- try {
- await activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
- await vi.advanceTimersByTimeAsync(RELAY_PROTOCOL_LIMITS.controlPingIntervalMs)
- await closeRenewalWindow()
- expect(renewControlActivities).toHaveBeenCalledOnce()
- await vi.advanceTimersByTimeAsync(RELAY_PROTOCOL_LIMITS.controlPingIntervalMs)
- await closeRenewalWindow()
- expect(renewControlActivities).toHaveBeenCalledTimes(2)
- } finally {
- warn.mockRestore()
- registry.drain(0)
- vi.advanceTimersByTime(0)
- }
- })
-
- it('retries past a stalled control renewal without waiting for it', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:1')
- const { registry, activate, renewControlActivities } = createRegistry(activateControl)
- const stalled = deferred()
- renewControlActivities.mockReturnValueOnce(stalled.promise)
- const socket = new FakeSocket()
- await activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
-
- await vi.advanceTimersByTimeAsync(RELAY_PROTOCOL_LIMITS.controlPingIntervalMs * 2)
- await closeRenewalWindow()
-
- expect(renewControlActivities).toHaveBeenCalledTimes(2)
- stalled.resolve(['renewed'])
- await vi.advanceTimersByTimeAsync(0)
- registry.drain(0)
- vi.advanceTimersByTime(0)
- })
-
- it('ignores a superseded renewal resolving after a fresher success', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:1')
- const { registry, activate, renewControlActivities } = createRegistry(activateControl)
- const stalled = deferred()
- renewControlActivities.mockReturnValueOnce(stalled.promise)
- const socket = new FakeSocket()
- await activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
-
- await vi.advanceTimersByTimeAsync(RELAY_PROTOCOL_LIMITS.controlPingIntervalMs * 2)
- await closeRenewalWindow()
- expect(renewControlActivities).toHaveBeenCalledTimes(2)
- stalled.resolve(['renewed'])
- await vi.advanceTimersByTimeAsync(0)
- await vi.advanceTimersByTimeAsync(RELAY_PROTOCOL_LIMITS.controlPingIntervalMs)
- await closeRenewalWindow()
-
- expect(renewControlActivities).toHaveBeenCalledTimes(2)
- await vi.advanceTimersByTimeAsync(RELAY_PROTOCOL_LIMITS.controlPingIntervalMs)
- await closeRenewalWindow()
-
- expect(renewControlActivities).toHaveBeenCalledTimes(3)
- registry.drain(0)
- vi.advanceTimersByTime(0)
- })
-
- it('closes when a missing control activity cannot be re-acquired on this cell', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:1')
- const { registry, activate, acquireActivity, renewControlActivities } =
- createRegistry(activateControl)
- renewControlActivities.mockResolvedValueOnce(['control_activity_not_found'])
- acquireActivity.mockRejectedValueOnce(new Error('activity_cell_not_authoritative'))
- const socket = new FakeSocket()
- await activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
-
- await vi.advanceTimersByTimeAsync(RELAY_PROTOCOL_LIMITS.controlPingIntervalMs)
- await closeRenewalWindow()
-
- expect(socket.close).toHaveBeenCalledWith(
- RELAY_CLOSE_CODE.DRAINING,
- 'control migration completed'
- )
- registry.drain(0)
- vi.advanceTimersByTime(0)
- })
-
- it('closes a control when renewal finds its cell is no longer authoritative', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:1')
- const { registry, activate, renewControlActivities } = createRegistry(activateControl)
- renewControlActivities.mockResolvedValueOnce(['activity_cell_not_authoritative'])
- const socket = new FakeSocket()
- await activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
-
- await vi.advanceTimersByTimeAsync(RELAY_PROTOCOL_LIMITS.controlPingIntervalMs)
- await closeRenewalWindow()
-
- expect(socket.close).toHaveBeenCalledWith(
- RELAY_CLOSE_CODE.DRAINING,
- 'control migration completed'
- )
- registry.drain(0)
- vi.advanceTimersByTime(0)
- })
-
- it('continues renewing throughout the drain grace period', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:1')
- const { registry, activate, renewControlActivities } = createRegistry(activateControl)
- const socket = new FakeSocket()
- await activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
- registry.drain(60_000)
-
- for (let interval = 0; interval < 3; interval++) {
- await vi.advanceTimersByTimeAsync(RELAY_PROTOCOL_LIMITS.controlPingIntervalMs)
- socket.emit('message', Buffer.from(JSON.stringify({ type: 'pong' })), false)
- await closeRenewalWindow()
- }
-
- expect(renewControlActivities).toHaveBeenCalledTimes(2)
- expect(socket.readyState).toBe(socket.OPEN)
- vi.advanceTimersByTime(15_000)
- })
-})
-
-describe('control renewal cadence across a rebind', () => {
- beforeEach(() => vi.useFakeTimers())
- afterEach(() => {
- vi.clearAllTimers()
- vi.useRealTimers()
- })
-
- it('keeps the halved cadence after a rebind lands under a stalled renewal', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:1')
- const { registry, activate, renewControlActivities } = createRegistry(activateControl)
- const ping = RELAY_PROTOCOL_LIMITS.controlPingIntervalMs
- const socket = new FakeSocket()
- await activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
-
- const beat = async (target: FakeSocket): Promise => {
- await vi.advanceTimersByTimeAsync(ping)
- target.emit('message', Buffer.from(JSON.stringify({ type: 'pong' })), false)
- await closeRenewalWindow()
- }
-
- // Age the session so its attempt counter is well above zero.
- for (let tick = 0; tick < 5; tick++) await beat(socket)
- expect(renewControlActivities).toHaveBeenCalledTimes(3)
-
- // The next renewal stalls and is still in flight when the control rebinds.
- const stalled = deferred()
- renewControlActivities.mockReturnValueOnce(stalled.promise)
- for (let tick = 0; tick < 2; tick++) await beat(socket)
- expect(renewControlActivities).toHaveBeenCalledTimes(4)
-
- const session = registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })!
- const rebindSocket = new FakeSocket()
- await activate(rebindSocket as unknown as WebSocket, identity, session, 1, true, 1)
- stalled.resolve(['renewed'])
- await vi.advanceTimersByTimeAsync(0)
-
- const before = renewControlActivities.mock.calls.length
- for (let tick = 0; tick < 4; tick++) await beat(rebindSocket)
- expect(renewControlActivities.mock.calls.length - before).toBe(2)
-
- registry.drain(0)
- vi.advanceTimersByTime(0)
- })
-})
-
-describe('control renewals shared by one batch', () => {
- beforeEach(() => vi.useFakeTimers())
- afterEach(() => {
- vi.clearAllTimers()
- vi.useRealTimers()
- })
-
- it('renews two due hosts in one call and leaves a stale one alone', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValueOnce('control:production-gce-c3:1')
- .mockResolvedValueOnce('control:production-gce-c3:1')
- const { registry, activate, renewControlActivities } = createRegistry(activateControl)
- const other = { ...identity, sub: 'user-2', relayHostId: 'ponmlkjihgfedcba' }
- const staleSocket = new FakeSocket()
- const liveSocket = new FakeSocket()
- await activate(staleSocket as unknown as WebSocket, identity, null, 1, false, 1)
- await activate(liveSocket as unknown as WebSocket, other, null, 1, false, 1)
- const stale = registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })!
- const live = registry.get({ userId: other.sub, relayHostId: other.relayHostId })!
-
- // Both come due inside the same window, and one socket goes away while the
- // statement is still in PostgreSQL.
- let release!: () => void
- renewControlActivities.mockImplementationOnce(
- async (rows: readonly ControlRenewalRequest[]) => {
- staleSocket.close()
- await new Promise((resolve) => (release = resolve))
- return rows.map((): ControlRenewalOutcome => 'renewed')
- }
- )
- await vi.advanceTimersByTimeAsync(RELAY_PROTOCOL_LIMITS.controlPingIntervalMs)
- const staleDueAt = stale.activityRenewalDueAt
- await closeRenewalWindow()
- release()
- await vi.advanceTimersByTimeAsync(0)
-
- expect(renewControlActivities).toHaveBeenCalledOnce()
- expect(
- renewControlActivities.mock.calls[0]![0].map(
- (row: ControlRenewalRequest) => row.identity.relayHostId
- )
- ).toEqual([identity.relayHostId, other.relayHostId])
- expect(live.activityRenewalCompletedAttempt).toBe(1)
- expect(stale.activityRenewalCompletedAttempt).toBe(0)
- expect(stale.activityRenewalDueAt).toBe(staleDueAt)
- registry.drain(0)
- vi.advanceTimersByTime(0)
- })
-})
-
-describe('control lease recovery after the session is gone', () => {
- beforeEach(() => vi.useFakeTimers())
- afterEach(() => {
- vi.clearAllTimers()
- vi.useRealTimers()
- })
-
- it('does not re-acquire a lease for a session a newer generation already replaced', async () => {
- const activateControl = vi
- .fn()
- .mockResolvedValueOnce('control:production-gce-c3:1')
- .mockResolvedValueOnce('control:production-gce-c3:2')
- const { registry, activate, acquireActivity, renewControlActivities } =
- createRegistry(activateControl)
- const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
- try {
- const socket = new FakeSocket()
- await activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
- const session = registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })!
-
- // The renewal is still in flight when a newer generation takes over.
- let finishRenewal!: (outcomes: ControlRenewalOutcome[]) => void
- renewControlActivities.mockReturnValueOnce(
- new Promise((resolve) => (finishRenewal = resolve))
- )
- await vi.advanceTimersByTimeAsync(RELAY_PROTOCOL_LIMITS.controlPingIntervalMs)
- await closeRenewalWindow()
- expect(renewControlActivities).toHaveBeenCalledOnce()
-
- const newer = new FakeSocket()
- await activate(newer as unknown as WebSocket, identity, session, 2, false, 1)
-
- // Its release already removed the lease, so the renewal reports it missing.
- finishRenewal(['control_activity_not_found'])
- await vi.advanceTimersByTimeAsync(0)
-
- expect(acquireActivity).not.toHaveBeenCalled()
- } finally {
- warn.mockRestore()
- registry.drain(0)
- vi.advanceTimersByTime(0)
- }
- })
})
describe('source-owned idle cutover', () => {
@@ -1145,124 +339,7 @@ describe('source-owned idle cutover', () => {
vi.setSystemTime(Date.now() + controlAgeMs)
return { ...h, socket, session: h.registry.get(request)! }
}
- it.each([
- { controlAgeMs: 0, outcome: 'busy' },
- { controlAgeMs: IDLE_REHOME_MIN_CONTROL_AGE_MS - 1, outcome: 'busy' },
- { controlAgeMs: IDLE_REHOME_MIN_CONTROL_AGE_MS, outcome: 'committed' },
- { controlAgeMs: 60 * 60 * 1000, outcome: 'committed' }
- ])('answers $outcome for a control socket $controlAgeMs ms old', async (row) => {
- const { controlAgeMs, outcome } = row
- const h = await source({}, controlAgeMs)
- const commit = vi.fn().mockResolvedValue({ outcome: 'committed' })
- expect(
- await h.registry.idleRehome(request, commit, vi.fn().mockResolvedValue('not-committed'))
- ).toEqual({ outcome })
- expect(commit).toHaveBeenCalledTimes(outcome === 'busy' ? 0 : 1)
- await vi.advanceTimersByTimeAsync(0)
- expect(h.socket.close).toHaveBeenCalledTimes(outcome === 'busy' ? 0 : 1)
- })
- it('restarts the age when the host rebinds its control socket', async () => {
- const h = await source()
- const rebound = new FakeSocket()
- h.registry.acceptControl(
- rebound as unknown as WebSocket,
- identity,
- undefined,
- new Set([RELAY_HOST_CAPABILITY_IDLE_REGIONAL_REHOME])
- )
- rebound.removeAllListeners('message')
- await h.activate(rebound as unknown as WebSocket, identity, h.session, 1, true, 1)
- const commit = vi.fn().mockResolvedValue({ outcome: 'committed' })
- expect(
- await h.registry.idleRehome(request, commit, vi.fn().mockResolvedValue('not-committed'))
- ).toEqual({ outcome: 'busy' })
- expect(commit).not.toHaveBeenCalled()
- })
- it('closes a superseded socket whose refresh meets the cutover, not its successor', async () => {
- const h = await source()
- const successor = new FakeSocket()
- h.registry.acceptControl(
- successor as unknown as WebSocket,
- identity,
- undefined,
- new Set([RELAY_HOST_CAPABILITY_IDLE_REGIONAL_REHOME])
- )
- successor.removeAllListeners('message')
- await h.activate(successor as unknown as WebSocket, identity, h.session, 1, true, 1)
- vi.setSystemTime(Date.now() + IDLE_REHOME_MIN_CONTROL_AGE_MS)
- const commit = deferred<{ outcome: 'committed' }>()
- const cutover = h.registry.idleRehome(
- request,
- vi.fn(() => commit.promise),
- vi.fn().mockResolvedValue('not-committed')
- )
- h.socket.emit(
- 'message',
- Buffer.from(JSON.stringify({ type: 'auth-refresh', relayJwt: 'jwt' })),
- false
- )
- await vi.advanceTimersByTimeAsync(0)
- expect(h.socket.close).toHaveBeenCalledWith(RELAY_CLOSE_CODE.DRAINING, 'resolve-director')
- expect(successor.close).not.toHaveBeenCalledWith(RELAY_CLOSE_CODE.DRAINING, 'resolve-director')
- commit.resolve({ outcome: 'committed' })
- await cutover
- })
- it('keeps either established client busy until both actually leave', async () => {
- const h = await source()
- h.session.activeConnIds.add('phone')
- h.session.activeConnIds.add('ipad')
- const commit = vi.fn().mockResolvedValue({ outcome: 'committed' })
- h.session.activeConnIds.delete('ipad')
- expect(
- await h.registry.idleRehome(request, commit, vi.fn().mockResolvedValue('not-committed'))
- ).toEqual({ outcome: 'busy' })
- expect(commit).not.toHaveBeenCalled()
- h.session.activeConnIds.delete('phone')
- expect(
- await h.registry.idleRehome(request, commit, vi.fn().mockResolvedValue('not-committed'))
- ).toEqual({ outcome: 'committed' })
- await vi.advanceTimersByTimeAsync(0)
- expect(h.socket.close).toHaveBeenCalledWith(RELAY_CLOSE_CODE.DRAINING, expect.any(String))
- expect(h.releaseActivity).toHaveBeenCalled()
- })
- it.each([
- { userId: 'other-user' },
- { sourceAssignmentEpoch: 2 },
- { sourceGeneration: 2 },
- { sourceCellIncarnation: 'other-incarnation' },
- { targetCellId: 'other-target' }
- ])('rejects a reused operation ID with changed authority %j', async (change) => {
- const h = await source()
- const result = deferred<{ outcome: 'deferred' }>()
- const commit = vi.fn().mockReturnValue(result.promise)
- const reconcile = vi.fn().mockResolvedValue('not-committed')
- const moving = h.registry.idleRehome(request, commit, reconcile)
- const conflicting = h.registry.idleRehome({ ...request, ...change }, commit, reconcile)
- result.resolve({ outcome: 'deferred' })
- expect(await conflicting).toEqual({ outcome: 'stale' })
- expect(await moving).toEqual({ outcome: 'deferred' })
- expect(commit).toHaveBeenCalledOnce()
- expect(h.socket.close).not.toHaveBeenCalled()
- })
- it('accounts for accepts before credential identity resolves', async () => {
- const lookup = deferred()
- const h = await source({
- resolveResume: vi.fn().mockReturnValue(lookup.promise),
- resolveInviteForMove: vi.fn().mockResolvedValue(null)
- })
- const client = new FakeSocket()
- const accept = h.registry.acceptClient(
- client as unknown as WebSocket,
- identity.relayHostId,
- 'credential'
- )
- expect(
- await h.registry.idleRehome(request, vi.fn(), vi.fn().mockResolvedValue('not-committed'))
- ).toEqual({ outcome: 'busy' })
- lookup.resolve(null)
- await accept
- expect(h.socket.close).not.toHaveBeenCalled()
- })
+
it('rejects new accepts and replacements synchronously while a commit awaits', async () => {
const h = await source()
const result = deferred<{ outcome: 'deferred' }>()
@@ -1334,60 +411,7 @@ describe('source-owned idle cutover', () => {
expect(h.socket.close).not.toHaveBeenCalled()
}
)
- it('owns accepted control mutations before the handler first awaits', async () => {
- const mutation = deferred()
- const h = await source()
- ;(h.registry as unknown as { verifyRelayToken: unknown }).verifyRelayToken = vi
- .fn()
- .mockReturnValue(mutation.promise)
- h.socket.emit(
- 'message',
- Buffer.from(JSON.stringify({ type: 'auth-refresh', relayJwt: 'token' })),
- false
- )
- const commit = vi.fn().mockResolvedValue({ outcome: 'deferred' })
- expect(
- await h.registry.idleRehome(request, commit, vi.fn().mockResolvedValue('not-committed'))
- ).toEqual({ outcome: 'busy' })
- mutation.resolve(identity)
- await vi.advanceTimersByTimeAsync(0)
- expect(
- await h.registry.idleRehome(request, commit, vi.fn().mockResolvedValue('not-committed'))
- ).toEqual({ outcome: 'deferred' })
- })
- it('owns queued replacement activation before its first persistence await', async () => {
- const h = await source()
- const activation = deferred()
- const assignments = (h.registry as unknown as { assignments: { activateControl: unknown } })
- .assignments
- assignments.activateControl = vi.fn().mockReturnValue(activation.promise)
- const replacement = new FakeSocket()
- const activating = h.activate(
- replacement as unknown as WebSocket,
- identity,
- h.session,
- 2,
- false,
- 1
- )
- expect(
- await h.registry.idleRehome(request, vi.fn(), vi.fn().mockResolvedValue('not-committed'))
- ).toEqual({ outcome: 'busy' })
- activation.resolve('control:2')
- await activating
- })
- it('retires changed authority even when the claim definitively deferred', async () => {
- const h = await source()
- expect(
- await h.registry.idleRehome(
- request,
- vi.fn().mockResolvedValue({ outcome: 'deferred' }),
- vi.fn().mockResolvedValue('stale')
- )
- ).toEqual({ outcome: 'stale' })
- expect(h.session.state).toBe('closed')
- expect(h.releaseActivity).toHaveBeenCalled()
- })
+
it('holds attach ownership through basis failure reservation cleanup', async () => {
const basis = deferred()
const cleanup = deferred()
@@ -1437,223 +461,6 @@ describe('source-owned idle cutover', () => {
cleanup.resolve()
await attached
})
- it('rejects an attach mid-cutover before its ticket is ever examined', async () => {
- const h = await source({ failReservation: vi.fn().mockResolvedValue(undefined) })
- const result = deferred<{ outcome: 'deferred' }>()
- // The cutover must already be in flight: an idle host is what it claims.
- const moving = h.registry.idleRehome(request, () => result.promise, vi.fn())
- const client = new FakeSocket()
- h.session.pendingConns.set('conn', {
- connId: 'conn',
- connTicket: 'ticket',
- client: client as unknown as WebSocket,
- reservation: {
- userId: identity.sub,
- relayHostId: identity.relayHostId,
- credentialKind: 'invite',
- leaseExpiresAt: Date.now() + 1000
- },
- attachTimer: setTimeout(() => {}, 1000),
- credentialActivityId: null
- } as never)
- const host = new FakeSocket()
- // The ticket below is the live one: only the cutover fence may reject it.
- expect(await h.registry.acceptHostData(host as unknown as WebSocket, 'conn', 'ticket', 1)).toBe(
- false
- )
- expect(host.close).toHaveBeenCalledWith(RELAY_CLOSE_CODE.WRONG_CELL, expect.any(String))
- expect(h.observer.recordAuth).not.toHaveBeenCalled()
- expect(h.session.pendingConns.has('conn')).toBe(true)
- expect(h.session.activeConnIds.size).toBe(0)
- result.resolve({ outcome: 'deferred' })
- await moving
- })
- it('holds no attach ownership when no session owns the connection', async () => {
- const h = await source()
- const host = new FakeSocket()
- expect(
- await h.registry.acceptHostData(host as unknown as WebSocket, 'stranger', 'ticket', 1)
- ).toBe(false)
- expect(h.observer.recordAuth).toHaveBeenCalledWith(false)
- expect(host.close).toHaveBeenCalledWith(
- RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL,
- expect.any(String)
- )
- // A leaked idle-work hold from the unowned attach would report `busy` here.
- expect(
- await h.registry.idleRehome(
- request,
- vi.fn().mockResolvedValue({ outcome: 'committed' }),
- vi.fn()
- )
- ).toEqual({ outcome: 'committed' })
- })
- it('returns the durable operation outcome after source retirement', async () => {
- const h = await source()
- const commit = vi.fn().mockResolvedValue({ outcome: 'committed' })
- await h.registry.idleRehome(request, commit, vi.fn())
- expect(
- await h.registry.idleRehome(request, commit, vi.fn().mockResolvedValue('committed'))
- ).toEqual({ outcome: 'committed' })
- expect(commit).toHaveBeenCalledOnce()
- })
- it('does not reopen a source overtaken by emergency drain', async () => {
- const h = await source()
- const result = deferred<{ outcome: 'deferred' }>()
- const moving = h.registry.idleRehome(
- request,
- () => result.promise,
- vi.fn().mockResolvedValue('not-committed')
- )
- h.registry.drain(0)
- await vi.advanceTimersByTimeAsync(0)
- result.resolve({ outcome: 'deferred' })
- await moving
- expect(h.session.state).toBe('closed')
- expect(h.registry.get(request)).toBeNull()
- })
-})
-
-// The host data leg's owner lookup is the registry's only whole-inventory scan on
-// an attach. These count what that scan touches, not how long it takes.
-describe('host data attach owner lookup', () => {
- beforeEach(() => vi.useFakeTimers())
- afterEach(() => {
- vi.clearAllTimers()
- vi.useRealTimers()
- })
-
- const SESSION_COUNT = 1000
- const CONN_ID = 'conn-owned'
- const OWNER_INDEX = { first: 0, middle: 499, last: 999 } as const
- type Placement = keyof typeof OWNER_INDEX | 'absent'
- type LookupCounts = { visits: number; membership: number }
-
- function bindOwn(map: Map, property: string | symbol): unknown {
- const value: unknown = Reflect.get(map, property, map)
- return typeof value === 'function' ? value.bind(map) : value
- }
-
- // One visit per session the scan pulls off the map iterator; answers unchanged.
- function countingValues(map: Map, counts: LookupCounts): Map {
- return new Proxy(map, {
- get(target, property) {
- if (property !== 'values') return bindOwn(target, property)
- return function* (): Generator {
- for (const value of target.values()) {
- counts.visits += 1
- yield value
- }
- }
- }
- })
- }
-
- // One membership check per `pendingConns.has`; answers unchanged.
- function countingHas(map: Map, counts: LookupCounts): Map {
- return new Proxy(map, {
- get(target, property) {
- if (property !== 'has') return bindOwn(target, property)
- return (key: K) => {
- counts.membership += 1
- return target.has(key)
- }
- }
- })
- }
-
- function pendingConn(
- client: FakeSocket,
- connTicket: string
- ): NonNullable> {
- return {
- connId: CONN_ID,
- connTicket,
- client: client as unknown as WebSocket,
- reservation: {
- userId: identity.sub,
- relayHostId: identity.relayHostId,
- credentialKind: 'invite',
- relayDeviceId: 'device-1',
- tokenHash: 'invite-hash',
- reservationId: 'reservation-1',
- leaseExpiresAt: Date.now() + 1000
- },
- attachTimer: setTimeout(() => {}, 1000),
- credentialActivityId: null,
- phonePath: 'db',
- timing: {
- startedAt: Date.now(),
- connOpenAt: Date.now(),
- stageMs: { assignment: 0, credential: 0, activity: 0 }
- }
- }
- }
-
- // Every decoy holds a pending conn of its own, so each membership check the
- // scan makes is real work rather than a lookup in an empty map.
- function decoySession(index: number, counts: LookupCounts): HostSession {
- const pendingConns = new Map([[`conn-decoy-${index}`, { connId: 'decoy' }]])
- return {
- relayHostId: `decoy-host-${index}`,
- generation: 1,
- state: 'active',
- activeConnIds: new Set(),
- pendingConns: countingHas(pendingConns, counts)
- } as unknown as HostSession
- }
-
- async function attachRegistry(placement: Placement, store: Partial = {}) {
- const h = createRegistry(vi.fn().mockResolvedValue('control:1'), {
- failReservation: vi.fn().mockResolvedValue(undefined),
- recordConnectionBasis: vi.fn().mockResolvedValue(undefined),
- deactivateBasis: vi.fn().mockResolvedValue(undefined),
- ...store
- })
- const control = new FakeSocket()
- await h.activate(control as unknown as WebSocket, identity, null, 1, false, 1)
- const internals = h.registry as unknown as { sessions: Map }
- const [ownerKey, owner] = [...internals.sessions.entries()][0]!
- const counts: LookupCounts = { visits: 0, membership: 0 }
- const client = new FakeSocket()
- if (placement !== 'absent') owner.pendingConns.set(CONN_ID, pendingConn(client, 'ticket'))
- owner.pendingConns = countingHas(owner.pendingConns, counts)
- const ordered: HostSession[] = []
- const sessions = new Map()
- const ownerIndex = placement === 'absent' ? 0 : OWNER_INDEX[placement]
- for (let index = 0; index < SESSION_COUNT; index += 1) {
- const session = index === ownerIndex ? owner : decoySession(index, counts)
- ordered.push(session)
- sessions.set(index === ownerIndex ? ownerKey : `decoy-${index}`, session)
- }
- internals.sessions = countingValues(sessions, counts)
- return { ...h, owner, ordered, counts, client, control, sessions: internals.sessions }
- }
-
- it.each([
- { reason: 'ticket', ticket: 'wrong', generation: 1, state: 'active' },
- { reason: 'generation', ticket: 'ticket', generation: 2, state: 'active' },
- { reason: 'state', ticket: 'ticket', generation: 1, state: 'orphaned' }
- ] as const)('fails an attach whose $reason does not match the owner', async (input) => {
- const h = await attachRegistry('middle')
- h.owner.state = input.state
- const host = new FakeSocket()
- expect(
- await h.registry.acceptHostData(
- host as unknown as WebSocket,
- CONN_ID,
- input.ticket,
- input.generation
- )
- ).toBe(false)
- expect(h.observer.recordAuth).toHaveBeenCalledExactlyOnceWith(false)
- expect(host.close).toHaveBeenCalledWith(
- RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL,
- 'invalid host data ticket'
- )
- expect(h.owner.pendingConns.has(CONN_ID)).toBe(true)
- expect(h.owner.activeConnIds.size).toBe(0)
- })
})
@@ -1695,46 +502,8 @@ describe('paced drain', () => {
).length
}
- it('sends every drain at once when no window is given', async () => {
- const { registry, sockets } = await connectHosts(4)
- registry.drain(0)
- // A zero-grace drain is told by its close, once the host's release has landed.
- await vi.advanceTimersByTimeAsync(0)
- expect(drainsSent(sockets)).toBe(4)
- })
-
// Windows here stay under the 75s control-silence watchdog, which would otherwise close
// a test socket that never heartbeats before its paced send is due.
- it('spreads the sends evenly across the window', async () => {
- const { registry, sockets } = await connectHosts(5)
- registry.drain(0, { paceWindowMs: 40_000 })
- // Each host is told by its zero-grace close, which a timer nested in the send runs 1 ms on.
- const advance = async (ms: number): Promise => {
- await vi.advanceTimersByTimeAsync(ms)
- await vi.advanceTimersByTimeAsync(1)
- }
- // The first host is told at once; the last lands on the window's closing edge.
- await advance(0)
- expect(drainsSent(sockets)).toBe(1)
- await advance(10_000)
- expect(drainsSent(sockets)).toBe(2)
- await advance(20_000)
- expect(drainsSent(sockets)).toBe(4)
- await advance(10_000)
- expect(drainsSent(sockets)).toBe(5)
- })
-
- it('refuses new host controls before the first paced send lands', async () => {
- const { registry, sockets } = await connectHosts(3)
- registry.drain(0, { paceWindowMs: 40_000 })
- expect(registry.isDraining()).toBe(true)
- // The fleet drain refuses newly arriving host controls immediately.
- const socket = new FakeSocket()
- registry.acceptControl(socket as unknown as WebSocket, { ...identity, sub: 'user-late' })
- expect(socket.close).toHaveBeenCalledWith(RELAY_CLOSE_CODE.DRAINING, 'relay draining')
- await vi.advanceTimersByTimeAsync(0)
- expect(drainsSent(sockets)).toBe(1)
- })
it('gives each host its own grace after its own send, not after the call', async () => {
const { registry, sockets } = await connectHosts(2)
@@ -1749,15 +518,6 @@ describe('paced drain', () => {
expect(sockets[1]!.readyState).toBe(sockets[1]!.CLOSED)
})
- it('leaves no timer behind once an emergency drain cuts a window short', async () => {
- const { registry } = await connectHosts(4)
- registry.drain(0, { paceWindowMs: 40_000 })
- registry.drain(0)
- await vi.advanceTimersByTimeAsync(0)
- // Every session is closed, so anything still pending is an orphan of the cut window.
- expect(vi.getTimerCount()).toBe(0)
- })
-
it('lets an emergency drain supersede the sends still queued by a paced one', async () => {
const { registry, sockets } = await connectHosts(4)
registry.drain(0, { paceWindowMs: 40_000 })
@@ -1772,123 +532,3 @@ describe('paced drain', () => {
})
})
-describe('controls closed after host proof but before wiring', () => {
- let warn: MockInstance
- beforeEach(() => {
- vi.useFakeTimers()
- warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
- })
- afterEach(() => {
- warn.mockRestore()
- vi.clearAllTimers()
- vi.useRealTimers()
- })
- const refusedLines = (): string[] =>
- warn.mock.calls
- .map((call) => String(call[0]))
- .filter((line) => line.includes('control refused after proof'))
-
- function expectRefusal(
- observer: { recordPostProofClose: ReturnType },
- code: number | null,
- reason: string,
- cause?: string
- ): void {
- expect(observer.recordPostProofClose).toHaveBeenCalledWith(reason)
- const [line] = refusedLines()
- expect(line).toContain(`host=${relayHostLogDigest(identity.relayHostId)} gen=1 app="1.4.173"`)
- expect(line).toContain(`code=${code ?? 'none'} reason=${JSON.stringify(reason)}`)
- if (cause) expect(line).toContain(`cause=${cause}`)
- expect(line).not.toContain(identity.relayHostId)
- expect(line).not.toContain(identity.sub)
- }
-
- it.each([
- { error: new Error('wrong_assignment'), cause: 'wrong_assignment' },
- { error: Object.assign(new Error('timeout'), { code: '57014' }), cause: 'database_transient' },
- // Assembled at runtime so the secret scanner does not read the fixture as a real URL.
- {
- error: new Error(`connect ${['postgres', '//user:secret@db/relay'].join(':')}`),
- cause: 'error'
- }
- ])('logs a failed host-proof assignment check as $cause', async ({ error, cause }) => {
- const h = createRegistry(
- vi.fn().mockRejectedValueOnce(error)
- )
- await h.activate(new FakeSocket() as unknown as WebSocket, identity, null, 1, false, 1)
- expectRefusal(
- h.observer,
- RELAY_CLOSE_CODE.WRONG_CELL,
- 'assignment changed during host proof',
- cause
- )
- expect(refusedLines()[0]).not.toContain('secret')
- })
-})
-
-describe('control error codes', () => {
- beforeEach(() => vi.useFakeTimers())
- afterEach(() => {
- vi.clearAllTimers()
- vi.useRealTimers()
- })
-
- async function revokeFailure(error: Error): Promise<{ sent: string[]; warned: string[] }> {
- const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
- const activateControl = vi
- .fn()
- .mockResolvedValue('control:production-gce-c3:1')
- const { registry, activate } = createRegistry(activateControl, {
- revoke: vi.fn().mockRejectedValue(error)
- })
- const socket = new FakeSocket()
- await activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
- socket.emit(
- 'message',
- Buffer.from(
- JSON.stringify({ type: 'device-revoke', reqId: 'revoke-1', relayDeviceId: 'device-1' })
- ),
- false
- )
- await vi.advanceTimersByTimeAsync(0)
- const sent = socket.send.mock.calls.map((call) => String(call[0]))
- const warned = warn.mock.calls.map((call) => String(call[0]))
- warn.mockRestore()
- registry.drain(0)
- vi.advanceTimersByTime(0)
- return { sent, warned }
- }
-
- function controlErrors(sent: string[]): unknown[] {
- return sent
- .map((line) => JSON.parse(line) as Record)
- .filter((message) => message.type === 'control-error')
- }
-
- it('never sends a database error message, which can carry the connection URL', async () => {
- // Assembled at runtime so secret scanners do not flag a fixture URL.
- const url = ['postgres', '://relay:', 'fake-pw', '@db.internal:5432/relay'].join('')
- const error = Object.assign(new Error(`connect to ${url} failed: Connection terminated`), {
- code: '08006'
- })
- const { sent, warned } = await revokeFailure(error)
-
- expect(controlErrors(sent)).toEqual([
- { type: 'control-error', reqId: 'revoke-1', code: 'database_transient' }
- ])
- expect(sent.join('\n')).not.toContain('fake-pw')
- expect(warned).toContain(
- '[orca-relay] control device-revoke failed: Error: redacted code=08006'
- )
- expect(warned.join('\n')).not.toContain('fake-pw')
- })
-
- it('maps any other unexpected message to a fixed code', async () => {
- const { sent } = await revokeFailure(new Error('Unexpected token < in JSON'))
-
- expect(controlErrors(sent)).toEqual([
- { type: 'control-error', reqId: 'revoke-1', code: 'control_operation_failed' }
- ])
- })
-
-})
diff --git a/cloud/apps/relay/src/database/postgres-transaction-recovery.test.ts b/cloud/apps/relay/src/database/postgres-transaction-recovery.test.ts
index ebd2635c73c..3f1cfb7b1c2 100644
--- a/cloud/apps/relay/src/database/postgres-transaction-recovery.test.ts
+++ b/cloud/apps/relay/src/database/postgres-transaction-recovery.test.ts
@@ -345,305 +345,6 @@ describePostgres('PostgreSQL transaction recovery', () => {
warn.mockRestore()
}, 10_000)
- it('defers assignment around a released-cell activity transaction', async () => {
- const now = 1_100_000_000_000
- const identity = { userId: 'released-order-user', relayHostId: 'releasedorder001' }
- const cellId = 'released-order-cell'
- const activityId = 'splice:released-order'
- await database.query(
- `DELETE FROM relay_assignment_activity_leases WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- await database.query(`DELETE FROM relay_assignments WHERE user_id = ? AND relay_host_id = ?`, [
- identity.userId,
- identity.relayHostId
- ])
- const seedStore = new RelayAssignmentStore(database, () => now)
- await seedStore.reconcileCells([
- { id: cellId, url: 'https://released-order.example.com', capacityRequests: 100 }
- ])
- const assignment = await seedStore.assign(identity)
- await seedStore.acquireActivity(identity, { activityId, kind: 'splice', cellId })
-
- const assignmentLocked = signal()
- const legacyCellLocked = signal()
- let gateFirstAssignmentAttempt = true
- const directorDatabase = new TransactionProbeDatabase(database, async (phase, sql) => {
- if (
- gateFirstAssignmentAttempt &&
- phase === 'after' &&
- sql.includes('FROM relay_assignments')
- ) {
- gateFirstAssignmentAttempt = false
- assignmentLocked.resolve()
- await legacyCellLocked.promise
- }
- })
- const directorStore = new RelayAssignmentStore(directorDatabase, () => now)
- const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
-
- const directorAssign = directorStore.assign(identity)
- await assignmentLocked.promise
- let legacyAttempts = 0
- const legacyRelease = database.transaction(async (transaction) => {
- legacyAttempts++
- const lease = (
- await transaction.queryLocked(
- `SELECT * FROM relay_assignment_activity_leases
- WHERE user_id = ? AND relay_host_id = ? AND activity_id = ?`,
- [identity.userId, identity.relayHostId, activityId]
- )
- )[0]
- if (!lease) return
- await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [cellId])
- legacyCellLocked.resolve()
- await transaction.query(
- `UPDATE relay_cells SET reserved_requests = reserved_requests - 2 WHERE cell_id = ?`,
- [cellId]
- )
- await transaction.query(
- `DELETE FROM relay_assignment_activity_leases
- WHERE user_id = ? AND relay_host_id = ? AND activity_id = ?`,
- [identity.userId, identity.relayHostId, activityId]
- )
- await transaction.query(
- `UPDATE relay_assignments SET reserved_splices = reserved_splices - 1
- WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- })
-
- await Promise.all([directorAssign, legacyRelease])
-
- expect(directorDatabase.attempts).toBe(2)
- expect(legacyAttempts).toBe(1)
- expect(warn).not.toHaveBeenCalledWith(
- expect.stringContaining('orca_relay_postgres_transaction_retry')
- )
- expect(warn).not.toHaveBeenCalledWith(
- expect.stringContaining('orca_relay_postgres_transaction_exhausted')
- )
- await expect(seedStore.resolve(identity)).resolves.toMatchObject({
- cellId,
- assignmentEpoch: assignment.assignmentEpoch
- })
- const state = await database.query(
- `SELECT assignment.reserved_controls, assignment.reserved_splices,
- cell.reserved_requests
- FROM relay_assignments assignment
- JOIN relay_cells cell ON cell.cell_id = assignment.cell_id
- WHERE assignment.user_id = ? AND assignment.relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- expect(state).toEqual([
- { reserved_controls: '1', reserved_splices: '0', reserved_requests: '1' }
- ])
- warn.mockRestore()
- }, 15_000)
-
- it('renews an existing control without waiting on a legacy cell lock', async () => {
- const now = 1_150_000_000_000
- const identity = { userId: 'sustained-lock-user', relayHostId: 'sustainedlock01' }
- const cell = {
- id: 'sustained-lock-cell',
- url: 'https://sustained-lock.example.com',
- capacityRequests: 100
- }
- const seedStore = new RelayAssignmentStore(database, () => now)
- await seedStore.reconcileCells([cell])
- await seedStore.assign(identity)
-
- const legacyCellLocked = signal()
- const releaseLegacyCell = signal()
- const legacyTransaction = database.transaction(async (transaction) => {
- await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [cell.id])
- legacyCellLocked.resolve()
- await releaseLegacyCell.promise
- })
- await legacyCellLocked.promise
-
- let inventoryAttempts = 0
- const assignmentDatabase = new TransactionProbeDatabase(
- database,
- async (phase, sql) => {
- if (phase !== 'before' || !sql.includes('FROM relay_cells ORDER BY')) return
- inventoryAttempts++
- }
- )
- const assignmentStore = new RelayAssignmentStore(assignmentDatabase, () => now)
- const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
-
- await expect(assignmentStore.assign(identity)).resolves.toMatchObject({
- cellId: cell.id
- })
- releaseLegacyCell.resolve()
- await expect(legacyTransaction).resolves.toBeUndefined()
- expect(inventoryAttempts).toBe(0)
- expect(warn).not.toHaveBeenCalledWith(
- expect.stringContaining('orca_relay_postgres_transaction_retry')
- )
- warn.mockRestore()
- }, 15_000)
-
- it('retries a new sticky control without forming a legacy cell-first deadlock', async () => {
- const now = 1_175_000_000_000
- const identity = {
- userId: 'sticky-cell-contention-user',
- relayHostId: 'stickycellwait1'
- }
- const cell = {
- id: 'sticky-cell-contention-cell',
- url: 'https://sticky-cell-contention.example.com',
- capacityRequests: 100
- }
- const seedStore = new RelayAssignmentStore(database, () => now)
- await seedStore.reconcileCells([cell])
- await seedStore.assign(identity)
- await seedStore.changeActivity(identity, 'migration', 1)
- // Drops the grant's pending lease too: a sticky control the rows do not
- // show is what sends the retry through the NOWAIT cell lock.
- await seedStore.releaseActivity(identity, 'control-pending:1')
-
- const legacyCellLocked = signal()
- const directorAssignmentLocked = signal()
- const legacyTransaction = database.transaction(async (transaction) => {
- await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [cell.id])
- legacyCellLocked.resolve()
- await directorAssignmentLocked.promise
- await transaction.queryLocked(
- `SELECT * FROM relay_assignments WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- })
- await legacyCellLocked.promise
-
- let signalFirstAttempt = true
- const directorLockOrder: string[] = []
- const assignmentDatabase = new TransactionProbeDatabase(database, async (phase, sql) => {
- if (phase === 'before') {
- // Only locked statements reach this hook, so classifying the pin read
- // is what proves it stays unlocked: if it ever grows a FOR UPDATE it
- // shows up in the order below instead of silently joining the queue.
- if (sql.includes('SELECT cell_id FROM relay_assignments')) {
- directorLockOrder.push('pin-read')
- } else if (sql.includes('FROM relay_assignments WHERE user_id = ?')) {
- directorLockOrder.push('assignment')
- } else if (sql.includes('FROM relay_assignment_activity_leases')) {
- directorLockOrder.push('activity')
- } else if (sql.includes('FROM relay_cells ORDER BY')) {
- directorLockOrder.push('cell-inventory')
- } else if (sql.includes('FROM relay_cells WHERE cell_id IN')) {
- directorLockOrder.push('cell-rows')
- } else if (sql.includes('FROM relay_cells WHERE cell_id = ?')) {
- directorLockOrder.push('cell')
- }
- }
- if (
- signalFirstAttempt &&
- phase === 'after' &&
- sql.includes('FROM relay_assignments WHERE user_id = ?')
- ) {
- signalFirstAttempt = false
- directorAssignmentLocked.resolve()
- }
- })
- const store = new RelayAssignmentStore(assignmentDatabase, () => now)
-
- await expect(store.assign(identity)).resolves.toMatchObject({
- cellId: cell.id,
- assignmentEpoch: 1
- })
- await expect(legacyTransaction).resolves.toBeUndefined()
- expect(assignmentDatabase.attempts).toBe(2)
- // The retry still takes a cell row before the assignment row — the order
- // that avoids the legacy cycle — but only the pinned row, never the
- // inventory.
- expect(directorLockOrder).toEqual([
- 'assignment',
- 'activity',
- 'cell',
- 'cell-rows',
- 'assignment',
- 'activity'
- ])
- const state = await database.query(
- `SELECT assignment.reserved_controls, assignment.migration_leases,
- cell.reserved_requests
- FROM relay_assignments assignment
- JOIN relay_cells cell ON cell.cell_id = assignment.cell_id
- WHERE assignment.user_id = ? AND assignment.relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- expect(state).toEqual([
- { reserved_controls: '1', migration_leases: '1', reserved_requests: '2' }
- ])
- }, 15_000)
-
- it('serializes normalized assignment and activity release without a retry', async () => {
- const now = 1_200_000_000_000
- const identity = { userId: 'normalized-order-user', relayHostId: 'normalizedorder1' }
- const cellId = 'normalized-order-cell'
- const activityId = 'splice:normalized-order'
- await database.query(
- `DELETE FROM relay_assignment_activity_leases WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- await database.query(`DELETE FROM relay_assignments WHERE user_id = ? AND relay_host_id = ?`, [
- identity.userId,
- identity.relayHostId
- ])
- const seedStore = new RelayAssignmentStore(database, () => now)
- await seedStore.reconcileCells([
- { id: cellId, url: 'https://normalized-order.example.com', capacityRequests: 100 }
- ])
- await seedStore.assign(identity)
- await seedStore.acquireActivity(identity, { activityId, kind: 'splice', cellId })
-
- const assignmentLocked = signal()
- const releaseReachedAssignment = signal()
- const continueAssignment = signal()
- let gateFirstAssignmentAttempt = true
- const assignDatabase = new TransactionProbeDatabase(database, async (phase, sql) => {
- if (
- gateFirstAssignmentAttempt &&
- phase === 'after' &&
- sql.includes('FROM relay_assignments')
- ) {
- gateFirstAssignmentAttempt = false
- assignmentLocked.resolve()
- await continueAssignment.promise
- }
- })
- const releaseDatabase = new TransactionProbeDatabase(database, async (phase, sql) => {
- if (phase === 'before' && sql.includes('FROM relay_assignments')) {
- releaseReachedAssignment.resolve()
- }
- })
- const assignStore = new RelayAssignmentStore(assignDatabase, () => now)
- const releaseStore = new RelayAssignmentStore(releaseDatabase, () => now)
-
- const assign = assignStore.assign(identity)
- await assignmentLocked.promise
- const release = releaseStore.releaseActivity(identity, activityId)
- await releaseReachedAssignment.promise
- continueAssignment.resolve()
- await Promise.all([assign, release])
-
- expect(assignDatabase.attempts).toBe(1)
- expect(releaseDatabase.attempts).toBe(1)
- const state = await database.query(
- `SELECT assignment.reserved_controls, assignment.reserved_splices,
- cell.reserved_requests
- FROM relay_assignments assignment
- JOIN relay_cells cell ON cell.cell_id = assignment.cell_id
- WHERE assignment.user_id = ? AND assignment.relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- expect(state).toEqual([
- { reserved_controls: '1', reserved_splices: '0', reserved_requests: '1' }
- ])
- }, 15_000)
-
it('takes the shared cell lock only for the final atomic activity write', async () => {
const now = 1_250_000_000_000
const cell = {
@@ -734,84 +435,6 @@ describePostgres('PostgreSQL transaction recovery', () => {
])
}, 15_000)
- it('reconciles drift under the assignment-first lock order while activity waits', async () => {
- const now = 1_300_000_000_000
- const cells = [
- { id: 'reconcile-cell-a', url: 'https://reconcile-a.example.com', capacityRequests: 100 },
- { id: 'reconcile-cell-b', url: 'https://reconcile-b.example.com', capacityRequests: 100 }
- ]
- const identities = Array.from({ length: 12 }, (_, index) => ({
- userId: `reconcile-user-${index}`,
- relayHostId: `reconcilehost${String(index).padStart(4, '0')}`
- }))
- const seedStore = new RelayAssignmentStore(database, () => now)
- await seedStore.reconcileCells(cells)
- for (const identity of identities) await seedStore.assign(identity)
- await database.query(
- `UPDATE relay_assignments SET reserved_controls = 7, reserved_splices = 5
- WHERE user_id LIKE 'reconcile-user-%'`
- )
- await database.query(
- `UPDATE relay_cells SET reserved_requests = 42
- WHERE cell_id IN (?, ?)`,
- ['reconcile-cell-a', 'reconcile-cell-b']
- )
-
- const assignmentsLocked = signal()
- const activityReachedAssignment = signal()
- const continueReconciliation = signal()
- let gateReconciliation = true
- const reconcileDatabase = new TransactionProbeDatabase(database, async (phase, sql) => {
- if (
- gateReconciliation &&
- phase === 'after' &&
- sql.includes('SELECT assignment.* FROM relay_assignments assignment')
- ) {
- gateReconciliation = false
- assignmentsLocked.resolve()
- await continueReconciliation.promise
- }
- })
- const activityDatabase = new TransactionProbeDatabase(database, async (phase, sql) => {
- if (phase === 'before' && sql.includes('FROM relay_assignments WHERE user_id')) {
- activityReachedAssignment.resolve()
- }
- })
- const reconcileStore = new RelayAssignmentStore(reconcileDatabase, () => now)
- const activityStore = new RelayAssignmentStore(activityDatabase, () => now)
-
- const reconciliation = reconcileStore.cellEvacuationStatus(
- 'reconcile-cell-a',
- 'reconcile-cell-b',
- true
- )
- await assignmentsLocked.promise
- const activity = activityStore.acquireActivity(identities[0]!, {
- activityId: 'splice:reconcile',
- kind: 'splice',
- cellId: 'reconcile-cell-a'
- })
- await activityReachedAssignment.promise
- continueReconciliation.resolve()
- await Promise.all([reconciliation, activity])
-
- expect(reconcileDatabase.attempts).toBe(1)
- expect(activityDatabase.attempts).toBe(1)
- const reservations = await database.query(
- `SELECT cell.cell_id, cell.reserved_requests,
- COALESCE(SUM(lease.request_units), 0) AS lease_units
- FROM relay_cells cell
- LEFT JOIN relay_assignment_activity_leases lease ON lease.cell_id = cell.cell_id
- WHERE cell.cell_id IN (?, ?)
- GROUP BY cell.cell_id, cell.reserved_requests ORDER BY cell.cell_id`,
- ['reconcile-cell-a', 'reconcile-cell-b']
- )
- expect(reservations).toEqual([
- { cell_id: 'reconcile-cell-a', reserved_requests: '8', lease_units: '8' },
- { cell_id: 'reconcile-cell-b', reserved_requests: '6', lease_units: '6' }
- ])
- }, 15_000)
-
it('keeps a unit placed between reconciliation reading leases and locking cells', async () => {
const now = 1_350_000_000_000
const cells = [
@@ -945,529 +568,4 @@ describePostgres('PostgreSQL transaction recovery', () => {
).resolves.toMatchObject({ inProgress: 0 })
}, 15_000)
- it('defers completion instead of deadlocking with a legacy cell-first lock', async () => {
- const now = 1_500_000_000_000
- const identity = {
- userId: 'completion-contention-user',
- relayHostId: 'completionwait01'
- }
- const sourceCell = {
- id: 'completion-contention-source',
- url: 'https://completion-contention-source.example.com',
- capacityRequests: 100
- }
- const targetCell = {
- id: 'completion-contention-target',
- url: 'https://completion-contention-target.example.com',
- capacityRequests: 100
- }
- const store = new RelayAssignmentStore(database, () => now, {
- requireLiveCells: true
- })
- await store.reconcileCells([sourceCell, targetCell])
- await store.recordCellHeartbeat({
- cellId: sourceCell.id,
- cellUrl: sourceCell.url,
- cellIncarnation: '11111111-1111-4111-8111-111111111111',
- startedAt: now - 100,
- ready: true,
- observedRequests: 0
- })
- await store.recordCellHeartbeat({
- cellId: targetCell.id,
- cellUrl: targetCell.url,
- cellIncarnation: '22222222-2222-4222-8222-222222222222',
- startedAt: now - 100,
- ready: true,
- observedRequests: 0
- })
- const assignment = await store.assign(identity)
- const sourceControl = await store.activateControl(identity, {
- cellId: sourceCell.id,
- assignmentEpoch: assignment.assignmentEpoch,
- generation: 1
- })
- const migration = await store.startEvacuation(identity, targetCell.id)
- await store.activateControl(identity, {
- cellId: targetCell.id,
- assignmentEpoch: migration.assignmentEpoch,
- generation: 1
- })
- await store.markMigrationTargetRegistered(identity, {
- cellId: targetCell.id,
- assignmentEpoch: migration.assignmentEpoch
- })
- await store.releaseActivity(identity, sourceControl)
- await store.setCellEnabled(sourceCell.id, false)
-
- const legacyCellLocked = signal()
- const completionAssignmentLocked = signal()
- const legacyTransaction = database.transaction(async (transaction) => {
- await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [
- sourceCell.id
- ])
- legacyCellLocked.resolve()
- await completionAssignmentLocked.promise
- await transaction.queryLocked(
- `SELECT * FROM relay_assignments WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- })
- await legacyCellLocked.promise
-
- let signalCompletion = true
- const completionDatabase = new TransactionProbeDatabase(
- database,
- async (phase, sql) => {
- if (
- signalCompletion &&
- phase === 'after' &&
- sql.includes('FROM relay_assignments WHERE user_id')
- ) {
- signalCompletion = false
- completionAssignmentLocked.resolve()
- }
- }
- )
- const completionStore = new RelayAssignmentStore(completionDatabase, () => now, {
- requireLiveCells: true
- })
- const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
-
- await expect(completionStore.completeReadyEvacuations()).resolves.toBe(0)
- await expect(legacyTransaction).resolves.toBeUndefined()
- expect(warn).not.toHaveBeenCalledWith(
- expect.stringContaining('orca_relay_postgres_transaction_retry')
- )
- await expect(store.completeReadyEvacuations()).resolves.toBe(1)
- }, 15_000)
-
- it('normalizes persistent dead-source inventory contention', async () => {
- let now = 1_550_000_000_000
- const identity = {
- userId: 'dead-source-contention-user',
- relayHostId: 'deadsourcewait01'
- }
- const secondIdentity = {
- userId: identity.userId,
- relayHostId: 'deadsourcewait02'
- }
- const sourceCell = {
- id: 'dead-source-contention-source',
- url: 'https://dead-source-contention-source.example.com',
- capacityRequests: 100
- }
- const targetCell = {
- id: 'dead-source-contention-target',
- url: 'https://dead-source-contention-target.example.com',
- capacityRequests: 100
- }
- const sourceIncarnation = '11111111-1111-4111-8111-111111111111'
- const targetIncarnation = '22222222-2222-4222-8222-222222222222'
- const store = new RelayAssignmentStore(database, () => now, {
- requireLiveCells: true
- })
- await store.reconcileCells([sourceCell, targetCell])
- await store.setCellEnabled(targetCell.id, false)
- await store.recordCellHeartbeat({
- cellId: sourceCell.id,
- cellUrl: sourceCell.url,
- cellIncarnation: sourceIncarnation,
- startedAt: now - 100,
- ready: true,
- observedRequests: 0
- })
- await store.recordCellHeartbeat({
- cellId: targetCell.id,
- cellUrl: targetCell.url,
- cellIncarnation: targetIncarnation,
- startedAt: now - 100,
- ready: true,
- observedRequests: 0
- })
- const assignment = await store.assign(identity)
- const sourceControl = await store.activateControl(identity, {
- cellId: sourceCell.id,
- assignmentEpoch: assignment.assignmentEpoch,
- generation: 1
- })
- await store.setCellEnabled(targetCell.id, true)
- const migration = await store.startEvacuation(identity, targetCell.id)
- await store.activateControl(identity, {
- cellId: targetCell.id,
- assignmentEpoch: migration.assignmentEpoch,
- generation: 1
- })
- await store.markMigrationTargetRegistered(identity, {
- cellId: targetCell.id,
- assignmentEpoch: migration.assignmentEpoch
- })
- await store.releaseActivity(identity, sourceControl)
- const secondAssignment = await store.assign(secondIdentity)
- expect(secondAssignment.cellId).toBe(sourceCell.id)
- const secondSourceControl = await store.activateControl(secondIdentity, {
- cellId: sourceCell.id,
- assignmentEpoch: secondAssignment.assignmentEpoch,
- generation: 1
- })
- const secondMigration = await store.startEvacuation(secondIdentity, targetCell.id)
- await store.activateControl(secondIdentity, {
- cellId: targetCell.id,
- assignmentEpoch: secondMigration.assignmentEpoch,
- generation: 1
- })
- await store.markMigrationTargetRegistered(secondIdentity, {
- cellId: targetCell.id,
- assignmentEpoch: secondMigration.assignmentEpoch
- })
- await store.releaseActivity(secondIdentity, secondSourceControl)
- await store.setCellEnabled(sourceCell.id, false)
- now += 45_001
- await store.recordCellHeartbeat({
- cellId: targetCell.id,
- cellUrl: targetCell.url,
- cellIncarnation: targetIncarnation,
- startedAt: now - 45_101,
- ready: true,
- observedRequests: 0
- })
- await store.attestCellFence(sourceCell.id, sourceIncarnation)
-
- const legacyCellLocked = signal()
- const completionAssignmentLocked = signal()
- const legacyTransaction = database.transaction(async (transaction) => {
- await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [
- sourceCell.id
- ])
- legacyCellLocked.resolve()
- await completionAssignmentLocked.promise
- await transaction.queryLocked(
- `SELECT * FROM relay_assignments WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- })
- await legacyCellLocked.promise
-
- let signalCompletion = true
- const fallbackInventoryLocked = signal()
- const freshAssignmentLocked = signal()
- const persistentInventoryLocked = signal()
- let releasePersistentInventory = false
- const completionDatabase = new TransactionProbeDatabase(
- database,
- async (phase, sql) => {
- if (
- signalCompletion &&
- phase === 'after' &&
- sql.includes('FROM relay_assignments WHERE user_id')
- ) {
- signalCompletion = false
- completionAssignmentLocked.resolve()
- } else if (
- phase === 'after' &&
- sql.trim() === 'SELECT * FROM relay_cells ORDER BY cell_id ASC'
- ) {
- fallbackInventoryLocked.resolve()
- await freshAssignmentLocked.promise
- }
- }
- )
- const completionStore = new RelayAssignmentStore(completionDatabase, () => now, {
- requireLiveCells: true
- })
- const freshAssignmentTransaction = database.transaction(async (transaction) => {
- await fallbackInventoryLocked.promise
- await transaction.queryLocked(
- `SELECT * FROM relay_assignments WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- freshAssignmentLocked.resolve()
- await transaction.queryLocked(`SELECT * FROM relay_cells ORDER BY cell_id ASC`)
- persistentInventoryLocked.resolve()
- while (!releasePersistentInventory) {
- await new Promise((resolve) => setTimeout(resolve, 250))
- await transaction.query(`SELECT 1`)
- }
- })
-
- const completion = completionStore.cellEvacuationStatus(
- sourceCell.id,
- targetCell.id,
- true
- )
- await persistentInventoryLocked.promise
- await expect(
- completion
- ).resolves.toMatchObject({ inProgress: 2, completed: 0, blocked: 2 })
- await expect(legacyTransaction).resolves.toBeUndefined()
- releasePersistentInventory = true
- await expect(freshAssignmentTransaction).resolves.toBeUndefined()
- await expect(
- store.cellEvacuationStatus(sourceCell.id, targetCell.id, true)
- ).resolves.toMatchObject({ inProgress: 0, completed: 2, blocked: 0 })
- }, 25_000)
-
- it('defers expired lease cleanup around a legacy cell-first lock', async () => {
- const now = 1_600_000_000_000
- const identity = {
- userId: 'lease-contention-user',
- relayHostId: 'leasecontention1'
- }
- const cell = {
- id: 'lease-contention-cell',
- url: 'https://lease-contention-cell.example.com',
- capacityRequests: 100
- }
- const store = new RelayAssignmentStore(database, () => now)
- await store.reconcileCells([cell])
- await store.assign(identity)
- await database.query(
- `UPDATE relay_assignment_activity_leases SET expires_at = ?
- WHERE user_id = ? AND relay_host_id = ?`,
- [now - 1, identity.userId, identity.relayHostId]
- )
-
- const legacyCellLocked = signal()
- const cleanupAssignmentLocked = signal()
- const legacyTransaction = database.transaction(async (transaction) => {
- await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [cell.id])
- legacyCellLocked.resolve()
- await cleanupAssignmentLocked.promise
- await transaction.queryLocked(
- `SELECT * FROM relay_assignments WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- })
- await legacyCellLocked.promise
-
- let signalCleanup = true
- const cleanupDatabase = new TransactionProbeDatabase(database, async (phase, sql) => {
- if (
- signalCleanup &&
- phase === 'after' &&
- sql.includes('FROM relay_assignments WHERE user_id')
- ) {
- signalCleanup = false
- cleanupAssignmentLocked.resolve()
- }
- })
- const cleanupStore = new RelayAssignmentStore(cleanupDatabase, () => now)
- const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
-
- await expect(cleanupStore.releaseExpiredActivityLeases()).resolves.toBe(0)
- await expect(legacyTransaction).resolves.toBeUndefined()
- expect(cleanupDatabase.attempts).toBe(1)
- expect(warn).not.toHaveBeenCalledWith(
- expect.stringContaining('orca_relay_postgres_transaction_retry')
- )
- await expect(store.releaseExpiredActivityLeases()).resolves.toBe(1)
- }, 15_000)
-
- it('skips an expired lease when another director owns its assignment lock', async () => {
- const now = 1_650_000_000_000
- const identity = {
- userId: 'lease-assignment-contention-user',
- relayHostId: 'leaseassignment1'
- }
- const cell = {
- id: 'lease-assignment-contention-cell',
- url: 'https://lease-assignment-contention-cell.example.com',
- capacityRequests: 100
- }
- const store = new RelayAssignmentStore(database, () => now)
- await store.reconcileCells([cell])
- await store.assign(identity)
- await database.query(
- `UPDATE relay_assignment_activity_leases SET expires_at = ?
- WHERE user_id = ? AND relay_host_id = ?`,
- [now - 1, identity.userId, identity.relayHostId]
- )
-
- const assignmentLocked = signal()
- const releaseAssignment = signal()
- const legacyTransaction = database.transaction(async (transaction) => {
- await transaction.queryLocked(
- `SELECT * FROM relay_assignments WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- assignmentLocked.resolve()
- await releaseAssignment.promise
- })
- await assignmentLocked.promise
-
- const cleanupDatabase = new TransactionProbeDatabase(database, async () => undefined)
- const cleanupStore = new RelayAssignmentStore(cleanupDatabase, () => now)
- const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
-
- await expect(cleanupStore.releaseExpiredActivityLeases()).resolves.toBe(0)
- expect(cleanupDatabase.attempts).toBe(1)
- expect(warn).not.toHaveBeenCalledWith(
- expect.stringContaining('orca_relay_postgres_transaction_retry')
- )
- warn.mockRestore()
-
- releaseAssignment.resolve()
- await expect(legacyTransaction).resolves.toBeUndefined()
- await expect(store.releaseExpiredActivityLeases()).resolves.toBe(1)
- }, 15_000)
-
- it('defers aggregate expiry cleanup around a legacy cell-first lock', async () => {
- const now = 1_700_000_000_000
- const identity = {
- userId: 'aggregate-contention-user',
- relayHostId: 'aggregatewait01'
- }
- const cell = {
- id: 'aggregate-contention-cell',
- url: 'https://aggregate-contention-cell.example.com',
- capacityRequests: 100
- }
- const store = new RelayAssignmentStore(database, () => now)
- await store.reconcileCells([cell])
- await store.assign(identity)
- await database.query(
- `DELETE FROM relay_assignment_activity_leases
- WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- await database.query(
- `UPDATE relay_assignments SET lease_expires_at = ?
- WHERE user_id = ? AND relay_host_id = ?`,
- [now - 1, identity.userId, identity.relayHostId]
- )
-
- const legacyCellLocked = signal()
- const cleanupAssignmentsLocked = signal()
- const legacyTransaction = database.transaction(async (transaction) => {
- await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [cell.id])
- legacyCellLocked.resolve()
- await cleanupAssignmentsLocked.promise
- await transaction.queryLocked(
- `SELECT * FROM relay_assignments WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- })
- await legacyCellLocked.promise
-
- let signalCleanup = true
- const cleanupDatabase = new TransactionProbeDatabase(database, async (phase, sql) => {
- if (
- signalCleanup &&
- phase === 'after' &&
- sql.includes('FROM relay_assignments WHERE lease_expires_at')
- ) {
- signalCleanup = false
- cleanupAssignmentsLocked.resolve()
- }
- })
- const cleanupStore = new RelayAssignmentStore(cleanupDatabase, () => now)
- const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
-
- await expect(cleanupStore.releaseExpiredActivity()).resolves.toBe(0)
- await expect(legacyTransaction).resolves.toBeUndefined()
- expect(cleanupDatabase.attempts).toBe(1)
- expect(warn).not.toHaveBeenCalledWith(
- expect.stringContaining('orca_relay_postgres_transaction_retry')
- )
- await expect(store.releaseExpiredActivity()).resolves.toBe(1)
- }, 15_000)
-
- it('defers aggregate expiry before waiting on a legacy assignment row', async () => {
- const now = 1_700_000_000_000
- const identity = {
- userId: 'aggregate-contention-user',
- relayHostId: 'aggregatewait01'
- }
- const cell = {
- id: 'aggregate-contention-cell',
- url: 'https://aggregate-contention-cell.example.com',
- capacityRequests: 100
- }
- const store = new RelayAssignmentStore(database, () => now)
- await store.reconcileCells([cell])
- await store.assign(identity)
- await database.query(
- `DELETE FROM relay_assignment_activity_leases
- WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- await database.query(
- `UPDATE relay_assignments SET lease_expires_at = ?
- WHERE user_id = ? AND relay_host_id = ?`,
- [now - 1, identity.userId, identity.relayHostId]
- )
-
- const legacyAssignmentLocked = signal()
- const releaseLegacyAssignment = signal()
- const legacyTransaction = database.transaction(async (transaction) => {
- await transaction.queryLocked(
- `SELECT * FROM relay_assignments WHERE user_id = ? AND relay_host_id = ?`,
- [identity.userId, identity.relayHostId]
- )
- legacyAssignmentLocked.resolve()
- await releaseLegacyAssignment.promise
- })
- await legacyAssignmentLocked.promise
-
- const timedOut = Symbol('timed-out')
- const cleanup = store.releaseExpiredActivity()
- const result = await Promise.race([
- cleanup,
- new Promise((resolve) => {
- setTimeout(() => resolve(timedOut), 750)
- })
- ])
- releaseLegacyAssignment.resolve()
- await legacyTransaction
- if (result === timedOut) await cleanup
-
- expect(result).toBe(0)
- await expect(store.releaseExpiredActivity()).resolves.toBe(1)
- }, 15_000)
-
- it('keeps concurrent dormant reassignments capacity-consistent', async () => {
- const now = 1_000_000_000_000
- const serializedDatabase = new TransactionProbeDatabase(database, async () => undefined)
- const store = new RelayAssignmentStore(serializedDatabase, () => now)
- await database.query(
- `DELETE FROM relay_assignment_activity_leases WHERE user_id LIKE 'postgres-user-%'`
- )
- await database.query(`DELETE FROM relay_assignments WHERE user_id LIKE 'postgres-user-%'`)
- await database.query(`DELETE FROM relay_cells WHERE cell_id IN (?, ?, ?)`, [
- 'cell-a',
- 'cell-b',
- 'cell-c'
- ])
- await store.reconcileCells([
- { id: 'cell-a', url: 'https://cell-a.example.com', capacityRequests: 100 },
- { id: 'cell-b', url: 'https://cell-b.example.com', capacityRequests: 100 },
- { id: 'cell-c', url: 'https://cell-c.example.com', capacityRequests: 100 }
- ])
- const identities = Array.from({ length: 30 }, (_, index) => ({
- userId: `postgres-user-${index}`,
- relayHostId: `postgreshost${String(index).padStart(5, '0')}`
- }))
- await Promise.all(identities.map(async (identity) => await store.assign(identity)))
-
- await database.query(`DELETE FROM relay_assignment_activity_leases`)
- await database.query(
- `UPDATE relay_assignments SET lease_expires_at = ?, last_activity_at = ?,
- reserved_controls = 0, reserved_splices = 0, reserved_invites = 0,
- pending_installs = 0, pending_confirmations = 0, migration_leases = 0`,
- [0, 0]
- )
- await database.query(`UPDATE relay_cells SET reserved_requests = 0`)
-
- await Promise.all(identities.map(async (identity) => await store.assign(identity)))
-
- const reservations = await database.query(
- `SELECT cell_id, reserved_requests FROM relay_cells ORDER BY cell_id`
- )
- expect(reservations).toEqual([
- { cell_id: 'cell-a', reserved_requests: '10' },
- { cell_id: 'cell-b', reserved_requests: '10' },
- { cell_id: 'cell-c', reserved_requests: '10' }
- ])
- }, 10_000)
-
})
diff --git a/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/README.md b/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/README.md
deleted file mode 100644
index 2ac4ad78391..00000000000
--- a/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/README.md
+++ /dev/null
@@ -1,8 +0,0 @@
-Exact relay contract snapshots from `027acb4efa2e6b226d40df266b86367423946d62`, `cloud/packages/relay-contract/src/`. Used to exercise the pre-correction strict wire parsers. Do not format or edit these baseline sources.
-
-```text
-aba94e108a5cd0f1af8b38875429ad8636d24c43a728273e3df60d9a1a1d1b6d director-messages.ts
-bd13b5a694a5d683a5b680c14e46ab33f4ef4a5bfedf040d046b09d540cb4c17 wire-scalars.ts
-bc89116f884a2f20a6588f9b91219aa596bc2410d28b499a93a78350def109d5 relay-regions.ts
-8fcae470a5fc72f2fcdde9d2f09cd20289c256356dd490484ac1cfa53839fbe4 control-messages.ts
-```
diff --git a/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/control-messages.ts b/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/control-messages.ts
deleted file mode 100644
index 0daf21e7c28..00000000000
--- a/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/control-messages.ts
+++ /dev/null
@@ -1,146 +0,0 @@
-import { z } from 'zod'
-import {
- Base6432ByteSchema,
- Base64Raw24ByteSchema,
- Base64Url32ByteSchema,
- EpochMsSchema,
- GenerationSchema,
- OpaqueIdSchema,
- PositiveDurationMsSchema,
- RelayHostIdSchema
-} from './wire-scalars.js'
-
-const AppVersionSchema = z.string().min(1).max(128)
-const BoundedCiphertextSchema = z
- .string()
- .min(1)
- .max(16 * 1024)
- .regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/)
-const ConnectionKindSchema = z.enum(['invite', 'resume'])
-
-export const HostHelloSchema = z
- .object({
- v: z.literal(1),
- relayHostId: RelayHostIdSchema,
- assignmentEpoch: GenerationSchema,
- hostPublicKeyB64: Base6432ByteSchema,
- appVersion: AppVersionSchema,
- previousGeneration: GenerationSchema.optional(),
- controlResumeSecret: Base64Url32ByteSchema.optional()
- })
- .strict()
-
-export const HostChallengeSchema = z
- .object({
- challengeId: OpaqueIdSchema,
- relayEphemeralPublicKeyB64: Base6432ByteSchema,
- nonceB64: Base64Raw24ByteSchema,
- ciphertextB64: BoundedCiphertextSchema,
- expiresAt: EpochMsSchema
- })
- .strict()
-
-export const HostChallengeAckSchema = z
- .object({ challengeId: OpaqueIdSchema, proofB64: Base6432ByteSchema })
- .strict()
-
-// Advertised on the control upgrade rather than in host-hello: HostHelloSchema
-// is strict, so a new hello key is refused by every already-deployed cell.
-export const RELAY_HOST_CAPABILITIES_HEADER = 'x-orca-host-capabilities'
-// The host accepts kind/relayDeviceId on a pendingConns entry. A host that does
-// not advertise this parses those entries strictly and would drop the whole ack.
-export const RELAY_HOST_CAPABILITY_PENDING_CONN_DETAILS = 'pending-conn-details'
-
-export function parseRelayHostCapabilities(
- header: string | string[] | undefined
-): ReadonlySet {
- const raw = Array.isArray(header) ? header.join(',') : (header ?? '')
- return new Set(
- raw
- .split(',')
- .map((token) => token.trim())
- .filter((token) => token.length > 0 && token.length <= 64)
- .slice(0, 16)
- )
-}
-
-// kind/relayDeviceId are optional so an entry stays readable by a host that
-// predates them; the cell only emits them to a host that advertised support.
-const PendingConnectionSchema = z
- .object({
- connId: OpaqueIdSchema,
- connTicket: Base64Url32ByteSchema,
- kind: ConnectionKindSchema.optional(),
- relayDeviceId: OpaqueIdSchema.optional()
- })
- .strict()
-
-export const HostHelloAckSchema = z
- .object({
- v: z.literal(1),
- generation: GenerationSchema,
- controlResumeSecret: Base64Url32ByteSchema,
- leaseExpiresAt: EpochMsSchema,
- activeConnIds: z.array(OpaqueIdSchema).max(8),
- pendingConns: z.array(PendingConnectionSchema).max(8)
- })
- .strict()
-
-export const ConnectionOpenSchema = z
- .object({
- connId: OpaqueIdSchema,
- connTicket: Base64Url32ByteSchema,
- kind: ConnectionKindSchema,
- relayDeviceId: OpaqueIdSchema,
- attachDeadlineMs: PositiveDurationMsSchema
- })
- .strict()
-
-export const HostDataAuthSchema = z
- .object({
- v: z.literal(1),
- connTicket: Base64Url32ByteSchema,
- generation: GenerationSchema
- })
- .strict()
-
-export const InviteCreateSchema = z
- .object({ reqId: OpaqueIdSchema, relayDeviceId: OpaqueIdSchema })
- .strict()
-
-export const InviteCreatedSchema = z
- .object({
- reqId: OpaqueIdSchema,
- inviteToken: Base64Url32ByteSchema,
- expiresAt: EpochMsSchema,
- maxAttempts: z.number().int().positive().max(16)
- })
- .strict()
-
-export const DeviceRevokeSchema = z
- .object({ reqId: OpaqueIdSchema, relayDeviceId: OpaqueIdSchema })
- .strict()
-
-export const AuthRefreshSchema = z.object({ relayJwt: z.string().min(1).max(8 * 1024) }).strict()
-
-export const DrainSchema = z
- .object({
- graceMs: z.number().int().nonnegative().max(60 * 60 * 1000),
- recovery: z.literal('resolve-director')
- })
- .strict()
-
-export const HeartbeatSchema = z.object({ t: EpochMsSchema }).strict()
-
-export type HostHello = z.infer
-export type HostChallenge = z.infer
-export type HostChallengeAck = z.infer
-export type HostHelloAck = z.infer
-export type ConnectionOpen = z.infer
-export type HostDataAuth = z.infer
-export type InviteCreate = z.infer
-export type InviteCreated = z.infer
-export type DeviceRevoke = z.infer
-export type AuthRefresh = z.infer
-export type Drain = z.infer
-export type Heartbeat = z.infer
diff --git a/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/director-messages.ts b/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/director-messages.ts
deleted file mode 100644
index e697135b68e..00000000000
--- a/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/director-messages.ts
+++ /dev/null
@@ -1,75 +0,0 @@
-import { z } from 'zod'
-import {
- Base64Url32ByteSchema,
- CanonicalHttpsOriginSchema,
- EpochMsSchema,
- GenerationSchema,
- RelayHostIdSchema
-} from './wire-scalars.js'
-import { RelayRegionSchema } from './relay-regions.js'
-
-const SignedAssignmentLeaseSchema = z.string().min(1).max(8 * 1024)
-
-export const AssignmentRequestSchema = z
- .object({
- v: z.literal(1),
- relayHostId: RelayHostIdSchema,
- // Client-declared reconnection; the director verifies it against the
- // durable assignment before granting fast-lane admission.
- reconnect: z.boolean().optional(),
- preferredRegion: RelayRegionSchema.optional()
- })
- .strict()
-
-export const AssignmentResponseSchema = z
- .object({
- v: z.literal(1),
- cellUrl: CanonicalHttpsOriginSchema,
- assignmentEpoch: GenerationSchema,
- lease: SignedAssignmentLeaseSchema
- })
- .strict()
-
-export const ResolveRequestSchema = z
- .object({
- v: z.literal(1),
- relayHostId: RelayHostIdSchema,
- resumeToken: Base64Url32ByteSchema
- })
- .strict()
-
-export const ResolveResponseSchema = z
- .object({
- v: z.literal(1),
- cellUrl: CanonicalHttpsOriginSchema,
- assignmentEpoch: GenerationSchema,
- leaseExpiresAt: EpochMsSchema
- })
- .strict()
-
-export const RelayMovedSchema = z
- .object({
- v: z.literal(1),
- cellUrl: CanonicalHttpsOriginSchema,
- assignmentEpoch: GenerationSchema
- })
- .strict()
-
-export function isTrustedNewerMove(input: {
- sourceOrigin: string
- configuredDirectorOrigin: string
- currentAssignmentEpoch: number
- move: z.infer
-}): boolean {
- // Why: cells and stale director responses must never redirect a credential-bearing client.
- return (
- input.sourceOrigin === input.configuredDirectorOrigin &&
- input.move.assignmentEpoch > input.currentAssignmentEpoch
- )
-}
-
-export type AssignmentRequest = z.infer
-export type AssignmentResponse = z.infer
-export type ResolveRequest = z.infer
-export type ResolveResponse = z.infer
-export type RelayMoved = z.infer
diff --git a/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/relay-regions.ts b/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/relay-regions.ts
deleted file mode 100644
index 6b8837829df..00000000000
--- a/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/relay-regions.ts
+++ /dev/null
@@ -1,71 +0,0 @@
-import { z } from 'zod'
-
-export const RELAY_REGIONS = ['us-central1', 'asia-east2'] as const
-
-export const RelayRegionSchema = z.enum(RELAY_REGIONS)
-
-export type RelayRegion = z.infer
-
-export const RELAY_DEFAULT_REGION: RelayRegion = 'us-central1'
-
-// Field-name segment for the flat per-region runtime counters, spelled out rather than derived so
-// the Terraform side can hold the same literal and a test can compare the two. `satisfies` makes a
-// new region a compile error here, which is the point: a region with no segment would silently
-// drop out of the region-skew alert's denominators.
-export const RELAY_REGION_METRIC_SEGMENTS = {
- 'us-central1': 'UsCentral1',
- 'asia-east2': 'AsiaEast2'
-} as const satisfies Record
-
-const RelayProbeOriginSchema = z.string().url().max(2_048).refine(isCanonicalHttpsOrigin)
-
-export const RelayRegionCatalogResponseSchema = z
- .object({
- v: z.literal(1),
- regions: z
- .array(
- z
- .object({
- region: RelayRegionSchema,
- probeOrigins: z.array(RelayProbeOriginSchema).min(1).max(2)
- })
- .strict()
- )
- .max(RELAY_REGIONS.length)
- })
- .strict()
- .superRefine((catalog, context) => {
- const regions = new Set()
- const origins = new Set()
- for (const [regionIndex, entry] of catalog.regions.entries()) {
- if (regions.has(entry.region)) {
- context.addIssue({
- code: 'custom',
- message: 'duplicate relay region',
- path: ['regions', regionIndex, 'region']
- })
- }
- regions.add(entry.region)
- for (const [originIndex, origin] of entry.probeOrigins.entries()) {
- if (origins.has(origin)) {
- context.addIssue({
- code: 'custom',
- message: 'duplicate relay probe origin',
- path: ['regions', regionIndex, 'probeOrigins', originIndex]
- })
- }
- origins.add(origin)
- }
- }
- })
-
-export type RelayRegionCatalogResponse = z.infer
-
-function isCanonicalHttpsOrigin(value: string): boolean {
- try {
- const url = new URL(value)
- return url.protocol === 'https:' && url.origin === value
- } catch {
- return false
- }
-}
diff --git a/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/wire-scalars.ts b/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/wire-scalars.ts
deleted file mode 100644
index 27dd3a8b30f..00000000000
--- a/cloud/apps/relay/src/test-fixtures/relay-contract-baseline/wire-scalars.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { z } from 'zod'
-
-export const Base64Url32ByteSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/)
-export const Base64Url24ByteSchema = z.string().regex(/^[A-Za-z0-9_-]{32}$/)
-export const Base6432ByteSchema = z.string().regex(/^(?:[A-Za-z0-9+/]{4}){10}[A-Za-z0-9+/]{3}=$/)
-export const Base64Raw24ByteSchema = z.string().regex(/^(?:[A-Za-z0-9+/]{4}){8}$/)
-export const RelayHostIdSchema = z.string().regex(/^[A-Za-z0-9_-]{16}$/)
-export const OpaqueIdSchema = z.string().min(1).max(128)
-export const EpochMsSchema = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER)
-export const GenerationSchema = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER)
-export const PositiveDurationMsSchema = z.number().int().positive().max(24 * 60 * 60 * 1000)
-
-export const CanonicalHttpsOriginSchema = z.string().max(2048).refine((value) => {
- try {
- const url = new URL(value)
- return url.protocol === 'https:' && url.origin === value && url.pathname === '/'
- } catch {
- return false
- }
-}, 'must be a canonical HTTPS origin')
diff --git a/cloud/packages/cloud-database/package.json b/cloud/packages/cloud-database/package.json
index 206fd4f6f70..d51b8fb517b 100644
--- a/cloud/packages/cloud-database/package.json
+++ b/cloud/packages/cloud-database/package.json
@@ -1,10 +1,20 @@
{
"name": "@orca-cloud/cloud-database",
- "private": true,
"version": "0.0.0",
+ "private": true,
"type": "module",
"main": "dist/index.js",
"types": "dist/index.d.ts",
+ "exports": {
+ ".": {
+ "types": "./dist/index.d.ts",
+ "default": "./dist/index.js"
+ },
+ "./cloud-database": {
+ "types": "./dist/cloud-database.d.ts",
+ "default": "./dist/cloud-database.js"
+ }
+ },
"scripts": {
"build": "tsc -p tsconfig.build.json",
"clean": "node -e \"require('fs').rmSync('dist', { recursive: true, force: true })\"",
diff --git a/cloud/packages/connector-contract/src/contract.test.ts b/cloud/packages/connector-contract/src/contract.test.ts
index 4da1296a902..35900489850 100644
--- a/cloud/packages/connector-contract/src/contract.test.ts
+++ b/cloud/packages/connector-contract/src/contract.test.ts
@@ -50,35 +50,4 @@ describe('hello and replies', () => {
expect(hello.features).toEqual(['answer', 'future-feature'])
expect(hello.sources).toEqual(['slack', 'future-source'])
})
-
- it('caps a hello at maxHelloProjects projects with short display strings', () => {
- const project = (name: string) => ({
- placeId: 'pl_1',
- name,
- kind: 'folder',
- where: { kind: 'local' }
- })
- const hello = (projects: unknown[]) =>
- ConnectorHelloRequestSchema.safeParse({
- v: 1,
- contract: 1,
- orcaVersion: '1.4.230',
- platform: 'linux',
- runtime: 'desktop',
- hostName: 'build-box',
- agents: ['claude'],
- promptKinds: [],
- features: [],
- sources: ['slack'],
- projects
- }).success
- const longest = 'x'.repeat(CONNECTOR_LIMITS.maxDisplayTextLength)
- expect(
- hello(Array.from({ length: CONNECTOR_LIMITS.maxHelloProjects }, () => project(longest)))
- ).toBe(true)
- expect(hello([project(`${longest}x`)])).toBe(false)
- expect(
- hello(Array.from({ length: CONNECTOR_LIMITS.maxHelloProjects + 1 }, () => project('orca')))
- ).toBe(false)
- })
})
diff --git a/cloud/packages/push-contract/package.json b/cloud/packages/push-contract/package.json
index 558f8e970f3..29484abca8d 100644
--- a/cloud/packages/push-contract/package.json
+++ b/cloud/packages/push-contract/package.json
@@ -1,10 +1,40 @@
{
"name": "@orca-cloud/push-contract",
- "private": true,
"version": "0.0.0",
+ "private": true,
"type": "module",
"main": "dist/index.js",
"types": "dist/index.d.ts",
+ "exports": {
+ ".": {
+ "types": "./dist/index.d.ts",
+ "default": "./dist/index.js"
+ },
+ "./device-registration-messages": {
+ "types": "./dist/device-registration-messages.d.ts",
+ "default": "./dist/device-registration-messages.js"
+ },
+ "./host-auth-messages": {
+ "types": "./dist/host-auth-messages.d.ts",
+ "default": "./dist/host-auth-messages.js"
+ },
+ "./push-host-proof-transcript": {
+ "types": "./dist/push-host-proof-transcript.d.ts",
+ "default": "./dist/push-host-proof-transcript.js"
+ },
+ "./push-limits": {
+ "types": "./dist/push-limits.d.ts",
+ "default": "./dist/push-limits.js"
+ },
+ "./send-messages": {
+ "types": "./dist/send-messages.d.ts",
+ "default": "./dist/send-messages.js"
+ },
+ "./wire-scalars": {
+ "types": "./dist/wire-scalars.d.ts",
+ "default": "./dist/wire-scalars.js"
+ }
+ },
"scripts": {
"build": "pnpm clean && tsc -p tsconfig.build.json",
"clean": "node -e \"require('fs').rmSync('dist', { recursive: true, force: true })\"",
diff --git a/cloud/packages/relay-contract/src/contract.test.ts b/cloud/packages/relay-contract/src/contract.test.ts
index 2c663b4388a..08c40c72f2d 100644
--- a/cloud/packages/relay-contract/src/contract.test.ts
+++ b/cloud/packages/relay-contract/src/contract.test.ts
@@ -1,6 +1,4 @@
import { describe, expect, it } from 'vitest'
-import { HostHelloAckSchema } from './control-messages.js'
-import { isTrustedNewerMove, RelayMovedSchema } from './director-messages.js'
import {
buildHostChallengePlaintext,
buildHostProofMacInput,
@@ -8,29 +6,6 @@ import {
} from './host-proof-transcript.js'
describe('relay protocol contract', () => {
-
- it('accepts moves only from the configured director at a strictly newer epoch', () => {
- const move = RelayMovedSchema.parse({
- v: 1,
- cellUrl: 'https://relay-c2.onorca.dev',
- assignmentEpoch: 4
- })
- const base = {
- configuredDirectorOrigin: 'https://relay.onorca.dev',
- currentAssignmentEpoch: 3,
- move
- }
- expect(isTrustedNewerMove({ ...base, sourceOrigin: 'https://relay.onorca.dev' })).toBe(true)
- expect(isTrustedNewerMove({ ...base, sourceOrigin: move.cellUrl })).toBe(false)
- expect(
- isTrustedNewerMove({
- ...base,
- sourceOrigin: 'https://relay.onorca.dev',
- currentAssignmentEpoch: 4
- })
- ).toBe(false)
- })
-
it('locks the complete host key-possession transcript', () => {
const transcript = buildHostProofTranscript({
relayOrigin: 'https://relay.onorca.dev',
@@ -89,29 +64,3 @@ describe('relay protocol contract', () => {
).toThrow('challengeNonce must be 24 bytes')
})
})
-
-describe('pending connection details capability', () => {
- it('reads a pending entry with or without the stated kind and device', () => {
- const ack = {
- v: 1 as const,
- generation: 3,
- controlResumeSecret: 'R'.repeat(43),
- leaseExpiresAt: 1_800_000_000_000,
- activeConnIds: []
- }
- const identifiers = { connId: 'conn-1', connTicket: 'T'.repeat(43) }
- expect(HostHelloAckSchema.safeParse({ ...ack, pendingConns: [identifiers] }).success).toBe(true)
- expect(
- HostHelloAckSchema.safeParse({
- ...ack,
- pendingConns: [{ ...identifiers, kind: 'resume', relayDeviceId: 'device-1' }]
- }).success
- ).toBe(true)
- expect(
- HostHelloAckSchema.safeParse({
- ...ack,
- pendingConns: [{ ...identifiers, reservationId: 'injected' }]
- }).success
- ).toBe(false)
- })
-})
diff --git a/cloud/packages/relay-contract/src/idle-regional-rehome.test.ts b/cloud/packages/relay-contract/src/idle-regional-rehome.test.ts
index 7303596c7d0..be9ee717221 100644
--- a/cloud/packages/relay-contract/src/idle-regional-rehome.test.ts
+++ b/cloud/packages/relay-contract/src/idle-regional-rehome.test.ts
@@ -2,22 +2,9 @@ import { describe, expect, it } from 'vitest'
import { IdleRegionalRehomeResponseSchema } from './idle-regional-rehome.js'
describe('idle regional rehome response', () => {
- it('accepts a source cell that has never heard of the reason field', () => {
- expect(IdleRegionalRehomeResponseSchema.parse({ v: 1, outcome: 'deferred' })).toEqual({
- v: 1,
- outcome: 'deferred'
- })
- })
-
it('reads a reason it does not know as absent instead of failing the response', () => {
expect(
IdleRegionalRehomeResponseSchema.parse({ v: 1, outcome: 'deferred', reason: 'from-a-newer-cell' })
).toEqual({ v: 1, outcome: 'deferred' })
})
-
- it('drops a field added after this decoder shipped', () => {
- expect(
- IdleRegionalRehomeResponseSchema.parse({ v: 1, outcome: 'committed', movedAt: 17 })
- ).toEqual({ v: 1, outcome: 'committed' })
- })
})
diff --git a/cloud/packages/relay-contract/src/persistence-invariants.test.ts b/cloud/packages/relay-contract/src/persistence-invariants.test.ts
index 204c8ce0062..c94ed8d2bc1 100644
--- a/cloud/packages/relay-contract/src/persistence-invariants.test.ts
+++ b/cloud/packages/relay-contract/src/persistence-invariants.test.ts
@@ -1,53 +1,9 @@
import { describe, expect, it } from 'vitest'
-import { hasAdmissionCapacity } from './admission-budgets.js'
import { decideResumeCommit, TokenFamilySchema } from './persistence-invariants.js'
const HASH = 'abcdefghijklmnopqrstuvwxyzABCDEFGH012345678'
describe('relay persistence invariants', () => {
- it('admits pre-auth sockets only outside every reserved budget', () => {
- expect(
- hasAdmissionCapacity({
- totalRequests: 649,
- preAuthConnections: 44,
- sourcePreAuthConnections: 3
- })
- ).toBe(true)
- expect(
- hasAdmissionCapacity({
- totalRequests: 650,
- preAuthConnections: 0,
- sourcePreAuthConnections: 0
- })
- ).toBe(false)
- expect(
- hasAdmissionCapacity({
- totalRequests: 0,
- preAuthConnections: 45,
- sourcePreAuthConnections: 0
- })
- ).toBe(false)
- expect(
- hasAdmissionCapacity({ totalRequests: 0, preAuthConnections: 0, sourcePreAuthConnections: 4 })
- ).toBe(false)
- expect(
- hasAdmissionCapacity({
- totalRequests: 2_899,
- preAuthConnections: 0,
- sourcePreAuthConnections: 0,
- totalRequestCeiling: 2_900
- })
- ).toBe(true)
- expect(
- hasAdmissionCapacity({
- totalRequests: 2_900,
- preAuthConnections: 0,
- sourcePreAuthConnections: 0,
- totalRequestCeiling: 2_900
- })
- ).toBe(false)
- })
-
it('makes commit-time current, grace, retired, expired, and revoked outcomes exact', () => {
const family = TokenFamilySchema.parse({
currentVersion: 3,
diff --git a/cloud/pnpm-lock.yaml b/cloud/pnpm-lock.yaml
index 4faad933bb0..3764bad91b8 100644
--- a/cloud/pnpm-lock.yaml
+++ b/cloud/pnpm-lock.yaml
@@ -188,8 +188,8 @@ importers:
apps/push:
dependencies:
'@hono/node-server':
- specifier: ^2.1.5
- version: 2.1.5(hono@4.13.13)
+ specifier: ^2.1.6
+ version: 2.1.6(hono@4.13.17)
'@orca-cloud/cloud-database':
specifier: workspace:*
version: link:../../packages/cloud-database
@@ -200,8 +200,8 @@ importers:
specifier: ^11.3.1
version: 11.3.1(supports-color@10.2.2)
hono:
- specifier: ^4.13.13
- version: 4.13.13
+ specifier: ^4.13.17
+ version: 4.13.17
tweetnacl:
specifier: ^1.0.3
version: 1.0.3
@@ -231,8 +231,8 @@ importers:
apps/relay:
dependencies:
'@hono/node-server':
- specifier: ^2.1.5
- version: 2.1.5(hono@4.13.13)
+ specifier: ^2.1.6
+ version: 2.1.6(hono@4.13.17)
'@orca-cloud/postgres-schema':
specifier: workspace:*
version: link:../../packages/postgres-schema
@@ -240,11 +240,11 @@ importers:
specifier: workspace:*
version: link:../../packages/relay-contract
hono:
- specifier: ^4.13.13
- version: 4.13.13
+ specifier: ^4.13.17
+ version: 4.13.17
jose:
- specifier: ^6.2.13
- version: 6.2.13
+ specifier: ^6.2.16
+ version: 6.2.16
pg:
specifier: ^8.23.1
version: 8.23.1
@@ -252,8 +252,8 @@ importers:
specifier: ^1.0.3
version: 1.0.3
ws:
- specifier: ^8.22.0
- version: 8.22.0
+ specifier: ^8.22.2
+ version: 8.22.2
zod:
specifier: ^4.6.7
version: 4.6.7
@@ -286,8 +286,8 @@ importers:
specifier: ^8.23.1
version: 8.23.1
jose:
- specifier: ^6.2.13
- version: 6.2.13
+ specifier: ^6.2.16
+ version: 6.2.16
pg:
specifier: ^8.23.1
version: 8.23.1
@@ -320,17 +320,17 @@ importers:
specifier: ^4.157.0
version: 4.157.0(@cloudflare/workers-types@5.20261104.1)(@types/node@24.19.2)
ws:
- specifier: ^8.22.0
- version: 8.22.0
+ specifier: ^8.22.2
+ version: 8.22.2
apps/relay-fence-broker:
dependencies:
'@hono/node-server':
- specifier: ^2.1.5
- version: 2.1.5(hono@4.13.13)
+ specifier: ^2.1.6
+ version: 2.1.6(hono@4.13.17)
hono:
- specifier: ^4.13.13
- version: 4.13.13
+ specifier: ^4.13.17
+ version: 4.13.17
zod:
specifier: ^4.6.7
version: 4.6.7
@@ -647,8 +647,8 @@ packages:
cpu: [x64]
os: [win32]
- '@hono/node-server@2.1.5':
- resolution: {integrity: sha512-MgP/I06GdvsilDspMk/qmRzpk8LOUStP6jFAbSRi40W09DhoyUn+Mj7eyKICPqeYKybOjVFLVIAQzvu1bfIa7Q==}
+ '@hono/node-server@2.1.6':
+ resolution: {integrity: sha512-p/KH9MnfNcsm3sR6x4lNgm5j+QN4Et8srKredl9DZfXiyZ1UQ3aQ2YVpFLbqktYN5JI+DB+VZFKM2PqE5hLKjQ==}
engines: {node: '>=20'}
peerDependencies:
hono: ^4 || ^5.0.0-0
@@ -1208,16 +1208,16 @@ packages:
resolution: {integrity: sha512-1R6uiq6XhXW2ZrcGtZpGgVDsYGzSmveVOn8Pp37qe1fbThHZ34e3t3eXj5mVu6PFSVx9fvB1KNVnYgVtq/BRcA==}
engines: {node: '>=22'}
- hono@4.13.13:
- resolution: {integrity: sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==}
+ hono@4.13.17:
+ resolution: {integrity: sha512-vZIcbkvjOR5hHRWERbGkr8fGfF0GGM1ooYkuH448iO3b2AdVEr3AXZSw4Z3Kn+1L5z0CVoVeyV29VGYmFh05kQ==}
engines: {node: '>=16.9.0'}
https-proxy-agent@7.0.6:
resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
engines: {node: '>= 14'}
- jose@6.2.13:
- resolution: {integrity: sha512-7TIg10ZE1x82YediN+lcrPNvGMKge9yFHQD+Qho/b8y2adfugU3AsvvHfxV0fzyFllT6l9xCjf4RWY9g/Z9PJQ==}
+ jose@6.2.16:
+ resolution: {integrity: sha512-4LSJpbuBuPdGrONCdZUy0xnxtLf8eEz+EY0SMXdHQEBU7bgUHDVblU/JAjryv3wID9/LK7/YuwFwq+AQNfMscQ==}
json-bigint@1.0.0:
resolution: {integrity: sha512-SiPv/8VpZuWbvLSMtTDU8hEfrZWg/mH/nV/b4o0CYbSxu1UIQPLdwKOCIyLQX+VIPO5vrLX3i8qtqFyhdPSUSQ==}
@@ -1609,8 +1609,8 @@ packages:
utf-8-validate:
optional: true
- ws@8.22.0:
- resolution: {integrity: sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==}
+ ws@8.22.2:
+ resolution: {integrity: sha512-/rEZ2ejown2N5gxVTHUu9bVVC7ttu0/Tgzf5hbTOixR3Fs7mbbXgn2DbdbcKgJOmpQMtrIUWivtYuVMnp/W/yA==}
engines: {node: '>=10.0.0'}
peerDependencies:
bufferutil: ^4.0.1
@@ -1748,9 +1748,9 @@ snapshots:
'@esbuild/win32-x64@0.28.2':
optional: true
- '@hono/node-server@2.1.5(hono@4.13.13)':
+ '@hono/node-server@2.1.6(hono@4.13.17)':
dependencies:
- hono: 4.13.13
+ hono: 4.13.17
'@img/colour@1.1.0': {}
@@ -2149,7 +2149,7 @@ snapshots:
google-logging-utils@2.1.0: {}
- hono@4.13.13: {}
+ hono@4.13.17: {}
https-proxy-agent@7.0.6(supports-color@10.2.2):
dependencies:
@@ -2158,7 +2158,7 @@ snapshots:
transitivePeerDependencies:
- supports-color
- jose@6.2.13: {}
+ jose@6.2.16: {}
json-bigint@1.0.0:
dependencies:
@@ -2506,7 +2506,7 @@ snapshots:
ws@8.21.0: {}
- ws@8.22.0: {}
+ ws@8.22.2: {}
xtend@4.0.2: {}
diff --git a/config/ast-grep/rules/claude-chat-entrypoint.yml b/config/ast-grep/rules/claude-chat-entrypoint.yml
index 0d2bbad8f49..be6996784eb 100644
--- a/config/ast-grep/rules/claude-chat-entrypoint.yml
+++ b/config/ast-grep/rules/claude-chat-entrypoint.yml
@@ -45,9 +45,9 @@ ignores:
- '**/__fixtures__/**'
- 'src/shared/agent-launch/startup/claude-chat-entrypoint.ts'
- 'src/main/claude/claude-stream-json-connection.ts'
- - 'src/main/claude/claude-agent-sdk-process-spawn.ts'
+ - 'src/main/claude/child-process/claude-agent-sdk-process-spawn.ts'
- 'src/main/claude/structured/launch/claude-structured-child-env.ts'
- - 'src/main/claude/claude-model-catalog-probe.ts'
+ - 'src/main/claude/model-catalog/claude-model-catalog-probe.ts'
rule:
all:
- any:
@@ -67,9 +67,9 @@ ignores:
- '**/__fixtures__/**'
- 'src/shared/agent-launch/startup/claude-chat-entrypoint.ts'
- 'src/main/claude/claude-stream-json-connection.ts'
- - 'src/main/claude/claude-agent-sdk-process-spawn.ts'
+ - 'src/main/claude/child-process/claude-agent-sdk-process-spawn.ts'
- 'src/main/claude/structured/launch/claude-structured-child-env.ts'
- - 'src/main/claude/claude-model-catalog-probe.ts'
+ - 'src/main/claude/model-catalog/claude-model-catalog-probe.ts'
rule:
all:
- any:
diff --git a/config/benchmarks/computer-use/README.md b/config/benchmarks/computer-use/README.md
index 1e9e7cb7116..52d324d192d 100644
--- a/config/benchmarks/computer-use/README.md
+++ b/config/benchmarks/computer-use/README.md
@@ -62,11 +62,11 @@ Tasks cover explicit text targeting with another field logically focused, Unicod
entry plus submit, select-all replacement plus submit, and color choice plus one
click. Interference probes remain separate from task latency comparisons.
-Explicit-target typing is a native capability probe. Orca's public CLI/RPC currently
-accepts typing at the focused field and does not expose an element target for text.
-Failure of this probe identifies a capability to consider adding; it does not prove
-a violation of the current public typing contract. Click-then-type tasks exercise
-the existing sequence, although this benchmark still bypasses public transports.
+Explicit-target typing is a native capability probe. Orca's public CLI/RPC accepts
+an element target for text (`type-text --element-index`) on providers that report
+`actions.typeTextElement` (macOS and Linux); Windows types only at the focused
+field. Click-then-type tasks send no element with the text, like `type-text`
+without the index, although this benchmark still bypasses public transports.
The Linux Electron job also records restoration stages in `focus-probe/results.json`.
It records the AT-SPI focus acknowledgment, selected ACTIVE state, manual legacy PID
diff --git a/config/benchmarks/computer-use/linux_typing_probe.py b/config/benchmarks/computer-use/linux_typing_probe.py
index e1446e8870a..e113973f067 100644
--- a/config/benchmarks/computer-use/linux_typing_probe.py
+++ b/config/benchmarks/computer-use/linux_typing_probe.py
@@ -137,7 +137,7 @@ def main():
raise AssertionError("cancellation fixture could not focus and select the field")
before = keymap()
operation = trial.directory / "cancel.json"
- bench.write_json(operation, engine._req("type_text", field, True, text="éΩAa" * 150))
+ bench.write_json(operation, engine._req("type_text", None, True, text="éΩAa" * 150))
held_before = held_keys()
env = dict(os.environ)
ready = trial.directory / "held-ready"
diff --git a/config/benchmarks/computer-use/providers.py b/config/benchmarks/computer-use/providers.py
index cc4544f8830..f8f81b342f7 100644
--- a/config/benchmarks/computer-use/providers.py
+++ b/config/benchmarks/computer-use/providers.py
@@ -194,7 +194,7 @@ class CuaEngine:
raise RuntimeError("selected cua element has no token")
if action == "click":
tool, args = "click", {**base, "element_token": tok}
- elif action == "type":
+ elif action in ("type", "type_into"):
tool, args = "type_text", {**base, "element_token": tok, "text": text}
elif action == "return":
tool, args = "press_key", {**base, "element_token": tok, "key": "return"}
@@ -254,6 +254,9 @@ class OrcaEngine:
if action == "click":
req = self._req("click", el, escalate)
elif action == "type":
+ # Why: click-then-type mirrors public `type-text` without --element-index, which types at focus.
+ req = self._req("type_text", None, escalate, text=text)
+ elif action == "type_into":
req = self._req("type_text", el, escalate, text=text)
elif action == "return":
req = self._req("press_key", el, escalate, key="return")
diff --git a/config/benchmarks/computer-use/trial_contract.py b/config/benchmarks/computer-use/trial_contract.py
index 0e65acc1ab1..5855c8f6b2e 100644
--- a/config/benchmarks/computer-use/trial_contract.py
+++ b/config/benchmarks/computer-use/trial_contract.py
@@ -12,7 +12,7 @@ SELECTORS = {
"scroll": (r"list|scroll|document|web", r"\blist\b|\bbenchelectron\b"),
}
TASKS = {
- "targeted_type": [("type", "field")],
+ "targeted_type": [("type_into", "field")],
"type_submit": [("click", "field"), ("type", "field"), ("return", "field")],
"replace_submit": [("click", "field"), ("ctrl_a", "field"), ("type", "field"), ("return", "field")],
"choose_and_click": [("choose", "color"), ("click", "button")],
diff --git a/config/build-plugins/bootstrap-fatal-exit-banner.ts b/config/build-plugins/bootstrap-fatal-exit-banner.ts
index 8a8359da9db..36120dd2637 100644
--- a/config/build-plugins/bootstrap-fatal-exit-banner.ts
+++ b/config/build-plugins/bootstrap-fatal-exit-banner.ts
@@ -1,4 +1,4 @@
-import { BOOTSTRAP_FATAL_EXIT_GUARD_KEY } from '../../src/main/startup/bootstrap-fatal-exit-guard'
+import { BOOTSTRAP_FATAL_EXIT_GUARD_KEY } from '../../src/main/startup/process-failure/bootstrap-fatal-exit-guard'
export const BOOTSTRAP_FATAL_LOG_ENV_VAR = 'ORCA_BOOTSTRAP_FATAL_LOG'
export const BOOTSTRAP_FATAL_LOG_FILE_NAME = 'bootstrap-fatal.log'
const BOOTSTRAP_FATAL_LOG_MAX_BYTES = 262_144
diff --git a/config/build-plugins/cli-main-entry-names.ts b/config/build-plugins/cli-main-entry-names.ts
index bb80c31d534..791768ff519 100644
--- a/config/build-plugins/cli-main-entry-names.ts
+++ b/config/build-plugins/cli-main-entry-names.ts
@@ -3,15 +3,17 @@ export const CLI_MAIN_ENTRY_NAMES = [
'agent-hooks/installation/managed-agent-hook-controls',
'gitlab/projects/project-ref-parser',
'orca-profiles/profile-index-store',
- 'claude-accounts/keychain',
+ 'claude-accounts/runtime-auth/keychain',
// The CLI checks a relocated runtime socket dir before it sends the auth token.
'daemon/endpoint/publication/daemon-socket-endpoint-path',
'skills/bundled-skill-install/bundled-skill-local-host',
'skills/bundled-skill-install/bundled-skill-installation',
'filesystem/macos-tree-clone',
- 'orcad/orcad-stale-lock-reclaim',
- 'orcad/orcad-host-identity-reset',
- 'plugins/plugin-authoring-checks',
+ 'orcad/instance-lock/orcad-stale-lock-reclaim',
+ 'orcad/profile-state/orcad-host-identity-reset',
+ 'plugins/plugin-artifact-validation',
+ 'plugins/plugin-content-hash',
+ 'plugins/plugin-catalog-release-entry',
// `orca vm env doctor` runs its checks in the CLI process.
'environment-doctor/environment-doctor',
'environment-doctor/environment-doctor-host',
@@ -25,5 +27,5 @@ export const CLI_MAIN_ENTRY_NAMES = [
'persistence/profile-state/recovery/profile-state-recovery-command',
'persistence/profile-state/legacy-json/profile-state-export-path',
'persistence/profile-state/legacy-json/profile-state-recovery',
- 'startup/http1-compatibility-marker'
+ 'startup/network-compatibility/http1-compatibility-marker'
] as const
diff --git a/config/build-plugins/main-build-entry-points.ts b/config/build-plugins/main-build-entry-points.ts
index ccd430d2f88..c2df19ac390 100644
--- a/config/build-plugins/main-build-entry-points.ts
+++ b/config/build-plugins/main-build-entry-points.ts
@@ -5,6 +5,7 @@ import { CLI_MAIN_ENTRY_NAMES } from './cli-main-entry-names'
/** Main-build Rollup inputs: output file name (without .js) to its source entry. */
export const MAIN_BUILD_ENTRY_POINTS: Record = {
index: resolve('src/main/index.ts'),
+ 'backend-entry': resolve('src/main/backend/backend-entry.ts'),
'browser-extension-native-host-supervisor-entry': resolve(
'src/main/browser/extensions/native-messaging/browser-extension-native-host-supervisor-entry.ts'
),
@@ -15,7 +16,7 @@ export const MAIN_BUILD_ENTRY_POINTS: Record = {
),
'computer-sidecar': resolve('src/main/computer/computer-sidecar.ts'),
'claude-conversation-fork-worker-entry': resolve(
- 'src/main/claude/claude-conversation-fork-worker-entry.ts'
+ 'src/main/claude/transcripts/claude-conversation-fork-worker-entry.ts'
),
'stt-worker': resolve('src/main/speech/stt-worker.ts'),
'warp-theme-parser-worker': resolve('src/main/warp-themes/warp-theme-parser-worker.ts'),
@@ -25,11 +26,14 @@ export const MAIN_BUILD_ENTRY_POINTS: Record = {
'foreign-sqlite-reader-entry': resolve(
'src/main/foreign-sqlite-readers/foreign-sqlite-reader-entry.ts'
),
+ 'agent-identity-worker-entry': resolve(
+ 'src/main/agent-hooks/identity/agent-identity-worker-entry.ts'
+ ),
'session-scanner-service-entry': resolve(
'src/main/ai-vault/scan-service/session-scanner-service-entry.ts'
),
'wsl-transcript-fs-process-entry': resolve(
- 'src/main/native-chat/wsl-transcript-fs-process-entry.ts'
+ 'src/main/native-chat/transcript-filesystem/process/wsl-transcript-fs-process-entry.ts'
),
// libuv spawns inline; run port probes on a worker to keep the UI loop free.
'port-scan-command-worker-entry': resolve('src/main/ports/port-scan-command-worker-entry.ts'),
@@ -47,7 +51,7 @@ export const MAIN_BUILD_ENTRY_POINTS: Record = {
),
// Why: a first account setup can merge a large history tree with sync fs calls.
'claude-profile-setup-worker-entry': resolve(
- 'src/main/claude-accounts/claude-profile-setup-worker-entry.ts'
+ 'src/main/claude-accounts/profiles/setup/claude-profile-setup-worker-entry.ts'
),
'profile-state-backup-worker-entry': resolve(
'src/main/persistence/profile-state/backup/profile-state-backup-worker-entry.ts'
diff --git a/config/build-plugins/plain-node-entry-guard.ts b/config/build-plugins/plain-node-entry-guard.ts
index 1a031934482..c6d796ebd17 100644
--- a/config/build-plugins/plain-node-entry-guard.ts
+++ b/config/build-plugins/plain-node-entry-guard.ts
@@ -15,6 +15,7 @@ type OutputChunk = Rollup.OutputChunk
// Plain-Node processes and CLI modules cannot load Electron's API.
const PLAIN_NODE_ENTRY_NAMES = [
+ 'backend-entry',
'browser-extension-native-host-supervisor-entry',
'daemon-entry',
'parcel-watcher-process-entry',
diff --git a/config/build-plugins/sandboxed-script-bundles.ts b/config/build-plugins/sandboxed-script-bundles.ts
index 3bef5c5c96e..9c297cf96f1 100644
--- a/config/build-plugins/sandboxed-script-bundles.ts
+++ b/config/build-plugins/sandboxed-script-bundles.ts
@@ -17,6 +17,10 @@ export const ONE_BYTE_UNMINIFIED_OUTPUT = {
const GUEST_PRELOADS = [
{ entry: 'src/preload/browser-extension-preload.ts', fileName: 'browser-extension-preload.js' },
{ entry: 'src/preload/browser-guest.ts', fileName: 'browser-guest-preload.js' },
+ {
+ entry: 'src/preload/browser-passkey-request.ts',
+ fileName: 'browser-passkey-request-preload.js'
+ },
{ entry: 'src/preload/doc-preview-link.ts', fileName: 'doc-preview-link-preload.js' },
{ entry: 'src/preload/plugin-frame-guest.ts', fileName: 'plugin-frame-guest-preload.js' }
]
diff --git a/config/build-plugins/worker-thread-entry-names.ts b/config/build-plugins/worker-thread-entry-names.ts
index 3f72cea6df2..d7dbee7cf84 100644
--- a/config/build-plugins/worker-thread-entry-names.ts
+++ b/config/build-plugins/worker-thread-entry-names.ts
@@ -2,6 +2,7 @@
export const WORKER_THREAD_ENTRY_NAMES = [
'warp-theme-parser-worker',
'foreign-sqlite-reader-entry',
+ 'agent-identity-worker-entry',
'session-search-worker-entry',
'main-thread-hang-watchdog-entry',
'port-scan-command-worker-entry',
diff --git a/config/daemon-blocking-call-baseline.txt b/config/daemon-blocking-call-baseline.txt
index 66d82518654..bdd5065bf0b 100644
--- a/config/daemon-blocking-call-baseline.txt
+++ b/config/daemon-blocking-call-baseline.txt
@@ -8,7 +8,7 @@
2 src/main/daemon/transport/stream/daemon-stream-backlog-probe.ts
1 src/main/daemon/process-scopes/daemon-user-manager-lifetime.ts
1 src/main/daemon/process-scopes/terminal-scopes.ts
-2 src/main/orcad/node-pty-precondition.ts
+2 src/main/orcad/native-runtime/node-pty-precondition.ts
1 src/main/pty/process-retirement/posix-pty-process-table.ts
1 src/main/pty/shell-startup/pwsh.ts
2 src/main/pty/shell-startup/zsh-startup-hook-pty-harness.ts
diff --git a/config/dependency-security-exceptions.json b/config/dependency-security-exceptions.json
index 8452cbee592..8749e8256de 100644
--- a/config/dependency-security-exceptions.json
+++ b/config/dependency-security-exceptions.json
@@ -38,19 +38,6 @@
"sha256": "c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd"
}
},
- {
- "workspace": "mobile",
- "package": "zod",
- "version": "3.25.76",
- "advisory": "GHSA-mrhx-c7xc-m3w5",
- "owner": "Orca maintainers",
- "reason": "Expo and Vercel require Zod 3, which has no fixed upstream release. Backport the upper collection-size gate from colinhacks/zod#6652 for the v3 and bundled v4 entrypoints; installed-dependency regression tests cover sync and async parsing. Remove when a fixed Zod 3 release or compatible consumer upgrade is available.",
- "expires": "2026-11-20",
- "patch": {
- "path": "patches/zod@3.25.76.patch",
- "sha256": "8f57d8e7910df51ec3c40c412b4f8fb3d01fd65e1889c057aae0e4a15483bcec"
- }
- },
{
"workspace": "docs/site",
"package": "zod",
diff --git a/config/docker/cli-launch-contract/run-cli-case.sh b/config/docker/cli-launch-contract/run-cli-case.sh
index 3293601f22f..9ec52f8db61 100755
--- a/config/docker/cli-launch-contract/run-cli-case.sh
+++ b/config/docker/cli-launch-contract/run-cli-case.sh
@@ -32,18 +32,11 @@ fi
case "$case_name" in
# The bundled launcher must stay in Electron's node mode.
- nofuse-userns-bundled-help) command=("$launcher" --help) ;;
- nofuse-userns-bundled-version) command=("$launcher" --version) ;;
nofuse-userns-bundled-status) command=("$launcher" status) ;;
- nofuse-userns-bundled-skills) command=("$launcher" skills --help) ;;
- nofuse-userns-bundled-worktree) command=("$launcher" worktree list) ;;
# Direct binaries must hand off before Ozone initializes.
nofuse-nosandbox-direct-binary-skills)
command=("$extracted_root/orca-ide" --no-sandbox skills --help)
;;
- nofuse-nosandbox-direct-binary-gui)
- command=("$extracted_root/orca-ide" --no-sandbox)
- ;;
stale-display-nosandbox-direct-binary-gui)
command=("$extracted_root/orca-ide" --no-sandbox)
;;
@@ -62,15 +55,6 @@ if ((status == 124)); then
exit 94
fi
-if [[ "$case_name" == nofuse-userns-bundled-version ]]; then
- version_file="$extracted_root/resources/app.asar.unpacked/out/package.json"
- expected_version=$(sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$version_file")
- if [[ -z "$expected_version" || "$output" != "$expected_version" ]]; then
- output="VERSION_MISMATCH expected=${expected_version:-missing} got=$output"
- status=93
- fi
-fi
-
# Shell signal exits are reported as 128 plus the signal number.
if ((status >= 128)); then
echo "CRASHED status=$status case=$case_name"
diff --git a/config/electron-builder.config.cjs b/config/electron-builder.config.cjs
index 2df9f8177df..affa225978c 100644
--- a/config/electron-builder.config.cjs
+++ b/config/electron-builder.config.cjs
@@ -348,26 +348,29 @@ module.exports = {
'out/main/filesystem/macos-tree-clone.js',
'out/main/orca-profiles/profile-index-store.js',
'out/main/persistence/profile-state/**',
- 'out/main/plugins/plugin-authoring-checks.js',
+ 'out/main/plugins/plugin-artifact-validation.js',
+ 'out/main/plugins/plugin-content-hash.js',
+ 'out/main/plugins/plugin-catalog-release-entry.js',
'out/main/environment-doctor/environment-doctor.js',
'out/main/environment-doctor/environment-doctor-host.js',
// `orca plugin test` and `orca plugin check` load the runtime, kit and hooks in Node.
'resources/plugins/declarative/*.mjs',
'out/main/skills/bundled-skill-install/bundled-skill-local-host.js',
'out/main/skills/bundled-skill-install/bundled-skill-installation.js',
- 'out/main/startup/http1-compatibility-marker.js',
+ 'out/main/startup/network-compatibility/http1-compatibility-marker.js',
'out/main/daemon-entry.js',
'out/main/session-scanner-service-entry.js',
'out/main/wsl-transcript-fs-process-entry.js',
'out/main/foreign-sqlite-reader-entry.js',
+ 'out/main/agent-identity-worker-entry.js',
'out/main/session-search-worker-entry.js',
'out/main/plugin-host-entry.js',
'out/main/browser-extension-native-host-supervisor-entry.js',
'out/main/computer-sidecar.js',
'out/main/parcel-watcher-process-entry.js',
'out/main/orcad/orcad-local-serve-selection-entry.js',
- 'out/main/orcad/orcad-stale-lock-reclaim.js',
- 'out/main/orcad/orcad-host-identity-reset.js',
+ 'out/main/orcad/instance-lock/orcad-stale-lock-reclaim.js',
+ 'out/main/orcad/profile-state/orcad-host-identity-reset.js',
'out/main/chunks/**',
'out/renderer/**',
'out/mobile-web/**',
diff --git a/config/flaky-test-pattern-baseline.txt b/config/flaky-test-pattern-baseline.txt
index a16936175e2..a970e9d0d5b 100644
--- a/config/flaky-test-pattern-baseline.txt
+++ b/config/flaky-test-pattern-baseline.txt
@@ -5,37 +5,27 @@
4 test-no-in-test-import-actual:src/main/bitbucket/credential-store.test.ts
1 test-no-in-test-import-actual:src/main/bitbucket/status-no-decrypt.test.ts
3 test-no-in-test-import-actual:src/main/claude-usage/scanner-scan.test.ts
-1 test-no-in-test-import-actual:src/main/claude/claude-agent-sdk-process-spawn.test.ts
5 test-no-in-test-import-actual:src/main/daemon/endpoint/publication/testing/daemon-endpoint-publish.test.ts
1 test-no-in-test-import-actual:src/main/daemon/history/storage/testing/terminal-history-permissions.test.ts
-1 test-no-in-test-import-actual:src/main/git/command-runner/spawned-command-tree-kill.test.ts
+1 test-no-in-test-import-actual:src/main/git/command-runner/process-capture/spawned-command-tree-kill.test.ts
1 test-no-in-test-import-actual:src/main/ipc/filesystem/filesystem-content-search-cancellation.test.ts
1 test-no-in-test-import-actual:src/main/linear/accounts/linear-account-client.test.ts
1 test-no-in-test-import-actual:src/main/linear/issues/linear-description-images.test.ts
+1 test-no-in-test-import-actual:src/main/managed-server/host-state/orcad-snapshot-room.test.ts
1 test-no-in-test-import-actual:src/main/omp/omp-session-cwd-lookup.test.ts
-1 test-no-in-test-import-actual:src/main/orcad/electron-serve-provider-selection.test.ts
1 test-no-in-test-import-actual:src/main/pty/scrollback/overlay-mirror.test.ts
1 test-no-in-test-import-actual:src/main/runtime/rpc/server/pairing/mobile-pairing-userdata-path.test.ts
1 test-no-in-test-import-actual:src/main/runtime/terminal/artifacts/orca-runtime-files-terminal-artifact-swap-detection.test.ts
1 test-no-in-test-import-actual:src/main/speech/openai-api-key-store.test.ts
5 test-no-in-test-import-actual:src/main/ssh/config/ssh-config-loader-regression.test.ts
2 test-no-in-test-import-actual:src/main/ssh/connection/ssh-connection-auth-fallback.test.ts
-1 test-no-in-test-import-actual:src/main/managed-server/host-state/orcad-snapshot-room.test.ts
-1 test-no-in-test-import-actual:src/main/window/dropped-path-preparation.test.ts
+1 test-no-in-test-import-actual:src/main/window/file-drop/dropped-path-preparation.test.ts
2 test-no-in-test-import-actual:src/main/workspace-hooks/hooks-runner.test.ts
1 test-no-in-test-import-actual:src/main/workspaces/removal/local-worktree-removal-recovery.test.ts
1 test-no-in-test-import-actual:src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-hook-idle-arbitration.test.ts
3 test-no-in-test-import-actual:src/renderer/src/components/terminal-pane/snapshots/remote-snapshot-alt-screen-host-chain.test.ts
1 test-no-in-test-import-actual:src/renderer/src/hooks/useIpcEvents-agent-status-pane-teardown.test.ts
1 test-no-polling-loop:src/main/browser/cookies/browser-cookie-import-concurrency.test.ts
-1 test-no-polling-loop:src/main/claude/claude-stop-ack-race.test.ts
-1 test-no-polling-loop:src/main/claude/claude-stream-json-connection.test.ts
-1 test-no-polling-loop:src/main/claude/claude-supervised-stop-real-cli.test.ts
-1 test-no-polling-loop:src/main/claude/claude-supervised-stop.integration.test.ts
-1 test-no-polling-loop:src/main/claude/structured/claude-structured-real-cli-fold.test.ts
-1 test-no-polling-loop:src/main/claude/structured/claude-structured-real-cli-stop-task.test.ts
-5 test-no-polling-loop:src/main/claude/structured/claude-structured-real-cli.test.ts
-1 test-no-polling-loop:src/main/claude/structured/launch/claude-structured-real-cli-options.test.ts
1 test-no-polling-loop:src/main/codex/hooks/reconciliation/codex-hook-toggle-off-wins.test.ts
1 test-no-polling-loop:src/main/codex/structured/launch/codex-structured-real-cli-command-env.test.ts
1 test-no-polling-loop:src/main/daemon/providers/adapter/testing/daemon-self-retirement-respawn.test.ts
@@ -55,14 +45,13 @@
1 test-no-polling-loop:src/main/pty/process-retirement/posix-pty-process-groups.integration.test.ts
1 test-no-polling-loop:src/main/pty/process-retirement/windows-live-tree-kill.win32.test.ts
1 test-no-polling-loop:src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-codex-real-pty.integration.test.ts
-1 test-no-polling-loop:src/main/runtime/rpc/methods/agent-launch/agent-launch-restart-replay.test.ts
1 test-no-polling-loop:src/main/runtime/rpc/server/remote-runtime-request-connection.integration.test.ts
3 test-no-polling-loop:src/main/skills/install/skill-bundle-process-termination.integration.test.ts
2 test-no-polling-loop:src/main/skills/runtime-upload/skill-upload-process-restart.integration.test.ts
1 test-no-polling-loop:src/main/ssh/connection/ssh-connection-host-key-store-wiring.test.ts
1 test-no-polling-loop:src/main/ssh/legacy-relay/endpoints/ssh-relay-endpoint-incumbent-shell.integration.test.ts
-2 test-no-polling-loop:src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts
-1 test-no-polling-loop:src/main/startup/run-electron-vite-dev.test.ts
+2 test-no-polling-loop:src/main/startup/gpu-recovery/gpu-lifecycle-install-dir-acl-guard.test.ts
+1 test-no-polling-loop:config/scripts/development/launch/run-electron-vite-dev.test.ts
2 test-no-polling-loop:src/main/windows/windows-host-job.win32.test.ts
1 test-no-polling-loop:src/main/windows/windows-pty-job.win32.test.ts
1 test-no-polling-loop:src/main/worker-thread-child-process/worker-thread-child-process.test.ts
@@ -82,7 +71,6 @@
1 test-no-polling-loop:tests/e2e/browser-tab.spec.ts
1 test-no-polling-loop:tests/e2e/chinese-ime-chat-input-repro.spec.ts
3 test-no-polling-loop:tests/e2e/combined-diff-scroll-restore.spec.ts
-1 test-no-polling-loop:tests/e2e/computer-windows.e2e.ts
1 test-no-polling-loop:tests/e2e/cross-version-wire/released-relay-daemon.ts
1 test-no-polling-loop:tests/e2e/cross-version-wire/released-relay-transport.ts
1 test-no-polling-loop:tests/e2e/daemon-lifecycle-retirement.spec.ts
@@ -151,21 +139,6 @@
1 test-no-real-time-wait:src/main/browser/identity/wire-probes/browser-session-ua-wire-identity.electron.test.ts
1 test-no-real-time-wait:src/main/browser/network/tunnels/execution-route-socket-duplex.test.ts
1 test-no-real-time-wait:src/main/browser/network/tunnels/remote-browser-socks-server.test.ts
-1 test-no-real-time-wait:src/main/claude-accounts/claude-login-session.test.ts
-1 test-no-real-time-wait:src/main/claude-accounts/claude-profile-router.test.ts
-1 test-no-real-time-wait:src/main/claude-accounts/claude-profile-wsl-router.test.ts
-1 test-no-real-time-wait:src/main/claude-accounts/runtime-auth-service.test.ts
-1 test-no-real-time-wait:src/main/claude-usage/scanner-incremental-reader.test.ts
-1 test-no-real-time-wait:src/main/claude/claude-agent-sdk-exit-proof.test.ts
-1 test-no-real-time-wait:src/main/claude/claude-agent-sdk-user-message-queue.test.ts
-1 test-no-real-time-wait:src/main/claude/claude-stop-ack-race.test.ts
-1 test-no-real-time-wait:src/main/claude/claude-stream-json-connection.test.ts
-1 test-no-real-time-wait:src/main/claude/claude-supervised-stop-real-cli.test.ts
-1 test-no-real-time-wait:src/main/claude/claude-supervised-stop.integration.test.ts
-2 test-no-real-time-wait:src/main/claude/structured/claude-structured-real-cli-fold.test.ts
-2 test-no-real-time-wait:src/main/claude/structured/claude-structured-real-cli-stop-task.test.ts
-5 test-no-real-time-wait:src/main/claude/structured/claude-structured-real-cli.test.ts
-1 test-no-real-time-wait:src/main/claude/structured/launch/claude-structured-real-cli-options.test.ts
1 test-no-real-time-wait:src/main/codex/hooks/reconciliation/codex-hook-reconcile.test.ts
1 test-no-real-time-wait:src/main/codex/hooks/reconciliation/codex-hook-toggle-off-wins.test.ts
1 test-no-real-time-wait:src/main/codex/structured/launch/codex-structured-real-cli-command-env.test.ts
@@ -190,14 +163,9 @@
1 test-no-real-time-wait:src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts
1 test-no-real-time-wait:src/main/daemon/terminal-host/testing/terminal-host.test.ts
3 test-no-real-time-wait:src/main/daemon/transport/client/testing/client.test.ts
-1 test-no-real-time-wait:src/main/git/refs/maintenance/local-repo-ref-maintenance.test.ts
4 test-no-real-time-wait:src/main/git/refs/maintenance/repo-ref-maintenance-real-git.test.ts
1 test-no-real-time-wait:src/main/git/worktrees/removal/remove-worktree-branch-cleanup.test.ts
-1 test-no-real-time-wait:src/main/git/worktrees/removal/worktree-prune-guard.test.ts
1 test-no-real-time-wait:src/main/grok/grok-hook-stdin-no-eof.test.ts
-1 test-no-real-time-wait:src/main/ipc/filesystem/watcher-process/parcel-watcher-shallow-file-subscription.test.ts
-1 test-no-real-time-wait:src/main/ipc/filesystem/watcher-process/rebinding-file-watch-noise.test.ts
-1 test-no-real-time-wait:src/main/ipc/filesystem/watcher-process/rebinding-file-watch.test.ts
4 test-no-real-time-wait:src/main/ipc/runtime-environments/runtime-environment-request-connections.test.ts
1 test-no-real-time-wait:src/main/ipc/worktrees/creation/worktree-base-directory-poller-marker-fanout.test.ts
2 test-no-real-time-wait:src/main/ipc/worktrees/git/worktree-git-status-attribution-real-git.test.ts
@@ -215,31 +183,23 @@
5 test-no-real-time-wait:src/main/pty/process-retirement/windows-live-tree-kill.win32.test.ts
1 test-no-real-time-wait:src/main/runtime/agent-session/structured-agent-session-legacy-send-behind-command.test.ts
3 test-no-real-time-wait:src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-codex-real-pty.integration.test.ts
-1 test-no-real-time-wait:src/main/runtime/rpc/methods/agent-launch/agent-launch-restart-replay.test.ts
1 test-no-real-time-wait:src/main/runtime/rpc/server/remote-runtime-request-connection.integration.test.ts
-1 test-no-real-time-wait:src/main/runtime/rpc/server/runtime-rpc-long-poll-transport.test.ts
-1 test-no-real-time-wait:src/main/runtime/rpc/terminal-subscribe-admission.test.ts
-1 test-no-real-time-wait:src/main/runtime/rpc/terminal-subscribe-mounted-pane.test.ts
-3 test-no-real-time-wait:src/main/runtime/rpc/terminal-subscribe-reconnect-rebind.test.ts
-1 test-no-real-time-wait:src/main/runtime/rpc/ws-transport.test.ts
+1 test-no-real-time-wait:src/main/runtime/rpc/terminal/terminal-subscribe-mounted-pane.test.ts
1 test-no-real-time-wait:src/main/runtime/terminal/recovery/layout-command-pane-starts-layout-owner.test.ts
1 test-no-real-time-wait:src/main/runtime/terminal/recovery/restored-pane-start-cli-handles.test.ts
1 test-no-real-time-wait:src/main/runtime/terminal/wait/launched-agent-crash-guard.live-shell.test.ts
1 test-no-real-time-wait:src/main/runtime/terminal/wait/launched-agent-shell-handoff-readiness.test.ts
-2 test-no-real-time-wait:src/main/runtime/terminal/wait/tui-idle-name-only-real-pty.integration.test.ts
1 test-no-real-time-wait:src/main/runtime/workspaces/removal/owned-session-teardown-policy.test.ts
3 test-no-real-time-wait:src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts
-3 test-no-real-time-wait:src/main/skills/install/skill-bundle-process-termination.integration.test.ts
1 test-no-real-time-wait:src/main/skills/cloud/skill-cloud-direct-upload.test.ts
+3 test-no-real-time-wait:src/main/skills/install/skill-bundle-process-termination.integration.test.ts
2 test-no-real-time-wait:src/main/skills/runtime-upload/skill-upload-process-restart.integration.test.ts
1 test-no-real-time-wait:src/main/ssh/connection/ssh-connection-host-key-store-wiring.test.ts
1 test-no-real-time-wait:src/main/ssh/legacy-relay/endpoints/ssh-relay-endpoint-incumbent-shell.integration.test.ts
-2 test-no-real-time-wait:src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts
-3 test-no-real-time-wait:src/main/startup/run-electron-vite-dev.test.ts
-2 test-no-real-time-wait:src/main/startup/windows-install-dir-acl-recovery.test.ts
+2 test-no-real-time-wait:src/main/startup/gpu-recovery/gpu-lifecycle-install-dir-acl-guard.test.ts
+3 test-no-real-time-wait:config/scripts/development/launch/run-electron-vite-dev.test.ts
1 test-no-real-time-wait:src/main/updater/lifecycle/serve-supervisor-install-park.test.ts
-1 test-no-real-time-wait:src/main/updater/updater.quit-and-install.test.ts
-1 test-no-real-time-wait:src/main/window/main-window-updater-deferred-setup.test.ts
+1 test-no-real-time-wait:src/main/updater/lifecycle/main-window-updater-deferred-setup.test.ts
3 test-no-real-time-wait:src/main/windows/windows-host-job.win32.test.ts
1 test-no-real-time-wait:src/main/windows/windows-process-tree-command-line-patch.test.ts
2 test-no-real-time-wait:src/main/windows/windows-pty-job.win32.test.ts
@@ -280,8 +240,6 @@
2 test-no-real-time-wait:tests/e2e/cli-floating-file-open-position.spec.ts
1 test-no-real-time-wait:tests/e2e/codex-ctrl-c-status.spec.ts
4 test-no-real-time-wait:tests/e2e/combined-diff-scroll-restore.spec.ts
-1 test-no-real-time-wait:tests/e2e/computer-windows.e2e.ts
-3 test-no-real-time-wait:tests/e2e/cross-version-wire/host-model-catalog-released-phone.unit.test.ts
1 test-no-real-time-wait:tests/e2e/cross-version-wire/legacy-relay-bridge.unit.test.ts
1 test-no-real-time-wait:tests/e2e/cross-version-wire/released-relay-daemon.ts
2 test-no-real-time-wait:tests/e2e/cross-version-wire/released-relay-transport.ts
@@ -333,7 +291,7 @@
1 test-no-real-time-wait:tests/e2e/markdown-table-row-backspace.spec.ts
1 test-no-real-time-wait:tests/e2e/native-chat-history-prepend-anchor.spec.ts
3 test-no-real-time-wait:tests/e2e/notification-sound-replay.spec.ts
-5 test-no-real-time-wait:tests/e2e/orchestration-idle-mail-delivery.spec.ts
+4 test-no-real-time-wait:tests/e2e/orchestration-idle-mail-delivery.spec.ts
1 test-no-real-time-wait:tests/e2e/orchestration-idle-mail-restore.spec.ts
4 test-no-real-time-wait:tests/e2e/paced-terminal-typing.ts
1 test-no-real-time-wait:tests/e2e/paired-client-hosted-browser-double-restart.spec.ts
@@ -433,34 +391,23 @@
4 test-no-wall-clock:src/cli/runtime/serve-bundle-park.test.ts
5 test-no-wall-clock:src/cli/runtime/serve-pid1-init-reaper.test.ts
1 test-no-wall-clock:src/cli/runtime/status-caller.test.ts
+2 test-no-wall-clock:src/main/agent-hooks/installation/commands/windows-native-hook-exe-hosts.test.ts
2 test-no-wall-clock:src/main/agent-hooks/installation/scripts/managed-hook-timeout.test.ts
1 test-no-wall-clock:src/main/agent-hooks/server/testing/http/server-endpoint-file-lifecycle.test.ts
-3 test-no-wall-clock:src/main/agent-hooks/server/testing/structured-ingress/server-ingest-structured-status.test.ts
4 test-no-wall-clock:src/main/agent-hooks/server/testing/identity/server-launch-resume-identity.test.ts
-5 test-no-wall-clock:src/main/agent-hooks/server/testing/replay/spool.test.ts
-2 test-no-wall-clock:src/main/agent-hooks/installation/commands/windows-native-hook-exe-hosts.test.ts
+3 test-no-wall-clock:src/main/agent-hooks/server/testing/replay/spool.test.ts
+3 test-no-wall-clock:src/main/agent-hooks/server/testing/structured-ingress/server-ingest-structured-status.test.ts
1 test-no-wall-clock:src/main/ai-vault/parse-cache/session-parse-cache-preview-upgrade.test.ts
2 test-no-wall-clock:src/main/ai-vault/scanners/copilot/session-scanner-copilot-parser.test.ts
2 test-no-wall-clock:src/main/ai-vault/scanners/cursor/session-scanner-cursor-chat-meta.test.ts
1 test-no-wall-clock:src/main/ai-vault/scanners/devin/session-scanner-devin-db.test.ts
2 test-no-wall-clock:src/main/ai-vault/scanners/grok/session-scanner-grok-parser.test.ts
-1 test-no-wall-clock:src/main/ai-vault/scanners/kimi/session-scanner-kimi-parser.test.ts
1 test-no-wall-clock:src/main/ai-vault/scanners/opencode/reader-transport/session-scanner-opencode-sqlite-process.test.ts
2 test-no-wall-clock:src/main/ai-vault/scanners/opencode/session-scanner-opencode-parser.test.ts
2 test-no-wall-clock:src/main/antigravity/posix-hook-invocation.test.ts
2 test-no-wall-clock:src/main/browser/cookies/browser-cookie-import-partition-reland.electron.test.ts
2 test-no-wall-clock:src/main/browser/network/execution-routes/wsl-browser-network-execution-route.test.ts
-1 test-no-wall-clock:src/main/claude/claude-background-wake-retention.test.ts
-1 test-no-wall-clock:src/main/claude/claude-descendant-escalation-boundary.test.ts
-1 test-no-wall-clock:src/main/claude/claude-folder-trust-file.test.ts
-5 test-no-wall-clock:src/main/claude/claude-supervised-stop-real-cli.test.ts
-6 test-no-wall-clock:src/main/claude/claude-supervised-stop.integration.test.ts
-4 test-no-wall-clock:src/main/claude/structured/claude-structured-real-cli-fold.test.ts
-1 test-no-wall-clock:src/main/claude/structured/claude-structured-real-cli-rewind.test.ts
-3 test-no-wall-clock:src/main/claude/structured/claude-structured-real-cli-stop-task.test.ts
-10 test-no-wall-clock:src/main/claude/structured/claude-structured-real-cli.test.ts
-3 test-no-wall-clock:src/main/claude/structured/launch/claude-structured-real-cli-options.test.ts
-1 test-no-wall-clock:src/main/codex-accounts/legacy-wsl-runtime-auth-drain-rollback-script.test.ts
+1 test-no-wall-clock:src/main/codex-accounts/legacy-wsl-auth-drain/legacy-wsl-runtime-auth-drain-rollback-script.test.ts
6 test-no-wall-clock:src/main/codex/app-server/codex-app-server-client.test.ts
2 test-no-wall-clock:src/main/codex/structured/launch/codex-structured-real-cli-command-env.test.ts
2 test-no-wall-clock:src/main/codex/trust/hooks/codex-hook-trust-derivation.test.ts
@@ -476,28 +423,26 @@
2 test-no-wall-clock:src/main/daemon/transport/framing/testing/daemon-stream-binary-negotiation.test.ts
2 test-no-wall-clock:src/main/external-conversations/external-conversation-cancel-settlement.test.ts
3 test-no-wall-clock:src/main/external-conversations/external-conversation-cancel.test.ts
-2 test-no-wall-clock:src/main/git/command-runner/git-command-resolution-windows-checkout.test.ts
-1 test-no-wall-clock:src/main/git/gh-rate-limit-breaker.test.ts
+2 test-no-wall-clock:src/main/git/command-runner/host-routing/git-command-resolution-windows-checkout.test.ts
+1 test-no-wall-clock:src/main/git/command-runner/hosted-cli/runner-gh-account-binding.test.ts
1 test-no-wall-clock:src/main/git/refs/maintenance/pack-refs-lock-ownership.test.ts
2 test-no-wall-clock:src/main/git/refs/maintenance/repo-ref-maintenance-real-git.test.ts
-2 test-no-wall-clock:src/main/git/runner-gh-account-binding.test.ts
1 test-no-wall-clock:src/main/git/source-control/blob-absence-real-git.test.ts
2 test-no-wall-clock:src/main/git/worktrees/catalog/worktree-created-description-real-git.test.ts
-1 test-no-wall-clock:src/main/git/wsl-windows-checkout-git-probe.test.ts
-3 test-no-wall-clock:src/main/github/pr-refresh-coordinator-active-visible-priority.test.ts
-8 test-no-wall-clock:src/main/github/pr-refresh-coordinator-alias-coalescing.test.ts
-5 test-no-wall-clock:src/main/github/pr-refresh-coordinator-completion-order.test.ts
-3 test-no-wall-clock:src/main/github/pr-refresh-coordinator-foreground-pacing.test.ts
-3 test-no-wall-clock:src/main/github/pr-refresh-coordinator-refresh-events.test.ts
-4 test-no-wall-clock:src/main/github/pr-refresh-coordinator-visibility-policy.test.ts
-3 test-no-wall-clock:src/main/github/pr-refresh-coordinator-visible-follow-up.test.ts
-4 test-no-wall-clock:src/main/github/pr-refresh-queue-growth-bound.test.ts
+3 test-no-wall-clock:src/main/github/pull-requests/refresh/pr-refresh-coordinator-active-visible-priority.test.ts
+8 test-no-wall-clock:src/main/github/pull-requests/refresh/pr-refresh-coordinator-alias-coalescing.test.ts
+3 test-no-wall-clock:src/main/github/pull-requests/refresh/pr-refresh-coordinator-completion-order.test.ts
+2 test-no-wall-clock:src/main/github/pull-requests/refresh/pr-refresh-queue-growth-bound.test.ts
2 test-no-wall-clock:src/main/grok/grok-hook-stdin-no-eof.test.ts
3 test-no-wall-clock:src/main/ipc/runtime-environments/runtime-environment-request-connections.test.ts
1 test-no-wall-clock:src/main/ipc/terminal-render-desync-evidence.test.ts
-5 test-no-wall-clock:src/main/ipc/worktrees-orphan-directory-cleanup.test.ts
+2 test-no-wall-clock:src/main/ipc/worktrees-orphan-directory-cleanup.test.ts
2 test-no-wall-clock:src/main/ipc/worktrees/git/worktree-git-status-attribution-real-git.test.ts
2 test-no-wall-clock:src/main/macos-permissions/macos-tcc-log-stream-orphans.test.ts
+4 test-no-wall-clock:src/main/managed-server/activation/orcad-exited-own-fence-mutation-race.test.ts
+6 test-no-wall-clock:src/main/managed-server/activation/orcad-exited-own-fence.test.ts
+4 test-no-wall-clock:src/main/managed-server/activation/orcad-exited-own-install-lock.test.ts
+2 test-no-wall-clock:src/main/managed-server/activation/orcad-exited-own-lock-windows.test.ts
1 test-no-wall-clock:src/main/managed-server/host-state/orcad-windows-host-fence-ops.test.ts
1 test-no-wall-clock:src/main/managed-server/install/remote-install-lock-exited-owner.test.ts
3 test-no-wall-clock:src/main/managed-server/install/remote-node-runtime-store-gc.test.ts
@@ -506,11 +451,11 @@
1 test-no-wall-clock:src/main/opencode/status-hooks/overlay-dir-gc.test.ts
2 test-no-wall-clock:src/main/orca-profiles/cloud-auth/profile-cloud-service-connect-overlap.test.ts
2 test-no-wall-clock:src/main/orca-profiles/cloud-auth/profile-cloud-service-sign-out-connect-race.test.ts
-2 test-no-wall-clock:src/main/orcad/orcad-artifact-cache-retention.test.ts
-1 test-no-wall-clock:src/main/orcad/orcad-artifact-materializer.test.ts
-6 test-no-wall-clock:src/main/orcad/orcad-serve-parity.integration.test.ts
-1 test-no-wall-clock:src/main/orcad/orcad-stale-lock-reclaim.test.ts
-3 test-no-wall-clock:src/main/orcad/orcad-stop-request-shutdown.integration.test.ts
+2 test-no-wall-clock:src/main/orcad/artifact-slots/orcad-artifact-cache-retention.test.ts
+1 test-no-wall-clock:src/main/orcad/artifact-slots/orcad-artifact-materializer.test.ts
+6 test-no-wall-clock:src/main/orcad/testing/serve-lifecycle/orcad-serve-parity.integration.test.ts
+1 test-no-wall-clock:src/main/orcad/instance-lock/orcad-stale-lock-reclaim.test.ts
+3 test-no-wall-clock:src/main/orcad/host-lifecycle/managed-stop/orcad-stop-request-shutdown.integration.test.ts
1 test-no-wall-clock:src/main/persistence/closed-terminal-tab-write-fence.test.ts
1 test-no-wall-clock:src/main/persistence/profile-state/backup/profile-state-backup-rotation.test.ts
1 test-no-wall-clock:src/main/persistence/profile-state/recovery/profile-state-section-repair.test.ts
@@ -526,30 +471,24 @@
5 test-no-wall-clock:src/main/rate-limits/service/service-account-target-selection.test.ts
1 test-no-wall-clock:src/main/rate-limits/service/service-cursor-usage.test.ts
3 test-no-wall-clock:src/main/rate-limits/service/service-minimax-usage.test.ts
-3 test-no-wall-clock:src/main/rate-limits/service/service-refresh-orchestration.test.ts
3 test-no-wall-clock:src/main/rate-limits/service/service-zcode-usage.test.ts
1 test-no-wall-clock:src/main/runtime/agent-session/lifecycle/structured-codex-child-work-runtime.test.ts
2 test-no-wall-clock:src/main/runtime/agent-session/structured-agent-session-held-signal.test.ts
1 test-no-wall-clock:src/main/runtime/agent-session/structured-child-records-switch.test.ts
-1 test-no-wall-clock:src/main/runtime/mobile-cloud-relay/mobile-relay-e2ee.integration.test.ts
+1 test-no-wall-clock:src/main/runtime/mobile-cloud-relay/testing/mobile-relay-e2ee.integration.test.ts
2 test-no-wall-clock:src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-codex-real-pty.integration.test.ts
-2 test-no-wall-clock:src/main/runtime/orchestration/workers/archives/worker-output-archive.test.ts
-3 test-no-wall-clock:src/main/runtime/orchestration/workers/archives/worker-terminal-archive-release.test.ts
-4 test-no-wall-clock:src/main/runtime/orchestration/workers/archives/worker-terminal-archive-screen.test.ts
-5 test-no-wall-clock:src/main/runtime/orchestration/workers/archives/worker-terminal-wrap-provenance.test.ts
1 test-no-wall-clock:src/main/runtime/push/push-device-registration-persistence.test.ts
1 test-no-wall-clock:src/main/runtime/push/push-registration-rpc.test.ts
1 test-no-wall-clock:src/main/runtime/push/push-unpair-persistence.test.ts
1 test-no-wall-clock:src/main/runtime/rpc/methods/agent-launch/agent-launch-prestart-failure.test.ts
1 test-no-wall-clock:src/main/runtime/rpc/methods/agent-launch/agent-launch-replay.test.ts
-2 test-no-wall-clock:src/main/runtime/rpc/methods/agent-launch/agent-launch-restart-replay.test.ts
1 test-no-wall-clock:src/main/runtime/rpc/methods/orchestration/federation/federation-output.test.ts
-2 test-no-wall-clock:src/main/runtime/rpc/methods/orchestration/worker/fleet-status-observed-identity.test.ts
-1 test-no-wall-clock:src/main/runtime/rpc/methods/orchestration/worker/worker-interactive-wait.test.ts
-1 test-no-wall-clock:src/main/runtime/rpc/methods/orchestration/worker/worker-output.test.ts
+2 test-no-wall-clock:src/main/runtime/rpc/methods/orchestration/worker/observation/fleet-status-observed-identity.test.ts
+1 test-no-wall-clock:src/main/runtime/rpc/methods/orchestration/worker/observation/worker-interactive-wait.test.ts
+1 test-no-wall-clock:src/main/runtime/rpc/methods/orchestration/worker/output/worker-output.test.ts
2 test-no-wall-clock:src/main/runtime/rpc/server/remote-runtime-request-connection.integration.test.ts
2 test-no-wall-clock:src/main/runtime/rpc/server/runtime-rpc-pairing-mode-persistence.test.ts
-7 test-no-wall-clock:src/main/runtime/rpc/server/runtime-rpc-relay-pairing.test.ts
+6 test-no-wall-clock:src/main/runtime/rpc/server/runtime-rpc-relay-pairing.test.ts
1 test-no-wall-clock:src/main/runtime/session-construction/agent-session/orca-runtime-agent-session-operation.test.ts
1 test-no-wall-clock:src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts
1 test-no-wall-clock:src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts
@@ -558,29 +497,21 @@
3 test-no-wall-clock:src/main/runtime/terminal/query/orca-runtime-codex-idle-title-chat-address.test.ts
1 test-no-wall-clock:src/main/runtime/terminal/recovery/terminal-pane-recovery-liveness-gate.test.ts
16 test-no-wall-clock:src/main/runtime/terminal/wait/tui-idle-hook-lane-runtime.test.ts
-4 test-no-wall-clock:src/main/runtime/terminal/wait/tui-idle-name-only-real-pty.integration.test.ts
1 test-no-wall-clock:src/main/runtime/workspaces/process-listing/runtime-worktree-structured-agent-rows-liveness.test.ts
1 test-no-wall-clock:src/main/runtime/workspaces/removal/owned-session-teardown-policy.test.ts
6 test-no-wall-clock:src/main/skills/install/skill-bundle-process-termination.integration.test.ts
-6 test-no-wall-clock:src/main/skills/transaction-state/skill-install-lock.test.ts
1 test-no-wall-clock:src/main/skills/install/skill-install-recovery.test.ts
1 test-no-wall-clock:src/main/skills/install/skill-install-request.test.ts
1 test-no-wall-clock:src/main/skills/provider-placement/skill-placement-reconciliation.test.ts
1 test-no-wall-clock:src/main/skills/provider-placement/skill-placement-transaction.test.ts
-2 test-no-wall-clock:src/main/skills/transaction-state/skill-transaction-startup-recovery.test.ts
4 test-no-wall-clock:src/main/skills/runtime-upload/skill-upload-process-restart.integration.test.ts
+6 test-no-wall-clock:src/main/skills/transaction-state/skill-install-lock.test.ts
+2 test-no-wall-clock:src/main/skills/transaction-state/skill-transaction-startup-recovery.test.ts
4 test-no-wall-clock:src/main/sqlite/sync-database.test.ts
-4 test-no-wall-clock:src/main/managed-server/activation/orcad-exited-own-fence-mutation-race.test.ts
-6 test-no-wall-clock:src/main/managed-server/activation/orcad-exited-own-fence.test.ts
-4 test-no-wall-clock:src/main/managed-server/activation/orcad-exited-own-install-lock.test.ts
-2 test-no-wall-clock:src/main/managed-server/activation/orcad-exited-own-lock-windows.test.ts
4 test-no-wall-clock:src/main/ssh/remote-exec/ssh-remote-commands.test.ts
-2 test-no-wall-clock:src/main/star-nag/service-direct-star.test.ts
-3 test-no-wall-clock:src/main/star-nag/service-threshold-prompt.test.ts
-1 test-no-wall-clock:src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts
-1 test-no-wall-clock:src/main/startup/login-shell-environment.test.ts
-2 test-no-wall-clock:src/main/startup/run-electron-vite-dev.test.ts
-13 test-no-wall-clock:src/main/startup/windows-install-dir-acl-recovery.test.ts
+2 test-no-wall-clock:config/scripts/development/launch/run-electron-vite-dev.test.ts
+1 test-no-wall-clock:src/main/startup/shell-environment/login-shell-environment.test.ts
+2 test-no-wall-clock:src/main/startup/windows-install-permissions/windows-install-dir-acl-recovery.test.ts
4 test-no-wall-clock:src/main/updater/lifecycle/serve-supervisor-install-park.test.ts
1 test-no-wall-clock:src/main/window/desktop-integration/macos-press-and-hold-default.defaults-domain.test.ts
2 test-no-wall-clock:src/main/windows/windows-host-job.win32.test.ts
@@ -594,7 +525,6 @@
3 test-no-wall-clock:src/renderer/src/components/activity/activity-auto-mark-read-loop.react185.test.tsx
2 test-no-wall-clock:src/renderer/src/components/artifacts/ArtifactCollection.test.tsx
1 test-no-wall-clock:src/renderer/src/components/browser-pane/assemble-chrome/browser-workspace-pane.adoption-chrome.test.tsx
-3 test-no-wall-clock:src/renderer/src/components/native-chat/conversation/turns/NativeChatResolvedView.turn-status.test.tsx
2 test-no-wall-clock:src/renderer/src/components/native-chat/tools/tasks/NativeChatStructuredSessionStatus.test.tsx
1 test-no-wall-clock:src/renderer/src/components/sidebar/workspace-card/review/use-workspace-reference-details.test.tsx
1 test-no-wall-clock:src/renderer/src/components/sidebar/worktree-list/listing/WorktreeList.lineage-agent-expansion-coupling.test.tsx
@@ -604,8 +534,8 @@
2 test-no-wall-clock:src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-removal.agent-stop.test.tsx
1 test-no-wall-clock:src/renderer/src/components/worktree-jump/WorktreeJumpPalette.recent-tabs.behavior.test.tsx
2 test-no-wall-clock:src/renderer/src/hooks/ipc-events/agent-status-terminal-title-tab-write.test.ts
-1 test-no-wall-clock:src/renderer/src/lib/workspace/ownership/workspace-terminal-host-authority.test.ts
1 test-no-wall-clock:src/renderer/src/lib/workspace/activation/worktree-activation-emptied-workspace-reseed.test.ts
+1 test-no-wall-clock:src/renderer/src/lib/workspace/ownership/workspace-terminal-host-authority.test.ts
2 test-no-wall-clock:src/renderer/src/store/github/pull-requests/github-pr-branch-linked-pr-divergence.test.ts
5 test-no-wall-clock:src/renderer/src/store/slices/worktrees/metadata/worktree-meta-hosted-review.test.ts
1 test-no-wall-clock:src/shared/__tests__/process-host/windows-cmd-shim-resolution.test.ts
@@ -625,12 +555,9 @@
4 test-no-wall-clock:tests/e2e/cross-version-wire/release-checkout.unit.test.ts
2 test-no-wall-clock:tests/e2e/cross-version-wire/release-source-retention.unit.test.ts
1 test-no-wall-clock:tests/e2e/host-cold-park-remote-subscriber.unit.test.ts
-2 test-timeout-needs-reason:mobile/src/terminal/document/native-document-bundle.test.ts
-1 test-timeout-needs-reason:mobile/src/test-support/rpc-recording/family-recordings.test.ts
-1 test-timeout-needs-reason:mobile/src/test-support/rpc-recording/mutants/family-mutants.test.ts
-1 test-timeout-needs-reason:src/cli/agent-launch-process.test.ts
+1 test-timeout-needs-reason:src/cli/agents/agent-launch-process.test.ts
1 test-timeout-needs-reason:src/cli/runtime/serve-pid1-init-reaper.test.ts
-1 test-timeout-needs-reason:src/cli/skills-install.test.ts
+1 test-timeout-needs-reason:src/cli/skills/skills-install.test.ts
2 test-timeout-needs-reason:src/main/acp/journal/acp-structured-broken-stream.test.ts
4 test-timeout-needs-reason:src/main/agent-hooks/server/testing/http/server-transport-interference.test.ts
1 test-timeout-needs-reason:src/main/agent-hooks/wsl-relay/testing/wsl-hook-relay-live.integration.test.ts
@@ -648,13 +575,6 @@
1 test-timeout-needs-reason:src/main/browser/guest-lifecycle/find/browser-find-frame-traversal.electron.test.ts
1 test-timeout-needs-reason:src/main/browser/identity/wire-probes/browser-session-ua-wire-identity-cross-context.electron.test.ts
1 test-timeout-needs-reason:src/main/browser/identity/wire-probes/browser-session-ua-wire-identity.electron.test.ts
-3 test-timeout-needs-reason:src/main/claude-usage/scanner-incremental-reader.test.ts
-1 test-timeout-needs-reason:src/main/claude/claude-agent-sdk-exit-proof.test.ts
-1 test-timeout-needs-reason:src/main/claude/claude-background-run-isolation-real-cli.test.ts
-2 test-timeout-needs-reason:src/main/claude/claude-status-line-windows.test.ts
-1 test-timeout-needs-reason:src/main/claude/claude-stop-ack-race.test.ts
-1 test-timeout-needs-reason:src/main/claude/structured/claude-structured-real-cli.test.ts
-1 test-timeout-needs-reason:src/main/claude/windows-native-hook-registration.test.ts
2 test-timeout-needs-reason:src/main/codex/app-server/codex-app-server-teardown.integration.test.ts
1 test-timeout-needs-reason:src/main/codex/hooks/installation/hook-service-legacy-cleanup.test.ts
1 test-timeout-needs-reason:src/main/codex/structured/catalog/codex-model-catalog-probe.test.ts
@@ -683,35 +603,31 @@
4 test-timeout-needs-reason:src/main/managed-server/lifecycle/orcad-managed-tunnel-transport-real-openssh.test.ts
3 test-timeout-needs-reason:src/main/native-chat/agent-model-catalog/agent-model-catalog-probe-runner.test.ts
1 test-timeout-needs-reason:src/main/notebook/notebook-kernel.test.ts
-1 test-timeout-needs-reason:src/main/orcad/orcad-bundle-native-load-order.test.ts
-1 test-timeout-needs-reason:src/main/orcad/orcad-packaged-node-pty.integration.test.ts
-1 test-timeout-needs-reason:src/main/orcad/orcad-packaged-structured-chat.integration.test.ts
-1 test-timeout-needs-reason:src/main/orcad/orcad-serve-parity.integration.test.ts
-1 test-timeout-needs-reason:src/main/orcad/orcad-stop-request-shutdown.integration.test.ts
-1 test-timeout-needs-reason:src/main/orcad/orcad-windows-conpty-breakaway.integration.test.ts
+1 test-timeout-needs-reason:src/main/orcad/native-runtime/orcad-bundle-native-load-order.test.ts
+1 test-timeout-needs-reason:src/main/orcad/native-runtime/orcad-packaged-node-pty.integration.test.ts
+1 test-timeout-needs-reason:src/main/orcad/testing/structured-chat/orcad-packaged-structured-chat.integration.test.ts
+1 test-timeout-needs-reason:src/main/orcad/testing/serve-lifecycle/orcad-serve-parity.integration.test.ts
+1 test-timeout-needs-reason:src/main/orcad/host-lifecycle/managed-stop/orcad-stop-request-shutdown.integration.test.ts
+1 test-timeout-needs-reason:src/main/orcad/native-runtime/orcad-windows-conpty-breakaway.integration.test.ts
1 test-timeout-needs-reason:src/main/persistence/applying-settings/persistence-source-control-ai-migration.test.ts
-1 test-timeout-needs-reason:src/main/plugins/workers/plugin-worker-supervision.integration.test.ts
2 test-timeout-needs-reason:src/main/providers/agent-foreground-process-git-bash.win32.test.ts
1 test-timeout-needs-reason:src/main/providers/local-pty/local-pty-child-process-verdict.test.ts
2 test-timeout-needs-reason:src/main/providers/startup-line-typed-length.live-shell.test.ts
5 test-timeout-needs-reason:src/main/pty/process-retirement/node-pty-master-fd-retirement.test.ts
-1 test-timeout-needs-reason:src/main/runtime/mobile-cloud-relay/mobile-relay-e2ee.integration.test.ts
+1 test-timeout-needs-reason:src/main/runtime/mobile-cloud-relay/testing/mobile-relay-e2ee.integration.test.ts
1 test-timeout-needs-reason:src/main/runtime/rpc/server/orchestration-cli-subprocess.test.ts
2 test-timeout-needs-reason:src/main/runtime/rpc/server/remote-runtime-request-connection.integration.test.ts
-1 test-timeout-needs-reason:src/main/runtime/rpc/ws-transport.test.ts
1 test-timeout-needs-reason:src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts
1 test-timeout-needs-reason:src/main/runtime/terminal/launch/qoder-mobile-resume-adoption.test.ts
2 test-timeout-needs-reason:src/main/runtime/terminal/wait/launched-agent-crash-guard.live-shell.test.ts
-3 test-timeout-needs-reason:src/main/runtime/terminal/wait/terminal-interactive-wait-visibility.test.ts
+2 test-timeout-needs-reason:src/main/runtime/terminal/wait/terminal-interactive-wait-visibility.test.ts
1 test-timeout-needs-reason:src/main/runtime/terminal/wait/terminal-wait-name-only-idle.test.ts
4 test-timeout-needs-reason:src/main/runtime/terminal/wait/tui-idle-hook-lane-runtime.test.ts
-3 test-timeout-needs-reason:src/main/runtime/terminal/wait/tui-idle-name-only-real-pty.integration.test.ts
1 test-timeout-needs-reason:src/main/skills/install/skill-bundle-process-termination.integration.test.ts
1 test-timeout-needs-reason:src/main/sqlite/sync-database-concurrent-backup.test.ts
2 test-timeout-needs-reason:src/main/ssh/connection/ssh-connection-sftp-wire.test.ts
2 test-timeout-needs-reason:src/main/ssh/system-transport/forwarding/system-ssh-forward-process-real-openssh.test.ts
-2 test-timeout-needs-reason:src/main/startup/single-instance-lock-exit.electron.test.ts
-1 test-timeout-needs-reason:src/main/window/renderer-publication-throttle.electron.test.ts
+1 test-timeout-needs-reason:src/main/window/visibility/renderer-publication-throttle.electron.test.ts
1 test-timeout-needs-reason:src/main/windows/windows-administrator-restart.win32.test.ts
1 test-timeout-needs-reason:src/main/windows/windows-host-job.win32.test.ts
1 test-timeout-needs-reason:src/main/windows/windows-msys-job.win32.test.ts
@@ -751,7 +667,6 @@
1 test-timeout-needs-reason:tests/e2e/daemon-generation-legacy-close-safety.spec.ts
2 test-timeout-needs-reason:tests/e2e/daemon-generation-reconnect-safety.spec.ts
2 test-timeout-needs-reason:tests/e2e/default-tabs-mark-crash-relaunch.spec.ts
-1 test-timeout-needs-reason:tests/e2e/desktop-published-split-orientation-legacy-leaf.spec.ts
2 test-timeout-needs-reason:tests/e2e/desktop-window-mobile-markdown.spec.ts
1 test-timeout-needs-reason:tests/e2e/floating-tab-rename.spec.ts
1 test-timeout-needs-reason:tests/e2e/golden-quit-relaunch-session.spec.ts
@@ -783,7 +698,7 @@
1 test-timeout-needs-reason:tests/e2e/markdown-review-selection-performance.spec.ts
1 test-timeout-needs-reason:tests/e2e/mobile-subscribe-idle-hidden-pane-fit.spec.ts
1 test-timeout-needs-reason:tests/e2e/orcad-serve-open-url-on-desktop.spec.ts
-10 test-timeout-needs-reason:tests/e2e/orchestration-idle-mail-delivery.spec.ts
+9 test-timeout-needs-reason:tests/e2e/orchestration-idle-mail-delivery.spec.ts
1 test-timeout-needs-reason:tests/e2e/orchestration-idle-mail-restore.spec.ts
1 test-timeout-needs-reason:tests/e2e/orchestration-legacy-worker-missing-terminal-recovery.spec.ts
1 test-timeout-needs-reason:tests/e2e/orchestration-worker-settlement-release-cli.spec.ts
@@ -807,11 +722,6 @@
1 test-timeout-needs-reason:tests/e2e/paired-client-hosted-profile-cookies.spec.ts
1 test-timeout-needs-reason:tests/e2e/paired-client-project-removal-stops-host-terminals.spec.ts
1 test-timeout-needs-reason:tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts
-1 test-timeout-needs-reason:tests/e2e/paired-desktop-server-held-pane-reopen.spec.ts
-1 test-timeout-needs-reason:tests/e2e/paired-desktop-server-layout-frames.spec.ts
-1 test-timeout-needs-reason:tests/e2e/paired-desktop-server-layout-intents.spec.ts
-1 test-timeout-needs-reason:tests/e2e/paired-desktop-server-layout-writes.spec.ts
-1 test-timeout-needs-reason:tests/e2e/paired-external-worktree-discovery.spec.ts
2 test-timeout-needs-reason:tests/e2e/paired-host-usage-credentials.spec.ts
7 test-timeout-needs-reason:tests/e2e/paired-instant-browser-tab.spec.ts
1 test-timeout-needs-reason:tests/e2e/paired-mobile-desktop-mirror-files-git-review.spec.ts
diff --git a/config/focus-setting-read-baseline.txt b/config/focus-setting-read-baseline.txt
index 7fc0cfa7341..5c767a92a7c 100644
--- a/config/focus-setting-read-baseline.txt
+++ b/config/focus-setting-read-baseline.txt
@@ -175,7 +175,6 @@
2 src/renderer/src/components/task-page/use-task-page-source-availability.ts
2 src/renderer/src/components/task-page/use-task-page-store-bindings.ts
1 src/renderer/src/components/terminal-pane/controller/use-terminal-pane-controller.ts
-1 src/renderer/src/components/terminal-pane/controller/use-terminal-pane-lifecycle.ts
1 src/renderer/src/components/terminal-pane/layout/close/retire-unbound-runtime-terminal-pane.ts
2 src/renderer/src/components/terminal-pane/layout/close/terminal-pane-close-admission.ts
2 src/renderer/src/components/terminal-pane/layout/close/use-terminal-pane-close-actions.ts
diff --git a/config/knip.json b/config/knip.json
index 34746da37b6..d00eeaddb1b 100644
--- a/config/knip.json
+++ b/config/knip.json
@@ -4,19 +4,21 @@
"src/main/index.ts",
"src/preload/index.ts",
"src/preload/browser-guest.ts",
+ "src/preload/browser-passkey-request.ts",
"src/main/daemon/daemon-entry.ts",
"src/main/plugins/workers/plugin-host-entry.ts",
"src/main/computer/computer-sidecar.ts",
"src/main/speech/stt-worker.ts",
"src/main/warp-themes/warp-theme-parser-worker.ts",
"src/main/foreign-sqlite-readers/foreign-sqlite-reader-entry.ts",
+ "src/main/agent-hooks/identity/agent-identity-worker-entry.ts",
"src/main/ports/port-scan-command-worker-entry.ts",
"src/main/plugins/panels/plugin-source-transpile-worker-entry.ts",
"src/main/worker-thread-child-process/worker-thread-child-process-entry.ts",
"src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.ts",
"src/main/hang-watchdog/main-thread-hang-watchdog-entry.ts",
"src/main/agent-hooks/installation/managed-agent-hook-controls.ts",
- "src/main/claude-accounts/keychain.ts",
+ "src/main/claude-accounts/runtime-auth/keychain.ts",
"src/renderer/src/main.tsx",
"src/renderer/src/popout.tsx",
"src/renderer/src/web/main.tsx",
@@ -40,15 +42,15 @@
"src/main/plugins/testing/plugin-test-hooks.ts",
"src/main/plugins/testing/plugin-test-register.ts",
"src/main/ai-vault/scan-service/session-scanner-service-entry.ts",
- "src/main/native-chat/wsl-transcript-fs-process-entry.ts",
+ "src/main/native-chat/transcript-filesystem/process/wsl-transcript-fs-process-entry.ts",
"src/main/usage/scan-worker/usage-scan-worker-entry.ts",
"src/main/workspaces/space-analysis/workspace-space-scan-worker-entry.ts",
- "src/main/claude-accounts/claude-profile-setup-worker-entry.ts",
+ "src/main/claude-accounts/profiles/setup/claude-profile-setup-worker-entry.ts",
"src/main/persistence/profile-state/backup/profile-state-backup-worker-entry.ts",
"src/main/persistence/profile-state/writer/profile-state-writer-worker-entry.ts",
"src/main/orcad/orcad-local-serve-selection-entry.ts",
"src/main/orcad/launcher.ts",
- "src/main/claude-accounts/claude-profile-wsl-entry.ts",
+ "src/main/claude-accounts/profiles/wsl/claude-profile-wsl-entry.ts",
"src/main/ai-vault/scanners/opencode/reader-transport/session-scanner-opencode-sqlite-process-entry.ts",
"src/wsl-guest/wsl-browser-network-relay.ts",
"src/renderer/src/space.tsx",
@@ -56,7 +58,7 @@
"src/**/*-electron-fixture.ts",
"src/**/*-test-fixture.ts",
"src/**/*.test-fixture.{ts,tsx}",
- "src/main/runtime/rpc/rpc-params-type-parity.ts",
+ "src/main/runtime/rpc/dispatch/rpc-params-type-parity.ts",
"src/main/runtime/rpc/methods/client-state/ui-state-schema-parity-checks.ts",
"src/renderer/src/components/editor/monaco-internal-test-module-types.ts",
"mobile/**/*.{ts,tsx}",
diff --git a/config/main-blocking-atomics-baseline.txt b/config/main-blocking-atomics-baseline.txt
new file mode 100644
index 00000000000..54e5085bb4c
--- /dev/null
+++ b/config/main-blocking-atomics-baseline.txt
@@ -0,0 +1,6 @@
+# Legacy synchronous atomics uses per file; counts may only go DOWN.
+# Only explicit worker/utility entry files are exempt; their imports remain guarded.
+1 src/main/runtime/rpc/server/pairing/device-registry-disk-merge.ts
+1 src/main/startup/linux-display/ensure-virtual-display.ts
+1 src/shared/windows-retry-file-operations.ts
+1 src/shared/windows-transient-lock-removal.ts
diff --git a/config/main-blocking-compression-baseline.txt b/config/main-blocking-compression-baseline.txt
new file mode 100644
index 00000000000..9b41ba5a702
--- /dev/null
+++ b/config/main-blocking-compression-baseline.txt
@@ -0,0 +1,7 @@
+# Legacy synchronous compression uses per file; counts may only go DOWN.
+# Only explicit worker/utility entry files are exempt; their imports remain guarded.
+1 src/main/browser/extensions/actions/browser-extension-action-icon.ts
+1 src/main/runtime/rpc/mobile/e2ee/mobile-e2ee-v2-compressed-frame.ts
+1 src/main/ssh/remote-exec/ssh-posix-command-wrapper.ts
+2 src/main/ssh/remote-exec/ssh-remote-powershell.ts
+1 src/shared/remote-runtime/e2ee/node/paired-e2ee-node-compressed-frame.ts
diff --git a/config/main-blocking-crypto-baseline.txt b/config/main-blocking-crypto-baseline.txt
new file mode 100644
index 00000000000..3c13aacf628
--- /dev/null
+++ b/config/main-blocking-crypto-baseline.txt
@@ -0,0 +1,3 @@
+# Legacy synchronous crypto uses per file; counts may only go DOWN.
+# Only explicit worker/utility entry files are exempt; their imports remain guarded.
+3 src/main/browser/cookies/sources/browser-cookie-key.ts
diff --git a/config/main-blocking-ipc-baseline.txt b/config/main-blocking-ipc-baseline.txt
new file mode 100644
index 00000000000..5821c30c503
--- /dev/null
+++ b/config/main-blocking-ipc-baseline.txt
@@ -0,0 +1,9 @@
+# Legacy synchronous ipc uses per file; counts may only go DOWN.
+# Only explicit worker/utility entry files are exempt; their imports remain guarded.
+3 src/main/host/native-chat-visual-guest-theme.ts
+1 src/main/ipc/renderer-shutdown-checkpoint.ts
+1 src/main/ipc/settings.ts
+1 src/preload/api/app-bridge.ts
+1 src/preload/api/native-chat-bridge.ts
+1 src/preload/api/settings-bridge.ts
+1 src/preload/native-chat-visual-guest-theme.ts
diff --git a/config/main-blocking-sqlite-baseline.txt b/config/main-blocking-sqlite-baseline.txt
new file mode 100644
index 00000000000..1fadfec8350
--- /dev/null
+++ b/config/main-blocking-sqlite-baseline.txt
@@ -0,0 +1,101 @@
+# Legacy synchronous sqlite uses per file; counts may only go DOWN.
+# Only explicit worker/utility entry files are exempt; their imports remain guarded.
+3 src/main/ai-vault-search/query/session-search-engine.ts
+6 src/main/ai-vault-search/query/session-search-postings.ts
+8 src/main/ai-vault-search/query/session-search-retrieval.ts
+2 src/main/ai-vault-search/query/session-search-snippet.ts
+2 src/main/ai-vault-search/query/session-search-source-presence.ts
+2 src/main/ai-vault-search/query/session-search-typo-repair.ts
+10 src/main/ai-vault-search/storage/session-search-file-records.ts
+8 src/main/ai-vault-search/storage/session-search-index-generation.ts
+17 src/main/ai-vault-search/storage/session-search-index-writer.ts
+10 src/main/ai-vault-search/storage/session-search-message-rows.ts
+3 src/main/ai-vault-search/storage/session-search-query-schema.ts
+17 src/main/ai-vault-search/storage/session-search-retention-delete.ts
+13 src/main/ai-vault-search/storage/session-search-schema.ts
+16 src/main/ai-vault-search/storage/session-search-store.ts
+26 src/main/ai-vault-search/storage/session-search-tool-purge.ts
+9 src/main/ai-vault-search/storage/session-search-write-buffer.ts
+19 src/main/ai-vault/parse-cache/session-parse-cache-database.ts
+13 src/main/ai-vault/parse-cache/session-scope-cwds-table.ts
+2 src/main/ai-vault/scanners/opencode/sqlite/session-scanner-opencode-sqlite-capture.ts
+4 src/main/ai-vault/scanners/opencode/sqlite/session-scanner-opencode-sqlite-list.ts
+1 src/main/ai-vault/scanners/opencode/sqlite/session-scanner-opencode-sqlite-open.ts
+6 src/main/ai-vault/scanners/opencode/sqlite/session-scanner-opencode-sqlite.ts
+5 src/main/ai-vault/scanners/opencode2/session-scanner-opencode2-sqlite-list.ts
+9 src/main/ai-vault/scanners/opencode2/session-scanner-opencode2-sqlite.ts
+5 src/main/browser-passwords/browser-password-chromium-import.ts
+1 src/main/browser/cookies/chromium/prepare-import.ts
+5 src/main/browser/cookies/sources/browser-cookie-firefox-import.ts
+25 src/main/browser/cookies/staging/browser-cookie-staged-import.ts
+8 src/main/codex/history/index/codex-state-db.ts
+3 src/main/foreign-sqlite-readers/readers/cursor-profile.ts
+44 src/main/github/pr-watch/pr-check-event-tables.ts
+14 src/main/github/pr-watch/pr-pending-actions.ts
+18 src/main/github/pr-watch/pr-watch-tables.ts
+6 src/main/managed-data-accounts/credential-capture.ts
+19 src/main/native-chat/agent-session-attachments/agent-session-attachment-claims.ts
+2 src/main/native-chat/agent-session-journal/database/journal-checkpoint-owner.ts
+13 src/main/native-chat/agent-session-journal/database/journal-database.ts
+1 src/main/native-chat/agent-session-journal/database/journal-host-database.ts
+12 src/main/native-chat/agent-session-journal/durable-rows/journal-row-table.ts
+18 src/main/native-chat/agent-session-journal/history-import/journal-pi-active-branch.ts
+15 src/main/native-chat/agent-session-journal/outcomes/journal-outcome-format.ts
+6 src/main/native-chat/agent-session-journal/outcomes/journal-outcome-table.ts
+6 src/main/native-chat/agent-session-journal/queued-messages/journal-queue-import.ts
+5 src/main/native-chat/agent-session-journal/queued-messages/queued-message-schema.ts
+10 src/main/native-chat/agent-session-journal/replay/journal-historical-inputs.ts
+4 src/main/native-chat/agent-session-journal/replay/journal-read-row.ts
+8 src/main/native-chat/agent-session-journal/replay/journal-retained-inputs.ts
+1 src/main/native-chat/agent-session-journal/writing/command-receipt-schema.ts
+8 src/main/native-chat/agent-session-journal/writing/command-receipt-table.ts
+2 src/main/native-chat/agent-session-journal/writing/journal-goal-attachment-inverse.ts
+10 src/main/native-chat/transcript-history/opencode/transcript-opencode-sqlite-query.ts
+14 src/main/native-chat/transcript-history/opencode/transcript-opencode2-fork-coverage.ts
+10 src/main/native-chat/transcript-history/opencode/transcript-opencode2-sqlite.ts
+10 src/main/opencode-usage/opencode-usage-row-queries.ts
+1 src/main/opencode-usage/scanner.ts
+12 src/main/persistence/moving-wsl-projects/desktop-state/wsl-move-orchestration-history-rewrite.ts
+8 src/main/persistence/profile-state/automation-runs/profile-state-automation-runs-migration.ts
+4 src/main/persistence/profile-state/automation-runs/profile-state-automation-runs-reader.ts
+6 src/main/persistence/profile-state/automation-runs/profile-state-automation-runs-storage.ts
+2 src/main/persistence/profile-state/automation-runs/profile-state-automation-runs-validation.ts
+8 src/main/persistence/profile-state/automation-runs/profile-state-automation-runs-writer.ts
+2 src/main/persistence/profile-state/automation-runs/profile-state-automation-runs.ts
+3 src/main/persistence/profile-state/database/profile-state-database-snapshot.ts
+4 src/main/persistence/profile-state/database/profile-state-database-validation.ts
+6 src/main/persistence/profile-state/database/profile-state-database.ts
+3 src/main/persistence/profile-state/database/profile-state-read-snapshot.ts
+4 src/main/persistence/profile-state/database/profile-state-revision.ts
+3 src/main/persistence/profile-state/database/profile-state-write-transaction.ts
+2 src/main/persistence/profile-state/document-parts/profile-state-document-parts-reader.ts
+25 src/main/persistence/profile-state/document-parts/profile-state-document-parts-storage.ts
+3 src/main/persistence/profile-state/document-parts/profile-state-document-parts.ts
+4 src/main/persistence/profile-state/document-parts/profile-state-legacy-document-refresh.ts
+2 src/main/persistence/profile-state/documents/profile-state-document-reader.ts
+7 src/main/persistence/profile-state/documents/profile-state-documents.ts
+8 src/main/persistence/profile-state/documents/profile-state-domain-writes.ts
+4 src/main/persistence/profile-state/legacy-json/profile-state-json-acceptance.ts
+2 src/main/persistence/profile-state/recovery/profile-state-section-repair.ts
+3 src/main/rate-limits/providers/opencode-go/opencode-go-api-key-source.ts
+2 src/main/runtime/agent-session/records/agent-session-record-lineage.ts
+34 src/main/runtime/agent-session/records/agent-session-record-rows.ts
+23 src/main/runtime/orchestration/db/dispatch-context/presentation-completion-source.ts
+6 src/main/runtime/orchestration/db/dispatch-row-writer.ts
+1 src/main/runtime/orchestration/db/federation/federated-stub-home-run-backfill.ts
+9 src/main/runtime/orchestration/db/lifecycle-transition.ts
+7 src/main/runtime/orchestration/db/mutation-receipts/mutation-receipt-capacity.ts
+5 src/main/runtime/orchestration/db/orchestration-db.ts
+4 src/main/runtime/orchestration/db/peer-runs/peer-run-queue-sql.ts
+10 src/main/runtime/orchestration/db/reset/removed-orchestration-work-read.ts
+6 src/main/runtime/orchestration/db/reset/removed-orchestration-work-store.ts
+4 src/main/runtime/orchestration/db/runs/run-coordinator-mail-routing.ts
+12 src/main/runtime/orchestration/db/schema/orchestration-schema-version-skew.ts
+15 src/main/runtime/orchestration/db/schema/structured-worker-orca-session-backfill.ts
+5 src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-settlement.ts
+4 src/main/runtime/orchestration/workers/lifecycle/context-only-dispatch-release.ts
+4 src/main/sqlite/node-sqlite-statement.ts
+19 src/main/sqlite/row-cache/keyed-json-row-cache.ts
+5 src/main/sqlite/sync-database.ts
+8 src/main/sqlite/versioned-cache-database.ts
+12 src/main/wsl/filesystem/wsl-drive-unc-conversion-stores.ts
diff --git a/config/main-blocking-worker-entries.json b/config/main-blocking-worker-entries.json
new file mode 100644
index 00000000000..adc63687765
--- /dev/null
+++ b/config/main-blocking-worker-entries.json
@@ -0,0 +1,25 @@
+{
+ "src/main/plugins/panels/plugin-source-transpile-worker-entry.ts": "Dedicated worker-thread entry; blocking work stays off Electron main.",
+ "src/main/claude/transcripts/claude-conversation-fork-worker-entry.ts": "Dedicated worker-thread entry; blocking work stays off Electron main.",
+ "src/main/speech/stt-worker.ts": "Dedicated utility/forked-process entry; speech work stays off Electron main.",
+ "src/main/warp-themes/warp-theme-parser-worker.ts": "Dedicated worker-thread entry; blocking work stays off Electron main.",
+ "src/main/ai-vault-search/worker/session-search-worker-entry.ts": "Dedicated worker-thread entry; blocking work stays off Electron main.",
+ "src/main/foreign-sqlite-readers/foreign-sqlite-reader-entry.ts": "Dedicated worker-thread entry; blocking work stays off Electron main.",
+ "src/main/agent-hooks/identity/agent-identity-worker-entry.ts": "Dedicated worker-thread entry; terminal agent identity SQL stays off Electron main and orcad's loop.",
+ "src/main/ports/port-scan-command-worker-entry.ts": "Dedicated worker-thread entry; blocking work stays off Electron main.",
+ "src/main/ipc/command-path/command-path-directory-worker-entry.ts": "Dedicated worker-thread entry; blocking work stays off Electron main.",
+ "src/main/worker-thread-child-process/worker-thread-child-process-entry.ts": "Dedicated worker-thread entry; blocking work stays off Electron main.",
+ "src/main/usage/scan-worker/usage-scan-worker-entry.ts": "Dedicated worker-thread entry; blocking work stays off Electron main.",
+ "src/main/workspaces/space-analysis/workspace-space-scan-worker-entry.ts": "Dedicated worker-thread entry; blocking work stays off Electron main.",
+ "src/main/claude-accounts/profiles/setup/claude-profile-setup-worker-entry.ts": "Dedicated worker-thread entry; blocking work stays off Electron main.",
+ "src/main/persistence/profile-state/backup/profile-state-backup-worker-entry.ts": "Dedicated worker-thread entry; blocking work stays off Electron main.",
+ "src/main/persistence/profile-state/writer/profile-state-writer-worker-entry.ts": "Dedicated worker-thread entry; blocking work stays off Electron main.",
+ "src/main/hang-watchdog/main-thread-hang-watchdog-entry.ts": "Dedicated worker-thread entry; blocking work stays off Electron main.",
+ "src/main/browser/extensions/native-messaging/browser-extension-native-host-supervisor-entry.ts": "Dedicated utility/child-process entry; blocking work stays off Electron main.",
+ "src/main/plugins/workers/plugin-host-entry.ts": "Dedicated utility/child-process entry; blocking work stays off Electron main.",
+ "src/main/computer/computer-sidecar.ts": "Dedicated utility/child-process entry; blocking work stays off Electron main.",
+ "src/main/ai-vault/scan-service/session-scanner-service-entry.ts": "Dedicated utility/child-process entry; blocking work stays off Electron main.",
+ "src/main/native-chat/transcript-filesystem/process/wsl-transcript-fs-process-entry.ts": "Dedicated utility/child-process entry; blocking work stays off Electron main.",
+ "src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.ts": "Dedicated utility/child-process entry; blocking work stays off Electron main.",
+ "src/main/orcad/orcad-local-serve-selection-entry.ts": "Dedicated utility/child-process entry; blocking work stays off Electron main."
+}
diff --git a/config/main-layout-writer-baseline.txt b/config/main-layout-writer-baseline.txt
index 1dec6b9a0d4..17a971600e9 100644
--- a/config/main-layout-writer-baseline.txt
+++ b/config/main-layout-writer-baseline.txt
@@ -47,7 +47,7 @@
5 src/main/persistence/restoring-sessions/session-owner-fields.ts
12 src/main/persistence/restoring-sessions/session-owner-removal.ts
2 src/main/persistence/restoring-sessions/workspace-pane-normalization.ts
-4 src/main/persistence/terminal-topology/terminal-topology-membership.ts
+4 src/main/persistence/terminal-topology/pane-ownership/terminal-topology-membership.ts
1 src/main/persistence/tracking-repos/project-group-operations.ts
4 src/main/persistence/tracking-repos/repo-worktree-pruning.ts
3 src/main/persistence/tracking-repos/worktree-identity-migration.ts
diff --git a/config/main-sync-fs-baseline.txt b/config/main-sync-fs-baseline.txt
index 9c56a270dab..571ebce48bd 100644
--- a/config/main-sync-fs-baseline.txt
+++ b/config/main-sync-fs-baseline.txt
@@ -30,7 +30,7 @@
7 src/main/antigravity/native-file-credentials.ts
12 src/main/artifacts/artifact-create-intent-store.ts
2 src/main/artifacts/artifact-share-record-store.ts
-1 src/main/automations/external-manager-discovery.ts
+1 src/main/automations/external-managers/external-manager-discovery.ts
7 src/main/bitbucket/credential-store.ts
1 src/main/browser-passwords/browser-password-chromium-import.ts
2 src/main/browser-passwords/browser-password-vault-file.ts
@@ -38,6 +38,7 @@
2 src/main/browser/agent-browser/helper-process/agent-browser-dependency-binary.ts
2 src/main/browser/agent-browser/helper-process/agent-browser-process-environment.ts
1 src/main/browser/agent-browser/session-lifecycle/agent-browser-session-reset.ts
+1 src/main/browser/bundled-main-file-path.ts
2 src/main/browser/client-hosts/file-transfers/browser-client-download-relay.ts
1 src/main/browser/client-hosts/file-transfers/browser-client-upload-staging.ts
2 src/main/browser/client-hosts/leases/browser-host-client-identity.ts
@@ -53,16 +54,15 @@
5 src/main/browser/cookies/sources/browser-cookie-source-profiles.ts
11 src/main/browser/cookies/staging/browser-session-cookie-staging.ts
1 src/main/browser/downloads/browser-download-destination.ts
-2 src/main/browser/extensions/api-runtime/browser-extension-worker-shim-source.ts
+2 src/main/browser/electron-fixtures/popup-identity-electron-probe.ts
+1 src/main/browser/extensions/api-runtime/browser-extension-worker-shim-source.ts
8 src/main/browser/extensions/installation/browser-extension-install-store.ts
1 src/main/browser/extensions/installation/browser-extension-load-directory.ts
-1 src/main/browser/extensions/profile-sessions/browser-extension-session-loader.ts
2 src/main/browser/extensions/profile-storage/browser-extension-data-removal.ts
8 src/main/browser/extensions/profile-storage/browser-extension-profile-document-store.ts
4 src/main/browser/extensions/profile-storage/browser-extension-profile-state-store.ts
3 src/main/browser/extensions/profile-storage/browser-extension-retired-profile-storage.ts
1 src/main/browser/guest-lifecycle/popups/compatibility/browser-popup-background-cdp-probe.ts
-2 src/main/browser/electron-fixtures/popup-identity-electron-probe.ts
1 src/main/browser/identity/mode/browser-identity-mode-record.ts
2 src/main/browser/identity/mode/browser-identity-mode-store.ts
2 src/main/browser/network/egress/browser-route-egress-electron-launch.ts
@@ -72,31 +72,31 @@
4 src/main/browser/routing/partitions/browser-route-partition-pending-deletes.ts
4 src/main/browser/sessions/profiles/browser-session-meta-store.ts
2 src/main/browser/site-settings/browser-profile-site-store.ts
-7 src/main/claude-accounts/claude-account-folder.ts
-1 src/main/claude-accounts/claude-observed-config-dirs.ts
-14 src/main/claude-accounts/claude-profile-history.ts
-2 src/main/claude-accounts/claude-profile-homes.ts
-1 src/main/claude-accounts/claude-profile-launch-preparation.ts
-7 src/main/claude-accounts/claude-profile-paths.ts
-26 src/main/claude-accounts/claude-profile-prompt-history.ts
-5 src/main/claude-accounts/claude-profile-provisioning.ts
-5 src/main/claude-accounts/claude-profile-router.ts
-1 src/main/claude-accounts/claude-profile-settings.ts
-1 src/main/claude-accounts/claude-profile-setup-worker.ts
-1 src/main/claude-accounts/claude-profile-setup.ts
-12 src/main/claude-accounts/claude-profile-sharing.ts
-1 src/main/claude-accounts/claude-profile-wsl-router.ts
-2 src/main/claude-accounts/keychain.ts
-1 src/main/claude-accounts/runtime-paths.ts
+2 src/main/claude-accounts/profiles/claude-profile-homes.ts
+7 src/main/claude-accounts/profiles/claude-profile-paths.ts
+1 src/main/claude-accounts/profiles/routing/claude-observed-config-dirs.ts
+1 src/main/claude-accounts/profiles/routing/claude-profile-launch-preparation.ts
+5 src/main/claude-accounts/profiles/routing/claude-profile-router.ts
+14 src/main/claude-accounts/profiles/setup/claude-profile-history.ts
+26 src/main/claude-accounts/profiles/setup/claude-profile-prompt-history.ts
+5 src/main/claude-accounts/profiles/setup/claude-profile-provisioning.ts
+1 src/main/claude-accounts/profiles/setup/claude-profile-settings.ts
+1 src/main/claude-accounts/profiles/setup/claude-profile-setup-worker.ts
+1 src/main/claude-accounts/profiles/setup/claude-profile-setup.ts
+12 src/main/claude-accounts/profiles/setup/claude-profile-sharing.ts
+1 src/main/claude-accounts/profiles/wsl/claude-profile-wsl-router.ts
+2 src/main/claude-accounts/runtime-auth/keychain.ts
+1 src/main/claude-accounts/runtime-auth/runtime-paths.ts
+7 src/main/claude-accounts/sign-in/claude-account-folder.ts
3 src/main/claude/agent-view/agent-view-install.ts
-1 src/main/claude/claude-diff-panel-auto-open.ts
-14 src/main/claude/claude-folder-trust-file.ts
-2 src/main/claude/claude-profile-hook-target.ts
-1 src/main/claude/claude-rejected-api-key.ts
-1 src/main/claude/claude-rewind-transcript.ts
+1 src/main/claude/configuration/claude-diff-panel-auto-open.ts
+14 src/main/claude/configuration/claude-folder-trust-file.ts
+2 src/main/claude/hooks/claude-profile-hook-target.ts
+1 src/main/claude/configuration/claude-rejected-api-key.ts
+1 src/main/claude/transcripts/claude-rewind-transcript.ts
1 src/main/claude/hook-service.ts
-3 src/main/claude/statusline-install.ts
-6 src/main/claude/windows-hook-files.ts
+3 src/main/claude/hooks/statusline-install.ts
+6 src/main/claude/hooks/windows-hook-files.ts
1 src/main/cli/appimage/appimage-copy-pre-extraction.ts
3 src/main/cli/appimage/appimage-extracted-root.ts
1 src/main/cli/appimage/appimage-extraction-pruning.ts
@@ -104,34 +104,32 @@
4 src/main/cli/appimage/appimage-generation-residency.ts
16 src/main/cli/appimage/appimage-stable-launcher.ts
1 src/main/cli/installation/cli-command-inspection.ts
-1 src/main/cli/launchers/cli-dev-launcher.ts
3 src/main/cli/installation/cli-install-location.ts
+1 src/main/cli/launchers/cli-dev-launcher.ts
2 src/main/cli/launchers/linux-bare-orca-dispatcher.ts
7 src/main/cli/launchers/linux-terminal-orca-cli-shim.ts
2 src/main/cli/wsl/wsl-managed-cli.ts
-2 src/main/codex-accounts/codex-account-identity.ts
-3 src/main/codex-accounts/codex-account-registration.ts
-4 src/main/codex-accounts/codex-config-mirror.ts
-1 src/main/codex-accounts/codex-credential-absence-grace.ts
-1 src/main/codex-accounts/codex-login-auth-snapshot.ts
-5 src/main/codex-accounts/codex-managed-home-lifecycle.ts
-6 src/main/codex-accounts/codex-managed-home-path.ts
-17 src/main/filesystem/atomic-file-publication.ts
-1 src/main/codex-accounts/guest-codex-account-homes.ts
-6 src/main/codex-accounts/host-codex-managed-home-ownership.ts
-2 src/main/codex-accounts/legacy-shared-auth-migration.ts
-21 src/main/codex-accounts/legacy-wsl-runtime-auth-drain-recovery-script-harness.ts
-36 src/main/codex-accounts/legacy-wsl-runtime-auth-drain-script-harness.ts
-6 src/main/codex-accounts/legacy-wsl-runtime-auth-drain-script-interference-shims.ts
-1 src/main/codex-accounts/managed-codex-auth-readiness.ts
-7 src/main/codex-accounts/runtime-home-service-auth-core.ts
-5 src/main/codex-accounts/runtime-home-service-auth-provenance.ts
-23 src/main/codex-accounts/runtime-home-service-auth-sync.ts
-19 src/main/codex-accounts/runtime-home-service-legacy-migration.ts
-1 src/main/codex-accounts/runtime-home-service-managed-home.ts
-14 src/main/codex-accounts/runtime-home-service-paths.ts
-1 src/main/codex-accounts/runtime-home-service-sync.ts
-2 src/main/codex-accounts/runtime-home-service-wsl-core.ts
+2 src/main/codex-accounts/credentials/codex-account-identity.ts
+3 src/main/codex-accounts/account-management/codex-account-registration.ts
+4 src/main/codex-accounts/managed-homes/codex-config-mirror.ts
+1 src/main/codex-accounts/credentials/codex-credential-absence-grace.ts
+1 src/main/codex-accounts/login/codex-login-auth-snapshot.ts
+5 src/main/codex-accounts/managed-homes/codex-managed-home-lifecycle.ts
+6 src/main/codex-accounts/managed-homes/codex-managed-home-path.ts
+1 src/main/codex-accounts/managed-homes/guest-codex-account-homes.ts
+6 src/main/codex-accounts/managed-homes/host-codex-managed-home-ownership.ts
+2 src/main/codex-accounts/runtime-home/legacy-host/legacy-shared-auth-migration.ts
+36 src/main/codex-accounts/legacy-wsl-auth-drain/legacy-wsl-runtime-auth-drain-script-harness.ts
+6 src/main/codex-accounts/legacy-wsl-auth-drain/legacy-wsl-runtime-auth-drain-script-interference-shims.ts
+1 src/main/codex-accounts/credentials/managed-codex-auth-readiness.ts
+7 src/main/codex-accounts/runtime-home/credentials/runtime-home-service-auth-core.ts
+5 src/main/codex-accounts/runtime-home/credentials/runtime-home-service-auth-provenance.ts
+23 src/main/codex-accounts/runtime-home/credentials/runtime-home-service-auth-sync.ts
+19 src/main/codex-accounts/runtime-home/legacy-host/runtime-home-service-legacy-migration.ts
+1 src/main/codex-accounts/runtime-home/routing/runtime-home-service-managed-home.ts
+14 src/main/codex-accounts/runtime-home/runtime-home-service-paths.ts
+1 src/main/codex-accounts/runtime-home/runtime-home-service-sync.ts
+2 src/main/codex-accounts/runtime-home/credentials/runtime-home-service-wsl-core.ts
1 src/main/codex-usage/codex-session-file-discovery.ts
1 src/main/codex/configuration/codex-path-observation.ts
21 src/main/codex/configuration/homes/codex-home-paths.ts
@@ -246,24 +244,27 @@
7 src/main/emulator/serve-sim-execution.ts
17 src/main/emulator/serve-sim-runtime-materializer.ts
12 src/main/external-editors/external-editor-launch.ts
+17 src/main/filesystem/atomic-file-publication.ts
9 src/main/filesystem/durable-file-write.ts
2 src/main/filesystem/rolling-file-backup.ts
2 src/main/foreign-sqlite-readers/foreign-sqlite-reader-entry-path.ts
1 src/main/foreign-sqlite-readers/foreign-sqlite-reader-spawn.ts
1 src/main/foreign-sqlite-readers/readers/cursor-profile.ts
1 src/main/foreign-sqlite-readers/readers/opencode-binder-sessions.ts
-1 src/main/git/huge-folder-ignore.ts
-5 src/main/git/repo-detection.ts
-13 src/main/git/repo-git-marker-scan.ts
+1 src/main/git/source-control/huge-folder-ignore.ts
+5 src/main/git/repositories/discovery/repo-detection.ts
+13 src/main/git/repositories/discovery/repo-git-marker-scan.ts
3 src/main/git/worktrees/catalog/worktree-git-path.ts
1 src/main/github/client/check/check-job-log-cache-retention-child.mjs
3 src/main/grok/grok-hook-backup-cleanup.ts
3 src/main/grok/grok-hook-owners.ts
4 src/main/grok/grok-hook-symlink-cleanup-marker.ts
4 src/main/grok/hook-service.ts
-4 src/main/hang-watchdog/hang-detection-marker.ts
+8 src/main/hang-watchdog/hang-detection-marker.ts
+4 src/main/hang-watchdog/hang-incident-snapshot.ts
1 src/main/hang-watchdog/hang-watchdog-worker-path.ts
1 src/main/hang-watchdog/previous-hang-detection.ts
+9 src/main/hang-watchdog/renderer-hang-records.ts
1 src/main/hermes/hermes-default-home.ts
10 src/main/hermes/hermes-home-filesystem.ts
2 src/main/hermes/hook-service.ts
@@ -273,15 +274,15 @@
1 src/main/ipc/command-path/command-path-resolver.ts
4 src/main/ipc/diagnostics.ts
2 src/main/ipc/filesystem/access/filesystem-path-containment.ts
-2 src/main/ipc/filesystem/watcher-process/parcel-watcher-canary-directory.ts
-1 src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.ts
-4 src/main/ipc/filesystem/watcher-process/parcel-watcher-delivery-canary.ts
+2 src/main/ipc/filesystem/watcher-process/child-lifecycle/parcel-watcher-canary-directory.ts
+1 src/main/ipc/filesystem/watcher-process/child-lifecycle/parcel-watcher-child-launch.ts
+4 src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-delivery-canary.ts
+1 src/main/ipc/filesystem/watcher-process/native-subscriptions/parcel-watcher-shallow-file-subscription.ts
+1 src/main/ipc/filesystem/watcher-process/native-subscriptions/parcel-watcher-shallow-subscription.ts
+1 src/main/ipc/filesystem/watcher-process/native-subscriptions/rebinding-file-watch.ts
3 src/main/ipc/filesystem/watcher-process/parcel-watcher-entry-path.ts
-1 src/main/ipc/filesystem/watcher-process/parcel-watcher-shallow-file-subscription.ts
-1 src/main/ipc/filesystem/watcher-process/parcel-watcher-shallow-subscription.ts
-1 src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-subscribe.ts
-1 src/main/ipc/filesystem/watcher-process/rebinding-file-watch.ts
-1 src/main/ipc/filesystem/watcher-process/watcher-event-root-path-rewrite.ts
+1 src/main/ipc/filesystem/watcher-process/root-paths/watcher-event-root-path-rewrite.ts
+1 src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-supervisor-subscribe.ts
1 src/main/ipc/floating-workspace-directory.ts
1 src/main/ipc/macos-keyboard-layout-snapshot.ts
1 src/main/ipc/notification-authorization-status.ts
@@ -296,6 +297,7 @@
13 src/main/kimi/hook-service.ts
3 src/main/kiro/hook-service.ts
1 src/main/kiro/standalone-hooks.ts
+3 src/main/lib/hidden-probe-cwd.ts
4 src/main/linear/accounts/linear-credential-paths.ts
3 src/main/linear/accounts/linear-legacy-viewer-store.ts
1 src/main/linear/accounts/linear-token-store.ts
@@ -314,8 +316,8 @@
4 src/main/muse/hook-service.ts
2 src/main/native-chat/agent-session-attachments/agent-session-attachment-claims.ts
1 src/main/native-chat/agent-session-journal/database/journal-host-database.ts
-1 src/main/native-chat/host-readable-transcript-path.ts
-2 src/main/native-chat/wsl-transcript-fs-process-spawn.ts
+1 src/main/native-chat/transcript-discovery/host-readable-transcript-path.ts
+2 src/main/native-chat/transcript-filesystem/process/wsl-transcript-fs-process-spawn.ts
1 src/main/node-runtime/appimage-bundled-node-runtime.ts
2 src/main/node-runtime/managed-runtime-release-install.ts
7 src/main/node-runtime/managed-runtime-release.ts
@@ -323,62 +325,62 @@
1 src/main/observability/bounded-log-file-writer.ts
2 src/main/observability/bundle.ts
6 src/main/observability/local-file-sink.ts
+1 src/main/opencode/opencode-private-server.ts
14 src/main/opencode/status-hooks/hook-service.ts
1 src/main/opencode/status-hooks/legacy-plugin-acl-retry.ts
2 src/main/opencode/status-hooks/opencode-overlay-manifest.ts
1 src/main/opencode/status-hooks/opencode-plugin-config-writer.ts
-1 src/main/opencode/opencode-private-server.ts
1 src/main/opencode/text-tasks/wsl/opencode-wsl-text-task.ts
-2 src/main/orca-profiles/storage/new-profile-state.ts
3 src/main/orca-profiles/catalog/other-profile-workspace-catalog.ts
3 src/main/orca-profiles/cloud-auth/profile-artifact-cloud-cleanup.ts
1 src/main/orca-profiles/cloud-auth/profile-cloud-index.ts
4 src/main/orca-profiles/cloud-session/profile-cloud-session-store.ts
12 src/main/orca-profiles/profile-index-store.ts
-5 src/main/orca-profiles/storage/profile-legacy-state-import.ts
4 src/main/orca-profiles/project-transfer/profile-project-move-intent.ts
3 src/main/orca-profiles/project-transfer/profile-project-move-record.ts
4 src/main/orca-profiles/project-transfer/profile-project-state-file.ts
+2 src/main/orca-profiles/storage/new-profile-state.ts
+5 src/main/orca-profiles/storage/profile-legacy-state-import.ts
2 src/main/orcad/launcher.ts
-7 src/main/orcad/node-pty-prebuilt-slot.ts
-2 src/main/orcad/node-pty-precondition.ts
-2 src/main/orcad/orcad-agent-browser-binary.ts
-1 src/main/orcad/orcad-app-paths.ts
-1 src/main/orcad/orcad-artifact-identity.ts
-2 src/main/orcad/orcad-artifact-materializer.ts
-12 src/main/orcad/orcad-bundled-runtime.ts
-2 src/main/orcad/orcad-cli-launcher.ts
-1 src/main/orcad/orcad-command-arguments.ts
-1 src/main/orcad/orcad-completed-stop-receipt.ts
-2 src/main/orcad/orcad-daemon-slot-pins.ts
-2 src/main/orcad/orcad-data-root-locality.ts
-3 src/main/orcad/orcad-data-root-privacy.ts
-4 src/main/orcad/orcad-host-account-launch-env-store.ts
-1 src/main/orcad/orcad-host-adapters.ts
-1 src/main/orcad/orcad-host-identity-reset.ts
-2 src/main/orcad/orcad-idle-stop-record.ts
-3 src/main/orcad/orcad-instance-lock-hold.ts
-16 src/main/orcad/orcad-instance-lock-reclaim.ts
-4 src/main/orcad/orcad-instance-lock.ts
-7 src/main/orcad/orcad-local-serve-selection.ts
-1 src/main/orcad/orcad-lock-clone-machine.ts
-1 src/main/orcad/orcad-managed-stop-cancellation.ts
-3 src/main/orcad/orcad-managed-stop-decision.ts
-2 src/main/orcad/orcad-managed-stop-request.ts
-4 src/main/orcad/orcad-plaintext-credential-migration.ts
-5 src/main/orcad/orcad-process-start-time.ts
-11 src/main/orcad/orcad-secret-key-record.ts
-3 src/main/orcad/orcad-stale-lock-reclaim.ts
-1 src/main/orcad/orcad-stop-request-listener.ts
-1 src/main/orcad/orcad-wsl-holder-release.ts
-2 src/main/orcad/orcad-wsl-host-claude-profile-refresh.ts
-1 src/main/orcad/serve-profile-ssh-targets.ts
+7 src/main/orcad/native-runtime/node-pty-prebuilt-slot.ts
+2 src/main/orcad/native-runtime/node-pty-precondition.ts
+2 src/main/orcad/browser-providers/orcad-agent-browser-binary.ts
+1 src/main/orcad/host-runtime/orcad-app-paths.ts
+1 src/main/orcad/artifact-slots/orcad-artifact-identity.ts
+2 src/main/orcad/artifact-slots/orcad-artifact-materializer.ts
+12 src/main/orcad/runtime-launch/orcad-bundled-runtime.ts
+2 src/main/orcad/serve-startup/orcad-cli-launcher.ts
+1 src/main/orcad/serve-startup/orcad-command-arguments.ts
+1 src/main/orcad/host-lifecycle/managed-stop/orcad-completed-stop-receipt.ts
+2 src/main/orcad/artifact-slots/orcad-daemon-slot-pins.ts
+2 src/main/orcad/instance-lock/orcad-data-root-locality.ts
+3 src/main/orcad/instance-lock/orcad-data-root-privacy.ts
+4 src/main/orcad/account-launch/orcad-host-account-launch-env-store.ts
+1 src/main/orcad/host-runtime/orcad-host-adapters.ts
+1 src/main/orcad/profile-state/orcad-host-identity-reset.ts
+2 src/main/orcad/host-lifecycle/idle-exit/orcad-idle-stop-record.ts
+3 src/main/orcad/instance-lock/orcad-instance-lock-hold.ts
+16 src/main/orcad/instance-lock/orcad-instance-lock-reclaim.ts
+4 src/main/orcad/instance-lock/orcad-instance-lock.ts
+7 src/main/orcad/serve-startup/orcad-local-serve-selection.ts
+1 src/main/orcad/instance-lock/orcad-lock-clone-machine.ts
+1 src/main/orcad/host-lifecycle/managed-stop/orcad-managed-stop-cancellation.ts
+3 src/main/orcad/host-lifecycle/managed-stop/orcad-managed-stop-decision.ts
+2 src/main/orcad/host-lifecycle/managed-stop/orcad-managed-stop-request.ts
+4 src/main/orcad/credentials/orcad-plaintext-credential-migration.ts
+5 src/main/orcad/instance-lock/orcad-process-start-time.ts
+11 src/main/orcad/credentials/orcad-secret-key-record.ts
+3 src/main/orcad/instance-lock/orcad-stale-lock-reclaim.ts
+1 src/main/orcad/host-lifecycle/managed-stop/orcad-stop-request-listener.ts
+1 src/main/orcad/instance-lock/orcad-wsl-holder-release.ts
+2 src/main/orcad/account-launch/orcad-wsl-host-claude-profile-refresh.ts
+1 src/main/orcad/profile-state/serve-profile-ssh-targets.ts
6 src/main/persistence/atomic-snapshot-writer.ts
5 src/main/persistence/loading-store/user-data-path.ts
-9 src/main/persistence/migrating-orcad-catalog/cutover-journals/migration-journal-directory.ts
4 src/main/persistence/migrating-orcad-catalog/blob-transfer/orcad-migration-blob-installers.ts
3 src/main/persistence/migrating-orcad-catalog/blob-transfer/orcad-migration-blob-staging.ts
17 src/main/persistence/migrating-orcad-catalog/blob-transfer/orcad-migration-staged-file.ts
+9 src/main/persistence/migrating-orcad-catalog/cutover-journals/migration-journal-directory.ts
1 src/main/persistence/migrating-orcad-catalog/terminal-history/orcad-scrollback-snapshot-transfer.ts
11 src/main/persistence/migrating-orcad-catalog/terminal-history/orcad-shell-history-installer.ts
7 src/main/persistence/migrating-orcad-catalog/terminal-history/orcad-terminal-history-installer.ts
@@ -388,33 +390,33 @@
6 src/main/persistence/moving-wsl-projects/terminal-state/wsl-move-slept-scrollback.ts
2 src/main/persistence/moving-wsl-projects/terminal-state/wsl-move-slept-spool-sweep.ts
5 src/main/persistence/preferences/active-view-preference.ts
+5 src/main/persistence/profile-state/access/profile-state-access-identity.ts
+12 src/main/persistence/profile-state/access/profile-state-access-owner.ts
+3 src/main/persistence/profile-state/access/profile-state-access.ts
+2 src/main/persistence/profile-state/backup/profile-state-backup-path.ts
+2 src/main/persistence/profile-state/backup/profile-state-backup-worker.ts
+1 src/main/persistence/profile-state/database/profile-state-authority-marker.ts
+2 src/main/persistence/profile-state/database/profile-state-database.ts
+2 src/main/persistence/profile-state/database/profile-state-storage-classification.ts
4 src/main/persistence/profile-state/legacy-json/profile-state-authority-exports.ts
2 src/main/persistence/profile-state/legacy-json/profile-state-export-path.ts
1 src/main/persistence/profile-state/legacy-json/profile-state-legacy-backup-path.ts
2 src/main/persistence/profile-state/legacy-json/profile-state-legacy-import.ts
8 src/main/persistence/profile-state/legacy-json/profile-state-recovery.ts
6 src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.ts
-5 src/main/persistence/profile-state/access/profile-state-access-identity.ts
-12 src/main/persistence/profile-state/access/profile-state-access-owner.ts
-3 src/main/persistence/profile-state/access/profile-state-access.ts
2 src/main/persistence/profile-state/offline-access/profile-state-active-location.ts
-5 src/main/persistence/profile-state/startup/profile-state-authority-bootstrap.ts
-1 src/main/persistence/profile-state/database/profile-state-authority-marker.ts
-2 src/main/persistence/profile-state/backup/profile-state-backup-path.ts
-2 src/main/persistence/profile-state/backup/profile-state-backup-worker.ts
+6 src/main/persistence/profile-state/offline-access/profile-state-offline-settings.ts
+2 src/main/persistence/profile-state/profile-state-sqlite-authority.ts
5 src/main/persistence/profile-state/recovery/profile-state-database-quarantine.ts
9 src/main/persistence/profile-state/recovery/profile-state-database-recovery.ts
-2 src/main/persistence/profile-state/database/profile-state-database.ts
-4 src/main/persistence/profile-state/startup/profile-state-migration.ts
-6 src/main/persistence/profile-state/offline-access/profile-state-offline-settings.ts
6 src/main/persistence/profile-state/recovery/profile-state-recovery-command.ts
8 src/main/persistence/profile-state/recovery/profile-state-recovery-copy.ts
2 src/main/persistence/profile-state/recovery/profile-state-recovery-crash-process.ts
1 src/main/persistence/profile-state/recovery/profile-state-recovery-required.ts
2 src/main/persistence/profile-state/recovery/profile-state-section-repair.ts
-2 src/main/persistence/profile-state/profile-state-sqlite-authority.ts
+5 src/main/persistence/profile-state/startup/profile-state-authority-bootstrap.ts
+4 src/main/persistence/profile-state/startup/profile-state-migration.ts
1 src/main/persistence/profile-state/startup/profile-state-startup-recovery-dialog.ts
-2 src/main/persistence/profile-state/database/profile-state-storage-classification.ts
1 src/main/persistence/profile-state/writer/profile-state-writer-worker-path.ts
2 src/main/persistence/restoring-sessions/floating-workspace-normalization.ts
1 src/main/persistence/tracking-repos/worktree-metadata-normalization.ts
@@ -424,14 +426,14 @@
3 src/main/plugins/appearance/plugin-appearance-service.ts
2 src/main/plugins/installation/plugin-install-staging.ts
1 src/main/plugins/installation/plugin-install.ts
-1 src/main/plugins/panels/plugin-frame-guest-sessions.ts
+1 src/main/plugins/panels/guest-isolation/plugin-frame-guest-sessions.ts
1 src/main/plugins/panels/plugin-source-transpile-client.ts
2 src/main/plugins/plugin-dev-watcher.ts
3 src/main/plugins/plugin-secrets-store.ts
3 src/main/plugins/plugin-storage-store.ts
1 src/main/plugins/testing/plugin-editor-static-check.ts
-1 src/main/plugins/workers/plugin-host-process.ts
-3 src/main/plugins/workers/plugin-worker-source-hooks.ts
+3 src/main/plugins/workers/child-runtime/plugin-worker-source-hooks.ts
+1 src/main/plugins/workers/parent-process/plugin-host-process.ts
8 src/main/ports/darwin-port-scan-lock.ts
1 src/main/ports/port-scan-command-client.ts
1 src/main/ports/port-scan-command-execution.ts
@@ -449,8 +451,7 @@
5 src/main/pty/history/terminal-history.ts
1 src/main/pty/process-retirement/posix-pty-process-table.ts
12 src/main/pty/scrollback/overlay-mirror.ts
-1 src/main/pty/scrollback/terminal-scrollback-snapshot-nonblocking-reads.ts
-11 src/main/pty/scrollback/terminal-scrollback-snapshots.ts
+7 src/main/pty/scrollback/terminal-scrollback-snapshots.ts
2 src/main/pty/shell-startup/codex-shell-launch-preflight.ts
7 src/main/pty/shell-startup/git-bash.ts
3 src/main/pty/shell-startup/legacy-terminal-posix-tombstone.ts
@@ -464,7 +465,6 @@
1 src/main/qoder/workspace-trust.ts
4 src/main/rate-limits/providers/cursor/cursor-auth.ts
2 src/main/rate-limits/providers/grok/grok-auth.ts
-3 src/main/lib/hidden-probe-cwd.ts
2 src/main/rate-limits/providers/opencode-go/opencode-go-api-key-source.ts
1 src/main/rate-limits/providers/zcode/zcode-usage-credentials.ts
3 src/main/ripgrep/bundled-ripgrep-path.ts
@@ -475,8 +475,8 @@
1 src/main/runtime/client/navigation/desktop-chat-creation-history.ts
9 src/main/runtime/host-instance-identity.ts
4 src/main/runtime/hosts/platform-probe/host-descriptor.ts
-5 src/main/runtime/mobile-cloud-relay/relay-region-preference.ts
-2 src/main/runtime/mobile-cloud-relay/relay-revoke-outbox.ts
+5 src/main/runtime/mobile-cloud-relay/region-selection/relay-region-preference.ts
+2 src/main/runtime/mobile-cloud-relay/pairing/relay-revoke-outbox.ts
1 src/main/runtime/orchestration/db/runtime-orchestration-database-access.ts
2 src/main/runtime/push/push-unregister-outbox.ts
1 src/main/runtime/rpc/methods/mobile-delivery/bundled-mobile-web-bundle.ts
@@ -487,8 +487,8 @@
3 src/main/runtime/rpc/server/pairing/e2ee-keypair.ts
3 src/main/runtime/rpc/server/runtime-metadata.ts
2 src/main/runtime/rpc/server/runtime-rpc-socket-metadata.ts
-5 src/main/runtime/rpc/unix-socket-transport.ts
-3 src/main/runtime/rpc/ws-fallback-port-store.ts
+5 src/main/runtime/rpc/transports/unix-socket-transport.ts
+3 src/main/runtime/rpc/transports/websocket/ws-fallback-port-store.ts
2 src/main/runtime/terminal/launch/claude-agent-teams-shim-env.ts
1 src/main/runtime/workspaces/persisted-surfaces/crew-operations.ts
1 src/main/server/serve-pairing-output.ts
@@ -514,24 +514,24 @@
3 src/main/ssh/system-transport/file-transfer/system-ssh-sftp-transfer.ts
3 src/main/ssh/system-transport/ssh-control-socket.ts
3 src/main/ssh/system-transport/system-ssh-binary.ts
-3 src/main/startup/cli-launch-redirect.ts
+3 src/main/startup/cli-launch/cli-launch-redirect.ts
2 src/main/startup/configure-process.ts
-4 src/main/startup/gpu-fallback-marker.ts
-2 src/main/startup/http1-compatibility-marker.ts
-5 src/main/startup/http1-compatibility-profile-state.ts
-1 src/main/startup/linux-dev-shm-policy.ts
-4 src/main/startup/linux-realtime-scheduling-guard.ts
-1 src/main/startup/linux-rttime-limit.ts
-2 src/main/startup/profile-state-recovery-preflight.ts
-1 src/main/startup/startup-diagnostics.ts
-1 src/main/startup/windows-app-data-path.ts
-5 src/main/startup/windows-install-dir-acl-poison-marker.ts
-1 src/main/startup/windows-install-dir-acl-probe.ts
-1 src/main/startup/windows-install-dir-package-acl-grant.ts
-4 src/main/startup/windows-install-dir-package-acl-repair.ts
-3 src/main/startup/windows-renderer-runtime-files.ts
-3 src/main/startup/windows-user-data-acl.ts
-6 src/main/startup/x-display-artifacts.ts
+4 src/main/startup/gpu-recovery/gpu-fallback-marker.ts
+2 src/main/startup/network-compatibility/http1-compatibility-marker.ts
+5 src/main/startup/network-compatibility/http1-compatibility-profile-state.ts
+1 src/main/startup/linux-runtime/linux-dev-shm-policy.ts
+4 src/main/startup/linux-runtime/linux-realtime-scheduling-guard.ts
+1 src/main/startup/linux-runtime/linux-rttime-limit.ts
+2 src/main/startup/profile-startup/profile-state-recovery-preflight.ts
+1 src/main/startup/diagnostics/startup-diagnostics.ts
+1 src/main/startup/windows-startup/windows-app-data-path.ts
+5 src/main/startup/windows-install-permissions/windows-install-dir-acl-poison-marker.ts
+1 src/main/startup/windows-install-permissions/windows-install-dir-acl-probe.ts
+1 src/main/startup/windows-install-permissions/windows-install-dir-package-acl-grant.ts
+4 src/main/startup/windows-install-permissions/windows-install-dir-package-acl-repair.ts
+3 src/main/startup/windows-startup/windows-renderer-runtime-files.ts
+3 src/main/startup/windows-startup/windows-user-data-acl.ts
+6 src/main/startup/linux-display/x-display-artifacts.ts
2 src/main/stats/stats-file-loader.ts
2 src/main/text-generation/source-control-prompt-files.ts
1 src/main/updater/lifecycle/windows-update-install-directory.ts
diff --git a/config/main-sync-spawn-baseline.txt b/config/main-sync-spawn-baseline.txt
index 1695c4ee3b9..34df7fd2668 100644
--- a/config/main-sync-spawn-baseline.txt
+++ b/config/main-sync-spawn-baseline.txt
@@ -9,40 +9,38 @@
1 src/main/browser/network/egress/browser-route-egress-electron-launch.ts
1 src/main/browser/routing/partitions/browser-route-partition-binding-store.ts
1 src/main/claude-accounts/runtime-auth-service.ts
-3 src/main/filesystem/atomic-file-publication.ts
-2 src/main/codex-accounts/legacy-wsl-runtime-auth-drain-recovery-script-harness.ts
-2 src/main/codex-accounts/legacy-wsl-runtime-auth-drain-script-harness.ts
-1 src/main/codex-accounts/runtime-home-service-home-routing.ts
-1 src/main/codex-accounts/runtime-home-service-wsl.ts
+2 src/main/codex-accounts/legacy-wsl-auth-drain/legacy-wsl-runtime-auth-drain-script-harness.ts
+1 src/main/codex-accounts/runtime-home/routing/runtime-home-service-home-routing.ts
+1 src/main/codex-accounts/runtime-home/wsl/runtime-home-service-wsl.ts
1 src/main/codex-accounts/service.ts
1 src/main/computer/macos-permissions/macos-computer-use-permissions.ts
-2 src/main/daemon/process-scopes/daemon-cgroup-scope.ts
1 src/main/daemon/endpoint/identity/daemon-process-identity-query.ts
1 src/main/daemon/endpoint/identity/daemon-process-start-time.ts
+2 src/main/daemon/process-scopes/daemon-cgroup-scope.ts
1 src/main/daemon/process-scopes/daemon-user-manager-lifetime.ts
-1 src/main/daemon/pty-subprocess/shell-launch-plan.ts
1 src/main/daemon/process-scopes/terminal-scopes.ts
+1 src/main/daemon/pty-subprocess/shell-launch-plan.ts
1 src/main/emulator/serve-sim-runtime-materializer.ts
+3 src/main/filesystem/atomic-file-publication.ts
1 src/main/git/command-runner/git-exec-file-sync.ts
-1 src/main/git/repo-detection-command.ts
-1 src/main/git/runner.ts
+1 src/main/git/repositories/discovery/repo-detection-command.ts
1 src/main/ipc/worktree-logic.ts
-2 src/main/window/desktop-integration/macos-press-and-hold-default.ts
1 src/main/network/macos-tailscale-dns-diagnostic.ts
1 src/main/opencode/status-hooks/legacy-plugin-acl-retry.ts
-2 src/main/orcad/node-pty-precondition.ts
-1 src/main/orcad/orcad-data-root-privacy.ts
+2 src/main/orcad/native-runtime/node-pty-precondition.ts
+1 src/main/orcad/instance-lock/orcad-data-root-privacy.ts
2 src/main/persistence/profile-state/access/profile-state-access-identity.ts
1 src/main/persistence/profile-state/recovery/profile-state-recovery-copy.ts
1 src/main/plugins/catalog/plugin-private-marketplace-ssh-shim.cjs
1 src/main/pty/process-retirement/posix-pty-process-table.ts
1 src/main/pty/shell-startup/pwsh.ts
+2 src/main/pty/shell-startup/zsh-startup-hook-pty-harness.ts
1 src/main/runtime/integrations/skill/runtime-skill-install-authority.ts
-2 src/main/startup/cli-launch-redirect.ts
-1 src/main/startup/linux-secret-service-probe.ts
+2 src/main/startup/cli-launch/cli-launch-redirect.ts
+1 src/main/startup/linux-runtime/linux-secret-service-probe.ts
+2 src/main/window/desktop-integration/macos-press-and-hold-default.ts
1 src/main/workspace-hooks/worktree-runner-script.ts
3 src/main/wsl/discovery/distro-catalog.ts
-2 src/main/pty/shell-startup/zsh-startup-hook-pty-harness.ts
1 src/shared/fish-binary-requirement.ts
1 src/shared/openssh-default-shell.ts
1 src/shared/secure-storage/secure-file.ts
diff --git a/config/mobile-localization-coverage-allowlist.json b/config/mobile-localization-coverage-allowlist.json
index 594bc0a7919..d84333750f2 100644
--- a/config/mobile-localization-coverage-allowlist.json
+++ b/config/mobile-localization-coverage-allowlist.json
@@ -7,35 +7,35 @@
"count": 1
},
{
- "filePath": "mobile/src/browser/MobileBrowserKeyRow.tsx",
+ "filePath": "mobile/src/browser/pane-view/MobileBrowserKeyRow.tsx",
"kind": "jsx-expression",
"text": "Esc",
"dynamic": false,
"count": 1
},
{
- "filePath": "mobile/src/browser/MobileBrowserPointerModifiers.tsx",
+ "filePath": "mobile/src/browser/pane-view/MobileBrowserPointerModifiers.tsx",
"kind": "object-property:label",
"text": "Alt",
"dynamic": false,
"count": 1
},
{
- "filePath": "mobile/src/browser/MobileBrowserPointerModifiers.tsx",
+ "filePath": "mobile/src/browser/pane-view/MobileBrowserPointerModifiers.tsx",
"kind": "object-property:label",
"text": "Cmd",
"dynamic": false,
"count": 1
},
{
- "filePath": "mobile/src/browser/MobileBrowserPointerModifiers.tsx",
+ "filePath": "mobile/src/browser/pane-view/MobileBrowserPointerModifiers.tsx",
"kind": "object-property:label",
"text": "Ctrl",
"dynamic": false,
"count": 1
},
{
- "filePath": "mobile/src/browser/MobileBrowserPointerModifiers.tsx",
+ "filePath": "mobile/src/browser/pane-view/MobileBrowserPointerModifiers.tsx",
"kind": "object-property:label",
"text": "Shift",
"dynamic": false,
@@ -289,7 +289,7 @@
{
"filePath": "mobile/src/settings/about-screen.tsx",
"kind": "jsx-attribute:title",
- "text": "onOrca.dev",
+ "text": "orca.dev",
"dynamic": false,
"count": 1
},
@@ -329,70 +329,70 @@
"count": 1
},
{
- "filePath": "mobile/src/tasks/mobile-smart-source-modes.ts",
+ "filePath": "mobile/src/new-workspace/source-selection/mobile-smart-source-modes.ts",
"kind": "object-property:label",
"text": "GitHub",
"dynamic": false,
"count": 1
},
{
- "filePath": "mobile/src/tasks/mobile-smart-source-modes.ts",
+ "filePath": "mobile/src/new-workspace/source-selection/mobile-smart-source-modes.ts",
"kind": "object-property:label",
"text": "GitLab",
"dynamic": false,
"count": 1
},
{
- "filePath": "mobile/src/tasks/mobile-smart-source-modes.ts",
+ "filePath": "mobile/src/new-workspace/source-selection/mobile-smart-source-modes.ts",
"kind": "object-property:label",
"text": "Jira",
"dynamic": false,
"count": 1
},
{
- "filePath": "mobile/src/tasks/mobile-smart-source-modes.ts",
+ "filePath": "mobile/src/new-workspace/source-selection/mobile-smart-source-modes.ts",
"kind": "object-property:label",
"text": "Linear",
"dynamic": false,
"count": 1
},
{
- "filePath": "mobile/src/tasks/mobile-tasks-create-drawers.tsx",
+ "filePath": "mobile/src/tasks/workspace-creation/mobile-tasks-create-drawers.tsx",
"kind": "jsx-attribute:placeholder",
"text": "lin_api_...",
"dynamic": false,
"count": 1
},
{
- "filePath": "mobile/src/tasks/mobile-tasks-options.tsx",
+ "filePath": "mobile/src/tasks/task-list/mobile-tasks-options.tsx",
"kind": "object-property:label",
"text": "GitHub",
"dynamic": false,
"count": 1
},
{
- "filePath": "mobile/src/tasks/mobile-tasks-options.tsx",
+ "filePath": "mobile/src/tasks/task-list/mobile-tasks-options.tsx",
"kind": "object-property:label",
"text": "GitLab",
"dynamic": false,
"count": 1
},
{
- "filePath": "mobile/src/tasks/mobile-tasks-options.tsx",
+ "filePath": "mobile/src/tasks/task-list/mobile-tasks-options.tsx",
"kind": "object-property:label",
"text": "Jira",
"dynamic": false,
"count": 1
},
{
- "filePath": "mobile/src/tasks/mobile-tasks-options.tsx",
+ "filePath": "mobile/src/tasks/task-list/mobile-tasks-options.tsx",
"kind": "object-property:label",
"text": "Linear",
"dynamic": false,
"count": 1
},
{
- "filePath": "mobile/src/tasks/mobile-tasks-workspace-trust-drawers.tsx",
+ "filePath": "mobile/src/tasks/workspace-creation/mobile-tasks-workspace-trust-drawers.tsx",
"kind": "jsx-attribute:placeholder",
"text": "src/renderer packages/ui",
"dynamic": false,
diff --git a/config/nsis/orca-installer-hooks.nsh b/config/nsis/orca-installer-hooks.nsh
index 9ac82b88a25..3a43eb35b4f 100644
--- a/config/nsis/orca-installer-hooks.nsh
+++ b/config/nsis/orca-installer-hooks.nsh
@@ -69,7 +69,7 @@
; WSL host sees nothing here. These are the folders Electron's userData (app.getName()) can be, as the
; deleteAppData step lists them; a custom --user-data-dir can't be known here.
; Sync the flags with WSL_HOLDER_UNINSTALL_FLAG and WSL_SERVER_UNINSTALL_FLAG in
- ; src/main/startup/wsl-holder-uninstall-preflight.ts.
+ ; src/main/startup/uninstall/wsl-holder-uninstall-preflight.ts.
${if} $installMode == "all"
SetShellVarContext current
${endIf}
@@ -114,7 +114,7 @@
; app, but once that folder is removed every agent fails a hook per event, so the last Orca for
; this user takes the entries out. Another install, or an unreadable registry, keeps them.
; Best effort: the exit code never blocks uninstall.
- ; Sync the flag with AGENT_HOOKS_UNINSTALL_FLAG in src/main/startup/agent-hooks-uninstall-preflight.ts.
+ ; Sync the flag with AGENT_HOOKS_UNINSTALL_FLAG in src/main/startup/uninstall/agent-hooks-uninstall-preflight.ts.
!insertmacro ORCA_OTHER_INSTALL_STATE $1
${if} $1 == "none"
nsExec::Exec '"$INSTDIR\${APP_EXECUTABLE_FILENAME}" --orca-uninstall-remove-agent-hooks'
diff --git a/config/process-host-direct-import-baseline.txt b/config/process-host-direct-import-baseline.txt
index 2bc95ef8cd6..20cbf03e10b 100644
--- a/config/process-host-direct-import-baseline.txt
+++ b/config/process-host-direct-import-baseline.txt
@@ -1,18 +1,17 @@
# Existing production source files importing child_process at runtime outside @orca/process-host.
# Migration debt: this list may only shrink; new callers use the package public API.
-src/cli/handlers/core.ts
-src/cli/handlers/interactive-login-interruption.ts
+src/cli/runtime/cli-lifecycle-handlers.ts
+src/cli/accounts/interactive-login-interruption.ts
src/cli/runtime/launch.ts
src/main/agent-hooks/installation/locking/managed-hook-owner-identity.ts
src/main/ai-vault/scan-service/session-scanner-service-spawn.ts
src/main/window/desktop-integration/app-icon.ts
-src/main/automations/precheck-runner.ts
+src/main/automations/dispatch/precheck-runner.ts
src/main/browser/agent-browser/helper-process/agent-browser-bridge-execution.ts
src/main/browser/agent-browser/helper-process/agent-browser-bridge-raw-process.ts
src/main/browser/network/egress/browser-route-egress-electron-launch.ts
-src/main/codex-accounts/legacy-wsl-runtime-auth-drain-recovery-script-harness.ts
-src/main/codex-accounts/legacy-wsl-runtime-auth-drain-script-harness.ts
+src/main/codex-accounts/legacy-wsl-auth-drain/legacy-wsl-runtime-auth-drain-script-harness.ts
src/main/codex-accounts/service.ts
src/main/computer/desktop-script/desktop-script-provider-bridge.ts
src/main/computer/macos-permissions/macos-computer-use-permission-status.ts
@@ -28,18 +27,18 @@ src/main/emulator/serve-sim-runtime-materializer.ts
src/main/emulator/simctl-simulator-devices.ts
src/main/emulator/simulator-app-visibility.ts
src/main/external-editors/external-editor-launch.ts
-src/main/git/command-runner/exec-file-capture.ts
+src/main/git/command-runner/process-capture/exec-file-capture.ts
src/main/git/command-runner/git-exec-file-sync.ts
src/main/git/command-runner/git-spawn.ts
src/main/git/command-runner/git-stream-stdout.ts
-src/main/git/command-runner/spawn-command-capture.ts
-src/main/git/command-runner/spawned-command-tree-kill.ts
-src/main/git/command-runner/wsl-aware-spawn.ts
-src/main/git/wsl-git-read-environment.ts
-src/main/github/gh-utils.ts
+src/main/git/command-runner/process-capture/spawn-command-capture.ts
+src/main/git/command-runner/process-capture/spawned-command-tree-kill.ts
+src/main/git/command-runner/host-routing/wsl-aware-spawn.ts
+src/main/git/command-runner/host-routing/wsl-git-read-environment.ts
+src/main/github/execution/github-legacy-command.ts
src/main/workspace-hooks/hooks.ts
src/main/ipc/developer-permissions.ts
-src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.ts
+src/main/ipc/filesystem/watcher-process/child-lifecycle/parcel-watcher-child-launch.ts
src/main/ipc/local-network-connection-test.ts
src/main/ipc/macos-keyboard-input-source.ts
src/main/ipc/macos-keyboard-layout-snapshot.ts
@@ -51,13 +50,12 @@ src/main/macos-keychain/generic-password.ts
src/main/power/macos-system-sleep-assertion.ts
src/main/macos-permissions/macos-tcc-prompt-watch.ts
src/main/memory/collector.ts
-src/main/native-chat/wsl-transcript-fs-process-spawn.ts
+src/main/native-chat/transcript-filesystem/process/wsl-transcript-fs-process-spawn.ts
src/main/network/macos-system-resolver-health.ts
src/main/network/macos-tailscale-dns-diagnostic.ts
-src/main/plugins/workers/plugin-host-process.ts
+src/main/plugins/workers/parent-process/plugin-host-process.ts
src/main/plugins/catalog/plugin-private-marketplace-ssh-shim.cjs
src/main/ports/port-scan-command-execution.ts
-src/main/providers/macos-login-session-pty-probe.ts
src/main/providers/process-cwd.ts
src/main/pty/process-retirement/pty-descendant-fresh-table.ts
src/main/rate-limits/providers/gemini/gemini-cli-oauth-extractor.ts
@@ -67,7 +65,7 @@ src/main/ssh/system-transport/ssh-proxy-command.ts
src/main/ssh/system-transport/system-ssh-command.ts
src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.ts
src/main/ssh/system-transport/file-transfer/system-ssh-file-transfer.ts
-src/main/startup/ensure-virtual-display.ts
+src/main/startup/linux-display/ensure-virtual-display.ts
src/main/pty/process-retirement/windows-process-tree-kill.ts
src/main/pty/shell-startup/zsh-startup-hook-pty-harness.ts
src/shared/ephemeral-vm-recipe-process.ts
diff --git a/config/react-compiler-bailout-baseline.txt b/config/react-compiler-bailout-baseline.txt
index 7a85324765e..9f0ed930bc1 100644
--- a/config/react-compiler-bailout-baseline.txt
+++ b/config/react-compiler-bailout-baseline.txt
@@ -206,7 +206,6 @@
2 src/renderer/src/components/mobile/use-mobile-page-paired-devices.ts
1 src/renderer/src/components/mobile/use-mobile-pairing-generation.ts
1 src/renderer/src/components/native-chat-recovery/offers/native-chat-restart-runtimes.ts
-1 src/renderer/src/components/native-chat/NativeChatStructuredSession.tsx
8 src/renderer/src/components/native-chat/attachments/chips/use-native-chat-composer-attachments.ts
2 src/renderer/src/components/native-chat/attachments/intake/use-native-chat-resolved-path-attachments.ts
2 src/renderer/src/components/native-chat/composer/controls/NativeChatComposerToolbar.tsx
@@ -227,7 +226,6 @@
6 src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.ts
4 src/renderer/src/components/native-chat/messages/agent-senders/native-chat-agent-message-sender-source.ts
6 src/renderer/src/components/native-chat/messages/notices/use-structured-agent-session-start-failure-facts.ts
-1 src/renderer/src/components/native-chat/pane/actions/NativeChatCopyOrcaSessionIdMenuItem.tsx
1 src/renderer/src/components/native-chat/pane/actions/use-native-chat-hand-off.tsx
1 src/renderer/src/components/native-chat/pane/actions/use-native-chat-session-context-actions.tsx
1 src/renderer/src/components/native-chat/paste/native-chat-paste-destination.ts
@@ -634,7 +632,7 @@
1 src/renderer/src/components/terminal-pane/controller/TerminalPaneCodexRestartPortals.tsx
1 src/renderer/src/components/terminal-pane/controller/use-terminal-pane-context-actions.ts
3 src/renderer/src/components/terminal-pane/controller/use-terminal-pane-foundation.ts
-10 src/renderer/src/components/terminal-pane/controller/use-terminal-pane-projection.ts
+2 src/renderer/src/components/terminal-pane/controller/use-terminal-pane-projection.ts
3 src/renderer/src/components/terminal-pane/controller/use-terminal-pane-startup-actions.ts
1 src/renderer/src/components/terminal-pane/controller/use-terminal-pane-store-actions.ts
1 src/renderer/src/components/terminal-pane/errors/TerminalErrorToast.tsx
diff --git a/config/recurring-timer-baseline.txt b/config/recurring-timer-baseline.txt
index 8054472ea82..48ae549ed1e 100644
--- a/config/recurring-timer-baseline.txt
+++ b/config/recurring-timer-baseline.txt
@@ -3,17 +3,17 @@
# collector (file-wide). Not counted: destructuring off a global object, a self-rescheduling setTimeout (it must back off or pause while hidden).
# This is a RATCHET: counts may only go DOWN.
# Prune after removing intervals: pnpm check:recurring-timer-ratchet --prune
-1 src/cli/handlers/orchestration/check-keepalive.ts
+1 src/cli/orchestration/messages/check-keepalive.ts
1 src/cli/runtime/mac-app-update-bundle.ts
1 src/cli/runtime/serve-supervised-service.ts
1 src/main/agent-hooks/server/server-opencode-binder.ts
-1 src/main/automations/retained-run-reconciliation.ts
-1 src/main/automations/service.ts
+1 src/main/automations/observation/retained-run-reconciliation.ts
+1 src/main/automations/automation-service.ts
1 src/main/browser/extensions/native-messaging/browser-extension-native-ports.ts
1 src/main/browser/extensions/web-store/browser-extension-webstore-updater.ts
1 src/main/claude/agent-view/agent-view-bridge.ts
1 src/main/cli/appimage/appimage-serve-preparation.ts
-1 src/main/codex-accounts/codex-login-session.ts
+1 src/main/codex-accounts/login/codex-login-session.ts
1 src/main/codex/configuration/homes/codex-windows-sandbox-read-grant.ts
1 src/main/crash-reporting/memory/pre-gone-host-memory.ts
1 src/main/crash-reporting/process-exits/process-gone-diagnostics.ts
@@ -27,8 +27,8 @@
1 src/main/git/refs/maintenance/pack-refs-lock-ownership.ts
1 src/main/hang-watchdog/main-thread-hang-watchdog-entry.ts
1 src/main/hang-watchdog/main-thread-hang-watchdog.ts
-2 src/main/ipc/filesystem/watcher-process/parcel-watcher-shallow-file-subscription.ts
-1 src/main/ipc/filesystem/watcher-process/parcel-watcher-shallow-subscription.ts
+2 src/main/ipc/filesystem/watcher-process/native-subscriptions/parcel-watcher-shallow-file-subscription.ts
+1 src/main/ipc/filesystem/watcher-process/native-subscriptions/parcel-watcher-shallow-subscription.ts
1 src/main/ipc/runtime-environments/runtime-environment-preference.ts
1 src/main/ipc/worktrees/git/worktree-git-common-narrow-watch.ts
1 src/main/ipc/worktrees/git/worktree-git-common-native-upgrade-poll.ts
@@ -38,10 +38,10 @@
1 src/main/native-chat/agent-session-wire/recovery/structured-agent-session-usage-limit-continue.ts
1 src/main/native-chat/agent-session-wire/termination/structured-agent-session-idle-sweep.ts
1 src/main/notifications/desktop-presence-reporter.ts
-1 src/main/orcad/orcad-browser-install-park.ts
-1 src/main/orcad/orcad-event-loop-watchdog.ts
-1 src/main/orcad/orcad-lock-clone-machine.ts
-1 src/main/orcad/orcad-stop-request-listener.ts
+1 src/main/orcad/browser-providers/orcad-browser-install-park.ts
+1 src/main/orcad/diagnostics/orcad-event-loop-watchdog.ts
+1 src/main/orcad/instance-lock/orcad-lock-clone-machine.ts
+1 src/main/orcad/host-lifecycle/managed-stop/orcad-stop-request-listener.ts
1 src/main/plugins/catalog/plugin-auto-updater.ts
1 src/main/plugins/catalog/plugin-kill-list-service.ts
1 src/main/plugins/installation/plugin-git-repository.ts
@@ -49,13 +49,13 @@
1 src/main/rate-limits/service/service-polling.ts
1 src/main/runtime/agent-state-rules/agent-state-rules-live-update.ts
1 src/main/runtime/mobile-cloud-relay/desktop-relay-service.ts
-3 src/main/runtime/mobile-cloud-relay/relay-control-liveness.ts
+3 src/main/runtime/mobile-cloud-relay/control-channel/relay-control-liveness.ts
1 src/main/runtime/rpc/methods/orchestration/messaging/check-run.ts
-1 src/main/runtime/rpc/mobile-socket-wiring.ts
-1 src/main/runtime/rpc/remote-runtime-server-heartbeat.ts
+1 src/main/runtime/rpc/mobile/mobile-socket-wiring.ts
+1 src/main/runtime/rpc/transports/websocket/remote-runtime-server-heartbeat.ts
1 src/main/runtime/rpc/server/runtime-metadata-ownership-watch.ts
-1 src/main/runtime/rpc/unix-socket-transport.ts
-1 src/main/runtime/sidebar-inputs/paired-server-rows-producer.ts
+1 src/main/runtime/rpc/transports/unix-socket-transport.ts
+1 src/main/runtime/sidebar-inputs/workspace-rows/paired-server-rows-producer.ts
1 src/main/runtime/terminal/input/agent-prompt-permission-hold.ts
1 src/main/runtime/terminal/output/terminal-derived-agent-facts.ts
1 src/main/runtime/terminal/wait/terminal-idle-polls.ts
@@ -64,8 +64,8 @@
1 src/main/ssh/port-forwarding/ssh-tcp-forwarding-probe.ts
1 src/main/ssh/protocol/ssh-channel-multiplexer.ts
1 src/main/startup/configure-process.ts
-1 src/main/startup/event-loop-stall-probe.ts
-1 src/main/startup/synthetic-title-runtime.ts
+1 src/main/startup/diagnostics/event-loop-stall-probe.ts
+1 src/main/startup/main-window/synthetic-title-runtime.ts
1 src/main/telemetry/wsl-usage-reporter.ts
1 src/main/wsl/host-lifecycle/wsl-hosts-policy-live-update.ts
1 src/main/wsl/orcad/wsl-orcad-connect-stop-fence.ts
diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc
index 37ace49618b..9eee6b4d2be 100644
--- a/config/reliability-gates.jsonc
+++ b/config/reliability-gates.jsonc
@@ -454,29 +454,25 @@
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime", "mobile-relay"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
- "coverageNotes": "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The broad mobile runner loses retired-name sequencing and PR action samples while retaining the editor-lifetime and original PR action keeper; commit-message generation is unchanged. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. The broad mobile command loses the entire three-case mocked diff-review controller suite and the stale layout-sequence comparator sample. Keep only the direct layout-versus-scrollback counter distinction; the unchanged dictation retry hook retains complete recording replay. No rendered app, native capture, actual process death or remote execution is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad mobile discovery loses whole prompt-presentation, Jira-URL and folder-source-repository suites. The prompt suite exercised presentation projections; it did not provide native mobile prompt acknowledgment acceptance. Existing direct prompt-controller selectors are unchanged. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The stale-leaf-liveness suite and its exact command/testFiles selector are removed; its fake terminal refusal/liveness alarms are intentionally lost. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The entire mocked mobile failure-banner suite and its sole send/previous-banner/new-notice ordering alarm are retired. Its filenames are removed from active selectors. Desktop prompt roots and the independent unchanged terminal wire-codec receipt remain at their stated scopes; no mobile send/recovery proof is claimed. Audit2251 narrows agent-paste-draft.test.ts from 25 authored cases (26 literal cases) to four. Retained cases cover buffered readiness on PTY binding, separate spawn/composer lifetimes, real per-PTY paste/Enter serialization against a competing paste, and frame closure/no Enter after a rejected content chunk. Intentionally lost alarms include agent marker and fallback examples, direct-write failure/rejection, missing-PTY and Codex process-only timeout paths, exact nonprimary-PTY routing, full large-body chunk reconstruction, escaping/CRLF samples, internal laziness/yield work assertions, oversized preflight refusal, and exact configured delay/budget counts. No equivalent replacement, new execution, real PTY/provider delivery, rendered/native UI, deployment, measured performance or cross-platform result is claimed. Historical prior account (preserved verbatim): Mobile owner-layout policy retires whole tests and mixed registrations without equivalent replacement coverage. Retained callbacks and reduced selectors need fresh execution at their stated scope; prior measurements do not validate them. Affected sources: mobile/src/session/mobile-prompt-controller.test.ts, tests/e2e/native-chat-ssh-delivery.unit.test.ts, mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts, mobile/src/session/native-chat/input/use-mobile-native-chat-cancel-ask.test.ts, mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts, mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts. Historical scope: Audit2003: Remove agent-prompt absence routing, throwing/live/missing-probe and cached-probe-count examples from the stale-leaf source. Controller-proven absence, unknown-liveness admission, obsolete-absence clearing and same-ID respawn fences remain at a supplied provider/row seam. Preserve the independent wire-codec receipt only in its original scope. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove partial-runtime terminal-send guard/status/floor/query projection and argument-inventory samples. Retained RPC viewport admission, authenticated-client spoof refusal, text admission and stale-binding fences remain bounded mock-boundary behavior. The unchanged wire-codec receipt remains valid only for its original command; it does not validate this reduced RPC selector. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1908 removes the complete prompt-presentation hook and literal interactive-protocol mapping suites and narrows the interactive card and prompt-card input suites. Lost alarms include replacement approval A settling after answered B; collapse/expand composer ownership and partial-answer presentation; identical new waits after an unmounted view; collapsed transcript re-reads; answered/dismissed status-backed persistence and retirement; and literal answer-to-PTY byte arrays. The retained stale-PTY acknowledgment, cancellation/answer retry, and answered-approval remount/rebind assertions remain meaningful but are not equivalent replacement coverage. No fresh reduced-selector result, physical provider, rendered/native-focus, mixed-version deployment, soak, or measured-budget validation is claimed. The unchanged wire-codec receipt remains valid only for its exact command. Historical prior account (preserved verbatim): Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1471 removes the entire interactive-send hook suite. Its mock-writer routing, cancellation-handle, option-digit, interrupt, supplied settlement and inference-argument alarms are retired. No actual PTY bytes, replacement question lifetime or agent delivery were exercised. No equivalent replacement or fresh execution of the reduced reliability selector is claimed; historical receipts retain their original scope. Audit1468 removes the entire runtime-send suite. Its mock PTY clear/body/Enter byte-order, nominal timing, queue cancellation/serialization, attachment escaping, key-group pacing and deferred acceptance callback alarms are intentionally retired. No actual receiving agent or physical terminal delivery was exercised. No equivalent replacement or fresh execution of the reduced reliability selector is claimed; historical receipts retain their original scope. Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally reduces src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts: Loses configured retry gap and single-Enter agent selection alarms alongside forbidden timer-count checks. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1383 changes referenced sources; no new execution result validates reduced selectors. Retained unchanged receipts apply only to unchanged commands. Historical coverage: Audits1340 and1348 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1316 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Production mobile controller, parser, presentation, overlay, view, question, permission and composer run with native surfaces mocked on macOS. Desktop selector groups traverse the real observed-write queue, verified helper, IPC chunker, SSH provider and transport callbacks; paired sends traverse the real dispatcher and runtime writer into that provider. Local/daemon contracts and released-version terminal codecs are covered. Provider labels describe contracts, not physical deployments; physical WSL/Linux/Windows remain gaps. Audit885 removes the isolated observed-send mock-call suite; no replacement-equivalence claim is made. Audit1107 removes the small healthy ordinary SSH-send byte/callback sample. Its exact clear/body/Enter sample alarm is lost; retained slow-answer, cancellation and simulated older-host sequence checks are not claimed as equivalent replacement coverage. The SSH delivery fixture uses controlled fake provider settlement, and its paired path uses the real runtime/dispatcher without a physical SSH or paired wire transport. Audit1278 removes the mobile Stop display/disabled/placeholder suite; its local Stop presentation, repeat-stop and dispatch-visibility alarms are intentionally lost. No equivalent replacement or runtime stopping proof is claimed. Audit1292: The blind OpenCode readiness warning and late launch success/failure content-plus-submit write samples are removed. Their mocked readiness/inspection/delivery alarms are lost; no real PTY delivery or equivalent replacement coverage is claimed. Audit1294 removes mobile/src/session/native-chat/input/mobile-native-chat-permission-send.test.ts. Its mock-only request/capability/private-state/copy alarms are intentionally lost. Remaining tests are not equivalent replacement coverage. Narrowed commands require fresh parent-owned validation; no new runtime, platform or physical mobile evidence is claimed. Audit1302: src/main/ipc/pty/ipc/write-input-acceptance.test.ts: Provider registry and write acceptance/refusal/unverifiable receipts are supplied by fixture; local/daemon/WSL/SSH labels use the same fake provider. Chunking/settlement/remount cases inspect delegated calls or canned receipts without actual provider acceptance/acknowledgement. Lose chunk/refusal/pending/remount and raw-pane routing alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1303 intentionally removes supplied-state/mock-callback component and hook examples in mobile/src/session/native-chat/input/use-mobile-native-chat-ask-dismiss.test.ts, mobile/src/session/native-chat/input/MobileNativeChatPromptCard.test.tsx. Their exact retired alarms are not equivalent to retained coverage; no new runtime, physical phone or deployed mixed-version evidence is claimed. Audit1310 removes the supplied-geometry/direct-callback chat history-paging suite. Its prepend/scroll-position examples are intentionally lost; no real rendered anchoring, equivalent replacement or physical phone proof is claimed. Narrowed commands need fresh validation. Audit1315 removes/narrows mobile/src/session/native-chat/MobileNativeChatView.composer-lock.test.ts, mobile/src/session/native-chat/MobileNativeChatView.prompt-presentation.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1316: src/renderer/src/lib/agent-followup-delivery.test.ts removed. Interpreter wrapper/live child/shell readiness and final readiness recheck delivery mock samples lose alarms. No equivalent replacement coverage is claimed. Audit1322 removes/narrows mobile/src/session/native-chat/MobileNativeChatView.tail-follow.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1341 scope1334 removes/narrows mobile/src/session/native-chat/mobile-native-chat-send.test.ts, mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1341 scope1335 removes/narrows mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts, mobile/src/session/mobile-prompt-controller.test.ts, mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1340: src/main/daemon/daemon-pty-write-settlement-recovery.test.ts removed. Ambiguous handoff settlement remains unverifiable when listener throws. No equivalent replacement coverage is claimed. Audit1348: src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts removed. Check-phase yielding and no-yield single-chunk scheduling work. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1383: src/main/ipc/pty/ipc/write-input-user-input.test.ts reduced. Lose admission provenance spy, direct local Escape write outcome matrix and separate client-side SSH no-evidence control. Provider writes mocked; retained tests protect observation order/facts only. No equivalent replacement coverage is claimed. Audit1401: src/main/ipc/pty/ipc/write-input-user-input.test.ts reduced. Loses local-only post-accept observation and refused/unverifiable settlement delivery alarms. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts removed. Intentionally loses clear-confirmation/body/submit and maximal-clear ordering, queued text/image send ordering, ordinary cursor-spanning draft replacement and oversized refusal/queue settlement alarms. No equivalent replacement or real terminal delivery claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1426 removes NativeChatComposer.test.tsx. Local pane-remount, draft/cancel/confirmation sequencing and manual IME callback alarms are lost. No equivalent replacement coverage or provider delivery is claimed; historical receipts retain their original scope and the reduced selector has no new execution result. Audit2450 removes the MobileNativeChatView failure-banner callback-only example whose old banner is supplied unchanged by its props. Retain fatal-read gating and the ordering test that preserves a new delivery notice. The removed false-send/old-banner combination has no equivalent replacement; prior raw receipts and budgets retain their original source scope. No new soak, platform, performance or red/green claim.",
+ "coverageNotes": "Audit3984 retires all four remaining viewport-fixture suites (14 authored/15 finite cases) and the fixture after composing the sender-host deletion. Accepted source-alarm losses include live-region/disclosure continuity, task/question/approval history and revision handling, stale turn status, prompt-dismissal remount/rebind, and pending-send cancellation when approval arrives between body and Enter. No equivalent replacement or fresh runtime validation is claimed. Audits3764/3766 retire16 authored/27 expanded mobile cases, including entire HTML-image syntax, Mermaid routing, table styles, file-query encoding, workspace naming and fresh-Git-status adapter suites. Accepted losses include image width/icon filtering, partial-heading streaming, mocked Mermaid key/identity checks, generated table widths/counts, selected-text caret placement, tiny Base64 chunk encoding, twelve query-path roundtrips, locale-import fallback, apostrophe slugging, fresh-status fallback and an intermediate reviewed marker. These are deliberate removals for marginal value; remaining tests are not equivalent replacements. Earlier receipts are historical and do not validate these deleted/reduced drivers. Audit3748 intentionally removes ten authored/ten finite registrations from the surviving media-handle-registry.test.ts driver selected by this full-mobile command. Retired real alarms: nominal minted handle uniqueness/metadata and dimensions; ordinary range/EOF/overread/empty-file/direct chunk-clamp samples; nominal successful release, expired-release false, exact millisecond TTL boundary and ordinary releaseAll replay. Deterministic registry code runs; these examples are removed on marginal value without replacement or fresh execution claims. Seven owner cases retain cap refusal/disposal and sweep-before-admission, nonempty EOF and unknown/released/expired refusal, read TTL refresh, idempotent explicit release and continuation after discard failure. Existing commands, assertions, unrelated wire receipt and timing remain; the driver survives. Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered mobile Vitest command. Its mobile/src include patterns admit the partial live-input-commit and native-media drivers:5 authored/5 finite removals. Accepted losses: two Android-labeled replay samples after mocked composition conversion, an immediate Backspace absence check that does not wait for pending commit or prove local edit, and released-handle/double-release adapter examples. Real hook, registry and adapter logic run; no equivalent replacement or native Android/iOS exercise is claimed. Both drivers and selector stay. The unchanged wire-specific dated receipt does not validate these reduced mobile sources. Audit3666 removes30 authored/36 finite mobile cases, including7 whole drivers. It retires direct consent/channel/token/header-payload/fingerprint/route-object inventories, background legacy-dismissal filtering, the two-row520-entry watermark retention workload, reentrant write-batch example, font-before-ready projection, and legacy-segmenter/scrollback/wrap selection examples. Actual policy, parsing, hashing, tray matching, serialization and xterm buffers execute in these tests; their stated alarms are deliberately lost without replacement. Twelve unchanged authored/19 finite cases retain compact browser geometry regressions, an independent fingerprint-to-host protocol vector, serialized watermark/reload isolation, OSC52 live/replay gating, queue boundaries/reset/generation, disposed font completion and Unicode cell mapping. Pairing classification2/2 was already approved by3657 and receives no3666 delta or credit. Static review only; no runtime, native, provider, browser rendering, OS, remote, mobile/folder parity or new historical fault evidence. Previous account (preserved verbatim): Audit3663 removes the complete mobile scan-error message suite (two authored/two finite callbacks). Its4URL assertion loop is one registration. Accept loss of Orca new/legacy Android-download URL classification and other-page invalid-code translated-key mapping. Real URL parsing/classification runs, but the only output observed is an identity-translator key. No camera scan, pairing offer admission, connection or device/UI action is exercised. No equivalent replacement or physical/mobile/mixed-version result claimed. Preserve all historical evidence and metadata bytes. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The broad mobile runner loses retired-name sequencing and PR action samples while retaining the editor-lifetime and original PR action keeper; commit-message generation is unchanged. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. The broad mobile command loses the entire three-case mocked diff-review controller suite and the stale layout-sequence comparator sample. Keep only the direct layout-versus-scrollback counter distinction; the unchanged dictation retry hook retains complete recording replay. No rendered app, native capture, actual process death or remote execution is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad mobile discovery loses whole prompt-presentation, Jira-URL and folder-source-repository suites. The prompt suite exercised presentation projections; it did not provide native mobile prompt acknowledgment acceptance. Existing direct prompt-controller selectors are unchanged. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The stale-leaf-liveness suite and its exact command/testFiles selector are removed; its fake terminal refusal/liveness alarms are intentionally lost. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The entire mocked mobile failure-banner suite and its sole send/previous-banner/new-notice ordering alarm are retired. Its filenames are removed from active selectors. Desktop prompt roots and the independent unchanged terminal wire-codec receipt remain at their stated scopes; no mobile send/recovery proof is claimed. Audit2251 narrows agent-paste-draft.test.ts from 25 authored cases (26 literal cases) to four. Retained cases cover buffered readiness on PTY binding, separate spawn/composer lifetimes, real per-PTY paste/Enter serialization against a competing paste, and frame closure/no Enter after a rejected content chunk. Intentionally lost alarms include agent marker and fallback examples, direct-write failure/rejection, missing-PTY and Codex process-only timeout paths, exact nonprimary-PTY routing, full large-body chunk reconstruction, escaping/CRLF samples, internal laziness/yield work assertions, oversized preflight refusal, and exact configured delay/budget counts. No equivalent replacement, new execution, real PTY/provider delivery, rendered/native UI, deployment, measured performance or cross-platform result is claimed. Historical prior account (preserved verbatim): Mobile owner-layout policy retires whole tests and mixed registrations without equivalent replacement coverage. Retained callbacks and reduced selectors need fresh execution at their stated scope; prior measurements do not validate them. Affected sources: mobile/src/session/mobile-prompt-controller.test.ts, tests/e2e/native-chat-ssh-delivery.unit.test.ts, mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts, mobile/src/session/native-chat/input/use-mobile-native-chat-cancel-ask.test.ts, mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts, mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts. Historical scope: Audit2003: Remove agent-prompt absence routing, throwing/live/missing-probe and cached-probe-count examples from the stale-leaf source. Controller-proven absence, unknown-liveness admission, obsolete-absence clearing and same-ID respawn fences remain at a supplied provider/row seam. Preserve the independent wire-codec receipt only in its original scope. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove partial-runtime terminal-send guard/status/floor/query projection and argument-inventory samples. Retained RPC viewport admission, authenticated-client spoof refusal, text admission and stale-binding fences remain bounded mock-boundary behavior. The unchanged wire-codec receipt remains valid only for its original command; it does not validate this reduced RPC selector. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1908 removes the complete prompt-presentation hook and literal interactive-protocol mapping suites and narrows the interactive card and prompt-card input suites. Lost alarms include replacement approval A settling after answered B; collapse/expand composer ownership and partial-answer presentation; identical new waits after an unmounted view; collapsed transcript re-reads; answered/dismissed status-backed persistence and retirement; and literal answer-to-PTY byte arrays. The retained stale-PTY acknowledgment, cancellation/answer retry, and answered-approval remount/rebind assertions remain meaningful but are not equivalent replacement coverage. No fresh reduced-selector result, physical provider, rendered/native-focus, mixed-version deployment, soak, or measured-budget validation is claimed. The unchanged wire-codec receipt remains valid only for its exact command. Historical prior account (preserved verbatim): Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1471 removes the entire interactive-send hook suite. Its mock-writer routing, cancellation-handle, option-digit, interrupt, supplied settlement and inference-argument alarms are retired. No actual PTY bytes, replacement question lifetime or agent delivery were exercised. No equivalent replacement or fresh execution of the reduced reliability selector is claimed; historical receipts retain their original scope. Audit1468 removes the entire runtime-send suite. Its mock PTY clear/body/Enter byte-order, nominal timing, queue cancellation/serialization, attachment escaping, key-group pacing and deferred acceptance callback alarms are intentionally retired. No actual receiving agent or physical terminal delivery was exercised. No equivalent replacement or fresh execution of the reduced reliability selector is claimed; historical receipts retain their original scope. Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally reduces src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts: Loses configured retry gap and single-Enter agent selection alarms alongside forbidden timer-count checks. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1383 changes referenced sources; no new execution result validates reduced selectors. Retained unchanged receipts apply only to unchanged commands. Historical coverage: Audits1340 and1348 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1316 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Production mobile controller, parser, presentation, overlay, view, question, permission and composer run with native surfaces mocked on macOS. Desktop selector groups traverse the real observed-write queue, verified helper, IPC chunker, SSH provider and transport callbacks; paired sends traverse the real dispatcher and runtime writer into that provider. Local/daemon contracts and released-version terminal codecs are covered. Provider labels describe contracts, not physical deployments; physical WSL/Linux/Windows remain gaps. Audit885 removes the isolated observed-send mock-call suite; no replacement-equivalence claim is made. Audit1107 removes the small healthy ordinary SSH-send byte/callback sample. Its exact clear/body/Enter sample alarm is lost; retained slow-answer, cancellation and simulated older-host sequence checks are not claimed as equivalent replacement coverage. The SSH delivery fixture uses controlled fake provider settlement, and its paired path uses the real runtime/dispatcher without a physical SSH or paired wire transport. Audit1278 removes the mobile Stop display/disabled/placeholder suite; its local Stop presentation, repeat-stop and dispatch-visibility alarms are intentionally lost. No equivalent replacement or runtime stopping proof is claimed. Audit1292: The blind OpenCode readiness warning and late launch success/failure content-plus-submit write samples are removed. Their mocked readiness/inspection/delivery alarms are lost; no real PTY delivery or equivalent replacement coverage is claimed. Audit1294 removes mobile/src/session/native-chat/input/mobile-native-chat-permission-send.test.ts. Its mock-only request/capability/private-state/copy alarms are intentionally lost. Remaining tests are not equivalent replacement coverage. Narrowed commands require fresh parent-owned validation; no new runtime, platform or physical mobile evidence is claimed. Audit1302: src/main/ipc/pty/ipc/write-input-acceptance.test.ts: Provider registry and write acceptance/refusal/unverifiable receipts are supplied by fixture; local/daemon/WSL/SSH labels use the same fake provider. Chunking/settlement/remount cases inspect delegated calls or canned receipts without actual provider acceptance/acknowledgement. Lose chunk/refusal/pending/remount and raw-pane routing alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1303 intentionally removes supplied-state/mock-callback component and hook examples in mobile/src/session/native-chat/input/use-mobile-native-chat-ask-dismiss.test.ts, mobile/src/session/native-chat/input/MobileNativeChatPromptCard.test.tsx. Their exact retired alarms are not equivalent to retained coverage; no new runtime, physical phone or deployed mixed-version evidence is claimed. Audit1310 removes the supplied-geometry/direct-callback chat history-paging suite. Its prepend/scroll-position examples are intentionally lost; no real rendered anchoring, equivalent replacement or physical phone proof is claimed. Narrowed commands need fresh validation. Audit1315 removes/narrows mobile/src/session/native-chat/MobileNativeChatView.composer-lock.test.ts, mobile/src/session/native-chat/MobileNativeChatView.prompt-presentation.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1316: src/renderer/src/lib/agent-followup-delivery.test.ts removed. Interpreter wrapper/live child/shell readiness and final readiness recheck delivery mock samples lose alarms. No equivalent replacement coverage is claimed. Audit1322 removes/narrows mobile/src/session/native-chat/MobileNativeChatView.tail-follow.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1341 scope1334 removes/narrows mobile/src/session/native-chat/mobile-native-chat-send.test.ts, mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1341 scope1335 removes/narrows mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts, mobile/src/session/mobile-prompt-controller.test.ts, mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1340: src/main/daemon/daemon-pty-write-settlement-recovery.test.ts removed. Ambiguous handoff settlement remains unverifiable when listener throws. No equivalent replacement coverage is claimed. Audit1348: src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts removed. Check-phase yielding and no-yield single-chunk scheduling work. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1383: src/main/ipc/pty/ipc/write-input-user-input.test.ts reduced. Lose admission provenance spy, direct local Escape write outcome matrix and separate client-side SSH no-evidence control. Provider writes mocked; retained tests protect observation order/facts only. No equivalent replacement coverage is claimed. Audit1401: src/main/ipc/pty/ipc/write-input-user-input.test.ts reduced. Loses local-only post-accept observation and refused/unverifiable settlement delivery alarms. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts removed. Intentionally loses clear-confirmation/body/submit and maximal-clear ordering, queued text/image send ordering, ordinary cursor-spanning draft replacement and oversized refusal/queue settlement alarms. No equivalent replacement or real terminal delivery claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1426 removes NativeChatComposer.test.tsx. Local pane-remount, draft/cancel/confirmation sequencing and manual IME callback alarms are lost. No equivalent replacement coverage or provider delivery is claimed; historical receipts retain their original scope and the reduced selector has no new execution result. Audit2450 removes the MobileNativeChatView failure-banner callback-only example whose old banner is supplied unchanged by its props. Retain fatal-read gating and the ordering test that preserves a new delivery notice. The removed false-send/old-banner combination has no equivalent replacement; prior raw receipts and budgets retain their original source scope. No new soak, platform, performance or red/green claim.",
"motivatingLinks": ["https://github.com/stablyai/orca/pull/25761"],
"invariant": "A prompt occurrence leaves the input region only when an accepted reply answers it (a current host's provider acknowledgment, or an older host's whole-write acceptance as before) or the user collapses it to a strip above the composer, which writes nothing and keeps the card mounted with its partial answer; status-backed occurrences are told apart by the host wait's start, so view toggles and remounts preserve them while real clear/replacement supersedes them, and a transcript-only one is dropped when the view stops observing it; obsolete results cannot change replacements; selector groups wait for complete writes before pacing; refusal or unknown handoff never causes replay; a card retires an unsubmitted composer send without writing under it or losing its text, and the hidden composer cannot send or interrupt; Collapse or Escape folds a card without writing, never during an in-flight answer, and a new occurrence shows expanded again; the phone blocks only Send while a card is expanded and shows one card per occurrence; cancellation stops unsent groups and active dictation can stop.",
- "oracle": "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The broad mobile runner loses retired-name sequencing and PR action samples while retaining the editor-lifetime and original PR action keeper; commit-message generation is unchanged. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. The broad mobile command loses the entire three-case mocked diff-review controller suite and the stale layout-sequence comparator sample. Keep only the direct layout-versus-scrollback counter distinction; the unchanged dictation retry hook retains complete recording replay. No rendered app, native capture, actual process death or remote execution is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad mobile discovery loses whole prompt-presentation, Jira-URL and folder-source-repository suites. The prompt suite exercised presentation projections; it did not provide native mobile prompt acknowledgment acceptance. Existing direct prompt-controller selectors are unchanged. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The stale-leaf-liveness suite and its exact command/testFiles selector are removed; its fake terminal refusal/liveness alarms are intentionally lost. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The entire mocked mobile failure-banner suite and its sole send/previous-banner/new-notice ordering alarm are retired. Its filenames are removed from active selectors. Desktop prompt roots and the independent unchanged terminal wire-codec receipt remain at their stated scopes; no mobile send/recovery proof is claimed. Audit2251 narrows agent-paste-draft.test.ts from 25 authored cases (26 literal cases) to four. Retained cases cover buffered readiness on PTY binding, separate spawn/composer lifetimes, real per-PTY paste/Enter serialization against a competing paste, and frame closure/no Enter after a rejected content chunk. Intentionally lost alarms include agent marker and fallback examples, direct-write failure/rejection, missing-PTY and Codex process-only timeout paths, exact nonprimary-PTY routing, full large-body chunk reconstruction, escaping/CRLF samples, internal laziness/yield work assertions, oversized preflight refusal, and exact configured delay/budget counts. No equivalent replacement, new execution, real PTY/provider delivery, rendered/native UI, deployment, measured performance or cross-platform result is claimed. Historical prior account (preserved verbatim): Mobile owner-layout policy retires whole tests and mixed registrations without equivalent replacement coverage. Retained callbacks and reduced selectors need fresh execution at their stated scope; prior measurements do not validate them. Historical oracle: Audit2003: Remove agent-prompt absence routing, throwing/live/missing-probe and cached-probe-count examples from the stale-leaf source. Controller-proven absence, unknown-liveness admission, obsolete-absence clearing and same-ID respawn fences remain at a supplied provider/row seam. Preserve the independent wire-codec receipt only in its original scope. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove partial-runtime terminal-send guard/status/floor/query projection and argument-inventory samples. Retained RPC viewport admission, authenticated-client spoof refusal, text admission and stale-binding fences remain bounded mock-boundary behavior. The unchanged wire-codec receipt remains valid only for its original command; it does not validate this reduced RPC selector. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1908 removes the complete prompt-presentation hook and literal interactive-protocol mapping suites and narrows the interactive card and prompt-card input suites. Lost alarms include replacement approval A settling after answered B; collapse/expand composer ownership and partial-answer presentation; identical new waits after an unmounted view; collapsed transcript re-reads; answered/dismissed status-backed persistence and retirement; and literal answer-to-PTY byte arrays. The retained stale-PTY acknowledgment, cancellation/answer retry, and answered-approval remount/rebind assertions remain meaningful but are not equivalent replacement coverage. No fresh reduced-selector result, physical provider, rendered/native-focus, mixed-version deployment, soak, or measured-budget validation is claimed. The unchanged wire-codec receipt remains valid only for its exact command. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Retained unchanged-selector receipts are the only current execution evidence. Reduced-source assertions await validation. Historical prior oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): After acknowledged phone replies with stale host status, the exact card disappears and Send is enabled; unknown, refused or unverifiable-settlement replies retain enabled choices, while an older host's accepted reply dismisses like an acknowledged one; a same-occurrence view toggle retains pending acknowledgment and real replacements discard it. A slow 32 KiB SSH answer completes all chunks before Enter; cancellation preserves issued bytes but omits remaining groups. Paired settlement invokes the actual provider and lost callbacks remain unknown; older hosts deliver ordinary messages, launch and selector groups once and their accepted answers dismiss as before. An answered card stays hidden across a view remount; a collapsed card is a strip that frees the composer and expands back; an identical question in a new wait shows again; a composer send caught by a new card keeps its bubble without submitting or clearing the line under it. Audit2450 removes the MobileNativeChatView failure-banner callback-only example whose old banner is supplied unchanged by its props. Retain fatal-read gating and the ordering test that preserves a new delivery notice. The removed false-send/old-banner combination has no equivalent replacement; prior raw receipts and budgets retain their original source scope. No new soak, platform, performance or red/green claim.",
+ "oracle": "Audits3764/3766 retire16 authored/27 expanded mobile cases, including entire HTML-image syntax, Mermaid routing, table styles, file-query encoding, workspace naming and fresh-Git-status adapter suites. Accepted losses include image width/icon filtering, partial-heading streaming, mocked Mermaid key/identity checks, generated table widths/counts, selected-text caret placement, tiny Base64 chunk encoding, twelve query-path roundtrips, locale-import fallback, apostrophe slugging, fresh-status fallback and an intermediate reviewed marker. These are deliberate removals for marginal value; remaining tests are not equivalent replacements. Earlier receipts are historical and do not validate these deleted/reduced drivers. Audit3748 intentionally removes ten authored/ten finite registrations from the surviving media-handle-registry.test.ts driver selected by this full-mobile command. Retired real alarms: nominal minted handle uniqueness/metadata and dimensions; ordinary range/EOF/overread/empty-file/direct chunk-clamp samples; nominal successful release, expired-release false, exact millisecond TTL boundary and ordinary releaseAll replay. Deterministic registry code runs; these examples are removed on marginal value without replacement or fresh execution claims. Seven owner cases retain cap refusal/disposal and sweep-before-admission, nonempty EOF and unknown/released/expired refusal, read TTL refresh, idempotent explicit release and continuation after discard failure. Existing commands, assertions, unrelated wire receipt and timing remain; the driver survives. Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered mobile Vitest command. Its mobile/src include patterns admit the partial live-input-commit and native-media drivers:5 authored/5 finite removals. Accepted losses: two Android-labeled replay samples after mocked composition conversion, an immediate Backspace absence check that does not wait for pending commit or prove local edit, and released-handle/double-release adapter examples. Real hook, registry and adapter logic run; no equivalent replacement or native Android/iOS exercise is claimed. Both drivers and selector stay. The unchanged wire-specific dated receipt does not validate these reduced mobile sources. Audit3666 removes30 authored/36 finite mobile cases, including7 whole drivers. It retires direct consent/channel/token/header-payload/fingerprint/route-object inventories, background legacy-dismissal filtering, the two-row520-entry watermark retention workload, reentrant write-batch example, font-before-ready projection, and legacy-segmenter/scrollback/wrap selection examples. Actual policy, parsing, hashing, tray matching, serialization and xterm buffers execute in these tests; their stated alarms are deliberately lost without replacement. Twelve unchanged authored/19 finite cases retain compact browser geometry regressions, an independent fingerprint-to-host protocol vector, serialized watermark/reload isolation, OSC52 live/replay gating, queue boundaries/reset/generation, disposed font completion and Unicode cell mapping. Pairing classification2/2 was already approved by3657 and receives no3666 delta or credit. Static review only; no runtime, native, provider, browser rendering, OS, remote, mobile/folder parity or new historical fault evidence. Previous oracle (preserved verbatim): Audit3663 removes the complete mobile scan-error message suite (two authored/two finite callbacks). Its4URL assertion loop is one registration. Accept loss of Orca new/legacy Android-download URL classification and other-page invalid-code translated-key mapping. Real URL parsing/classification runs, but the only output observed is an identity-translator key. No camera scan, pairing offer admission, connection or device/UI action is exercised. No equivalent replacement or physical/mobile/mixed-version result claimed. Preserve all historical evidence and metadata bytes. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The broad mobile runner loses retired-name sequencing and PR action samples while retaining the editor-lifetime and original PR action keeper; commit-message generation is unchanged. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. The broad mobile command loses the entire three-case mocked diff-review controller suite and the stale layout-sequence comparator sample. Keep only the direct layout-versus-scrollback counter distinction; the unchanged dictation retry hook retains complete recording replay. No rendered app, native capture, actual process death or remote execution is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad mobile discovery loses whole prompt-presentation, Jira-URL and folder-source-repository suites. The prompt suite exercised presentation projections; it did not provide native mobile prompt acknowledgment acceptance. Existing direct prompt-controller selectors are unchanged. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The stale-leaf-liveness suite and its exact command/testFiles selector are removed; its fake terminal refusal/liveness alarms are intentionally lost. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The entire mocked mobile failure-banner suite and its sole send/previous-banner/new-notice ordering alarm are retired. Its filenames are removed from active selectors. Desktop prompt roots and the independent unchanged terminal wire-codec receipt remain at their stated scopes; no mobile send/recovery proof is claimed. Audit2251 narrows agent-paste-draft.test.ts from 25 authored cases (26 literal cases) to four. Retained cases cover buffered readiness on PTY binding, separate spawn/composer lifetimes, real per-PTY paste/Enter serialization against a competing paste, and frame closure/no Enter after a rejected content chunk. Intentionally lost alarms include agent marker and fallback examples, direct-write failure/rejection, missing-PTY and Codex process-only timeout paths, exact nonprimary-PTY routing, full large-body chunk reconstruction, escaping/CRLF samples, internal laziness/yield work assertions, oversized preflight refusal, and exact configured delay/budget counts. No equivalent replacement, new execution, real PTY/provider delivery, rendered/native UI, deployment, measured performance or cross-platform result is claimed. Historical prior account (preserved verbatim): Mobile owner-layout policy retires whole tests and mixed registrations without equivalent replacement coverage. Retained callbacks and reduced selectors need fresh execution at their stated scope; prior measurements do not validate them. Historical oracle: Audit2003: Remove agent-prompt absence routing, throwing/live/missing-probe and cached-probe-count examples from the stale-leaf source. Controller-proven absence, unknown-liveness admission, obsolete-absence clearing and same-ID respawn fences remain at a supplied provider/row seam. Preserve the independent wire-codec receipt only in its original scope. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove partial-runtime terminal-send guard/status/floor/query projection and argument-inventory samples. Retained RPC viewport admission, authenticated-client spoof refusal, text admission and stale-binding fences remain bounded mock-boundary behavior. The unchanged wire-codec receipt remains valid only for its original command; it does not validate this reduced RPC selector. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1908 removes the complete prompt-presentation hook and literal interactive-protocol mapping suites and narrows the interactive card and prompt-card input suites. Lost alarms include replacement approval A settling after answered B; collapse/expand composer ownership and partial-answer presentation; identical new waits after an unmounted view; collapsed transcript re-reads; answered/dismissed status-backed persistence and retirement; and literal answer-to-PTY byte arrays. The retained stale-PTY acknowledgment, cancellation/answer retry, and answered-approval remount/rebind assertions remain meaningful but are not equivalent replacement coverage. No fresh reduced-selector result, physical provider, rendered/native-focus, mixed-version deployment, soak, or measured-budget validation is claimed. The unchanged wire-codec receipt remains valid only for its exact command. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Retained unchanged-selector receipts are the only current execution evidence. Reduced-source assertions await validation. Historical prior oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): After acknowledged phone replies with stale host status, the exact card disappears and Send is enabled; unknown, refused or unverifiable-settlement replies retain enabled choices, while an older host's accepted reply dismisses like an acknowledged one; a same-occurrence view toggle retains pending acknowledgment and real replacements discard it. A slow 32 KiB SSH answer completes all chunks before Enter; cancellation preserves issued bytes but omits remaining groups. Paired settlement invokes the actual provider and lost callbacks remain unknown; older hosts deliver ordinary messages, launch and selector groups once and their accepted answers dismiss as before. An answered card stays hidden across a view remount; a collapsed card is a strip that frees the composer and expands back; an identical question in a new wait shows again; a composer send caught by a new card keeps its bubble without submitting or clearing the line under it. Audit2450 removes the MobileNativeChatView failure-banner callback-only example whose old banner is supplied unchanged by its props. Retain fatal-read gating and the ordering test that preserves a new delivery notice. The removed false-send/old-banner combination has no equivalent replacement; prior raw receipts and budgets retain their original source scope. No new soak, platform, performance or red/green claim.",
"commands": [
- "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/surfaces/integration/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/conversation/turns/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/runtime/terminal/input/runtime-terminal-writer.test.ts src/main/runtime/rpc/terminal-send.test.ts --maxWorkers=2",
+ "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/runtime/terminal/input/runtime-terminal-writer.test.ts --maxWorkers=2",
"ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts mobile/src/session/native-chat/input/mobile-prompt-controller.test.ts --maxWorkers=2",
"ORCA_BACKGROUND_LAUNCH=1 pnpm test tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts --maxWorkers=1",
- "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/conversation/turns/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts --maxWorkers=2",
+ "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts --maxWorkers=2",
"ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts --maxWorkers=2"
],
"testFiles": [
"src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx",
- "src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx",
- "src/renderer/src/components/native-chat/surfaces/integration/NativeChatResolvedView.prompt-card-composer.test.tsx",
- "src/renderer/src/components/native-chat/conversation/turns/NativeChatResolvedView.turn-status.test.tsx",
"src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts",
"src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts",
"src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts",
"src/main/ipc/pty/ipc/write-input-user-input.test.ts",
"src/main/ipc/pty/pty-write-ipc-validation.test.ts",
"src/main/runtime/terminal/input/runtime-terminal-writer.test.ts",
- "src/main/runtime/rpc/terminal-send.test.ts",
"mobile/src/session/native-chat/input/mobile-prompt-controller.test.ts",
"tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts"
],
@@ -499,19 +495,6 @@
"keeps structured answer controls after a thrown send"
]
},
- {
- "file": "src/renderer/src/components/native-chat/surfaces/integration/NativeChatResolvedView.prompt-card-composer.test.tsx",
- "assertions": [
- "keeps an in-flight message visible and never submits it into the approval",
- "routes no typing to the hidden composer until the card is answered"
- ]
- },
- {
- "file": "src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx",
- "assertions": [
- "keeps an answered approval hidden across a chat view remount and a PTY rebind"
- ]
- },
{
"file": "src/main/runtime/terminal/input/runtime-terminal-writer.test.ts",
"assertions": [
@@ -550,6 +533,13 @@
"evidence": "No fresh reduced-source performance measurement is claimed. Historical account: Historical prior-selector budget; changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. No polling, subprocess, startup await, new status producer or dismissal timer. Reuses the existing bounded per-tab committed observation and per-PTY queue; waits for each group before its existing pacing timer. Duplicate-cancel and yielding chunk tests bound writes. Optional paired proof reuses provider settlement only for requesting clients; legacy requests keep their raw path."
},
"knownGaps": [
+ "Audit3984 retires all four remaining viewport-fixture suites (14 authored/15 finite cases) and the fixture after composing the sender-host deletion. Accepted source-alarm losses include live-region/disclosure continuity, task/question/approval history and revision handling, stale turn status, prompt-dismissal remount/rebind, and pending-send cancellation when approval arrives between body and Enter. No equivalent replacement or fresh runtime validation is claimed.",
+ "Audit3984 retired assertionRefs, preserved verbatim as historical values; not active coverage: [{\"file\":\"src/renderer/src/components/native-chat/surfaces/integration/NativeChatResolvedView.prompt-card-composer.test.tsx\",\"assertions\":[\"keeps an in-flight message visible and never submits it into the approval\",\"routes no typing to the hidden composer until the card is answered\"]},{\"file\":\"src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx\",\"assertions\":[\"keeps an answered approval hidden across a chat view remount and a PTY rebind\"]}]",
+ "Audits3764/3766 retire16 authored/27 expanded mobile cases, including entire HTML-image syntax, Mermaid routing, table styles, file-query encoding, workspace naming and fresh-Git-status adapter suites. Accepted losses include image width/icon filtering, partial-heading streaming, mocked Mermaid key/identity checks, generated table widths/counts, selected-text caret placement, tiny Base64 chunk encoding, twelve query-path roundtrips, locale-import fallback, apostrophe slugging, fresh-status fallback and an intermediate reviewed marker. These are deliberate removals for marginal value; remaining tests are not equivalent replacements. Earlier receipts are historical and do not validate these deleted/reduced drivers.",
+ "Audit3748 intentionally removes ten authored/ten finite registrations from the surviving media-handle-registry.test.ts driver selected by this full-mobile command. Retired real alarms: nominal minted handle uniqueness/metadata and dimensions; ordinary range/EOF/overread/empty-file/direct chunk-clamp samples; nominal successful release, expired-release false, exact millisecond TTL boundary and ordinary releaseAll replay. Deterministic registry code runs; these examples are removed on marginal value without replacement or fresh execution claims. Seven owner cases retain cap refusal/disposal and sweep-before-admission, nonempty EOF and unknown/released/expired refusal, read TTL refresh, idempotent explicit release and continuation after discard failure. Existing commands, assertions, unrelated wire receipt and timing remain; the driver survives.",
+ "Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered mobile Vitest command. Its mobile/src include patterns admit the partial live-input-commit and native-media drivers:5 authored/5 finite removals. Accepted losses: two Android-labeled replay samples after mocked composition conversion, an immediate Backspace absence check that does not wait for pending commit or prove local edit, and released-handle/double-release adapter examples. Real hook, registry and adapter logic run; no equivalent replacement or native Android/iOS exercise is claimed. Both drivers and selector stay. The unchanged wire-specific dated receipt does not validate these reduced mobile sources.",
+ "Audit3666 removes30 authored/36 finite mobile cases, including7 whole drivers. It retires direct consent/channel/token/header-payload/fingerprint/route-object inventories, background legacy-dismissal filtering, the two-row520-entry watermark retention workload, reentrant write-batch example, font-before-ready projection, and legacy-segmenter/scrollback/wrap selection examples. Actual policy, parsing, hashing, tray matching, serialization and xterm buffers execute in these tests; their stated alarms are deliberately lost without replacement. Twelve unchanged authored/19 finite cases retain compact browser geometry regressions, an independent fingerprint-to-host protocol vector, serialized watermark/reload isolation, OSC52 live/replay gating, queue boundaries/reset/generation, disposed font completion and Unicode cell mapping. Pairing classification2/2 was already approved by3657 and receives no3666 delta or credit. Static review only; no runtime, native, provider, browser rendering, OS, remote, mobile/folder parity or new historical fault evidence.",
+ "Audit3663 removes the complete mobile scan-error message suite (two authored/two finite callbacks). Its4URL assertion loop is one registration. Accept loss of Orca new/legacy Android-download URL classification and other-page invalid-code translated-key mapping. Real URL parsing/classification runs, but the only output observed is an identity-translator key. No camera scan, pairing offer admission, connection or device/UI action is exercised. No equivalent replacement or physical/mobile/mixed-version result claimed. Preserve all historical evidence and metadata bytes.",
"Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
"Audit1471 removes the entire interactive-send hook suite. Its mock-writer routing, cancellation-handle, option-digit, interrupt, supplied settlement and inference-argument alarms are retired. No actual PTY bytes, replacement question lifetime or agent delivery were exercised. No equivalent replacement or fresh execution of the reduced reliability selector is claimed; historical receipts retain their original scope.",
"Audit1468 removes the entire runtime-send suite. Its mock PTY clear/body/Enter byte-order, nominal timing, queue cancellation/serialization, attachment escaping, key-group pacing and deferred acceptance callback alarms are intentionally retired. No actual receiving agent or physical terminal delivery was exercised. No equivalent replacement or fresh execution of the reduced reliability selector is claimed; historical receipts retain their original scope.",
@@ -605,7 +595,8 @@
"Complete prior testFiles before exact deleted selectors were pruned: [\"src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx\",\"src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx\",\"src/renderer/src/components/native-chat/surfaces/integration/NativeChatResolvedView.prompt-card-composer.test.tsx\",\"src/renderer/src/components/native-chat/conversation/turns/NativeChatResolvedView.turn-status.test.tsx\",\"src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts\",\"src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts\",\"src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts\",\"src/main/ipc/pty/ipc/write-input-user-input.test.ts\",\"src/main/ipc/pty/pty-write-ipc-validation.test.ts\",\"src/main/runtime/terminal/input/runtime-terminal-writer.test.ts\",\"src/main/runtime/rpc/terminal-send.test.ts\",\"src/main/runtime/terminal/input/terminal-send-stale-leaf-liveness.test.ts\",\"mobile/src/session/native-chat/input/mobile-prompt-controller.test.ts\",\"tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts\"]",
"Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad mobile discovery loses whole prompt-presentation, Jira-URL and folder-source-repository suites. The prompt suite exercised presentation projections; it did not provide native mobile prompt acknowledgment acceptance. Existing direct prompt-controller selectors are unchanged. All prior notes, assertion references and complete dated receipts retain their original historical scopes.",
"Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. The broad mobile command loses the entire three-case mocked diff-review controller suite and the stale layout-sequence comparator sample. Keep only the direct layout-versus-scrollback counter distinction; the unchanged dictation retry hook retains complete recording replay. No rendered app, native capture, actual process death or remote execution is claimed. All prior notes and archived receipts retain original scopes.",
- "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The broad mobile runner loses retired-name sequencing and PR action samples while retaining the editor-lifetime and original PR action keeper; commit-message generation is unchanged. Earlier notes, complete dated receipts and archived gaps retain their original scopes."
+ "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The broad mobile runner loses retired-name sequencing and PR action samples while retaining the editor-lifetime and original PR action keeper; commit-message generation is unchanged. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
+ "Audit3911 removes terminal-send.test.ts and accepts loss of its supplied client/query-reply refusal, oversized ASCII error-redaction, and oversized emoji byte-limit guard alarms. Remaining tests do not replace these three deleted cases; archived evidence remains historical."
],
"promotionCriteria": [
"Record change-reverted red/green evidence and repeatable remote rendered approval/question/dictation journeys.",
@@ -1308,10 +1299,10 @@
"providers": ["local", "remote-runtime"],
"coveredPlatforms": [],
"coveredProviders": [],
- "coverageNotes": "Audit1670 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Actual startOrcad entry with mocked daemon/RPC startup boundaries; real controller, push service, and persisted device registry. Gateway send is stubbed.",
+ "coverageNotes": "Audit3738 removes the explicit-registration seven-day lease example from desktop-push-service.test.ts. Its register/registry expiry arithmetic was real, but the ordinary dispatch omitted notificationSeq/notificationEpoch and returned null before target enumeration/send, so it did not prove delivery leaves a lease unchanged. The exact expiry and explicit-renewal alarm is intentionally retired without replacement. This gate already has no active commands, testFiles, assertionRefs or evidenceRuns; prior lease oracle text is historical intent, not a current retained execution claim. Audit1670 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Actual startOrcad entry with mocked daemon/RPC startup boundaries; real controller, push service, and persisted device registry. Gateway send is stubbed.",
"motivatingLinks": ["https://github.com/stablyai/orca/pull/19204"],
"invariant": "Headless startup installs and disposes push delivery; desktop notification categories remain authoritative, the three-minute away policy is preserved, and host activity cannot extend the seven-day mobile lease.",
- "oracle": "Require registration after RPC identity initialization and shutdown cleanup; idle 179/180/0 yields false/true/false in retained event metadata and exactly one gateway push. Legacy socket subscriptions preserve notification filtering, while opted-in push clients can request dismissal reconciliation. Desktop categories remain authoritative. Persisted lease expires exactly at seven days and only explicit registration renews it.",
+ "oracle": "Audit3738 removes the explicit-registration seven-day lease example from desktop-push-service.test.ts. Its register/registry expiry arithmetic was real, but the ordinary dispatch omitted notificationSeq/notificationEpoch and returned null before target enumeration/send, so it did not prove delivery leaves a lease unchanged. The exact expiry and explicit-renewal alarm is intentionally retired without replacement. This gate already has no active commands, testFiles, assertionRefs or evidenceRuns; prior lease oracle text is historical intent, not a current retained execution claim. Require registration after RPC identity initialization and shutdown cleanup; idle 179/180/0 yields false/true/false in retained event metadata and exactly one gateway push. Legacy socket subscriptions preserve notification filtering, while opted-in push clients can request dismissal reconciliation. Desktop categories remain authoritative. Persisted lease expires exactly at seven days and only explicit registration renews it.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
@@ -1334,6 +1325,7 @@
},
"promotionCriteria": ["Collect repeated CI runs without unexplained failures."],
"knownGaps": [
+ "Audit3738 removes the explicit-registration seven-day lease example from desktop-push-service.test.ts. Its register/registry expiry arithmetic was real, but the ordinary dispatch omitted notificationSeq/notificationEpoch and returned null before target enumeration/send, so it did not prove delivery leaves a lease unchanged. The exact expiry and explicit-renewal alarm is intentionally retired without replacement. This gate already has no active commands, testFiles, assertionRefs or evidenceRuns; prior lease oracle text is historical intent, not a current retained execution claim.",
"Audit1670 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
"Does not prove APNs silent background wakeup or actual operating-system idle transitions.",
"Rendererless agent/bell event generation remains outside the documented feature contract.",
@@ -2190,22 +2182,19 @@
"providers": ["local-daemon", "ssh-daemon", "paired-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local-daemon"],
- "coverageNotes": "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Real TerminalHost, Session, and subprocess wrapper with injected native I/O failures and mocked OS signals. Local non-daemon and SSH-relay implementations are unaffected; daemon consumers on SSH, WSL, paired runtimes, and mobile retain host-owned semantics. Live Linux/Windows/WSL and remote runs remain gaps. No git or folder-workspace assumptions. The fault-injection suite also runs with simulated darwin/linux/win32 platform branches; these do not constitute native OS coverage. Native macOS coverage now proves shell exit and PTY master-fd closure, input/output round trips, and teardown of a paused producer for both graceful and immediate cleanup. Windows single-close/job escalation and pre-listener output/status are fault-injected contracts. Audit1302: src/main/daemon/terminal-host-teardown-recreate.test.ts: Fake subprocess handles synthesize exits via real40ms/30s timers or manual exit callback, with descendant retirement mocked away; assertions inspect isNew/refusal/spawn counts. No real subprocess/PTY teardown/recreation or owned-tree retention boundary. Lose artificial teardown/attach/shutdown/cancellation scheduling alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
+ "coverageNotes": "Audit 3959 retires the whole session.test.ts driver (27 authored / 33 finite cases): startup/echo filtering, readiness input gates, ownership confirmation, detach authority, and termination retry/exit ordering alarms are intentionally lost. No equivalent replacement or fresh runtime validation is claimed. Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Real TerminalHost, Session, and subprocess wrapper with injected native I/O failures and mocked OS signals. Local non-daemon and SSH-relay implementations are unaffected; daemon consumers on SSH, WSL, paired runtimes, and mobile retain host-owned semantics. Live Linux/Windows/WSL and remote runs remain gaps. No git or folder-workspace assumptions. The fault-injection suite also runs with simulated darwin/linux/win32 platform branches; these do not constitute native OS coverage. Archived native macOS results previously exercised shell exit and PTY master-fd closure, input/output round trips, and teardown of a paused producer; that suite is now retired without replacement. Windows single-close/job escalation and pre-listener output/status are fault-injected contracts. Audit1302: src/main/daemon/terminal-host-teardown-recreate.test.ts: Fake subprocess handles synthesize exits via real40ms/30s timers or manual exit callback, with descendant retirement mocked away; assertions inspect isNew/refusal/spawn counts. No real subprocess/PTY teardown/recreation or owned-tree retention boundary. Lose artificial teardown/attach/shutdown/cancellation scheduling alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.\nOrcad folder cleanup intentionally retires the Cartesian native failed-I/O test under repository test policy, without equivalent replacement. Remaining selectors retain their narrower scope. Dated evidenceRuns remain historical and do not validate this changed selector.",
"motivatingLinks": ["docs/terminal-daemon-session-leak-investigation.md"],
"invariant": "I/O errors must not establish physical exit or disable termination of an owned PTY. Session and native handle disposal require the exit event.",
- "oracle": "Inject write and resize failures, require graceful and forced signals to reach the native owner, keep producer resume available, suppress repeated failed I/O, deliver output and exit, and suppress signals after exit. Across 32 create/close cycles per failure, retain each session before exit and release its native handle and emulator exactly once afterwards. Mark physical exit before notifying listeners; reentrant kill/forceKill/signal from those listeners must never signal the retired PID. A native POSIX test performs input/output and resize, pauses the producer, injects each I/O failure, then gracefully or immediately closes 16 real shells; require ESRCH for each child PID and EBADF for each PTY master fd.",
+ "oracle": "Inject write and resize failures, require graceful and forced signals to reach the native owner, keep producer resume available, suppress repeated failed I/O, deliver output and exit, and suppress signals after exit. Across 32 create/close cycles per failure, retain each session before exit and release its native handle and emulator exactly once afterwards. Mark physical exit before notifying listeners; reentrant kill/forceKill/signal from those listeners must never signal the retired PID. The former native POSIX shell/PID/fd oracle is retired without replacement.",
"commands": [
"pnpm test src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-cleanup.test.ts",
- "pnpm test src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-cleanup.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess-handle-lifecycle.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts src/main/daemon/terminal-host/testing/terminal-session-teardown.test.ts src/main/daemon/sessions/testing/session.test.ts",
- "pnpm test src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-native.test.ts"
+ "pnpm test src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-cleanup.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess-handle-lifecycle.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts src/main/daemon/terminal-host/testing/terminal-session-teardown.test.ts"
],
"testFiles": [
"src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-cleanup.test.ts",
"src/main/daemon/pty-subprocess/testing/pty-subprocess-handle-lifecycle.test.ts",
"src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts",
- "src/main/daemon/terminal-host/testing/terminal-session-teardown.test.ts",
- "src/main/daemon/sessions/testing/session.test.ts",
- "src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-native.test.ts"
+ "src/main/daemon/terminal-host/testing/terminal-session-teardown.test.ts"
],
"assertionRefs": [
{
@@ -2216,10 +2205,6 @@
"suppresses repeated native I/O failures while still delivering output and exit",
"blocks reentrant termination from an exit listener after I/O failure"
]
- },
- {
- "file": "src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-native.test.ts",
- "assertions": ["reaps real shells and master fds after %s failure (immediate=%s)"]
}
],
"evidenceRuns": [
@@ -2232,16 +2217,6 @@
"durationSeconds": 3.71,
"summary": "32 tests passed with 4 Windows-only cases skipped; simulated macOS/Linux/Windows branches include 192 failed-I/O create/close cycles and exit-listener reentrancy.",
"currentCommand": "pnpm test src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-cleanup.test.ts"
- },
- {
- "date": "2026-09-07",
- "runner": "local",
- "platform": "macos",
- "command": "pnpm test src/main/daemon/pty-subprocess-io-failure-native.test.ts",
- "result": "passed",
- "durationSeconds": 2.52,
- "summary": "Four native cases pass across 16 real shells, including input/output, pause before teardown, confirmed PID absence, and closed PTY master fds.",
- "currentCommand": "pnpm test src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-native.test.ts"
}
],
"runtimeBudget": {
@@ -2266,10 +2241,11 @@
"knownGaps": [
"Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
"Fault injection proves a leak mechanism, not causality for the historical 427-session incident.",
- "Real Linux/Windows/WSL, remote, startup-close, login-wrapper descendants, and multi-day load evidence remain outstanding. Native tests inject synchronous I/O errors; they do not model every asynchronous node-pty pipe failure.",
+ "Real Linux/Windows/WSL, remote, startup-close, login-wrapper descendants, and multi-day load evidence remain outstanding. The archived native tests injected synchronous I/O errors; they did not model every asynchronous node-pty pipe failure. No active native-shell coverage remains after their retirement.",
"No output throughput change or interactive latency benchmark is included.",
"Audit1302: src/main/daemon/terminal-host-teardown-recreate.test.ts: Fake subprocess handles synthesize exits via real40ms/30s timers or manual exit callback, with descendant retirement mocked away; assertions inspect isNew/refusal/spawn counts. No real subprocess/PTY teardown/recreation or owned-tree retention boundary. Lose artificial teardown/attach/shutdown/cancellation scheduling alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
- "Audit1302 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n \"date\": \"2026-09-07\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm test src/main/daemon/pty-subprocess-io-failure-cleanup.test.ts src/main/daemon/pty-subprocess-handle-lifecycle.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/daemon/terminal-host-teardown-recreate.test.ts src/main/daemon/terminal-session-teardown.test.ts src/main/daemon/session.test.ts\",\n \"result\": \"passed\",\n \"durationSeconds\": 0.617,\n \"summary\": \"136 tests passed across six files; failed-I/O cycle tests cover 64 closures.\"\n }"
+ "Audit1302 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n \"date\": \"2026-09-07\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm test src/main/daemon/pty-subprocess-io-failure-cleanup.test.ts src/main/daemon/pty-subprocess-handle-lifecycle.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/daemon/terminal-host-teardown-recreate.test.ts src/main/daemon/terminal-session-teardown.test.ts src/main/daemon/session.test.ts\",\n \"result\": \"passed\",\n \"durationSeconds\": 0.617,\n \"summary\": \"136 tests passed across six files; failed-I/O cycle tests cover 64 closures.\"\n }",
+ "Orcad owner layout retires this native test receipt without replacement. Original receipt verbatim:\n{\n \"date\": \"2026-09-07\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm test src/main/daemon/pty-subprocess-io-failure-native.test.ts\",\n \"result\": \"passed\",\n \"durationSeconds\": 2.52,\n \"summary\": \"Four native cases pass across 16 real shells, including input/output, pause before teardown, confirmed PID absence, and closed PTY master fds.\",\n \"currentCommand\": \"pnpm test src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-native.test.ts\"\n }"
],
"demotionRule": "Keep experimental; investigate any lost cleanup signal, premature exit, or unexplained flake."
},
@@ -2290,13 +2266,13 @@
"providers": ["local", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
- "coverageNotes": "Audit3381 intentionally removes the entire Cmd-J host-qualified candidate-ownership suite and its active selectors/assertion. The hidden same-id sibling ambiguity regression alarm is lost without replacement. The complete original dated failed receipt below is retired verbatim, including both command and currentCommand, rather than reassigned as validation of remaining selectors. Other complete receipts retain their exact original scopes; remaining browser/simulator/workspace/e2e selectors do not imply equivalent ownership protection. No fresh execution is claimed. Audit3359 retires the whole ensure-simulator-tab-behavior suite: host-collision reuse, host stamping, inactive creation and unknown-owner routing alarms are intentionally lost without equivalent replacement. Its standalone command is removed and four compound commands narrowed. Three complete dated receipts selecting that source through currentCommand are retired verbatim, including their compound historical selectors; no retained test inherits their validation. Seven unrelated macOS receipts retain their original scope. No fresh runtime/UI, simulator, provider, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the orphaned mobile file-close fallback and ordinary cross-content MRU examples from tabs-open-close-lifecycle.test.ts. Earlier descriptions of retained MRU coverage are historical. The integrated mobile markdown close/frame-settlement case remains unchanged and is narrower. Preserve the existing administrative failed receipt and all complete retired receipts verbatim, along with selectors and unrelated assertions; no equivalent replacement or fresh Cmd-J, native or remote result is claimed. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit2729 reduces browser-page-palette-activation.test.ts: separate SSH/paired-runtime alias forwarding, distinct multigroup views accepted, and remote-folder activation forwarding alarms are removed. Collision refusal, preactivation address-bar focus capture, owning-group activation state and missing-tab refusal remain byte-identical. No equivalent replacement, fresh gate execution or actual host/browser delivery evidence is claimed. Prior coverage account: Audit2697 browser source review (metadata followup2702): Reduce src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts by four authored/expanded cases without replacement. The remaining three cases preserve only their existing same-ID execution-host separation, absent stamped-owner refusal and ambiguous legacy-bucket refusal scope. Intentionally lose duplicate backing-tab-ID suppression, multiple unified-browser claims of one workspace, foreign-worktree unified-tab rejection, and the 1000-workspace output/internal getter-read budget alarm. These are real removed alarms; the retained host cases are not equivalent replacements. Current test-value policy rejects internal getter/read budgets; no replacement performance or measured-cost claim is made. Keep existing nonempty selectors and the retained same-ID browser assertionRef. No fresh gate execution or reduced-source validation is supplied; dated receipts, results, commands and historical coverage accounts remain within their original source scope. No live browser activation, physical provider, mixed-version execution, mobile, native UI, platform hardware, soak or timing result is added. Prior coverage account (preserved verbatim): Audit2266 reduces cmd-j-host-qualified-candidate-ownership.test.ts to the scoped open-tab hidden same-ID legacy ambiguity refusal. Separate browser/simulator paired-runtime alias and current-row projections, generic workspace host projection and hostless explicit-owner refusal examples are removed without equivalent replacement. No fresh gate execution, browser activation, physical host, simulator or remote delivery evidence is claimed. Historical dated receipts and budgets remain raw-byte exact. Prior coverage account: Audit1899 replays sealed Audit1895: workspace-session-schema.test.ts keeps only cross-workspace truncated-tab salvage and legacy browser-history cap normalization. Four current commands and testFiles retain that reduced source; no current assertionRef or active receipt selects it. SSH file-owner, isolated browser partition, launch/title/quick-command fields, recency, structured-chat/view-mode and remote browser identity hydration alarms are intentionally lost. Existing retired receipt strings and unrelated active receipts remain verbatim. No equivalent replacement, new Cmd-J gate execution, native simulator or remote/browser restore proof is claimed. Historical coverage account before Audit1899: Audit1494 removes use-open-tab-search.test.ts. Supplied host/worktree/title/ranking projections, simple subscription updates and result-array identity alarms are retired. No actual activation or navigation occurred in that suite. No equivalent replacement coverage or fresh Cmd-J gate validation is claimed. Historical receipts remain scoped to their original selectors. Audit1433 narrows worktree-checks-review-index.test.ts to same-ID local/SSH object-key review isolation. Local provider/cache lookup, GitLab preference, suppression/legacy fallback, explicit-PR authority, physical-versus-runtime review isolation, and branchless-workspace alarms are intentionally removed. No equivalent replacement coverage is claimed. Historical receipts and commands remain unchanged and do not certify the reduced source. Historical coverage account: Audit1396 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic candidate-builder contracts inject local and paired-runtime worktrees with the same bare id into the real aggregated tab buckets, including folder workspaces and a paired runtime transporting an SSH-owned worktree. A mirror contract preserves distinct same-id runtime tabs. A paired Electron journey verifies both visible browser rows and both visible simulator rows, then requires each selection to render its owning active tab and update backing host-qualified state. The test-value audit narrowed simulator-palette-search.test.ts to the recency tie, same-id host isolation, ambiguous legacy host rejection and oversized-input getter tripwire. Supplied timestamp, empty-query context ordering, host projection, alias/range, metadata matching, active-tab score, over-token/whitespace and malformed display-name fallback examples were removed. Their separate alarms are lost; retained candidate and activation contracts do not establish equivalent coverage. Historical run commands and results remain historical. The audit also removed the standalone workspace-tab-palette-search suite: supplied row, title, metadata, alias, range, ranking and ownership examples no longer provide their separate alarms. Other retained contracts are not replacement coverage. The mirror-identity fixture now retains same-id sibling-runtime isolation and the repeated-frame subscriber tripwire only. Supplied field, owner, alias and mapping examples are removed; their separate alarms are lost. The retained sibling-runtime case is not equivalent coverage for them. The test-value audit removed tabs-open-close-lifecycle host-stamping examples and ordinary tab/group operations from tabs-pane-layout-operations. Local-null, explicit-runtime and SSH-without-active-host stamp assertions are lost; retained mobile/MRU and subscriber/atomic split cases do not replace them. Candidate and live Cmd-J evidence retains its own scope. Historical commands, outcomes and narratives remain historical. Audit1308: src/renderer/src/lib/browser-palette-search.test.ts removed. Browser-palette token and pasted-query size-guard work alarms disappear. No equivalent replacement coverage is claimed. Audit1386: src/renderer/src/lib/open-mobile-emulator-tab.test.ts reduced. Duplicate attach count and null-tab creation retry/guard reset standalone alarms removed; no simulator device used. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1396: src/renderer/src/lib/simulator-palette-search.test.ts reduced. Lose simulator-specific lastFocusedAt tie-order alarm; identity/routing and pre-scan size fence remain. No native simulator or real remote launch claim. No equivalent replacement coverage is claimed. Audit1402: src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts reduced. Loses repeated no-op frame store-notification budget; independent cross-runtime resource preservation remains. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
+ "coverageNotes": "Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence. Audit3381 intentionally removes the entire Cmd-J host-qualified candidate-ownership suite and its active selectors/assertion. The hidden same-id sibling ambiguity regression alarm is lost without replacement. The complete original dated failed receipt below is retired verbatim, including both command and currentCommand, rather than reassigned as validation of remaining selectors. Other complete receipts retain their exact original scopes; remaining browser/simulator/workspace/e2e selectors do not imply equivalent ownership protection. No fresh execution is claimed. Audit3359 retires the whole ensure-simulator-tab-behavior suite: host-collision reuse, host stamping, inactive creation and unknown-owner routing alarms are intentionally lost without equivalent replacement. Its standalone command is removed and four compound commands narrowed. Three complete dated receipts selecting that source through currentCommand are retired verbatim, including their compound historical selectors; no retained test inherits their validation. Seven unrelated macOS receipts retain their original scope. No fresh runtime/UI, simulator, provider, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the orphaned mobile file-close fallback and ordinary cross-content MRU examples from tabs-open-close-lifecycle.test.ts. Earlier descriptions of retained MRU coverage are historical. The integrated mobile markdown close/frame-settlement case remains unchanged and is narrower. Preserve the existing administrative failed receipt and all complete retired receipts verbatim, along with selectors and unrelated assertions; no equivalent replacement or fresh Cmd-J, native or remote result is claimed. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit2729 reduces browser-page-palette-activation.test.ts: separate SSH/paired-runtime alias forwarding, distinct multigroup views accepted, and remote-folder activation forwarding alarms are removed. Collision refusal, preactivation address-bar focus capture, owning-group activation state and missing-tab refusal remain byte-identical. No equivalent replacement, fresh gate execution or actual host/browser delivery evidence is claimed. Prior coverage account: Audit2697 browser source review (metadata followup2702): Reduce src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts by four authored/expanded cases without replacement. The remaining three cases preserve only their existing same-ID execution-host separation, absent stamped-owner refusal and ambiguous legacy-bucket refusal scope. Intentionally lose duplicate backing-tab-ID suppression, multiple unified-browser claims of one workspace, foreign-worktree unified-tab rejection, and the 1000-workspace output/internal getter-read budget alarm. These are real removed alarms; the retained host cases are not equivalent replacements. Current test-value policy rejects internal getter/read budgets; no replacement performance or measured-cost claim is made. Keep existing nonempty selectors and the retained same-ID browser assertionRef. No fresh gate execution or reduced-source validation is supplied; dated receipts, results, commands and historical coverage accounts remain within their original source scope. No live browser activation, physical provider, mixed-version execution, mobile, native UI, platform hardware, soak or timing result is added. Prior coverage account (preserved verbatim): Audit2266 reduces cmd-j-host-qualified-candidate-ownership.test.ts to the scoped open-tab hidden same-ID legacy ambiguity refusal. Separate browser/simulator paired-runtime alias and current-row projections, generic workspace host projection and hostless explicit-owner refusal examples are removed without equivalent replacement. No fresh gate execution, browser activation, physical host, simulator or remote delivery evidence is claimed. Historical dated receipts and budgets remain raw-byte exact. Prior coverage account: Audit1899 replays sealed Audit1895: workspace-session-schema.test.ts keeps only cross-workspace truncated-tab salvage and legacy browser-history cap normalization. Four current commands and testFiles retain that reduced source; no current assertionRef or active receipt selects it. SSH file-owner, isolated browser partition, launch/title/quick-command fields, recency, structured-chat/view-mode and remote browser identity hydration alarms are intentionally lost. Existing retired receipt strings and unrelated active receipts remain verbatim. No equivalent replacement, new Cmd-J gate execution, native simulator or remote/browser restore proof is claimed. Historical coverage account before Audit1899: Audit1494 removes use-open-tab-search.test.ts. Supplied host/worktree/title/ranking projections, simple subscription updates and result-array identity alarms are retired. No actual activation or navigation occurred in that suite. No equivalent replacement coverage or fresh Cmd-J gate validation is claimed. Historical receipts remain scoped to their original selectors. Audit1433 narrows worktree-checks-review-index.test.ts to same-ID local/SSH object-key review isolation. Local provider/cache lookup, GitLab preference, suppression/legacy fallback, explicit-PR authority, physical-versus-runtime review isolation, and branchless-workspace alarms are intentionally removed. No equivalent replacement coverage is claimed. Historical receipts and commands remain unchanged and do not certify the reduced source. Historical coverage account: Audit1396 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic candidate-builder contracts inject local and paired-runtime worktrees with the same bare id into the real aggregated tab buckets, including folder workspaces and a paired runtime transporting an SSH-owned worktree. A mirror contract preserves distinct same-id runtime tabs. A paired Electron journey verifies both visible browser rows and both visible simulator rows, then requires each selection to render its owning active tab and update backing host-qualified state. The test-value audit narrowed simulator-palette-search.test.ts to the recency tie, same-id host isolation, ambiguous legacy host rejection and oversized-input getter tripwire. Supplied timestamp, empty-query context ordering, host projection, alias/range, metadata matching, active-tab score, over-token/whitespace and malformed display-name fallback examples were removed. Their separate alarms are lost; retained candidate and activation contracts do not establish equivalent coverage. Historical run commands and results remain historical. The audit also removed the standalone workspace-tab-palette-search suite: supplied row, title, metadata, alias, range, ranking and ownership examples no longer provide their separate alarms. Other retained contracts are not replacement coverage. The mirror-identity fixture now retains same-id sibling-runtime isolation and the repeated-frame subscriber tripwire only. Supplied field, owner, alias and mapping examples are removed; their separate alarms are lost. The retained sibling-runtime case is not equivalent coverage for them. The test-value audit removed tabs-open-close-lifecycle host-stamping examples and ordinary tab/group operations from tabs-pane-layout-operations. Local-null, explicit-runtime and SSH-without-active-host stamp assertions are lost; retained mobile/MRU and subscriber/atomic split cases do not replace them. Candidate and live Cmd-J evidence retains its own scope. Historical commands, outcomes and narratives remain historical. Audit1308: src/renderer/src/lib/browser-palette-search.test.ts removed. Browser-palette token and pasted-query size-guard work alarms disappear. No equivalent replacement coverage is claimed. Audit1386: src/renderer/src/lib/open-mobile-emulator-tab.test.ts reduced. Duplicate attach count and null-tab creation retry/guard reset standalone alarms removed; no simulator device used. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1396: src/renderer/src/lib/simulator-palette-search.test.ts reduced. Lose simulator-specific lastFocusedAt tie-order alarm; identity/routing and pre-scan size fence remain. No native simulator or real remote launch claim. No equivalent replacement coverage is claimed. Audit1402: src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts reduced. Loses repeated no-op frame store-notification budget; independent cross-runtime resource preservation remains. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4965",
"https://github.com/stablyai/orca/pull/15371"
],
"invariant": "Candidate identity is the tuple of execution-host identity and worktree identity: same-id sibling hosts retain separate correct browser, simulator, and workspace tabs, each tab appears exactly once, and selection activates its owning host.",
- "oracle": "Audit3381 intentionally removes the entire Cmd-J host-qualified candidate-ownership suite and its active selectors/assertion. The hidden same-id sibling ambiguity regression alarm is lost without replacement. The complete original dated failed receipt below is retired verbatim, including both command and currentCommand, rather than reassigned as validation of remaining selectors. Other complete receipts retain their exact original scopes; remaining browser/simulator/workspace/e2e selectors do not imply equivalent ownership protection. No fresh execution is claimed. Audit3359 retires the whole ensure-simulator-tab-behavior suite: host-collision reuse, host stamping, inactive creation and unknown-owner routing alarms are intentionally lost without equivalent replacement. Its standalone command is removed and four compound commands narrowed. Three complete dated receipts selecting that source through currentCommand are retired verbatim, including their compound historical selectors; no retained test inherits their validation. Seven unrelated macOS receipts retain their original scope. No fresh runtime/UI, simulator, provider, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the orphaned mobile file-close fallback and ordinary cross-content MRU examples from tabs-open-close-lifecycle.test.ts. Earlier descriptions of retained MRU coverage are historical. The integrated mobile markdown close/frame-settlement case remains unchanged and is narrower. Preserve the existing administrative failed receipt and all complete retired receipts verbatim, along with selectors and unrelated assertions; no equivalent replacement or fresh Cmd-J, native or remote result is claimed. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit2697 browser source review (metadata followup2702): Reduce src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts by four authored/expanded cases without replacement. The remaining three cases preserve only their existing same-ID execution-host separation, absent stamped-owner refusal and ambiguous legacy-bucket refusal scope. Intentionally lose duplicate backing-tab-ID suppression, multiple unified-browser claims of one workspace, foreign-worktree unified-tab rejection, and the 1000-workspace output/internal getter-read budget alarm. These are real removed alarms; the retained host cases are not equivalent replacements. Current test-value policy rejects internal getter/read budgets; no replacement performance or measured-cost claim is made. Keep existing nonempty selectors and the retained same-ID browser assertionRef. No fresh gate execution or reduced-source validation is supplied; dated receipts, results, commands and historical coverage accounts remain within their original source scope. No live browser activation, physical provider, mixed-version execution, mobile, native UI, platform hardware, soak or timing result is added. Prior coverage account (preserved verbatim): Audit2266 current retained source checks only that scoped open-tab search rejects hostless legacy browser, simulator and workspace tabs when a hidden same-ID sibling host remains in the ownership catalog. Reduced selectors require fresh validation; existing historical receipts do not validate the changed source. Prior oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Aggregate two hosts' tabs under one intentionally colliding worktree id, stamp each unified tab with its execution host, and require exactly one candidate per owner. Repeat with an SSH physical owner transported by a paired-runtime alias. Independently require each browser and simulator Cmd-J selection to update activeWorkspaceExecutionHostId plus its owning workspace/group and render the selected tab active. Ambiguous legacy tabs without ownership fail closed.",
+ "oracle": "Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence. Audit3381 intentionally removes the entire Cmd-J host-qualified candidate-ownership suite and its active selectors/assertion. The hidden same-id sibling ambiguity regression alarm is lost without replacement. The complete original dated failed receipt below is retired verbatim, including both command and currentCommand, rather than reassigned as validation of remaining selectors. Other complete receipts retain their exact original scopes; remaining browser/simulator/workspace/e2e selectors do not imply equivalent ownership protection. No fresh execution is claimed. Audit3359 retires the whole ensure-simulator-tab-behavior suite: host-collision reuse, host stamping, inactive creation and unknown-owner routing alarms are intentionally lost without equivalent replacement. Its standalone command is removed and four compound commands narrowed. Three complete dated receipts selecting that source through currentCommand are retired verbatim, including their compound historical selectors; no retained test inherits their validation. Seven unrelated macOS receipts retain their original scope. No fresh runtime/UI, simulator, provider, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the orphaned mobile file-close fallback and ordinary cross-content MRU examples from tabs-open-close-lifecycle.test.ts. Earlier descriptions of retained MRU coverage are historical. The integrated mobile markdown close/frame-settlement case remains unchanged and is narrower. Preserve the existing administrative failed receipt and all complete retired receipts verbatim, along with selectors and unrelated assertions; no equivalent replacement or fresh Cmd-J, native or remote result is claimed. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit2697 browser source review (metadata followup2702): Reduce src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts by four authored/expanded cases without replacement. The remaining three cases preserve only their existing same-ID execution-host separation, absent stamped-owner refusal and ambiguous legacy-bucket refusal scope. Intentionally lose duplicate backing-tab-ID suppression, multiple unified-browser claims of one workspace, foreign-worktree unified-tab rejection, and the 1000-workspace output/internal getter-read budget alarm. These are real removed alarms; the retained host cases are not equivalent replacements. Current test-value policy rejects internal getter/read budgets; no replacement performance or measured-cost claim is made. Keep existing nonempty selectors and the retained same-ID browser assertionRef. No fresh gate execution or reduced-source validation is supplied; dated receipts, results, commands and historical coverage accounts remain within their original source scope. No live browser activation, physical provider, mixed-version execution, mobile, native UI, platform hardware, soak or timing result is added. Prior coverage account (preserved verbatim): Audit2266 current retained source checks only that scoped open-tab search rejects hostless legacy browser, simulator and workspace tabs when a hidden same-ID sibling host remains in the ownership catalog. Reduced selectors require fresh validation; existing historical receipts do not validate the changed source. Prior oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Aggregate two hosts' tabs under one intentionally colliding worktree id, stamp each unified tab with its execution host, and require exactly one candidate per owner. Repeat with an SSH physical owner transported by a paired-runtime alias. Independently require each browser and simulator Cmd-J selection to update activeWorkspaceExecutionHostId plus its owning workspace/group and render the selected tab active. Ambiguous legacy tabs without ownership fail closed.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx",
@@ -2422,6 +2398,7 @@
"Add a live paired-runtime-over-SSH journey when the E2E harness can provision that combined topology."
],
"knownGaps": [
+ "Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence.",
"Audit2729 retires browser palette standalone paired-runtime SSH alias forwarding, multigroup-view acceptance and remote-folder forwarding alarms without equivalent replacement. The retained partial suite has no fresh execution result; existing exact receipts and budgets stay scoped to their unchanged selectors.",
"Audit2697/2702 intentional palette coverage losses: 'omits a browser row whose backing tab id is duplicated': Remove malformed duplicate unified-tab-ID fixture and its empty result. Real duplicate-ID suppression alarm is lost; this narrow private inventory has no palette selection or activation flow. 'omits a workspace claimed by more than one unified browser tab': Remove two unified browser claims of one workspace. Real first-indexed-foreign-versus-later-owned collision rejection alarm is lost; same-host and ambiguous legacy cases do not replace it. 'omits a workspace whose single unified browser tab is not owned by this worktree': Remove one unique workspace backed by foreign-worktree unified tab fixture. Real foreign-tab/worktree rejection alarm is lost; stamped host tests are not equivalent to foreign worktree mismatch. 'indexes workspace tabs when building a large browser palette': Remove internal getter read budget over1000workspaces: current main policy explicitly rejects getter/Proxy/read counts and says performance changes get correctness tests only. Loses direct quadratic-indexing cost alarm and positive1000workspace output check; no equivalent replacement claimed. The same source review also deletes browser-link-profile-isolation.test.ts (two authored/five expanded) and removes two HTTP-routing declarations (three expanded). Exact tracked-tree filename/case search finds no active gate selector/assertionRef for those navigation sources; their local profile isolation/reuse, deferred minted-profile privacy/lifetime, foreground view/group projection and contextless must-create-page alarms still disappear without replacement. This palette gate is not credited with coverage of those unrelated navigation cases. Historical shard timings are retained unchanged. Audit2697 browser source review (metadata followup2702): Reduce src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts by four authored/expanded cases without replacement. The remaining three cases preserve only their existing same-ID execution-host separation, absent stamped-owner refusal and ambiguous legacy-bucket refusal scope. Intentionally lose duplicate backing-tab-ID suppression, multiple unified-browser claims of one workspace, foreign-worktree unified-tab rejection, and the 1000-workspace output/internal getter-read budget alarm. These are real removed alarms; the retained host cases are not equivalent replacements. Current test-value policy rejects internal getter/read budgets; no replacement performance or measured-cost claim is made. Keep existing nonempty selectors and the retained same-ID browser assertionRef. No fresh gate execution or reduced-source validation is supplied; dated receipts, results, commands and historical coverage accounts remain within their original source scope. No live browser activation, physical provider, mixed-version execution, mobile, native UI, platform hardware, soak or timing result is added.",
"Live Linux, Windows, and paired-runtime-over-SSH journeys are not collected; the SSH/runtime dual-owner topology is deterministic renderer coverage.",
@@ -2634,7 +2611,7 @@
"providers": ["local", "local-daemon", "ssh-daemon", "ssh-relay", "paired-runtime"],
"coveredPlatforms": ["macos", "linux"],
"coveredProviders": ["local", "local-daemon", "ssh-relay", "paired-runtime"],
- "coverageNotes": "Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Real macOS node-pty integration covers zsh 5.9 .zshenv/.zprofile and bash 3.2 profile replacement shells, including exec -a names, same-shell and child-process silent reads, a blocking zle-line-init hook, non-shell readline replacements, and a non-shell image renamed zsh. A real Fish PTY proves marker stripping is byte-exact and does not render bracketed-paste control text. Ubuntu 20.04/Bash 5.0 and Ubuntu 24.04/Bash 5.2 containers cover scalar and array PROMPT_COMMAND composition, including real zoxide on 24.04. Deterministic owner contracts cover local, daemon, and SSH relay identity/readiness composition plus provider-owned delivery; explicit terminal-paste remains renderer-owned. Live isolated journeys cover a macOS headed desktop owner with paired web client, headless orca serve with paired web client, and a Docker Linux OpenSSH/Bash target with one readiness-time reconnect. Linux desktop, WSL/Windows, live zsh-over-SSH, and physical remote hosts remain gaps.",
+ "coverageNotes": "Audit 3959 retires the whole session.test.ts driver (27 authored / 33 finite cases): startup/echo filtering, readiness input gates, ownership confirmation, detach authority, and termination retry/exit ordering alarms are intentionally lost. No equivalent replacement or fresh runtime validation is claimed. Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Real macOS node-pty integration covers zsh 5.9 .zshenv/.zprofile and bash 3.2 profile replacement shells, including exec -a names, same-shell and child-process silent reads, a blocking zle-line-init hook, non-shell readline replacements, and a non-shell image renamed zsh. A real Fish PTY proves marker stripping is byte-exact and does not render bracketed-paste control text. Ubuntu 20.04/Bash 5.0 and Ubuntu 24.04/Bash 5.2 containers cover scalar and array PROMPT_COMMAND composition, including real zoxide on 24.04. Deterministic owner contracts cover local, daemon, and SSH relay identity/readiness composition plus provider-owned delivery; explicit terminal-paste remains renderer-owned. Live isolated journeys cover a macOS headed desktop owner with paired web client, headless orca serve with paired web client, and a Docker Linux OpenSSH/Bash target with one readiness-time reconnect. Linux desktop, WSL/Windows, live zsh-over-SSH, and physical remote hosts remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/13767",
"https://linear.app/stably/issue/STA-4067",
@@ -2647,8 +2624,8 @@
"invariant": "Shell startup scanning preserves every non-Orca output byte in order across arbitrary PTY chunk boundaries. Bash scalar and supported array PROMPT_COMMAND values preserve user bytes, hook order, and foreground exit status while emitting exactly one OSC 133 A/C/D lifecycle without syntax errors. Before user startup files run, the wrapper publishes its shell PID. If a later exec discards the ready marker, proof-based recovery releases queued startup input only after the launched shell's actual executable image with that exact PID owns the PTY foreground, emits its post-hook line-editor enable sequence, and exposes zle/readline termios; startup reads, line-init hooks, child foreground processes, and non-shell readline replacements cannot trigger that proof. The existing bounded compatibility timeout may enqueue input without proof, but must not publish readiness, lose or duplicate that input across reconnect, or execute it before the replacement shell can accept it.",
"oracle": "Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Split Fish output immediately after the ready marker and after the following ESC introducer; local and daemon owners must emit the exact ESC [ ? 2004 h bytes and headless xterm must not render literal control text. Run the real generated wrappers under node-pty with disposable zsh, bash, and Fish startup files. Exercise Bash scalar and array PROMPT_COMMAND values with empty, repeated, escaped, whitespace, control-byte, odd-backslash, status-mutating, DEBUG-trap, zoxide, and RHEL-style hooks; require exact A,C,D:0,A,C,D:1,A,C ordering and byte preservation. Plain and exec -a replacement shells must receive one queued command at their first completed line editor without waiting for the 15-second timeout. The identical oracle must time out without the startup identity and prompt fallback. Same-shell reads, child-process reads, a blocking zle-line-init hook, sqlite3, and sqlite3 renamed zsh must not trigger prompt fallback. Relay owner coverage must use the same lossless scanner composition and release through the same prompt contract.",
"commands": [
- "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/shell-readiness/testing/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/main/daemon/shell-readiness/testing/bash-prompt-command-composition.test.ts src/main/pty/shell-startup/line-editor-ready-output-scanner.test.ts src/main/pty/shell-startup/shell-startup-identity-scanner.test.ts src/main/pty/shell-startup/shell-startup-output-scanner.test.ts src/shared/terminal/pty/native-process/pty-slave-line-discipline-echo.test.ts src/shared/terminal/pty/native-process/shell-process-readiness.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/shell-readiness/testing/shell-ready.test.ts src/main/providers/local-pty/local-pty-shell-ready-marker-scan.test.ts src/main/providers/local-pty/local-pty-shell-ready-startup-command.test.ts src/main/providers/local-pty/local-pty-shell-ready-wrapper-generation.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/shell-readiness/testing/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/main/pty/shell-startup/line-editor-ready-output-scanner.test.ts src/main/pty/shell-startup/shell-startup-identity-scanner.test.ts src/main/pty/shell-startup/shell-startup-output-scanner.test.ts src/shared/terminal/pty/native-process/pty-slave-line-discipline-echo.test.ts src/shared/terminal/pty/native-process/shell-process-readiness.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/shell-readiness/testing/shell-ready.test.ts src/main/providers/local-pty/local-pty-shell-ready-marker-scan.test.ts src/main/providers/local-pty/local-pty-shell-ready-startup-command.test.ts src/main/providers/local-pty/local-pty-shell-ready-wrapper-generation.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/shell-readiness/testing/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/main/daemon/shell-readiness/testing/bash-prompt-command-composition.test.ts src/main/pty/shell-startup/line-editor-ready-output-scanner.test.ts src/main/pty/shell-startup/shell-startup-identity-scanner.test.ts src/main/pty/shell-startup/shell-startup-output-scanner.test.ts src/shared/terminal/pty/native-process/pty-slave-line-discipline-echo.test.ts src/shared/terminal/pty/native-process/shell-process-readiness.test.ts src/main/daemon/shell-readiness/testing/shell-ready.test.ts src/main/providers/local-pty/local-pty-shell-ready-marker-scan.test.ts src/main/providers/local-pty/local-pty-shell-ready-startup-command.test.ts src/main/providers/local-pty/local-pty-shell-ready-wrapper-generation.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/shell-readiness/testing/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/main/pty/shell-startup/line-editor-ready-output-scanner.test.ts src/main/pty/shell-startup/shell-startup-identity-scanner.test.ts src/main/pty/shell-startup/shell-startup-output-scanner.test.ts src/shared/terminal/pty/native-process/pty-slave-line-discipline-echo.test.ts src/shared/terminal/pty/native-process/shell-process-readiness.test.ts src/main/daemon/shell-readiness/testing/shell-ready.test.ts src/main/providers/local-pty/local-pty-shell-ready-marker-scan.test.ts src/main/providers/local-pty/local-pty-shell-ready-startup-command.test.ts src/main/providers/local-pty/local-pty-shell-ready-wrapper-generation.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/daemon/shell-readiness/testing/shell-ready.test.ts src/main/pty/shell-startup/shell-startup-output-scanner.test.ts",
"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-startup-exec-readiness.spec.ts --config tests/playwright.config.ts --project electron-headless --project electron-headful --workers=1"
],
@@ -2660,7 +2637,6 @@
"src/main/pty/shell-startup/shell-startup-output-scanner.test.ts",
"src/shared/terminal/pty/native-process/pty-slave-line-discipline-echo.test.ts",
"src/shared/terminal/pty/native-process/shell-process-readiness.test.ts",
- "src/main/daemon/sessions/testing/session.test.ts",
"src/main/daemon/shell-readiness/testing/shell-ready.test.ts",
"src/main/providers/local-pty/local-pty-shell-ready-marker-scan.test.ts",
"src/main/providers/local-pty/local-pty-shell-ready-startup-command.test.ts",
@@ -3269,7 +3245,7 @@
"id": "desktop-relay.assignment-backpressure",
"title": "Desktop relay drain recovery cannot amplify a director outage",
"maturity": "experimental",
- "protection": "partial",
+ "protection": "none",
"owner": "desktop-runtime",
"layer": "main-relay-state-machine",
"surfaces": [
@@ -3279,50 +3255,16 @@
],
"platforms": ["macos", "linux", "windows"],
"providers": ["cloud-relay"],
- "coveredPlatforms": ["macos"],
- "coveredProviders": ["cloud-relay"],
- "coverageNotes": "Deterministic main-process tests cover duplicate drain notifications, full-jitter backoff, Retry-After during initial setup and drain recovery, successful recovery, and broker-close cleanup. Packaged desktop, mixed-version fleets, GFE, and production Cloud SQL remain live-test gaps.",
+ "coveredPlatforms": [],
+ "coveredProviders": [],
+ "coverageNotes": "D42 RPC owner layout has no unchanged passed current receipt for this gate; no fresh execution or replacement coverage claimed. Historical prior account (preserved): Deterministic main-process tests cover duplicate drain notifications, full-jitter backoff, Retry-After during initial setup and drain recovery, successful recovery, and broker-close cleanup. Packaged desktop, mixed-version fleets, GFE, and production Cloud SQL remain live-test gaps.",
"motivatingLinks": ["https://github.com/stablyai/orca-cloud/actions/runs/30223521062"],
"invariant": "One relay host may have at most one assignment attempt or retry timer per recovery path. Sustained director failure must increase the retry window up to five minutes, a bounded Retry-After must be respected during initial setup and drain recovery, shutdown must cancel pending work, and recovery must activate the authoritative assigned origin.",
"oracle": "Inject duplicate drain events, deterministic randomness, fake time, repeated assignment failures, a 30-second Retry-After during initial setup and drain recovery, broker close, and eventual director recovery. Count every assignment call, require 500 ms then 1,000 ms retry windows, reject duplicate fanout, require no pre-hint retry or post-close work, and prove the recovered cell becomes authoritative.",
- "commands": [
- "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-cloud-relay/relay-session-broker.test.ts src/main/runtime/mobile-cloud-relay/relay-http-client.test.ts src/main/runtime/mobile-cloud-relay/relay-auth-coordinator-recovery.test.ts --reporter=dot"
- ],
- "testFiles": [
- "src/main/runtime/mobile-cloud-relay/relay-session-broker.test.ts",
- "src/main/runtime/mobile-cloud-relay/relay-http-client.test.ts",
- "src/main/runtime/mobile-cloud-relay/relay-auth-coordinator-recovery.test.ts"
- ],
- "assertionRefs": [
- {
- "file": "src/main/runtime/mobile-cloud-relay/relay-session-broker.test.ts",
- "assertions": [
- "duplicate drain notifications share one exponentially backed-off retry schedule",
- "Retry-After suppresses early assignment requests",
- "broker close prevents retry resurrection",
- "a later successful assignment activates the new origin"
- ]
- },
- {
- "file": "src/main/runtime/mobile-cloud-relay/relay-http-client.test.ts",
- "assertions": ["assignment overload preserves a bounded Retry-After hint"]
- },
- {
- "file": "src/main/runtime/mobile-cloud-relay/relay-auth-coordinator-recovery.test.ts",
- "assertions": ["initial relay setup does not retry before Retry-After expires"]
- }
- ],
- "evidenceRuns": [
- {
- "date": "2026-07-26",
- "runner": "local",
- "platform": "macos",
- "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-cloud-relay/relay-session-broker.test.ts src/main/runtime/mobile-cloud-relay/relay-http-client.test.ts src/main/runtime/mobile-cloud-relay/relay-auth-coordinator-recovery.test.ts --reporter=dot",
- "result": "passed",
- "durationSeconds": 0.49,
- "summary": "Three focused relay files passed with 25 assertions."
- }
- ],
+ "commands": [],
+ "testFiles": [],
+ "assertionRefs": [],
+ "evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 5,
"scope": "focused desktop relay state-machine tests"
@@ -3347,7 +3289,9 @@
"knownGaps": [
"No packaged desktop or physical phone was exercised.",
"The deterministic seam does not measure production GFE, carrier NAT, DNS, TLS, or Cloud SQL behavior.",
- "Legacy desktop versions remain dependent on server-side overload protection."
+ "Legacy desktop versions remain dependent on server-side overload protection.",
+ "D42 RPC owner layout retires this complete dated receipt because its source/command scope changed. It does not validate relocated/reduced selectors. Native complete receipt verbatim:\n{\n \"date\": \"2026-07-26\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-cloud-relay/relay-session-broker.test.ts src/main/runtime/mobile-cloud-relay/relay-http-client.test.ts src/main/runtime/mobile-cloud-relay/relay-auth-coordinator-recovery.test.ts --reporter=dot\",\n \"result\": \"passed\",\n \"durationSeconds\": 0.49,\n \"summary\": \"Three focused relay files passed with 25 assertions.\"\n }",
+ "D42 RPC owner layout archives complete native active selector/coverage fields because no unchanged passed current receipt remains. These native fields are historical scope, not current execution:\n{\n \"commands\": [\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-cloud-relay/relay-session-broker.test.ts src/main/runtime/mobile-cloud-relay/relay-http-client.test.ts src/main/runtime/mobile-cloud-relay/relay-auth-coordinator-recovery.test.ts --reporter=dot\"\n ],\n \"testFiles\": [\n \"src/main/runtime/mobile-cloud-relay/relay-session-broker.test.ts\",\n \"src/main/runtime/mobile-cloud-relay/relay-http-client.test.ts\",\n \"src/main/runtime/mobile-cloud-relay/relay-auth-coordinator-recovery.test.ts\"\n ],\n \"assertionRefs\": [\n {\n \"file\": \"src/main/runtime/mobile-cloud-relay/relay-session-broker.test.ts\",\n \"assertions\": [\n \"duplicate drain notifications share one exponentially backed-off retry schedule\",\n \"Retry-After suppresses early assignment requests\",\n \"broker close prevents retry resurrection\",\n \"a later successful assignment activates the new origin\"\n ]\n },\n {\n \"file\": \"src/main/runtime/mobile-cloud-relay/relay-http-client.test.ts\",\n \"assertions\": [\n \"assignment overload preserves a bounded Retry-After hint\"\n ]\n },\n {\n \"file\": \"src/main/runtime/mobile-cloud-relay/relay-auth-coordinator-recovery.test.ts\",\n \"assertions\": [\n \"initial relay setup does not retry before Retry-After expires\"\n ]\n }\n ],\n \"protection\": \"partial\",\n \"maturity\": \"experimental\",\n \"coveredPlatforms\": [\n \"macos\"\n ],\n \"coveredProviders\": [\n \"cloud-relay\"\n ]\n}"
],
"demotionRule": "Keep experimental or demote if assignment calls overlap, duplicate drain events bypass backoff, Retry-After is ignored, close resurrects work, or mixed-version request rate exceeds the reviewed director budget."
},
@@ -3439,7 +3383,7 @@
"providers": ["local", "ssh"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
- "coverageNotes": "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed. Module layout SSH policy: Retire reset/private-arithmetic generation rollover registrations. The two retained local-versus-SSH mutation refusals do not establish process-scope rollover or sibling-token invalidation; remove this unrelated gate selector and its rollover assertion claim. Unchanged unrelated execution receipts retain only their original scope. No replacement, fresh rollover execution or cross-platform proof is claimed. Historical prior account (preserved verbatim): Audit2003: Remove the standalone one-client shared-runtime/headless-publication example. The retained two-client callback (real WebSocket/runtime coordination with supplied Git listings and watcher notifications) and invalidated scan/reconnect races keep their exact owning scope, without replacement-equivalence or rendered-headless proof. Retire the entire dated38-case receipt through its effective currentCommand. Preserve the unrelated SSH bridge receipt and paired Electron receipt within their original commands. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1412 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Local deterministic evidence covers git-common classification, desktop watcher debounce counts, non-overlapping poller semantics, macOS native-watch fallback, paired-runtime publication to two independent clients with reconnect and stale-cache checks, and process generation-scope rollover across sibling targets. A headed macOS Electron host and separate paired Electron client both rendered a worktree created through the real Git binary and watcher entry path without reconnect. Linux/Windows desktop clients, multi-target live fanout, and WSL runs remain gaps. Audit1309: src/main/ipc/worktrees/creation/worktree-head-identity-reader.test.ts: Keep real filesystem HEAD/loose/packed/relative metadata reads and traversal refusal. Remove invalid-oid/nonstandard-layout characterization. Lose malformed object-id and bare-dir omission alarms; no Git-produced layout claim. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1381 removes the two mock-forwarding registrations in src/renderer/src/components/right-sidebar/source-control/sync/git-status-push-signal-refresh.test.ts. Sibling attribution suppression and missing/unknown attribution refresh callback alarms are intentionally lost; no equivalent replacement or real hook lifecycle/status-update coverage is claimed. Remaining exact receipts, platform/provider scope, and budgets remain limited to their unchanged selectors; no new execution result is claimed. Audit1412: src/main/ssh/ssh-provider-authority.test.ts removed. Loses real AbortController revocation/target isolation/reentrancy outcomes, recreated-target generation-floor/session rollover behavior, stale mutation refusal and settled-registration cleanup alarms. These useful alarms are deliberately lost; no equivalent cancellation coverage is claimed. No equivalent replacement coverage is claimed.",
+ "coverageNotes": "Command-runner layout policy retires the paired external-worktree E2E: rendered two-client discovery and transport-continuity coverage is lost, with no equivalent replacement. The archived dated receipt does not validate current source. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed. Module layout SSH policy: Retire reset/private-arithmetic generation rollover registrations. The two retained local-versus-SSH mutation refusals do not establish process-scope rollover or sibling-token invalidation; remove this unrelated gate selector and its rollover assertion claim. Unchanged unrelated execution receipts retain only their original scope. No replacement, fresh rollover execution or cross-platform proof is claimed. Historical prior account (preserved verbatim): Audit2003: Remove the standalone one-client shared-runtime/headless-publication example. The retained two-client callback (real WebSocket/runtime coordination with supplied Git listings and watcher notifications) and invalidated scan/reconnect races keep their exact owning scope, without replacement-equivalence or rendered-headless proof. Retire the entire dated38-case receipt through its effective currentCommand. Preserve the unrelated SSH bridge receipt and paired Electron receipt within their original commands. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1412 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Local deterministic evidence covers git-common classification, desktop watcher debounce counts, non-overlapping poller semantics, macOS native-watch fallback, paired-runtime publication to two independent clients with reconnect and stale-cache checks, and process generation-scope rollover across sibling targets. A headed macOS Electron host and separate paired Electron client both rendered a worktree created through the real Git binary and watcher entry path without reconnect. Linux/Windows desktop clients, multi-target live fanout, and WSL runs remain gaps. Audit1309: src/main/ipc/worktrees/creation/worktree-head-identity-reader.test.ts: Keep real filesystem HEAD/loose/packed/relative metadata reads and traversal refusal. Remove invalid-oid/nonstandard-layout characterization. Lose malformed object-id and bare-dir omission alarms; no Git-produced layout claim. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1381 removes the two mock-forwarding registrations in src/renderer/src/components/right-sidebar/source-control/sync/git-status-push-signal-refresh.test.ts. Sibling attribution suppression and missing/unknown attribution refresh callback alarms are intentionally lost; no equivalent replacement or real hook lifecycle/status-update coverage is claimed. Remaining exact receipts, platform/provider scope, and budgets remain limited to their unchanged selectors; no new execution result is claimed. Audit1412: src/main/ssh/ssh-provider-authority.test.ts removed. Loses real AbortController revocation/target isolation/reentrancy outcomes, recreated-target generation-floor/session rollover behavior, stale mutation refusal and settled-registration cleanup alarms. These useful alarms are deliberately lost; no equivalent cancellation coverage is claimed. No equivalent replacement coverage is claimed.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7086",
"https://github.com/stablyai/orca/issues/16477"
@@ -3449,14 +3393,12 @@
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktrees/creation/worktree-base-directory-event-filter.test.ts src/main/ipc/worktrees/creation/worktree-head-identity-reader.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/workspaces/catalog/external-worktree-paired-client-discovery.integration.test.ts",
- "ORCA_E2E_FORCE_HEADFUL=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-external-worktree-discovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts --reporter=dot"
],
"testFiles": [
"src/main/ipc/worktrees/creation/worktree-base-directory-event-filter.test.ts",
"src/main/ipc/worktrees/creation/worktree-head-identity-reader.test.ts",
"src/main/runtime/workspaces/catalog/external-worktree-paired-client-discovery.integration.test.ts",
- "tests/e2e/paired-external-worktree-discovery.spec.ts",
"src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts"
],
"assertionRefs": [
@@ -3482,14 +3424,6 @@
"a disconnected client reconnects to current catalog state without replaying a stale invalidation",
"an event-ignoring client remains compatible, and colliding local/SSH owners do not publish an owner-blind event"
]
- },
- {
- "file": "tests/e2e/paired-external-worktree-discovery.spec.ts",
- "assertions": [
- "a real git worktree add advances the authoritative host inventory",
- "the headed host and separate paired Electron client render the same new worktree identity",
- "the paired client's main-process shared-control transport keeps one connection epoch while converging and compares Windows paths case-insensitively"
- ]
}
],
"evidenceRuns": [
@@ -3501,15 +3435,6 @@
"result": "passed",
"durationSeconds": 1.21,
"summary": "The direct SSH state-bridge wiring file passed with 6 tests after the reconnect coordinator, scheduler and telemetry were deleted."
- },
- {
- "date": "2026-08-26",
- "runner": "local",
- "platform": "macos",
- "command": "ORCA_E2E_FORCE_HEADFUL=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-external-worktree-discovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
- "result": "passed",
- "durationSeconds": 17.96,
- "summary": "One forced-visible paired Electron test passed: real Git inventory, matching visible host/client rows, and one unchanged main-process shared-control transport epoch during convergence."
}
],
"runtimeBudget": {
@@ -3558,7 +3483,8 @@
"Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed. All earlier notes and dated/archived evidence retain original scopes.",
"Exact prior command before deleted attach-main-window-services selector removal: \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/workspaces/catalog/external-worktree-paired-client-discovery.integration.test.ts src/main/window/attach-main-window-services.test.ts\"",
"Exact retired testFiles selector: \"src/main/window/attach-main-window-services.test.ts\"",
- "Complete prior assertionRef retired as historical data only: {\n \"file\": \"src/main/window/attach-main-window-services.test.ts\",\n \"assertions\": [\n \"main-window wiring installs the runtime as the watched-worktree remote-client notifier alongside the existing repo notifier\"\n ]\n }"
+ "Complete prior assertionRef retired as historical data only: {\n \"file\": \"src/main/window/attach-main-window-services.test.ts\",\n \"assertions\": [\n \"main-window wiring installs the runtime as the watched-worktree remote-client notifier alongside the existing repo notifier\"\n ]\n }",
+ "Command-runner layout policy: historical paired external-worktree receipt, preserved verbatim; it no longer validates current source:\n{\n \"date\": \"2026-08-26\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"ORCA_E2E_FORCE_HEADFUL=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-external-worktree-discovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n \"result\": \"passed\",\n \"durationSeconds\": 17.96,\n \"summary\": \"One forced-visible paired Electron test passed: real Git inventory, matching visible host/client rows, and one unchanged main-process shared-control transport epoch during convergence.\"\n }"
],
"demotionRule": "Keep experimental or demote if the focused gate flakes without a product or harness bug, if index-only churn can emit worktrees:changed, or if structural add/remove/HEAD/lock changes fail to converge."
},
@@ -3579,15 +3505,16 @@
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "orca-server"],
- "coveredPlatforms": ["macos"],
+ "coveredPlatforms": ["linux"],
"coveredProviders": ["local", "orca-server"],
- "coverageNotes": "Audit1931 (sources1928/1929): Partial real local-loopback multi-client suite loses supplied device-metadata attribution, direct worktree-local navigation, focused terminal-create projection and crossed-two-server inventory alarms. Retire the worktree-local alias and the stale host-originated reveal-to-all alias: no surviving callback backs that positive reveal claim; the retained host-create callback instead excludes paired observers. Keep the five exact caller-only create, explicit all-surface, reconnect non-replay, headless caller-only and follow-intent aliases. No equivalent replacement or external remote-host journey is assigned. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): A real two-client integration harness pairs two authenticated devices to one OrcaRuntimeService over WebSockets with E2EE and drives worktree.create through the real RPC dispatcher, in both headed-notifier and headless orca-serve shapes. The headless case is a modeled `orca serve` runtime shape — no notifier, no attached window — not a CLI bootstrap, and the in-process reveal non-regression calls createManagedWorktree directly. A headed Electron journey runs the desktop app as the remote server with two independently paired web clients in separate partitions and asserts each client's rendered active worktree. Windows and Linux are covered by the platform-neutral contract only; the reported field topology was a Windows server with mixed-OS clients. Audit1313: src/main/runtime/rpc/methods/worktree-create-navigation.test.ts: Fake runtime creation/show/dedupe under real RPC decoder only inspects forwarded navigation option matrices, with duplicate desktop case. Lose runtime/mobile/legacy CLI/follow/all navigation authority wiring; no rendered reveal. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
+ "coverageNotes": "Audit3924 fresh local Linux evidence covers only the unchanged in-process paired-WebSocket integration suite (9 tests passed), not rendered Electron, actual headless CLI bootstrap, live remote/mobile or other platforms. Audit3918: Remove the standalone paired-client selection example; its distinct-device-id and initial selection alarms are intentionally lost. Retain the manually selected create-and-observe and host-folder journeys without claiming equivalent replacement, composer auto-navigation, folder-picker selection delivery, actual external-agent execution, live remote/mobile or cross-platform validation. The changed Electron selector has no fresh execution receipt. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial real local-loopback multi-client suite loses supplied device-metadata attribution, direct worktree-local navigation, focused terminal-create projection and crossed-two-server inventory alarms. Retire the worktree-local alias and the stale host-originated reveal-to-all alias: no surviving callback backs that positive reveal claim; the retained host-create callback instead excludes paired observers. Keep the five exact caller-only create, explicit all-surface, reconnect non-replay, headless caller-only and follow-intent aliases. No equivalent replacement or external remote-host journey is assigned. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): A real two-client integration harness pairs two authenticated devices to one OrcaRuntimeService over WebSockets with E2EE and drives worktree.create through the real RPC dispatcher, in both headed-notifier and headless orca-serve shapes. The headless case is a modeled `orca serve` runtime shape — no notifier, no attached window — not a CLI bootstrap, and the in-process reveal non-regression calls createManagedWorktree directly. A headed Electron journey runs the desktop app as the remote server with two independently paired web clients in separate partitions and asserts each client's rendered active worktree. Windows and Linux are covered by the platform-neutral contract only; the reported field topology was a Windows server with mixed-OS clients. Audit1313: src/main/runtime/rpc/methods/worktree-create-navigation.test.ts: Fake runtime creation/show/dedupe under real RPC decoder only inspects forwarded navigation option matrices, with duplicate desktop case. Lose runtime/mobile/legacy CLI/follow/all navigation authority wiring; no rendered reveal. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
"motivatingLinks": ["https://github.com/stablyai/orca/issues/11027"],
"invariant": "View intent belongs to the connection that requested it. With no explicit navigation target, a workspace create arriving over a paired desktop/web client connection activates only that caller; it must not emit an activateWorktree client event to sibling connections or drive the host renderer. An explicit navigation of host/clients/all remains an allowed, tested follow intent. Shared model state — repo/worktree catalogs, terminals, agent output — must keep propagating to every client unchanged. In-process and CLI creates keep notifying the host and all clients so a headless server's only viewer still gets its reveal.",
- "oracle": "Audit1931 (sources1928/1929): Partial real local-loopback multi-client suite loses supplied device-metadata attribution, direct worktree-local navigation, focused terminal-create projection and crossed-two-server inventory alarms. Retire the worktree-local alias and the stale host-originated reveal-to-all alias: no surviving callback backs that positive reveal claim; the retained host-create callback instead excludes paired observers. Keep the five exact caller-only create, explicit all-surface, reconnect non-replay, headless caller-only and follow-intent aliases. No equivalent replacement or external remote-host journey is assigned. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): notifyActivateWorktree takes its navigation target as a required parameter, so a create call site that forgets to forward it is a compile error rather than a silent fallback to broadcasting — mutation testing confirmed all six call sites (folder, git, and remote/SSH branches, startup and no-startup each) are killed by typecheck. Behaviorally: two paired clients subscribe to runtime.clientEvents. Client A creates a workspace with activate:true; a reposChanged fence emitted after the create must be the next frame each client sees, proving no activation frame was interleaved, while worktreesChanged still arrives on both streams. The host notifier's activateWorktree is asserted not called and the host's mirrored selection is unchanged. Repeated ordinary worktree.activate calls by A are the negative control. The same file asserts the in-process create still reaches host and clients, headed and headless. The Electron journey asserts the observer's data-rendered-active-worktree-id is unchanged while the created workspace still appears in its sidebar.",
+ "oracle": "Audit3918: Remove the standalone paired-client selection example; its distinct-device-id and initial selection alarms are intentionally lost. Retain the manually selected create-and-observe and host-folder journeys without claiming equivalent replacement, composer auto-navigation, folder-picker selection delivery, actual external-agent execution, live remote/mobile or cross-platform validation. The changed Electron selector has no fresh execution receipt. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial real local-loopback multi-client suite loses supplied device-metadata attribution, direct worktree-local navigation, focused terminal-create projection and crossed-two-server inventory alarms. Retire the worktree-local alias and the stale host-originated reveal-to-all alias: no surviving callback backs that positive reveal claim; the retained host-create callback instead excludes paired observers. Keep the five exact caller-only create, explicit all-surface, reconnect non-replay, headless caller-only and follow-intent aliases. No equivalent replacement or external remote-host journey is assigned. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): notifyActivateWorktree takes its navigation target as a required parameter, so a create call site that forgets to forward it is a compile error rather than a silent fallback to broadcasting — mutation testing confirmed all six call sites (folder, git, and remote/SSH branches, startup and no-startup each) are killed by typecheck. Behaviorally: two paired clients subscribe to runtime.clientEvents. Client A creates a workspace with activate:true; a reposChanged fence emitted after the create must be the next frame each client sees, proving no activation frame was interleaved, while worktreesChanged still arrives on both streams. The host notifier's activateWorktree is asserted not called and the host's mirrored selection is unchanged. Repeated ordinary worktree.activate calls by A are the negative control. The same file asserts the in-process create still reaches host and clients, headed and headless. The Electron journey asserts the observer's data-rendered-active-worktree-id is unchanged while the created workspace still appears in its sidebar.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/client/navigation/multi-client-navigation-isolation.integration.test.ts",
- "pnpm run test:e2e:multi-client-navigation -- tests/e2e/multi-client-navigation-isolation.spec.ts"
+ "pnpm run test:e2e:multi-client-navigation -- tests/e2e/multi-client-navigation-isolation.spec.ts",
+ "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/client/navigation/multi-client-navigation-isolation.integration.test.ts --maxWorkers=2"
],
"testFiles": [
"src/main/runtime/client/navigation/multi-client-navigation-isolation.integration.test.ts",
@@ -3607,20 +3534,19 @@
{
"file": "tests/e2e/multi-client-navigation-isolation.spec.ts",
"assertions": [
- "keeps a paired client workspace create-with-agent off the other client and the host",
- "keeps two paired browser clients and the host on independent worktrees"
+ "keeps a paired client workspace create-with-agent off the other client and the host"
]
}
],
"evidenceRuns": [
{
- "date": "2026-08-18",
+ "date": "2026-11-12",
"runner": "local",
- "platform": "macos",
- "command": "pnpm run test:e2e:multi-client-navigation -- tests/e2e/multi-client-navigation-isolation.spec.ts",
+ "platform": "linux",
+ "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/client/navigation/multi-client-navigation-isolation.integration.test.ts --maxWorkers=2",
"result": "passed",
- "durationSeconds": 80,
- "summary": "Headed Orca desktop server with two paired web clients: the observer stayed on its own worktree while the creator's workspace appeared in its sidebar. With the fix disabled the same journey failed with the observer rendering the created workspace."
+ "durationSeconds": 4.79,
+ "summary": "9 tests passed in the existing multi-client-navigation-isolation.integration.test.ts suite. In-process real paired WebSocket/runtime contracts only; no rendered Electron, CLI bootstrap, physical PTY/provider, live remote/mobile, macOS or Windows validation."
}
],
"runtimeBudget": {
@@ -3629,11 +3555,11 @@
},
"flakeHistory": {
"status": "unknown",
- "evidence": "New contracts. The integration file is fence-ordered rather than timing-based and passed repeatedly locally; the Electron journey passed twice locally on macOS. CI and soak history have not started."
+ "evidence": "Audit3918: Historical evidence for the original source only; no fresh validation of the reduced Electron selector. New contracts. The integration file is fence-ordered rather than timing-based and passed repeatedly locally; the Electron journey passed twice locally on macOS. CI and soak history have not started."
},
"redGreenEvidence": {
"status": "complete",
- "evidence": "Both layers were observed red on origin/main 4ec6bbf588 before any fix: the observer client received ['worktreesChanged', 'activateWorktree'] instead of the fence, and the Electron observer's data-rendered-active-worktree-id resolved to the workspace the other client had just created. Both went green with the caller scoping and red again when only resolveRuntimeNavigationTarget's clientKind input was removed."
+ "evidence": "Audit3918: Historical evidence for the original source only; no fresh validation of the reduced Electron selector. Both layers were observed red on origin/main 4ec6bbf588 before any fix: the observer client received ['worktreesChanged', 'activateWorktree'] instead of the fence, and the Electron observer's data-rendered-active-worktree-id resolved to the workspace the other client had just created. Both went green with the caller scoping and red again when only resolveRuntimeNavigationTarget's clientKind input was removed."
},
"performanceBudget": {
"required": false,
@@ -3645,6 +3571,7 @@
"Extend the oracle to mobile observers and to a client with two windows open on one connection."
],
"knownGaps": [
+ "Audit3918: Remove the standalone paired-client selection example; its distinct-device-id and initial selection alarms are intentionally lost. Retain the manually selected create-and-observe and host-folder journeys without claiming equivalent replacement, composer auto-navigation, folder-picker selection delivery, actual external-agent execution, live remote/mobile or cross-platform validation. The changed Electron selector has no fresh execution receipt. Retired complete dated receipt verbatim:\n{\n \"date\": \"2026-08-18\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm run test:e2e:multi-client-navigation -- tests/e2e/multi-client-navigation-isolation.spec.ts\",\n \"result\": \"passed\",\n \"durationSeconds\": 80,\n \"summary\": \"Headed Orca desktop server with two paired web clients: the observer stayed on its own worktree while the creator's workspace appeared in its sidebar. With the fix disabled the same journey failed with the observer rendering the created workspace.\"\n }",
"Audit2141: Remove only the in-memory fake-store restart callback from src/main/runtime/client/navigation/multi-client-navigation-isolation.integration.test.ts. Its copied persistence-object alarm is intentionally lost without replacement. All eight actual paired-WebSocket callbacks and five active assertion aliases remain byte-identical. Existing Electron receipt is unchanged and validates only its original source/journey; no fresh validation of the reduced integration selector, disk persistence, live remote/mobile, or cross-platform result is claimed.",
"No live Windows or Linux server run yet; the reported field topology was a Windows 11 server.",
"Mobile observers are covered only by the platform-neutral clientKind contract, not by a live phone journey.",
@@ -3681,17 +3608,17 @@
"providers": ["local", "daemon", "ssh"],
"coveredPlatforms": ["linux"],
"coveredProviders": [],
- "coverageNotes": "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2271: Linux coverage is limited to the unchanged serve-signal-exit-diagnostic supervisor selector and the late-handoff-after-child-exit assertion recorded below. It does not cover desktop promotion, renderer continuity, persistent PTYs or native updater behavior. No current local, daemon or SSH provider execution is established; coveredProviders is empty. Historical macOS/provider scope remains only in preserved prior accounts and archived receipts. Audit2252 removes the entire handassembled serve promotion/renderer hydration suite. Retired alarms: queued and repeated activation coalescing, duplicate serve suppression, unavailable-provider diagnostic, and zero resume/replacement accounting on independently supplied renderer state. The fixture never joined actual daemon-to-renderer delivery. These exact alarms have no equivalent replacement assigned. Remaining gate selectors keep their existing narrower scope; historical dated receipts remain verbatim and do not validate this changed selector set. No fresh runtime, native/provider, live remote/mobile, cross-platform or performance result is claimed. Archived removed active entries verbatim: commands: \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts\"\ntestFiles: \"src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts\"\nassertionRefs: {\n \"file\": \"src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts\",\n \"assertions\": [\n \"a forced desktop relaunch reaching the headless lock owner opens exactly one window, and only after the persistent provider settles\",\n \"a duplicate `orca serve` launch never promotes the headless owner\",\n \"the renderer promoted inside the serve process resumes zero agents while daemon panes survive, before and after those panes rebind their PTYs\",\n \"no replacement resume tab, startup command, or automatic-resume claim is created, and every surviving session record is left untouched\"\n ]\n } Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2020: Retire CLI supervisor outcome, local-open promotion and paired-open projection alarms; launch retains only the two referenced stream-framing cases. Remaining CLI refusal/timeout cases do not replace headless-promotion coverage. Preserve both independent dated receipts at their original commands. Reduced selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1589 removes mock-only CLI forwarding, canned provisioning/catalog/error projections and private inventories without equivalent replacement coverage. Retained cases exercise actual local markdown/paste/reconciliation, stream framing/backpressure/output-drain, temporary directory cleanup and persisted handoff with injected host/provider/process boundaries. No real Jira, provisioning, remote launch, native pipe/process-tree authority or deployed provider catalog proof. Assertion references use the surviving handoff registration titles; changed-selector historical receipts are retired and unaffected receipts remain unchanged. Historical scope before this audit: Deterministic unit coverage exercises activation gating, single-instance ownership, local/remote CLI status, headless binding persistence, local daemon identity, SSH identity transfer, the promoted renderer's agent-resume accounting, and the macOS serve update handoff from staged installer through atomic bundle replacement and target-version readiness. Supervisor settlement coverage prevents a late handoff-completion failure from rearming termination after the replacement child exits. A macOS Electron journey covers headless promotion and persistent PTY identity. A disposable locally signed Electron canary exercised real ShipIt and a temporary LaunchAgent with the compiled production supervisor; full packaged Orca and Linux/Windows serve updates remain uncollected. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
+ "coverageNotes": "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2271: Linux coverage is limited to the unchanged serve-signal-exit-diagnostic supervisor selector and the late-handoff-after-child-exit assertion recorded below. It does not cover desktop promotion, renderer continuity, persistent PTYs or native updater behavior. No current local, daemon or SSH provider execution is established; coveredProviders is empty. Historical macOS/provider scope remains only in preserved prior accounts and archived receipts. Audit2252 removes the entire handassembled serve promotion/renderer hydration suite. Retired alarms: queued and repeated activation coalescing, duplicate serve suppression, unavailable-provider diagnostic, and zero resume/replacement accounting on independently supplied renderer state. The fixture never joined actual daemon-to-renderer delivery. These exact alarms have no equivalent replacement assigned. Remaining gate selectors keep their existing narrower scope; historical dated receipts remain verbatim and do not validate this changed selector set. No fresh runtime, native/provider, live remote/mobile, cross-platform or performance result is claimed. Archived removed active entries verbatim: commands: \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts\"\ntestFiles: \"src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts\"\nassertionRefs: {\n \"file\": \"src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts\",\n \"assertions\": [\n \"a forced desktop relaunch reaching the headless lock owner opens exactly one window, and only after the persistent provider settles\",\n \"a duplicate `orca serve` launch never promotes the headless owner\",\n \"the renderer promoted inside the serve process resumes zero agents while daemon panes survive, before and after those panes rebind their PTYs\",\n \"no replacement resume tab, startup command, or automatic-resume claim is created, and every surviving session record is left untouched\"\n ]\n } Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2020: Retire CLI supervisor outcome, local-open promotion and paired-open projection alarms; launch retains only the two referenced stream-framing cases. Remaining CLI refusal/timeout cases do not replace headless-promotion coverage. Preserve both independent dated receipts at their original commands. Reduced selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1589 removes mock-only CLI forwarding, canned provisioning/catalog/error projections and private inventories without equivalent replacement coverage. Retained cases exercise actual local markdown/paste/reconciliation, stream framing/backpressure/output-drain, temporary directory cleanup and persisted handoff with injected host/provider/process boundaries. No real Jira, provisioning, remote launch, native pipe/process-tree authority or deployed provider catalog proof. Assertion references use the surviving handoff registration titles; changed-selector historical receipts are retired and unaffected receipts remain unchanged. Historical scope before this audit: Deterministic unit coverage exercises activation gating, single-instance ownership, local/remote CLI status, headless binding persistence, local daemon identity, SSH identity transfer, the promoted renderer's agent-resume accounting, and the macOS serve update handoff from staged installer through atomic bundle replacement and target-version readiness. Supervisor settlement coverage prevents a late handoff-completion failure from rearming termination after the replacement child exits. A macOS Electron journey covers headless promotion and persistent PTY identity. A disposable locally signed Electron canary exercised real ShipIt and a temporary LaunchAgent with the compiled production supervisor; full packaged Orca and Linux/Windows serve updates remain uncollected. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8457",
"https://github.com/stablyai/orca/issues/9563"
],
"invariant": "A safely promotable headless serve process is the single app owner. Desktop activation preserves its daemon-backed sessions. On macOS, a CLI-supervised serve update keeps the node-mode parent alive across ShipIt's atomic bundle swap, restarts with the original serve arguments only after the target bundle is present, and clears handoff state only after that target version reports runtime readiness. Once a supervised child exits or fails to start, no late handoff completion may signal it or arm force-kill escalation. Unsupported or failed handoffs leave the current serving owner intact or recover it once without an install retry loop.",
- "oracle": "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2252: The removed synthetic lock/gate/hydration fixture supplies no current promotion continuity oracle. Existing other selectors retain only their own independent scope; changed selector execution is pending. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2020: Retire CLI supervisor outcome, local-open promotion and paired-open projection alarms; launch retains only the two referenced stream-framing cases. Remaining CLI refusal/timeout cases do not replace headless-promotion coverage. Preserve both independent dated receipts at their original commands. Reduced selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Unit tests coalesce early activation, preserve daemon and SSH identity, and reproduce the update race with a staged target, old serving child, persistent CLI parent, atomic .app replacement, and replacement readiness message. They assert the parent does not exit for launchd to respawn the old app, the native updater does not launch an interactive GUI, the replacement version is verified before handoff completion, mismatches become durable failures without retries, and unsupported/preflight-failed installs do not invoke native quit or PTY cleanup. Force handoff completion to fail after the replacement child exits and require zero later child signals and zero escalation timers. A joined lock-owner/activation/hydration contract asserts that a forced relaunch opens exactly one window and that the renderer promoted inside the serve process launches zero agent resumes, creates no replacement tab or startup command, and leaves every surviving session record untouched. The Electron journey independently verifies headless promotion retains owner/runtime/daemon/PTY identity and terminal I/O.",
+ "oracle": "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed. Historical prior account (preserved verbatim): Audit3814 deliberately retires60 authored/60 finite cases:53runtime compatibility cases,4native XCTest methods and3Python clipboard methods, including the entire StableElementIndexes suite. Clipboard cuts retire the one-over-cap sample, incoming-offer destruction trace and sequential20-copy replay; actual wire, FD/pipe, startup and Xvfb/GTK boundaries remain without equivalent replacement claims. Accepted losses include narrow terminal-send payload/provider projections, legacy and direct no-op/error permutations, timing/work-count examples, private state/title/activity projections and fixture-driven readiness examples, individually enumerated below. These include real bounded production alarms consciously retired for marginal value; retained failed writes, duplicate submission, stale capture, transcript/ring and allocation fences are not equivalent replacements. No fresh native/remote/browser execution or complete transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3806 deliberately retires40 authored/40 finite runtime compatibility cases, including the terminal-side-effect-facts-part03 headless-snapshots-part02 and agent-status-and-waits-part03 fragments, plus20 scalar Swift precondition sites. Lost runtime alarms include status/title/attention projection examples, simple renderer/headless frame restoration and status waiting outcomes detailed in the accepted-loss ledger. Swift cuts retire duplicate generation-map/schema/navigation/bridge and notification-wrapper assertions; no standalone native program is deleted. These include real bounded production alarms consciously retired for marginal value. Retained races, pending writes/reflow, namespace and waiter ownership are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3798 deliberately retires21 authored/24 finite compatibility cases, including the entire SSH-worktree-lifecycle and repository-project-operations fragments. Accepted losses include navigation-only settings acknowledgement, browser session cleanup and host preservation projections, window positive/policy-state examples, terminal recovery/reload and no-incarnation remint examples, terminal listing compatibility/malformed IDs, directory browse/sort/Windows path smoke, SSH create refusal/manual lineage, recursive parent-folder creation and fork/origin/avatar/icon projections. Real bounded production alarms are consciously retired for marginal value; retained authority races, cleanup/clone ownership, pending waiters, nested-folder and scan invalidation cases are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2252: The removed synthetic lock/gate/hydration fixture supplies no current promotion continuity oracle. Existing other selectors retain only their own independent scope; changed selector execution is pending. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2020: Retire CLI supervisor outcome, local-open promotion and paired-open projection alarms; launch retains only the two referenced stream-framing cases. Remaining CLI refusal/timeout cases do not replace headless-promotion coverage. Preserve both independent dated receipts at their original commands. Reduced selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Unit tests coalesce early activation, preserve daemon and SSH identity, and reproduce the update race with a staged target, old serving child, persistent CLI parent, atomic .app replacement, and replacement readiness message. They assert the parent does not exit for launchd to respawn the old app, the native updater does not launch an interactive GUI, the replacement version is verified before handoff completion, mismatches become durable failures without retries, and unsupported/preflight-failed installs do not invoke native quit or PTY cleanup. Force handoff completion to fail after the replacement child exits and require zero later child signals and zero escalation timers. A joined lock-owner/activation/hydration contract asserts that a forced relaunch opens exactly one window and that the renderer promoted inside the serve process launches zero agent resumes, creates no replacement tab or startup command, and leaves every surviving session record untouched. The Electron journey independently verifies headless promotion retains owner/runtime/daemon/PTY identity and terminal I/O.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/launch.test.ts src/main/updater/serve-update-handoff.test.ts src/main/updater/updater.headless-serve-install.test.ts src/main/updater/mac-install/updater.mac-install.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/serve-signal-exit-diagnostic.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/startup/serve-desktop-activation.test.ts src/cli/runtime-client.test.ts src/cli/runtime/websocket-transport.test.ts src/main/runtime/construction/orca-runtime.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/startup/serve-launch/serve-desktop-activation.test.ts src/cli/runtime/client.test.ts src/cli/runtime/websocket-transport.test.ts src/main/runtime/construction/orca-runtime.test.ts",
"pnpm exec electron-vite build --mode e2e",
"pnpm run test:e2e -- tests/e2e/headless-serve-desktop-activation.spec.ts --workers=1"
],
@@ -3700,8 +3627,8 @@
"src/main/updater/serve-update-handoff.test.ts",
"src/cli/runtime/launch.test.ts",
"src/cli/runtime/serve-signal-exit-diagnostic.test.ts",
- "src/main/startup/serve-desktop-activation.test.ts",
- "src/cli/runtime-client.test.ts",
+ "src/main/startup/serve-launch/serve-desktop-activation.test.ts",
+ "src/cli/runtime/client.test.ts",
"src/cli/runtime/websocket-transport.test.ts",
"src/main/runtime/construction/orca-runtime.test.ts",
"tests/e2e/headless-serve-desktop-activation.spec.ts"
@@ -3739,7 +3666,7 @@
]
},
{
- "file": "src/main/startup/serve-desktop-activation.test.ts",
+ "file": "src/main/startup/serve-launch/serve-desktop-activation.test.ts",
"assertions": [
"early activation requests coalesce until the persistent provider is ready",
"a blocked provider drops pending activation and never opens a window"
@@ -3787,6 +3714,10 @@
"Add an Electron SSH promotion journey in addition to the deterministic identity-transfer unit contract."
],
"knownGaps": [
+ "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed.",
+ "Audit3814 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle from a Codex ready prompt even when stale startup lines remain :: Stale MCP startup lines must not block a later Codex ready header.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle when a stale Codex prompt is followed by the ready header :: A Codex ready header following a stale resume prompt must satisfy tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for an idle Cursor lane past its dismissed trust dialog (#8210) :: Later Cursor idle banner overrides retained trust dialog.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not block a mid-run Cursor lane on its dismissed trust dialog (#8210) :: Dismissed trust dialog must not report blocked for later busy Cursor; wait times out.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not classify unrelated press-enter prompts as Codex blocked prompts :: Unidentified press-enter text must time out rather than be classified Codex blocked.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for quiet background PTY agents without OSC titles :: Quiet Codex background terminal without OSC title eventually resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: sends agent prompts as bracketed paste before submit :: Driving prompt escapes embedded paste-end ESC, writes one framed paste then CR, and counts bytes.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: settles a foreground Codex prompt when launch metadata has not arrived :: Codex inferred from foreground without launch metadata waits for composer marker/quiescence before one CR.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: gives a late Codex render marker a fresh quiescence window :: Marker arriving at7.9s re-arms fresh quiet window instead of submitting at initial cap.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: writes large agent prompt paste frames atomically before delayed submit :: A prompt larger than input chunk budget is a single paste write before delayed CR with exact byte count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects oversized terminal.send text before provider writes :: Oversized ordinary terminal.send rejects input-too-large before any provider write.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects focusing an exited background terminal session :: focusTerminal refuses terminal_exited before invoking background reveal.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: pastes the same bytes the desktop draft paste sent for the prompt :: Launch-ready prompt normalizes CR/LF and renders embedded ESC visibly identically to desktop bracketed paste.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: keeps a prompt into a running agent behind the render settle, as before :: Driving prompt remains held through7s repaint activity then submits once by9s.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reports a queued PTY focus as not navigated when its notifier disappears :: Queued PTY focus and completed active reveal report not navigated after notifier removal; no second reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: does not invoke a stale graph-leaf focus notifier after queued PTY work :: Queued graph-leaf focus must not invoke old notifier after preceding PTY reveal and notifier removal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: paginates retained terminal output with explicit limits and truncation metadata :: Preview120lines, fractional limits,50/200 pages, retained2000line truncation and future-cursor metadata stay consistent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: falls back to renderer visible screen when uncursored TUI tail is blank :: Substantial blank uncursored tail uses mounted renderer visible screen with zero scrollback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reads and shows the runtime-owned alternate-screen grid without serialization :: Actual runtime alternate-screen grid provides read/show content without renderer/provider serialization.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: classifies older provider alternate-screen snapshots from ANSI :: Older provider without alternateScreen metadata classifies ANSI alternate entry and returns Remote Vim screen.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: honors the last ANSI screen transition when older provider metadata is absent :: Last ANSI alternate exit overrides earlier entry when explicit provider mode metadata is absent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: rejects a full provider screen frame after live output advances :: Live output arriving during second full-screen capture causes screen-unavailable rather than stale full frame.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: shares one provider snapshot between concurrent read and show calls :: Concurrent read/show share one successful provider snapshot and both receive Shared TUI content.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps cursor reads provider-free on restored alternate-screen PTYs :: Restored alternate-screen cursor transcript reads never acquire provider snapshot.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: backs off after a provider snapshot failure instead of retrying for show :: Failed provider capture is cached/backed off so later show does not retry.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: falls back once to a mounted renderer when a known alternate provider fails :: A known-alternate failed provider capture falls back exactly once to newly mounted renderer.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: bounds provider visible frames for read and show responses :: Provider visible read/show use six bounded lines and300character preview.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps renderer-fallback composer drafts separate from terminal output :: Renderer fallback strips dim composer draft from terminal output and exposes draft separately.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: does not use renderer visible-screen fallback for a short blank shell tail :: Two blank shell lines must not trigger renderer screen fallback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: trims terminal tail character budget without per-line array shifts :: Tail builder trims to256KiB with correct retained suffix and no Array.shift calls.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains ANSI-only status redraws instead of appending every frame :: Repeated erase/redraw replaces preview until newline then publishes one completed cursor row.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains split multi-line ANSI footer redraw state across chunks :: CUU state across chunks retains corrected footer rows and publishes new cursor entries.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not let stale lower rows hide earlier corrected footer rows from cursor reads :: Earlier corrected footer row must not be hidden by stale lower rows in cursor reads.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: bounds completed transcript entries from a single multi-line redraw chunk :: Single redraw chunk bounds completed transcript to2000retained lines and correct oldest/next/latest cursors.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains multi-line ANSI redraws when the last footer row stays partial :: Partial final redrawn row appears in preview but cursor sees it only after newline.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not retain split ANSI controls as visible terminal preview text :: Split color/mode escapes never leak preview fragments; long split OSC title truncates at MAX_OSC_TITLE_CHARS.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains same-line redraw cursor position across split full-line erase chunks :: Full-line erase preserves column across chunks so XY follows three spaces rather than old ABC.\nsrc/main/runtime/orca-runtime-tests/conpty-stream-read.spec.ts :: fills the requested line count even when blank rows sit below the prompt :: Blank rows below a ConPTY prompt must not consume the requested nonempty-line count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: does not retain split ST-terminated string controls as preview text :: Split ST-terminated Kitty/string controls must remain excluded from preview text.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects split OSC titles before retaining terminal previews :: Split BEL OSC title must update working title/status without leaking into preview.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects ST-terminated OSC titles split before the final backslash :: ST OSC split before final backslash must update title without leaking framing.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: preserves a trailing escape after a completed OSC title :: Completed OSC followed by pending ESC must preserve the next idle-title transition.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: seeds newly synced leaves from PTY pending ANSI state :: A newly synced graph leaf inherits pending ANSI so a split color fragment cannot leak.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: bounds retained partial terminal output before preview reads :: Partial terminal state stays capped at 4000, preserves retained array identity, and preview truncation/cursor output remains correct.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: submits the mail pointer to Cursor Agent only after the paste-burst delay :: Cursor mailbox pointer Enter must wait through the paste-burst delay; this is a real input-timing alarm intentionally retired.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts :: adopts a v1.4.150-shaped agent, setup, and shell orphan as one topology transaction :: Stale incarnation refuses without topology change; three agent/setup/shell lanes adopt atomically with layout/group/revision and preserved read/input/resize; exact replay is idempotent and competing owner refuses.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: retires the exact worker when it exits after renderer reveal :: Exact worker exit after reveal retires that worker and its surface.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: re-reveals a recovered worker after the renderer graph epoch changes :: Changed renderer graph epoch invalidates reveal receipt and forces another reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: defers recovery when the renderer omits the exact reveal identity :: Missing exact reveal identity defers recovery after two attempts.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: reconciles a same-id process replacement before headless adoption :: A process replacement before headless adoption must fence off stale ownership.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retires provider resume only after authoritative inventory proves the legacy PTY exited :: Authoritative owning-host inventory overrides false local hasPty, avoids SSH scanning, retires exited provider resume/surface, adopts live workers without headless reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retries inventory and unknown liveness without revealing a ghost worker :: Inventory failure and unknown liveness must retry without ghost reveal, eventually adopt, and stop retrying.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: refuses a live reserved pane before issuing a handle or revealing it :: A requireFreshPane launch receiving a live reserved owner must reject before handle/reveal/kill, and release its claim. No equivalent replacement claimed.",
+ "Audit3806 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: skips a listener unsubscribed mid-fan-out even with mobile exclusions active :: A listener removed by an earlier listener during one fanout is not called, including with a side-effect-excluded mobile listener present.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: retains bytes emitted before a fresh daemon spawn resolves :: Bytes and title arriving before an initial zero/reset provider response survive in the serialized headless buffer with their counted sequence.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits command-finished facts with best-effort exit codes across chunk splits :: A split OSC133 D exit code becomes130 and a missing code becomes null in ordered command-finished facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits pr-link facts once per URL with batch attribution :: A split GitHub PR URL yields42 rather than4, emits42/43 once each, and carries PTY/worktree/tab attribution.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits 2031-subscribe facts across chunk splits :: Split ESC[?20 then31h emits exactly one2031-subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: restores a provisional 2031 subscribe when daemon scan authority returns :: Returning daemon scan authority with partial scan seed and pending2031 subscription restores exactly one subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers the tracked title over the renderer snapshot lastTitle :: A synthetic live Cursor title overrides stale renderer lastTitle while preserving renderer snapshot source.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers provider history over a partial headless mirror for requested snapshots :: Authoritative requested snapshots return supplied provider frame/history/seq rather than a partial headless mirror, requesting5000rows.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: tracks live alternate-screen transitions after a provider snapshot :: Provider alternateScreen true is accepted, then live1049l/1049h update isTerminalAlternateScreen false/true.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: translates reset provider snapshots without retaining the old title :: A reset provider snapshot translates new local seq into the runtime domain and replaces Old process title with New process.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits the chunk agentStatus events before its side-effect batch :: Agent status callback precedes side-effect batch callback for one coalesced OSC9999/title/bell chunk.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: still emits a throwing chunk’s facts under its own seq, not the next chunk’s :: A tracker throw still flushes first chunk title facts under its own seq, and second chunk does not inherit those facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: seeds the lazily created tracker from the daemon-snapshot title :: A lazy tracker hydrated from renderer snapshot title Codex working emits agent-idle on later Codex done.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits command-code-working facts only after the banner arms the scrape :: Unarmed Thinking text emits no facts; a Command Code0.27.3 banner then hardcoded colored spinner text emits attributed command-code-working with the submitted prompt.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits a command-code-done fact when the idle composer returns :: After hardcoded banner/working text, returned idle composer emits command-code-done with the earlier submitted prompt.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: resizes the headless mirror after an accepted desktop PTY resize :: An external accepted resize produces the resized dimensions and same status-frame lines as a separately driven reference emulator.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: replaces suffix-only headless state with the recovered renderer snapshot :: Replacing suffix-only state removes old suffix, retains renderer history plus later output/cwd, and returns the live47x40PTY grid.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: stamps SSH connection identity on runtime terminal status :: A synthetic mounted-leaf OSC9999 status after registerPty carries the supplied SSH connectionId.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: does not retain WSL context when a PTY id is reused :: After exit and same-ID new null distro context, OSC7 file://server/share/repo uses UNC server path rather than old Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: preserves immutable context while a live daemon attach is unresolved :: preparePtyExecutionContext with preserveExisting refuses a supplied Debian replacement and subsequent OSC7 keeps original Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts :: projects frame-independent live state through main buffer snapshots :: Main-buffer snapshot puts focus-report/cursor-visibility modes in frameRestoreAnsi, excludes STATIC-FRAME there and includes it in data.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts :: continues terminal agent status fanout when a callback throws :: Throwing on the first status callback does not prevent second payload delivery and logs contextual error.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: returns a title-only replay snapshot and never historical attention :: Lose replay:true/title-only fact projection despite earlierbell and unknownPTYnull. No actual delivered-history notification or reattach behavior was exercised. No equivalent replacement claimed.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects a handle rebind while a controller-less status check yields :: A handle rebound while the null-controller status continuation yields must throw terminal_handle_stale.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects confirmation evidence when the owning PTY exits :: A pending strong confirmation resolving after owning PTY exit must reject terminal_exited.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts :: keeps ordinary terminal send suffix failures on the existing not-writable contract :: Ordinary send writes text but refused CR must throw terminal_not_writable with beforeWrite twice and afterWrite once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell the execution host cannot apply instead of spawning its default :: Requested Windows shell on POSIX must refuse before spawning a default shell.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: quotes the agent startup command for the requested shell, not the host default :: Requested cmd shell must override PowerShell default quoting for agent startup command.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: keeps restored receipts outside a targeted worktree scan :: Targeted scan removes the moved-worktree receipt while preserving another worktree receipt.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: observes setup command completion without waiting for its interactive shell to exit :: Nonzero completion marker 17 resolves while interactive shell remains running.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: falls back to setup terminal exit when no completion signal is available :: Setup completion observer without token falls back to actual exit code 9.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: cancels setup completion observation when the caller aborts :: Abort rejects with the original reason and unsubscribes once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps observing after an uncertain setup terminal status :: Unknown exit waiter result must leave observation pending until completion marker arrives.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh omits a record :: Controller inventory omission disconnects the record but preserves its retained transcript.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh times out :: Hung inventory timeout leaves connected record and retained transcript intact.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle for adopted background PTY handles from the renderer title :: An adopted background handle resolves tui-idle from ready Codex renderer title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves live-leaf tui-idle from an OpenCode native title :: A live leaf resolves tui-idle from an OpenCode native title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from a Codex ready prompt preview :: A supplied Codex prompt preview resolves tui-idle without an actual agent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from an Antigravity prompt before the model line :: A supplied Antigravity prompt before model line resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell with no workspace instead of creating a default-shell tab :: Workspace-less explicit shell must reject before renderer default-tab request or spawn. This real guard/wiring alarm is deliberately retired.",
+ "Audit3798 per-case accepted losses:\nsrc/main/runtime/orca-runtime-tests/paired-settings.spec.ts :: awaits navigation-only updates from paired clients (%s) :: Updating only claudeSubagentNavigationEnabled waits for the actual controller call to the supplied pending Claude-view reconcile for both on/off values.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: drops a client page record even when its close command cannot be issued :: A removed workspace loses its runtime client-page record and headless browser projection despite close delivery_required rejection, and emits the asynchronous warning.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: leaves client-hosted pages alone when another host still owns the same worktree id :: Removing runtime:env-b metadata with local ownership leaves the local same-ID client page unchanged and issues no close command.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: marks live bindings again when reopening after a promoted window closes :: A reopened window marks its still-registered live worktree in activeWorktreeIdsOnShutdown after the first promoted window closes.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: preserves live SSH session identities when promoting a headless runtime :: Headless-to-desktop promotion records active worktree, SSH connection and remoteSessionIdsByTabId from the supplied surviving SSH PTY/session.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores a surviving renderer when its reload is cancelled :: A sole ready renderer reload cancelled under its current renderer fence returns true and becomes ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores headless authority when desktop promotion navigation is cancelled :: A cancelled desktop promotion with headless recovery returns false while headless authority remains ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: moves a desktop graph to unavailable when its reload times out :: A ready desktop graph without a headless fallback becomes unavailable at the reload deadline and retains its window/epoch.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: recovers a failed headless promotion and accepts a later renderer generation :: A promotion failure restores ready headless authority; a later valid same-window graph publishes ready desktop authority.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: clears a failed pane recovery so a later reconnect can retry :: After relay_reconnecting rejection, the pending recovery lock clears and the same pane/handle can call createTerminal a second time and return its supplied replacement.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: still preserves a CLI agent leaf when the reloaded renderer has not rebound its PTY :: An empty graph published during renderer reload preserves a preallocated live CLI PTY as one listable terminal before renderer rebind.\nsrc/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts :: keeps a no-incarnation handle across an in-graph pane remint :: Within one graph lifetime an unversioned PTY reminted onto another leaf retains its issued handle and resolves its old exit waiter after onPtyExit.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: matches explicit-id cwd PTYs when the resolved worktree cache is incomplete :: An explicit target absent from a fresh incomplete resolved cache adopts only its cwd PTY, rejects nested cwd PTY and does not rescan Git.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: ignores cwd-only controller PTYs for malformed explicit worktree IDs :: Malformed id:repo-1:: returns no terminals, does not adopt cwd-only controller PTY and avoids Git rescanning.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: refuses an SSH-backed create for mobile/runtime callers instead of creating locally :: Loss of this public unserved SSH create error-class/no-local-add/no-local-list alarm.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: records an app-selected parent workspace as a manual action :: Loss of the local runtime folder-parent manual origin, active-workspace source and explicit confidence projection alarm; no claim that SSH or cleanup coverage replaces it.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: browses runtime server directories before projects are added :: Loss of this public runtime alarm for browse availability before registration, directories-first lexical ordering and native path flavor.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: lists drive roots for a server-root browse :: Loss of the Windows public slash-root drive enumeration smoke and presence of the temporary directory drive.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations-part-02.spec.ts :: creates a missing runtime parent before creating the project directory :: Loss of this runtime createRepo recursive missing-parent/child existence and registered-path alarm.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: preserves selected project %s when a hosted parent is known :: Loss of both parent-selected and origin-selected normal fork-link projection/persisted upstream alarms plus exact single-probe count.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: links a current enterprise remote despite unavailable metadata and a retained %s :: Loss of normal current-enterprise-origin linking with stale automatic GitHub avatar or protected file image, unchanged icon assertion, and serialized project identity under unavailable metadata.",
"Audit2271: Retire the deleted serve-desktop-promotion-session-continuity suite receipt from structured evidenceRuns. The exact dated original object is preserved below as historical text, including its prior claims; it supplies no current promotion/renderer continuity or equivalent replacement evidence. The replacement structured receipt covers only the unchanged serve-signal-exit-diagnostic selector and its late-handoff-after-child-exit supervisor assertion. No promoted-renderer, persistent-PTY, native Electron, provider, remote or platform execution equivalence is assigned. Historical retired receipt verbatim:\n{\n \"date\": \"2026-08-05\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts\",\n \"result\": \"passed\",\n \"durationSeconds\": 2,\n \"summary\": \"Six tests passed joining the serve lock owner, the activation gate, and the promoted renderer's resume accounting. Red evidence: reverting the hidden-pane ownership predicate launched two duplicate codex resume tabs; additionally zeroing the live-PTY check made both hydration passes red; removing the duplicate-serve argv guard opened a window for `--serve`; always marking the gate ready removed the fail-closed diagnostic; refusing to open a window dropped both promotion assertions.\"\n }",
"Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
"Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
@@ -3814,7 +3745,9 @@
"Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
"Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
"Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed. All earlier notes and dated/archived evidence retain original scopes.",
- "Exact prior command before deleted attach-main-window-services selector removal: \"pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/launch.test.ts src/main/updater/serve-update-handoff.test.ts src/main/updater/updater.headless-serve-install.test.ts src/main/updater/mac-install/updater.mac-install.test.ts src/main/window/attach-main-window-services.test.ts\""
+ "Exact prior command before deleted attach-main-window-services selector removal: \"pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/launch.test.ts src/main/updater/serve-update-handoff.test.ts src/main/updater/updater.headless-serve-install.test.ts src/main/updater/mac-install/updater.mac-install.test.ts src/main/window/attach-main-window-services.test.ts\"",
+ "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed.",
+ "Audit3946 reduces src/main/updater/mac-install/updater.mac-install.test.ts from16 to3 authored cases, deliberately retiring13 narrow desktop-Mac staging/ordinary-quit/rejection/timeout/blocker projections. Lose pre-download staging ordering, normal-quit/native-readiness distinction, initial pre-ready blocker handling, sanitized handoff logging,15s readiness escape, injected sidecar recovery, enumeration-failure handling, ordinary quit after refusal, simpler probe/cleanup/retry guards, and required-cleanup failure escape. Retain only native-ready deferred cleanup ownership, delayed blocker-description refusal→retry, and competing actions during a retry; these mocked Electron/native/process boundaries provide no equivalent replacement for every retired alarm or native ShipIt proof. All3 survivors remain darwin-only and skip on Linux; no fresh macOS/native run or narrowed-selector receipt is claimed. This gate command still names the existing suite. Original dated receipts and other gate evidence retain their exact original scope and do not validate the reduced case set."
],
"demotionRule": "Quarantine the Electron journey only with a linked product or harness defect; demote if activation changes the owner/runtime/daemon/PTY identity, loses prior output, opens before provider readiness, or fails to honor a committed quit."
},
@@ -3834,16 +3767,16 @@
"providers": ["local", "daemon", "ssh", "paired-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon", "paired-runtime"],
- "coverageNotes": "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Deterministic lifecycle, IPC, window-notification, and runtime ownership tests cover generation replacement, stale callbacks, same-frame old-document publication, blocked external navigation, cancelled renderer navigation, concurrent provisional starts, process loss, timeout cleanup, headless fallback, and competing windows. Isolated macOS Electron validation covers cancelled navigation, forced renderer recovery, and headless serve promotion with live daemon-backed PTY identity and I/O. Linux, Windows, WSL, SSH promotion, and mixed-version desktop/server live runs remain uncollected; the renderer generation stays local to Electron IPC and does not change the remote wire. The renderer scheduling fixture now retains in-flight coalescing only, and payload partitioning retains publication-failure and main-dropped-worktree retry. Immediate publication, stale SSH cleanup, reconnect resync and isolated partition membership alarms were removed; other lifecycle evidence does not establish equivalent coverage. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1400: src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
+ "coverageNotes": "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Deterministic lifecycle, IPC, window-notification, and runtime ownership tests cover generation replacement, stale callbacks, same-frame old-document publication, blocked external navigation, cancelled renderer navigation, concurrent provisional starts, process loss, timeout cleanup, headless fallback, and competing windows. Isolated macOS Electron validation covers cancelled navigation, forced renderer recovery, and headless serve promotion with live daemon-backed PTY identity and I/O. Linux, Windows, WSL, SSH promotion, and mixed-version desktop/server live runs remain uncollected; the renderer generation stays local to Electron IPC and does not change the remote wire. The renderer scheduling fixture now retains in-flight coalescing only, and payload partitioning retains publication-failure and main-dropped-worktree retry. Immediate publication, stale SSH cleanup, reconnect resync and isolated partition membership alarms were removed; other lifecycle evidence does not establish equivalent coverage. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1400: src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.\nWindow folder cleanup retires the mock-call-only navigation fence suite and the per-generation warning-count case. Retained sender results and existing rendered checks keep their own original scope; no equivalent replacement or fresh execution is claimed here.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/14066",
"https://linear.app/stably/issue/STA-4016",
"https://github.com/stablyai/orca/pull/14070"
],
"invariant": "Every genuine renderer graph reload revision settles exactly once, while a blocked external navigation that preserves the current document never starts a revision. A cancelled renderer-document navigation restores authority only when that same renderer survived; cancellation after an earlier document committed remains fenced until publication or timeout. Replacing a reload cancels only the prior revision; its timer and callbacks cannot settle a newer revision. A desktop reload succeeds only from a publication carrying a new renderer-document generation, while a failed headless promotion may recover only from its originating window. Timeout, renderer loss, and close reach a terminal graph state, and successful desktop publication permanently retires headless sentinel fallback until a new headless runtime is established.",
- "oracle": "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Start a blocked external main-frame navigation and require the current renderer graph and notification path to remain authoritative. Start a same-renderer navigation, cancel it before commit, and require the renderer canary and ready authority to survive; coalesce overlapping provisional starts into one fence, and keep an earlier committed reload fenced if a later navigation is cancelled. Drive two genuine reloads half a timeout apart and require the first deadline to leave the second revision reloading while the second deadline alone makes it unavailable. During the second revision publish from the prior renderer document through the still-current main frame and require rejection without graph mutation or timeout cancellation. Restore headless authority after failed promotion, publish from a competing window, and require rejection while the sentinel remains authoritative. Then force a real renderer crash and separately promote an isolated headless serve owner; require runtime graph readiness, stable runtime/main/daemon/PTY identities, recovered visible terminal output, and post-recovery input/output.",
+ "oracle": "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed. Historical prior account (preserved verbatim): Audit3814 deliberately retires60 authored/60 finite cases:53runtime compatibility cases,4native XCTest methods and3Python clipboard methods, including the entire StableElementIndexes suite. Clipboard cuts retire the one-over-cap sample, incoming-offer destruction trace and sequential20-copy replay; actual wire, FD/pipe, startup and Xvfb/GTK boundaries remain without equivalent replacement claims. Accepted losses include narrow terminal-send payload/provider projections, legacy and direct no-op/error permutations, timing/work-count examples, private state/title/activity projections and fixture-driven readiness examples, individually enumerated below. These include real bounded production alarms consciously retired for marginal value; retained failed writes, duplicate submission, stale capture, transcript/ring and allocation fences are not equivalent replacements. No fresh native/remote/browser execution or complete transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3806 deliberately retires40 authored/40 finite runtime compatibility cases, including the terminal-side-effect-facts-part03 headless-snapshots-part02 and agent-status-and-waits-part03 fragments, plus20 scalar Swift precondition sites. Lost runtime alarms include status/title/attention projection examples, simple renderer/headless frame restoration and status waiting outcomes detailed in the accepted-loss ledger. Swift cuts retire duplicate generation-map/schema/navigation/bridge and notification-wrapper assertions; no standalone native program is deleted. These include real bounded production alarms consciously retired for marginal value. Retained races, pending writes/reflow, namespace and waiter ownership are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3798 deliberately retires21 authored/24 finite compatibility cases, including the entire SSH-worktree-lifecycle and repository-project-operations fragments. Accepted losses include navigation-only settings acknowledgement, browser session cleanup and host preservation projections, window positive/policy-state examples, terminal recovery/reload and no-incarnation remint examples, terminal listing compatibility/malformed IDs, directory browse/sort/Windows path smoke, SSH create refusal/manual lineage, recursive parent-folder creation and fork/origin/avatar/icon projections. Real bounded production alarms are consciously retired for marginal value; retained authority races, cleanup/clone ownership, pending waiters, nested-folder and scan invalidation cases are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Start a blocked external main-frame navigation and require the current renderer graph and notification path to remain authoritative. Start a same-renderer navigation, cancel it before commit, and require the renderer canary and ready authority to survive; coalesce overlapping provisional starts into one fence, and keep an earlier committed reload fenced if a later navigation is cancelled. Drive two genuine reloads half a timeout apart and require the first deadline to leave the second revision reloading while the second deadline alone makes it unavailable. During the second revision publish from the prior renderer document through the still-current main frame and require rejection without graph mutation or timeout cancellation. Restore headless authority after failed promotion, publish from a competing window, and require rejection while the sentinel remains authoritative. Then force a real renderer crash and separately promote an isolated headless serve owner; require runtime graph readiness, stable runtime/main/daemon/PTY identities, recovered visible terminal output, and post-recovery input/output.",
"commands": [
- "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-graph/runtime-graph-reload-lifecycle.test.ts src/main/window/runtime-renderer-notification-sender.test.ts src/main/window/renderer-document-navigation.test.ts src/main/ipc/runtime.test.ts src/main/runtime/construction/orca-runtime.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-payload-partition.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-graph/runtime-graph-reload-lifecycle.test.ts src/main/window/renderer-relays/runtime-renderer-notification-sender.test.ts src/main/ipc/runtime.test.ts src/main/runtime/construction/orca-runtime.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-payload-partition.test.ts",
"pnpm exec electron-vite build --mode e2e",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/renderer-blocked-navigation-graph-authority.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"SKIP_BUILD=1 pnpm exec playwright test e2e/renderer-crash-recovery-terminal-input.spec.ts tests/e2e/renderer-crash-recovery-terminal-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
@@ -3851,8 +3784,7 @@
],
"testFiles": [
"src/main/runtime/session-graph/runtime-graph-reload-lifecycle.test.ts",
- "src/main/window/runtime-renderer-notification-sender.test.ts",
- "src/main/window/renderer-document-navigation.test.ts",
+ "src/main/window/renderer-relays/runtime-renderer-notification-sender.test.ts",
"src/main/ipc/runtime.test.ts",
"src/main/runtime/construction/orca-runtime.test.ts",
"src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-payload-partition.test.ts",
@@ -3870,20 +3802,12 @@
]
},
{
- "file": "src/main/window/runtime-renderer-notification-sender.test.ts",
+ "file": "src/main/window/renderer-relays/runtime-renderer-notification-sender.test.ts",
"assertions": [
- "renderer failure is contained once per load generation",
+ "disposed-frame failures are contained and send admission remains closed until a valid renderer document returns",
"late events cannot revive a closed sender"
]
},
- {
- "file": "src/main/window/renderer-document-navigation.test.ts",
- "assertions": [
- "blocked external navigation does not start a renderer generation",
- "only the packaged renderer file or development origin starts a renderer generation",
- "concurrent provisional starts share one reload fence and cancel only after every attempt fails"
- ]
- },
{
"file": "tests/e2e/renderer-blocked-navigation-graph-authority.spec.ts",
"assertions": [
@@ -3961,6 +3885,10 @@
"Add live SSH or WSL promotion evidence if provider-specific graph restoration diverges."
],
"knownGaps": [
+ "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed.",
+ "Audit3814 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle from a Codex ready prompt even when stale startup lines remain :: Stale MCP startup lines must not block a later Codex ready header.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle when a stale Codex prompt is followed by the ready header :: A Codex ready header following a stale resume prompt must satisfy tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for an idle Cursor lane past its dismissed trust dialog (#8210) :: Later Cursor idle banner overrides retained trust dialog.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not block a mid-run Cursor lane on its dismissed trust dialog (#8210) :: Dismissed trust dialog must not report blocked for later busy Cursor; wait times out.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not classify unrelated press-enter prompts as Codex blocked prompts :: Unidentified press-enter text must time out rather than be classified Codex blocked.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for quiet background PTY agents without OSC titles :: Quiet Codex background terminal without OSC title eventually resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: sends agent prompts as bracketed paste before submit :: Driving prompt escapes embedded paste-end ESC, writes one framed paste then CR, and counts bytes.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: settles a foreground Codex prompt when launch metadata has not arrived :: Codex inferred from foreground without launch metadata waits for composer marker/quiescence before one CR.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: gives a late Codex render marker a fresh quiescence window :: Marker arriving at7.9s re-arms fresh quiet window instead of submitting at initial cap.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: writes large agent prompt paste frames atomically before delayed submit :: A prompt larger than input chunk budget is a single paste write before delayed CR with exact byte count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects oversized terminal.send text before provider writes :: Oversized ordinary terminal.send rejects input-too-large before any provider write.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects focusing an exited background terminal session :: focusTerminal refuses terminal_exited before invoking background reveal.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: pastes the same bytes the desktop draft paste sent for the prompt :: Launch-ready prompt normalizes CR/LF and renders embedded ESC visibly identically to desktop bracketed paste.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: keeps a prompt into a running agent behind the render settle, as before :: Driving prompt remains held through7s repaint activity then submits once by9s.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reports a queued PTY focus as not navigated when its notifier disappears :: Queued PTY focus and completed active reveal report not navigated after notifier removal; no second reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: does not invoke a stale graph-leaf focus notifier after queued PTY work :: Queued graph-leaf focus must not invoke old notifier after preceding PTY reveal and notifier removal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: paginates retained terminal output with explicit limits and truncation metadata :: Preview120lines, fractional limits,50/200 pages, retained2000line truncation and future-cursor metadata stay consistent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: falls back to renderer visible screen when uncursored TUI tail is blank :: Substantial blank uncursored tail uses mounted renderer visible screen with zero scrollback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reads and shows the runtime-owned alternate-screen grid without serialization :: Actual runtime alternate-screen grid provides read/show content without renderer/provider serialization.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: classifies older provider alternate-screen snapshots from ANSI :: Older provider without alternateScreen metadata classifies ANSI alternate entry and returns Remote Vim screen.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: honors the last ANSI screen transition when older provider metadata is absent :: Last ANSI alternate exit overrides earlier entry when explicit provider mode metadata is absent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: rejects a full provider screen frame after live output advances :: Live output arriving during second full-screen capture causes screen-unavailable rather than stale full frame.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: shares one provider snapshot between concurrent read and show calls :: Concurrent read/show share one successful provider snapshot and both receive Shared TUI content.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps cursor reads provider-free on restored alternate-screen PTYs :: Restored alternate-screen cursor transcript reads never acquire provider snapshot.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: backs off after a provider snapshot failure instead of retrying for show :: Failed provider capture is cached/backed off so later show does not retry.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: falls back once to a mounted renderer when a known alternate provider fails :: A known-alternate failed provider capture falls back exactly once to newly mounted renderer.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: bounds provider visible frames for read and show responses :: Provider visible read/show use six bounded lines and300character preview.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps renderer-fallback composer drafts separate from terminal output :: Renderer fallback strips dim composer draft from terminal output and exposes draft separately.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: does not use renderer visible-screen fallback for a short blank shell tail :: Two blank shell lines must not trigger renderer screen fallback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: trims terminal tail character budget without per-line array shifts :: Tail builder trims to256KiB with correct retained suffix and no Array.shift calls.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains ANSI-only status redraws instead of appending every frame :: Repeated erase/redraw replaces preview until newline then publishes one completed cursor row.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains split multi-line ANSI footer redraw state across chunks :: CUU state across chunks retains corrected footer rows and publishes new cursor entries.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not let stale lower rows hide earlier corrected footer rows from cursor reads :: Earlier corrected footer row must not be hidden by stale lower rows in cursor reads.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: bounds completed transcript entries from a single multi-line redraw chunk :: Single redraw chunk bounds completed transcript to2000retained lines and correct oldest/next/latest cursors.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains multi-line ANSI redraws when the last footer row stays partial :: Partial final redrawn row appears in preview but cursor sees it only after newline.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not retain split ANSI controls as visible terminal preview text :: Split color/mode escapes never leak preview fragments; long split OSC title truncates at MAX_OSC_TITLE_CHARS.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains same-line redraw cursor position across split full-line erase chunks :: Full-line erase preserves column across chunks so XY follows three spaces rather than old ABC.\nsrc/main/runtime/orca-runtime-tests/conpty-stream-read.spec.ts :: fills the requested line count even when blank rows sit below the prompt :: Blank rows below a ConPTY prompt must not consume the requested nonempty-line count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: does not retain split ST-terminated string controls as preview text :: Split ST-terminated Kitty/string controls must remain excluded from preview text.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects split OSC titles before retaining terminal previews :: Split BEL OSC title must update working title/status without leaking into preview.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects ST-terminated OSC titles split before the final backslash :: ST OSC split before final backslash must update title without leaking framing.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: preserves a trailing escape after a completed OSC title :: Completed OSC followed by pending ESC must preserve the next idle-title transition.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: seeds newly synced leaves from PTY pending ANSI state :: A newly synced graph leaf inherits pending ANSI so a split color fragment cannot leak.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: bounds retained partial terminal output before preview reads :: Partial terminal state stays capped at 4000, preserves retained array identity, and preview truncation/cursor output remains correct.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: submits the mail pointer to Cursor Agent only after the paste-burst delay :: Cursor mailbox pointer Enter must wait through the paste-burst delay; this is a real input-timing alarm intentionally retired.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts :: adopts a v1.4.150-shaped agent, setup, and shell orphan as one topology transaction :: Stale incarnation refuses without topology change; three agent/setup/shell lanes adopt atomically with layout/group/revision and preserved read/input/resize; exact replay is idempotent and competing owner refuses.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: retires the exact worker when it exits after renderer reveal :: Exact worker exit after reveal retires that worker and its surface.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: re-reveals a recovered worker after the renderer graph epoch changes :: Changed renderer graph epoch invalidates reveal receipt and forces another reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: defers recovery when the renderer omits the exact reveal identity :: Missing exact reveal identity defers recovery after two attempts.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: reconciles a same-id process replacement before headless adoption :: A process replacement before headless adoption must fence off stale ownership.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retires provider resume only after authoritative inventory proves the legacy PTY exited :: Authoritative owning-host inventory overrides false local hasPty, avoids SSH scanning, retires exited provider resume/surface, adopts live workers without headless reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retries inventory and unknown liveness without revealing a ghost worker :: Inventory failure and unknown liveness must retry without ghost reveal, eventually adopt, and stop retrying.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: refuses a live reserved pane before issuing a handle or revealing it :: A requireFreshPane launch receiving a live reserved owner must reject before handle/reveal/kill, and release its claim. No equivalent replacement claimed.",
+ "Audit3806 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: skips a listener unsubscribed mid-fan-out even with mobile exclusions active :: A listener removed by an earlier listener during one fanout is not called, including with a side-effect-excluded mobile listener present.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: retains bytes emitted before a fresh daemon spawn resolves :: Bytes and title arriving before an initial zero/reset provider response survive in the serialized headless buffer with their counted sequence.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits command-finished facts with best-effort exit codes across chunk splits :: A split OSC133 D exit code becomes130 and a missing code becomes null in ordered command-finished facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits pr-link facts once per URL with batch attribution :: A split GitHub PR URL yields42 rather than4, emits42/43 once each, and carries PTY/worktree/tab attribution.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits 2031-subscribe facts across chunk splits :: Split ESC[?20 then31h emits exactly one2031-subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: restores a provisional 2031 subscribe when daemon scan authority returns :: Returning daemon scan authority with partial scan seed and pending2031 subscription restores exactly one subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers the tracked title over the renderer snapshot lastTitle :: A synthetic live Cursor title overrides stale renderer lastTitle while preserving renderer snapshot source.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers provider history over a partial headless mirror for requested snapshots :: Authoritative requested snapshots return supplied provider frame/history/seq rather than a partial headless mirror, requesting5000rows.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: tracks live alternate-screen transitions after a provider snapshot :: Provider alternateScreen true is accepted, then live1049l/1049h update isTerminalAlternateScreen false/true.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: translates reset provider snapshots without retaining the old title :: A reset provider snapshot translates new local seq into the runtime domain and replaces Old process title with New process.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits the chunk agentStatus events before its side-effect batch :: Agent status callback precedes side-effect batch callback for one coalesced OSC9999/title/bell chunk.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: still emits a throwing chunk’s facts under its own seq, not the next chunk’s :: A tracker throw still flushes first chunk title facts under its own seq, and second chunk does not inherit those facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: seeds the lazily created tracker from the daemon-snapshot title :: A lazy tracker hydrated from renderer snapshot title Codex working emits agent-idle on later Codex done.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits command-code-working facts only after the banner arms the scrape :: Unarmed Thinking text emits no facts; a Command Code0.27.3 banner then hardcoded colored spinner text emits attributed command-code-working with the submitted prompt.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits a command-code-done fact when the idle composer returns :: After hardcoded banner/working text, returned idle composer emits command-code-done with the earlier submitted prompt.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: resizes the headless mirror after an accepted desktop PTY resize :: An external accepted resize produces the resized dimensions and same status-frame lines as a separately driven reference emulator.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: replaces suffix-only headless state with the recovered renderer snapshot :: Replacing suffix-only state removes old suffix, retains renderer history plus later output/cwd, and returns the live47x40PTY grid.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: stamps SSH connection identity on runtime terminal status :: A synthetic mounted-leaf OSC9999 status after registerPty carries the supplied SSH connectionId.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: does not retain WSL context when a PTY id is reused :: After exit and same-ID new null distro context, OSC7 file://server/share/repo uses UNC server path rather than old Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: preserves immutable context while a live daemon attach is unresolved :: preparePtyExecutionContext with preserveExisting refuses a supplied Debian replacement and subsequent OSC7 keeps original Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts :: projects frame-independent live state through main buffer snapshots :: Main-buffer snapshot puts focus-report/cursor-visibility modes in frameRestoreAnsi, excludes STATIC-FRAME there and includes it in data.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts :: continues terminal agent status fanout when a callback throws :: Throwing on the first status callback does not prevent second payload delivery and logs contextual error.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: returns a title-only replay snapshot and never historical attention :: Lose replay:true/title-only fact projection despite earlierbell and unknownPTYnull. No actual delivered-history notification or reattach behavior was exercised. No equivalent replacement claimed.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects a handle rebind while a controller-less status check yields :: A handle rebound while the null-controller status continuation yields must throw terminal_handle_stale.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects confirmation evidence when the owning PTY exits :: A pending strong confirmation resolving after owning PTY exit must reject terminal_exited.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts :: keeps ordinary terminal send suffix failures on the existing not-writable contract :: Ordinary send writes text but refused CR must throw terminal_not_writable with beforeWrite twice and afterWrite once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell the execution host cannot apply instead of spawning its default :: Requested Windows shell on POSIX must refuse before spawning a default shell.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: quotes the agent startup command for the requested shell, not the host default :: Requested cmd shell must override PowerShell default quoting for agent startup command.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: keeps restored receipts outside a targeted worktree scan :: Targeted scan removes the moved-worktree receipt while preserving another worktree receipt.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: observes setup command completion without waiting for its interactive shell to exit :: Nonzero completion marker 17 resolves while interactive shell remains running.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: falls back to setup terminal exit when no completion signal is available :: Setup completion observer without token falls back to actual exit code 9.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: cancels setup completion observation when the caller aborts :: Abort rejects with the original reason and unsubscribes once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps observing after an uncertain setup terminal status :: Unknown exit waiter result must leave observation pending until completion marker arrives.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh omits a record :: Controller inventory omission disconnects the record but preserves its retained transcript.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh times out :: Hung inventory timeout leaves connected record and retained transcript intact.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle for adopted background PTY handles from the renderer title :: An adopted background handle resolves tui-idle from ready Codex renderer title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves live-leaf tui-idle from an OpenCode native title :: A live leaf resolves tui-idle from an OpenCode native title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from a Codex ready prompt preview :: A supplied Codex prompt preview resolves tui-idle without an actual agent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from an Antigravity prompt before the model line :: A supplied Antigravity prompt before model line resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell with no workspace instead of creating a default-shell tab :: Workspace-less explicit shell must reject before renderer default-tab request or spawn. This real guard/wiring alarm is deliberately retired.",
+ "Audit3798 per-case accepted losses:\nsrc/main/runtime/orca-runtime-tests/paired-settings.spec.ts :: awaits navigation-only updates from paired clients (%s) :: Updating only claudeSubagentNavigationEnabled waits for the actual controller call to the supplied pending Claude-view reconcile for both on/off values.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: drops a client page record even when its close command cannot be issued :: A removed workspace loses its runtime client-page record and headless browser projection despite close delivery_required rejection, and emits the asynchronous warning.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: leaves client-hosted pages alone when another host still owns the same worktree id :: Removing runtime:env-b metadata with local ownership leaves the local same-ID client page unchanged and issues no close command.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: marks live bindings again when reopening after a promoted window closes :: A reopened window marks its still-registered live worktree in activeWorktreeIdsOnShutdown after the first promoted window closes.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: preserves live SSH session identities when promoting a headless runtime :: Headless-to-desktop promotion records active worktree, SSH connection and remoteSessionIdsByTabId from the supplied surviving SSH PTY/session.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores a surviving renderer when its reload is cancelled :: A sole ready renderer reload cancelled under its current renderer fence returns true and becomes ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores headless authority when desktop promotion navigation is cancelled :: A cancelled desktop promotion with headless recovery returns false while headless authority remains ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: moves a desktop graph to unavailable when its reload times out :: A ready desktop graph without a headless fallback becomes unavailable at the reload deadline and retains its window/epoch.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: recovers a failed headless promotion and accepts a later renderer generation :: A promotion failure restores ready headless authority; a later valid same-window graph publishes ready desktop authority.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: clears a failed pane recovery so a later reconnect can retry :: After relay_reconnecting rejection, the pending recovery lock clears and the same pane/handle can call createTerminal a second time and return its supplied replacement.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: still preserves a CLI agent leaf when the reloaded renderer has not rebound its PTY :: An empty graph published during renderer reload preserves a preallocated live CLI PTY as one listable terminal before renderer rebind.\nsrc/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts :: keeps a no-incarnation handle across an in-graph pane remint :: Within one graph lifetime an unversioned PTY reminted onto another leaf retains its issued handle and resolves its old exit waiter after onPtyExit.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: matches explicit-id cwd PTYs when the resolved worktree cache is incomplete :: An explicit target absent from a fresh incomplete resolved cache adopts only its cwd PTY, rejects nested cwd PTY and does not rescan Git.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: ignores cwd-only controller PTYs for malformed explicit worktree IDs :: Malformed id:repo-1:: returns no terminals, does not adopt cwd-only controller PTY and avoids Git rescanning.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: refuses an SSH-backed create for mobile/runtime callers instead of creating locally :: Loss of this public unserved SSH create error-class/no-local-add/no-local-list alarm.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: records an app-selected parent workspace as a manual action :: Loss of the local runtime folder-parent manual origin, active-workspace source and explicit confidence projection alarm; no claim that SSH or cleanup coverage replaces it.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: browses runtime server directories before projects are added :: Loss of this public runtime alarm for browse availability before registration, directories-first lexical ordering and native path flavor.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: lists drive roots for a server-root browse :: Loss of the Windows public slash-root drive enumeration smoke and presence of the temporary directory drive.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations-part-02.spec.ts :: creates a missing runtime parent before creating the project directory :: Loss of this runtime createRepo recursive missing-parent/child existence and registered-path alarm.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: preserves selected project %s when a hosted parent is known :: Loss of both parent-selected and origin-selected normal fork-link projection/persisted upstream alarms plus exact single-probe count.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: links a current enterprise remote despite unavailable metadata and a retained %s :: Loss of normal current-enterprise-origin linking with stale automatic GitHub avatar or protected file image, unchanged icon assertion, and serialized project identity under unavailable metadata.",
"Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
"Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts. Unresolved local/computed edges remain explicit debt.",
"Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts. Unresolved local/computed edges remain explicit debt.",
@@ -3986,7 +3914,8 @@
"Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
"Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed. All earlier notes and dated/archived evidence retain original scopes.",
"Exact prior command before deleted attach-main-window-services selector removal: \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-graph/runtime-graph-reload-lifecycle.test.ts src/main/window/runtime-renderer-notification-sender.test.ts src/main/window/renderer-document-navigation.test.ts src/main/ipc/runtime.test.ts src/main/window/attach-main-window-services.test.ts src/main/runtime/construction/orca-runtime.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-payload-partition.test.ts\"",
- "Exact retired testFiles selector: \"src/main/window/attach-main-window-services.test.ts\""
+ "Exact retired testFiles selector: \"src/main/window/attach-main-window-services.test.ts\"",
+ "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed."
],
"demotionRule": "Demote if a reload revision settles more than once, a stale document or competing window can publish, a timer survives settlement, desktop failure stays indefinitely reloading, headless fallback returns after successful promotion, or either isolated Electron journey loses runtime or PTY identity."
},
@@ -4076,10 +4005,10 @@
"providers": ["remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["remote-runtime"],
- "coverageNotes": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Deterministic main-IPC contract tests cover disconnect-driven close delivery, exactly-once close, per-subscription teardown isolation against a failing socket close and a throwing liveness probe, containment of a throwing renderer send on the unguarded host-close path, and continued suppression of stale payloads from a retired transport. A headed paired-server journey (real Orca host plus a separate paired Orca desktop client) covers hidden-but-mounted reveal, cold-parked reveal, and cold-parked reveal across a disconnect/reconnect. Live Linux and Windows paired-server evidence and real sleep/wake transport loss remain uncollected.",
+ "coverageNotes": "Audit3788 retires10 authored/11 expanded cases across six changed drivers, including the entire screencast pending-frame-retry and usage-source-cache-streaming suites. Deliberate losses are false-refused last-frame retry/once-only delivery, ordinary stable-pane reattachment, cleared-chat Dispatch completion, terminal-declared chat-caller refusal, at-rest worker liveness projection, nested depth/cap policy, small unsigned6/sealed7 plain-format and verified-bit examples, generic malformed-ISIZE footer refusal examples, and synthetic10k/100k chunk-size/work-count budgets in gzip and general cache I/O. These include real state/disk/RPC outcomes consciously retired for marginal value; retained E2EE-backlog, receipt/custody/uncertain-ack, integrity/migration and staging-cleanup cases are not equivalent replacements. The footer test did not prove early rejection or bounded allocation; staging cleanup did not seed unrelated files. No replacement or fresh native/remote/performance execution is claimed. Earlier raw selectors and dated receipts remain historical. Audit3779 retires17 authored/17 expanded registrations across six changed drivers, including the entire shared-Codex-home and prompt-telemetry suites. Accepted losses are shared-home wrapper noninterference/opt-out preservation, mocked metric count/provenance filters, SSH activity labeling/clearing and handover idle timing, VM ownership/capability/status projections and asleep-worktree refusal, a link-only external conversation replay sample, and two narrow input-credit noninterference/expiry examples. Retain the direct exact-tab/single-use input-credit case. These bounded real disk/state/routing alarms are intentionally retired for marginal value without equivalent replacement or fresh execution claims; earlier receipts remain historical. Audit3772 retires18 authored/27 expanded cases, including whole Codex service opt-out, RPC capability-parser, creator-provenance, short-ciphertext and readiness-null suites. Accepted losses include service ledger/symlink/mode cleanup, user TOML substring preservation, old-hash cleanup, description pass-through, malformed-file/pending-hash examples, coordinator write/probe counts, capability array bounds, positive creator projections, early short-payload refusal and readiness helper null shape. Two redundant Codex exit-cause rows are also retired; Pi shares their direct-idle path only in this empty-output immediate-exit fixture, and future agent-config drift coverage is lost. Real bounded filesystem/parser/runtime alarms are deliberately retired for marginal value; no equivalent replacements or fresh execution are claimed. Earlier receipts retain their historical scope. Audits3754/3755 intentionally remove9 authored/9 finite registrations: the entire one-case usage-source-cache-streaming.test.ts driver and8 cases from the surviving computer-action-validation.test.ts driver. This gate retains an unfiltered root Vitest command; UNIT_INCLUDE admits both source paths. Accepted losses are the real encoder output chunk-size/work-count alarm on repetitive10k/100k ownership payloads through a mocked durable sink, plus CLI diagnostic precedence, fractional window-id rejection, action-call-site window-target exclusivity, plain-text click-count recovery copy, incomplete click/drag targeting, mouse/modifier/direction allowlist samples and inline/stdin text exclusivity. These CLI cases exercise real argument/handler validation before mocked runtime calls; they are deliberately retired for marginal value, not declared tautologies. Retained cache I/O and CLI cases are not equivalent replacements for these alarms. Existing historical raw receipts remain unchanged and do not validate the deleted or reduced drivers. No fresh execution claim is made. Audits3758/3763 intentionally remove9 authored/11 finite registrations from6 changed drivers, including the entire pane-title-notification, window-linear-notices and worktree-card-lifecycle-effects suites. This gate retains an unfiltered root Vitest command admitting these paths. Accepted losses are same-account linked-row success-notice fanout, sidebar-switch channel forwarding, Linear-only notification forwarding/non-terminal-consumer selection/closed-window detach, destroyed-window refusal and first-send-failure suspension through the pane-title adapter, the100-card synthetic focus/poll absence sample, stored-source local folder badge refresh, unobserved-row badge refusal, and immediate reposChanged lineage invalidation. These exercise real owners with controlled ports; they are retired for marginal value, without equivalent replacement claims. The no-badge-work fixture does not seed its title-promised collection-only cache. Preserved historical receipts do not validate deleted or reduced drivers; no fresh execution is claimed. Audit3759 retires the entire one-case Tailwind compiler/scanner smoke. Accept loss of the direct CSS production/test/spec source-exclusion and rescan alarm; no replacement or current execution is claimed. Audit3752 independently approves audit3749: retire five authored/five finite watcher-process registrations, retaining18 raw-exact registrations. Accept loss of healthy shared-pool joint recovery, last-pending-failure idle retirement/respawn, late VITEST fallback release, missing-entry fail-closed selection and independent-supervisor fuse locality alarms. These are real bounded host-policy alarms intentionally retired for low marginal value; no equivalent replacement is asserted. Remaining driver selections exercise controlled FakeChild supervisor lifecycle, cancellation, physical-exit fencing, recovery and fuse behavior. This source review supplies no fresh native/process/platform/remote/SSH execution; historical receipts retain original source and selector scopes. Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered root Vitest command. Current UNIT_INCLUDE admits the partial push-service, metadata-dialog and two config/scripts browser drivers:10 authored/16 finite removals. Accepted losses: actual retry30s/60s progression and register bucket/refill wiring, explicit seven-day lease arithmetic (its notification lacked seq/epoch and never reached send), equal-name edit latch/save payload, real image/font/meta-refresh/form/popup browser refusal controls, and broad rich-markdown bridge/command/edit-select smoke. Actual production state, callback routing and browser enforcement run in these cases; these alarms are deliberately retired on marginal value. All drivers and selectors survive. Existing unrelated receipts remain historical evidence for their unchanged selectors, not proof of the reduced cases. Audit3732 removes 2 authored/3 finite registrations from two partial suites: nominal custom/Kimi local naming success and deferred context usage row presentation. Real losses: custom/Kimi successful extraction through conversation-name sanitization and agentLabel composition; separate ordered counted/deferred lists and exact percentage/token formatting. No replacement or equivalent coverage claimed. Retain 11 authored/13 finite raw-exact registrations for bounded naming instruction/refusal/cancellation, menu dismissal focus ownership and hover/composer Escape/timer cleanup. Source-only bounded value review, no runtime/CI/native/remote/mobile/folder workspace or global completion credit. Previous account (preserved verbatim): Audit3733 removes2authored/2finite terminal input checks: fixed custom-cap error/secret fixture and three-emoji cap5refusal whose6UTF16units already trip length fast guard (no UTF8-dependent boundary). Accept exact non-disclosure/oversized-refusal alarm losses; no replacement/equivalence claim. Retain13/13scalar/pending input, OSC state and cron DST/cadence outcomes after bounded material reads. Source-only zero runtime/novelty credit; original historical reasons preserved. Previous account (preserved verbatim): Audit3729 removes1authored/3finite by deleting whole CLI runtime pairing advisory-close suite. Accept losing post-real-close injected EIO preservation of native/script/unreadable pairing, env identity/preservation and exact close/release assertions; no actual failed-close leak or replacement coverage claimed. Two retained URL grammar/identity suites11authored16finite raw unchanged. Bounded source/owner/caller value review, zero novelty/runtime credit; other seven3724deferred closures remain. Historical receipts preserve original limits. Previous account (preserved verbatim): Audit3724 removes3authored/3finite checks by deleting two whole suites: TUI clear burst-size singleton and terminal-file-URL target two-case wrapper suite. Deliberate losses: derived widest burst<64byte alarm, UNC authority+line-column anchor composition, and malformed-percent null refusal. Real production algorithms execute in those tests; no mocked-output tautology, equivalent replacement, actual Claude/file-navigation delivery or universal safety-irrelevance claim. TUI58byte bound and URI examples have low marginal value as standalone suites. Actual1262/1264/1742KEEP superseded explicitly. Remaining14drivers83authored136finite raw unchanged. Bounded source-only review; ten closures deferred, four bounded keep judgments repeated with zero new semantic-frontier credit. No runtime/CI/native/remote/mobile/folder/global completion claim; historical receipts retain original scope. Previous account (preserved verbatim): Audit3723 removes 4 authored/4 finite registrations in two whole suites: keybinding cache freeze/token spellings and host-dependent Orca command name examples. Real losses include returned-object freeze, repeated Mod+P key, Space/PageDown/NumpadSubtract mapping, unknown/empty/prototype-token rejection, and headless Linux versus Windows-server/WSL command choice. No equivalent or replacement coverage claimed. Retain 12 authored/21 finite raw-exact registrations exercising generated scaffold validation, artifact failures, shipped editor/hook/worker/panel tests, actual generated typing compilation, independent CLI root routing and intent-name precedence. Source-only bounded audit; no runtime, CI, native, remote, mobile, folder workspace or global completion credit. Previous account (preserved verbatim): Audit3720 removes17authored/23finite checks: whole main catalog-date adapter2 and shared date-helper7, seven renderer nominal ranking/cap/no-date/composition cases, and one browser registration expanding to seven forced-container/DOM-child boundary cases. Deliberate real losses: community oldest-date UTC forwarding, official/undated omission, date sorting/window/invalid/future/skew/clamp and default/override cap; nominal ranking/cap and combined Featured/Newly-added outputs; real CSS459/460,719/720,1055/1056breakpoint, five-card partial-row and720px two-card first-row alarms. Browser cases really measure rendered geometry but force width/remove DOM children; no fake-pixel or tautology rationale. No replacement/equivalent coverage claimed. Retain14authored/19finite raw-exact registrations across4drivers: adversarial featured category/order/tie and installability, date order/window selection, actual PluginManager failure/escaping/duplicate-card suppression, real browser viewport/odd-count geometry/phone catalog visibility, syntax ingress/depth/include/printability and68dlong-bracket auto-close fill-in. No tests/browser/native/UI/provider/remote/mobile/folder/CI/global execution or completion credit. Previous account (preserved verbatim): Audit3717 removes6 authored/6finite checks in two whole thin-adapter/presentation suites. Deliberate real losses: ordinary recipe repository-URL withholding and provisioned-root credential scrubbing/forwarding; repository label lockstep suffix expansion, host-scoped map identity/collision grouping, Windows crosshost paths and WSL distro suffixes. Actual provision options, label/sort consumers and host/scrubber delegates inspected; no replacement/equivalence claim. Retain40 authored/84finite registrations raw exact in14 drivers with bounded owner/context review. Prior KEEP superseded for removed suites; no runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous account (preserved verbatim): Audit3714 removes8 authored/39finite checks: whole CLI selector-recovery, task display-text and ANSI grammar suites plus two name joiner/blank tables. Deliberate real losses: selector flag/value/identity and mutation recovery merge/serialization; exact task suffix, transcript fallback, input immutability, cache reuse and edited blocks; independent failed-escape/resumption and OSC/DCS/BEL/ST/C1/nested/unfinished stripping outputs; meaningful-language joiner preservation and invisible/blank-name rejection. These are real bounded alarms, removed as narrow supplied-error examples, helper/token inventories and repeated internal-work fixtures. Prior2936,1195/1196,1214/1215 and1082 KEEP superseded; no replacement or equivalent coverage claimed. Keep9authored/9finite raw-exact registrations in5surviving drivers: screenshot export/failure filesystem behavior, CLI local tree query, event-local reply provenance, vault role-sensitive content and four hostile/UTF16/dangling/tag-name regressions. No native/UI/provider/remote/mobile/folder/runtime/CI/global completion credit. Previous account (preserved verbatim): Audit3711 retires2authored/4finite cases by deleting whole clipboard-image-temp-file signature-to-name inventory (HEIC/TIFF/unrecognised bytes) and workspace-last-active switch-on supplied visit/reason singleton, plus its now-orphan test fixture. This intentionally loses real generated-filename suffix/extensionless alarms and real newer-visit archived7day versus inactive30day filtering/older-visit identity alarms. Filesystem writing and production reason pruning really execute; no equivalent replacement or universal absence of safety relevance is claimed. The clipboard test does not inspect written bytes, native delivery or decode; the visit test supplies candidate/timestamps and does not exercise persisted visit routing or actual removal.20authored/20finite cases remain unchanged across4bounded Git/sidecar/removal drivers. No new runner/test/module evaluation or runtime result; historical notes and receipts remain historical. Previous account (preserved verbatim): Audit3707 removes10 authored/11finite checks: three whole renderer adapter/assembled-stage suites and two native projection cases. Deliberate losses: plugin URL/ref/default-version/local-path and unsafe credential refusal forwarding; real Task hook/store A→B→A late-save/list/count fences, owner disappearance, legacy-host convergence, query/history/eviction and same-ID host history; native child append ordered-ID/replacement and compound fallback/order/optimistic-admission/child-turn/duplicate/shrink/revision alarms. These are real bounded alarms; removal follows thin adapter, manually assembled Task pipeline and repetitive fixture value judgment, with no replacement or equivalent coverage claim. Prior1179/1182,1220/1221 and1885 KEEP superseded as applicable. Keep36 authored/38finite registrations raw exact across13 surviving drivers. No runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous account (preserved verbatim): Audit3706 removes7authored/7potential cases from3renderer sources: whole usage-label3case and130000-distinct-day usage-overview singleton suites, plus3SSH grouping/ordinary-range examples. Retain11authored/11potential cases across6drivers in this bounded selection; no equivalent replacement or fresh runtime result. Existing bare root-unit commands admit this selection statically; prior command/receipt strings remain historical. Audit3706 intentionally retires first/second-order usage-group label collision alarms; equal50%-weekly bucket versus derived-weekly selection identity and Gemini wk label alarm;130000distinct-day aggregation no-spread-crash/max/intensity alarm; legacy absent-source SSH grouping and ordinary reverse-select/selected-target deselect range alarms. Actual label ambiguity and pathological-input crash are accepted losses. Distinct-day fixture spans~356years; no hard producer/date bound is claimed. Retained filtered-anchor/grouped-order guards do not replace removed deselection/reverse-range/legacy-group coverage. No native SSH, mounted renderer, live provider, remote/folder/mobile end-to-end or current runtime pass was obtained. Previous account (preserved verbatim): Audit3699 removes4 authored/4finite checks, including one whole xterm copy-policy suite and one root/group CLI help case. Deliberate losses: direct copy-chord admission for platform, selection, Kitty mode, defaultPrevented, logical/physical key and key phase; command-group disclosure and group help routing including claude-teams early return without RuntimeClient construction. These are real bounded policy/wiring alarms; no replacement or equivalent coverage claimed. Retain14 authored/19finite raw-exact registrations across6 drivers: unsafe CLI refusal, Claude model event carry and disk reconstruction/OSC-first case, attachment ownership/upload lifetime and mixed BMP file-reference/PNG-chip delivery, actual SQLite authority/admission/mutation, and Electron geometry/hit-testing. No runtime, CI, native-key delivery, external provider, mobile, remote, folder or global completion credit. Previous account (preserved verbatim): Audit3692 removes5 authored/5finite marginal Codex checks: unrelated login URL without notice; ordinary per-account launch resource/config materialization; no-retained-pane skip; preservation of a previously owed full scan through actual preparation and pending-marker update (no actual history scan/settlement); ordinary later-config refresh. Accept these exact branch/wiring alarms as deliberate losses without replacement. Retain32 authored/34finite raw callbacks/registrations/table bytes exact across14suites, including credential/admission refusal, grace/reset readiness, filesystem ownership, commit-dependent queue state, streaming/host trust, path canonicalization and private-state preservation. All14whole suites challenged without keeper quota; no whole deletion warranted on current concrete signals. No runtime/CI/native WSL/remote/mobile/folder/global completion credit Previous account (preserved verbatim): Audit3691 removes two complete runtime-home routing singleton suites (2 authored/2 finite): catalog wrapper mirror login-copy and passive transcript-lookup filesystem noncreation. Exact accepted losses are recorded in knownGaps; no replacement or equivalent coverage claimed. Audit3691: no dedicated alarm remains in the deleted sources for post-launch system login import through prepareHostCodexHomeForReadOnlyAppServer, or for repeated missing-transcript lookups leaving removed Codex account/runtime directories absent and userData entries unchanged. Ownership-marker read avoidance was never independently measured. No real catalog probe, provider, native Windows or crash was validated by those fixtures. Previous account (preserved verbatim): Audit3686 current Claude profile/account review removes5 authored/5 finite cases: whole structured-auth diagnostic-label suite3 and Windows-only command suite1 whose advertised cache alarm is ineffective because cache lifetime is per invocation; remove duplicate setup namespace-link refusal1 at wrapper layer. All5 exact historical KEEP are consciously superseded. Retain49 authored/50 finite unchanged, including filesystem privacy/recovery, route identity and concurrency, built worker/helper, legacy WSL alias compatibility and sign-in handoff. These are deliberate coverage losses without replacement. No runtime/CI/native WSL/macOS Keychain, remote/mobile/folder or global completion credit. Explicit accepted real losses: unknown-account host fallback and mixed-version/WSL-only structured auth diagnostic labels; Windows-only sentinel ENOENT-to-friendly-error translation plus fresh-call successful dispatch smoke; setup catch-to-refused wrapper and no-write outcome for a namespace symlink. The command case does not discriminate removal of its per-invocation noncache guard; it still supplies the error-translation alarm, which is intentionally retired. No replacement/equivalence promise. Previous account (preserved verbatim): Audit3680 removes eleven authored/eleven finite unit cases across four files, including entire launch setup row projection, structured legacy-model metadata, and legacy classifier suites. Accept loss of exact row partition/start selection, Codex supersession/default/unknown and Claude alias/suffix folding examples, other-agent exemption, getter/cache read budgets, same-array per-agent cache isolation, replaced-catalog metadata, and tracked-only model exclusion from structured and PTY legacy inventories. These are real narrow policy/metadata alarms intentionally retired without equivalent replacements. Retain real menu collapse/reopen in dropdown/select, AI picker cancel/accept and stale-effort filing, IME carry/gesture/frame transitions, and typed-flip versus held-dispatch fencing. No production or shared fixtures change. No dead timing entry exists for the three deleted drivers; retained timing keys stay unchanged. Static source-value review only; no project import, test runner, native/app execution or runtime validation established. Earlier receipts retain historical scope. Previous account (preserved verbatim): Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit. Previous account (preserved verbatim): Audit3672 renewed by3676 removes four authored/four finite cases from federation-output.test.ts: nominal show/read routing and terminal-fallback projection; initial archive-table SELECT failure returning retained/no-close; simulated old-peer read/fleet/refusal and method inventory; and absent archive-release capability refusing release. These actual compatibility/guard alarms are intentionally lost without equivalent replacement; the dropped-table case never reaches capture or commit. Current selected frontier9 becomes5: retain actual temporary transcript parsing/path omission, current no-transcript release/unavailable-output/restart/replay regression, and three home deadline/stop nonmutation cases. Prior held-capture case was already removed upstream and receives no new removal credit; prior redacted snapshot archive behavior was rewritten upstream and is not claimed retained here. The surviving driver timing entry stays. Static review/private composition only; no actual peer/network/native/platform or fresh runtime validation. Previous account (preserved verbatim): Audit3671 removes14 authored/32 finite root-unit cases, including the whole WSL move-handler refusal suite, WSL preload object-presence suite and internal gate spelling truth table. Also retire the weak withheld-command non-array shape assertion, static serve-only Add/capability/mock-remove example, grammar scope equality and basic configuration/payload schema roundtrips. Genuine wrong-window/malformed-request/gate-before-work, exact gate spellings/platform/argv precedence, static serve-only routing, declaration mismatch and empty grammar/pair admission alarms are consciously lost without replacement; prior KEEP decisions are reconsidered. Seven unchanged authored/finite root-unit cases retain real image/provider/line budgets, live policy transition/capability broadcast, grammar resource/reference traversal and strict-versus-tolerant literal salvage. Source-value evidence only; no runner/compiler/build/app/native/provider/remote/mobile/folder validation or historical fault claim. Independently remove one authored/finite Playwright closed-gate app-boot inventory: accept loss of real renderer/preload/main refusal composition, saved-host row and Add/Move hiding/Remove visibility alarms. Keep the unchanged scripted-move rendered dialog lifecycle/reload case. It runs no real WSL migration, host connection, file copy or automation restoration. No selector or Playwright participation cleanup is required because the spec remains. Previous account (preserved verbatim): Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence. Audit3634: Remove five authored/five finite cases, including the complete structured chat terminal-refusal, terminal-plus-agent worker-start validation, and canonical Git common-directory parser suites. Also remove the gh free-text -R argument projection case. Consciously supersede prior KEEP decisions and accept chat-versus-stale redirect classification, real RPC refusal-before-SQLite-Dispatch, old-Git echoed-option relative-path parsing, WSL execution-space resolution, and free-text preservation/bare-repo qualification alarms. These are genuine narrow alarms, intentionally retired without equivalent replacements. Retain real Git stdin/EOF delivery, bound-account host admission, naming environment/account precedence, upload iterator cancellation and remote path confinement. Shared fixtures and production code remain. Remove only the dead canonical-repo-key timing entry. Static source-value evidence only; all prior evidence retains historical scope. Audit3636: Remove the entire maintenance opportunity internal-count driver (one authored/two finite cases), the mocked remote worker start-card argument case (one/one), and the follow-up heading mapping table (one/two). Root-unit discovery loses three authored/five finite cases. Independently remove four Python native screenshot methods/five statically enumerated subTest scenarios: grim argv/stub payload, failure-code mapping, X11 mocked capture payload, and capability flags. The Python lane is verify:computer-native and is not root Vitest. Accept loss of exact native command/projection and exception/capability alarms, ready-only card publication arguments/agent forwarding, and serialized follow-up heading mapping; no equivalent replacement is claimed. Retain actual ownership/mail/queue/reopen transitions, remote lost-response fencing and first-result settlement, filesystem/maintenance admission and successor progress, wrong-region screenshot refusal and Sway geometry. The whole-deleted new driver has no timing key; this component requires no timing cleanup. No production changes. Static source-value review only; no project import, runner, app, native desktop or runtime validation established. All prior evidence retains historical scope. Audit3629 removes two singleton parser suites: WSL Claude plugin metadata out-of-range index rejection and Git checkout unlink-warning path extraction. Their real range-refusal and quoted-path extraction alarms are intentionally lost without replacement; no WSL execution, checkout recovery or equivalent remaining coverage is claimed. Audit3630 removes the sole orphan automation availability test (1 authored/1 finite). Its real policy kind, orphan precondition, delete/toggle enablement and run/edit refusal alarms are intentionally lost. The test did not dispatch an action, enforce a server generation fence or observe a remote mutation. No equivalent replacement, actual renderer/transport execution or new platform/provider evidence is claimed. Previous account (preserved verbatim): Audit3628: remove the entire one-authored/one-finite RepositoryRemoveProjectSection happy-dom suite. Accept losing the local zero-to-one-terminal stale-count revalidation alarm: first confirmation defers the removal callback and second confirmation invokes it after the count snapshot updates. The test never asserts updated warning text/count, actual terminal creation or removal/PTY teardown, host/scope routing, cancellation or folder/mobile behavior. No equivalent replacement or end-to-end warning-before-teardown proof asserted. Static evidence only; historical receipts retain original scope. Audit3624: Remove one authored/five finite positive Gemini identity table from the Claude/Gemini title collision driver. The real normalization, legacy label and explicit title evidence owners execute, so ordinary Gemini marker/name/wrapper recognition and normalized-label composition alarms are consciously retired without equivalent replacement; these five supplied title-to-literal identity examples have low marginal value. Preserve the six-row Claude task-text collision oracle, whose unrelated CLI mentions must not rebrand or destructively normalize titles. The other audited drivers preserve real permission-mode session transitions, prompt secret/fence/bounds defenses, JSON-to-Ask option/preview preservation, and optional GitLab failure summary/trace composition. Root-unit discovery loses one authored/five finite cases; no whole driver or timing key is removed. No actual terminal stream, UI routing, application/native or runtime execution established; all prior evidence retains historical scope. Audit3618: Remove three authored/three finite browser reload cases, including the complete renderer reload-actions suite. Agent bridge fake did-fail-load plus permanently supplied manager error projects description/code into a rejection. Renderer seeded empty metadata projects a saved URL into plain webview src; its earlier not-ready case projects a live-id/throwing fake reload into absence of a loading patch. Real queue/wait/error/cache/classifier/hook code executes, but these narrow supplied-state and exception-to-callback wirings have low marginal value; no rerender, lifecycle, actual cache generation/retirement or guest commit is asserted. Explicitly supersede audit1822 not-ready KEEP and preliminary3617 cross-module retain opinion, accepting offline-reload failure reporting, empty guest to saved URL routing, native-reload bypass and premature-loading/stranded-state alarms without replacement. Retain distinct main cancellation queue progression and absent queued side-effect dispatch. Root-unit discovery loses three/three. No Electron guest, network failure, restored navigation/commit, app/native focus or runtime execution established; earlier evidence retains its historical scope. Audit3614: Remove thirty-one authored/thirty-nine finite potential cases across CLI format and argument drivers, including three whole suites: search-result/status sanitation sites, Linear issue/list/warning sanitation sites, and quote-stripped JSON diagnostic secret non-echo. Those real formatter/guard transformations execute on supplied strings; intentionally retire their field-specific CSI/OSC/C1/newline/bell and diagnostic secrecy alarms as low-value caller/output inventories, without replacement. Also retire twenty-one search registrations/twenty-four finite cases covering minimal positional request/default omission, exhaustive all-flags request projection, nominal named query/index routes, repeated syntax/agent examples, enum/agent/path-count/timestamp/numeric/cursor admission examples, unknown/browser flag examples and postcommand last-wins projections; retire one parser sentinel-only case. Keep actual ambiguity, conflicting index request, precommand/crosscommand scoping, variadic reference parsing and missing-repeatable-value controls, without claiming equivalent coverage. Root-unit discovery loses all twenty-nine/thirty-seven. No CLI/RPC/terminal/PowerShell/host/schema/runtime execution is established by this source-only audit; earlier evidence retains its historical scope. Audit3613: remove six authored/six finite callbacks, including whole reviewer-display oversize-input and explorer-root record-filter suites, plus plugin family-emoji/invisible-only-name and pool legacy-name/urgent-countdown samples. Accept losing oversized-input empty-result/no-split, malformed-record/prototype-sensitive-key/nonstring filtering, exact ZWJ family preservation, invisible-only name refusal, no-group old-host full-name preservation, and80/79/null-reset countdown composition alarms. No equivalent replacement asserted. Retained strict/runtime sanitization, SVG parser, mobile focus recovery and collision/tie cases have different scopes. Static evidence only; historical receipts retain original scope. Audit3609: Remove the complete pnpm CLI invocation literal-selection suite (eleven authored/nineteen finite potential cases), with no replacement claimed. Root-unit discovery loses JavaScript-versus-native command selection, npm/npx executable rejection, Windows cmd/bat casing and shell selection, non-Windows cmd behavior, native PNPM_HOME flat/bin preference, explicit-path priority, relative-home rejection, missing-native fallback and non-Windows home-probe refusal alarms. The suite called the real resolver with independently expected objects, but exercised no pnpm/node/cmd process, installed native executable or real filesystem probe. Earlier KEEP decisions are consciously superseded by accepting these narrow branch and probe-inventory alarms as low value. Real symlink entry, Git signing isolation, Bun filesystem/Node child normalization and compiler scheduling/continuation tests remain distinct tests, not equivalent coverage. No runner, compiler, app, platform or remote execution was performed in this source-only audit. Earlier evidence retains its historical scope. Audit3608: remove five authored/five finite callbacks, including whole owner-slug and remote favicon URL suites and two repository-label projections. Lose five owner acceptance samples, eleven negative owner samples plus nonstring refusal, six host-local icon refusal samples, legacy-SSH same-path label-map cardinality, and explicit runtime ownership over stale legacy metadata at label level. These are accepted narrow grammar/presentation alarms with no equivalent replacement claimed. Retained binary parser, React recovery and label grouping/platform cases do not replace these losses. Static evidence only; historical receipts retain their original scope. Audit3606 adopts the enhanced3604/3605 icon cuts: nine authored/nine finite cases removed, including the whole tray-attention-icon suite. Retires the no-encoder oversized-upload null sample, missing-ID/request-order sample, encoder-null PNG-prefix fallback, SVG/404 rejection samples, transparent amber-dot placement and half-alpha white-tint sample, exact small fetched-byte passthrough, host-qualified image-key inventory and constant-encoder large-upload projection. These specific admission, formatting and bitmap alarms are intentionally lost without equivalent replacements. Retained queue/cache, bounded fetch and Dock lifecycle checks do not establish actual raster decoding, native image conversion or rendered appearance. Historical receipts below are preserved evidence for earlier test sets, not fresh validation of this reduced selection. Audit3601 scope: remove the whole custom-sound happy-path IPC suite and one custom-label/multiline notification formatting example (2 authored/2 finite). Intentionally lose configured .ogg selection, exact byte/MIME success wiring, successful dispatch for the formatting fixture, custom-label whitespace/title normalization and assistant-body whitespace/180-character-cap alarms. Retain prompt-exclusion, persisted qualified dismissal/restart, theme ownership/restore and Ghostty precedence/collision cases; none replaces the retired sound/formatting alarms. No actual playback, native delivery, phone/network, cross-platform or new runtime evidence is claimed; historical execution keeps its original scope. Audit3598: Remove seven authored/nine finite literal-table potential test registrations across workflow routing, Claude cold-start and real-zsh preexec drivers. Root-unit discovery loses six authored/six finite: three test-local workflow parser fixtures, the five-positive/three-negative explicit command-paint route inventory, a boot-banner-before-composer sample and an already-painted bare-title positive sample. The separately selected shell_contracts live-shell driver loses one authored/three finite raw-capture paint-only cases across three hook configurations; its real-wrapper launch-order, four rechunkings (twelve finite) and runtime-wait replay remain, without claiming equivalent replacement. Intentionally lose those parser, exact routing-list, banner, post-paint subscription and native-read-boundary paint alarms. Retained workflow/UNIT_EXCLUDE/classifier cross-source routing checks and readiness-race-to-writer timing are distinct bounded alarms. No runner, real shell, PTY, app, native focus, remote delivery, cross-platform execution or full-feature correctness is established by this source-only audit. Earlier evidence retains its historical scope. Audit3597 scope: remove two renderer-hang-capture examples (2 authored/2 finite): an invalid repeated-token oversized reducer fixture and a shorter unanswered-request fixture. Intentionally lose the direct truncated flag/sanitized frame fixture and request-pending status/zero-sample alarms. Retain window-death/stale-result exclusion, generation reconciliation, and baseline-publication cancellation lifecycles; they are not equivalent bound, redaction or pending-status replacements. Historical execution retains its original source scope; no new runtime evidence is claimed. Audit3591: Retire the whole one-case background journal-producer attribution suite and the fabricated malformed-details-block case (two authored/two finite cases). Intentionally lose the fixed own-task versus output/foreign-task attribution examples across flat/message row shapes, missing-root classification, and direct unbalanced/detailsish fabricated-block rejection alarms. Retained parser sibling/depth and editor navigation tests do not replace these alarms. No equivalent replacement or fresh runtime, transport, persistence, native focus or rendered UI validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3592: Retire the whole three-case shared agent smart-key resolver suite, explicitly superseding its Audit3238/3237 keep decisions. Intentionally lose literal permission-versus-question classification, longest-question digit selection, Codex async-question opener/digit/Enter/skip mapping, and unsupported-agent/state/prompt refusal examples. These were real parser/selection and literal-byte alarms; they did not exercise terminal delivery or timing. No equivalent replacement or fresh runtime, native TUI, mobile, remote or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3587/3588: Retire six authored/fourteen finite cases, including the whole WSL stopped-notice and connecting-status selector suites. Intentionally lose direct WSL retry connection field/target/ready-epoch/null-guard examples, connecting/reconnecting distro and absent-state selector samples, and stopped/connecting notice text/button/data-attribute examples. Retained host-ready retry and content-loader/reload lifecycles do not replace these alarms. No equivalent replacement or fresh runtime, native WSL, remote, rendered UI or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed. Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions. Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Deterministic main-IPC contract tests cover disconnect-driven close delivery, exactly-once close, per-subscription teardown isolation against a failing socket close and a throwing liveness probe, containment of a throwing renderer send on the unguarded host-close path, and continued suppression of stale payloads from a retired transport. A headed paired-server journey (real Orca host plus a separate paired Orca desktop client) covers hidden-but-mounted reveal, cold-parked reveal, and cold-parked reveal across a disconnect/reconnect. Live Linux and Windows paired-server evidence and real sleep/wake transport loss remain uncollected.",
"motivatingLinks": ["tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts"],
"invariant": "Every renderer-held runtime subscription receives exactly one terminal close event when its transport is retired, including when the retirement advanced the transport generation first, and a single failing teardown never abandons that environment's remaining subscriptions nor escapes into the transport that reported the close. Payload frames from a retired transport stay suppressed. A revealed remote terminal therefore reattaches over a live multiplex connection: its buffer restores, typed input reaches the host PTY, the echo paints without a tab flip, and the PTY converges on the revealed pane grid.",
- "oracle": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): The main IPC contract test subscribes terminal.multiplex through the real handler, disconnects the environment, and asserts the renderer received exactly one {type: close} subscription event. Two isolation tests subscribe a second stream to the same environment and make the first one fail -- in its socket close, and in the liveness probe inside notifyClosed -- then assert the disconnect does not throw, both transports closed, and every close the renderer could still receive was delivered. A third drives a host-initiated close through the transport callback, which is the one notifyClosed call site with no surrounding guard, with a renderer send that throws, and asserts it cannot escape into the WebSocket close handler. A fourth test asserts that after retirement a late response frame is not forwarded and a late transport close does not re-send. The paired-server journey runs three reveal scenarios against one real host and one real paired desktop client, and for each records buffer restore, host-side receipt of the typed marker through an out-of-band host sink file, live paint without a tab flip, and PTY-versus-pane grid convergence.",
+ "oracle": "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed. Historical prior account (preserved verbatim): Audit3814 deliberately retires60 authored/60 finite cases:53runtime compatibility cases,4native XCTest methods and3Python clipboard methods, including the entire StableElementIndexes suite. Clipboard cuts retire the one-over-cap sample, incoming-offer destruction trace and sequential20-copy replay; actual wire, FD/pipe, startup and Xvfb/GTK boundaries remain without equivalent replacement claims. Accepted losses include narrow terminal-send payload/provider projections, legacy and direct no-op/error permutations, timing/work-count examples, private state/title/activity projections and fixture-driven readiness examples, individually enumerated below. These include real bounded production alarms consciously retired for marginal value; retained failed writes, duplicate submission, stale capture, transcript/ring and allocation fences are not equivalent replacements. No fresh native/remote/browser execution or complete transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3806 deliberately retires40 authored/40 finite runtime compatibility cases, including the terminal-side-effect-facts-part03 headless-snapshots-part02 and agent-status-and-waits-part03 fragments, plus20 scalar Swift precondition sites. Lost runtime alarms include status/title/attention projection examples, simple renderer/headless frame restoration and status waiting outcomes detailed in the accepted-loss ledger. Swift cuts retire duplicate generation-map/schema/navigation/bridge and notification-wrapper assertions; no standalone native program is deleted. These include real bounded production alarms consciously retired for marginal value. Retained races, pending writes/reflow, namespace and waiter ownership are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3798 deliberately retires21 authored/24 finite compatibility cases, including the entire SSH-worktree-lifecycle and repository-project-operations fragments. Accepted losses include navigation-only settings acknowledgement, browser session cleanup and host preservation projections, window positive/policy-state examples, terminal recovery/reload and no-incarnation remint examples, terminal listing compatibility/malformed IDs, directory browse/sort/Windows path smoke, SSH create refusal/manual lineage, recursive parent-folder creation and fork/origin/avatar/icon projections. Real bounded production alarms are consciously retired for marginal value; retained authority races, cleanup/clone ownership, pending waiters, nested-folder and scan invalidation cases are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3788 retires10 authored/11 expanded cases across six changed drivers, including the entire screencast pending-frame-retry and usage-source-cache-streaming suites. Deliberate losses are false-refused last-frame retry/once-only delivery, ordinary stable-pane reattachment, cleared-chat Dispatch completion, terminal-declared chat-caller refusal, at-rest worker liveness projection, nested depth/cap policy, small unsigned6/sealed7 plain-format and verified-bit examples, generic malformed-ISIZE footer refusal examples, and synthetic10k/100k chunk-size/work-count budgets in gzip and general cache I/O. These include real state/disk/RPC outcomes consciously retired for marginal value; retained E2EE-backlog, receipt/custody/uncertain-ack, integrity/migration and staging-cleanup cases are not equivalent replacements. The footer test did not prove early rejection or bounded allocation; staging cleanup did not seed unrelated files. No replacement or fresh native/remote/performance execution is claimed. Earlier raw selectors and dated receipts remain historical. Audit3779 retires17 authored/17 expanded registrations across six changed drivers, including the entire shared-Codex-home and prompt-telemetry suites. Accepted losses are shared-home wrapper noninterference/opt-out preservation, mocked metric count/provenance filters, SSH activity labeling/clearing and handover idle timing, VM ownership/capability/status projections and asleep-worktree refusal, a link-only external conversation replay sample, and two narrow input-credit noninterference/expiry examples. Retain the direct exact-tab/single-use input-credit case. These bounded real disk/state/routing alarms are intentionally retired for marginal value without equivalent replacement or fresh execution claims; earlier receipts remain historical. Audit3772 retires18 authored/27 expanded cases, including whole Codex service opt-out, RPC capability-parser, creator-provenance, short-ciphertext and readiness-null suites. Accepted losses include service ledger/symlink/mode cleanup, user TOML substring preservation, old-hash cleanup, description pass-through, malformed-file/pending-hash examples, coordinator write/probe counts, capability array bounds, positive creator projections, early short-payload refusal and readiness helper null shape. Two redundant Codex exit-cause rows are also retired; Pi shares their direct-idle path only in this empty-output immediate-exit fixture, and future agent-config drift coverage is lost. Real bounded filesystem/parser/runtime alarms are deliberately retired for marginal value; no equivalent replacements or fresh execution are claimed. Earlier receipts retain their historical scope. Audits3754/3755 intentionally remove9 authored/9 finite registrations: the entire one-case usage-source-cache-streaming.test.ts driver and8 cases from the surviving computer-action-validation.test.ts driver. This gate retains an unfiltered root Vitest command; UNIT_INCLUDE admits both source paths. Accepted losses are the real encoder output chunk-size/work-count alarm on repetitive10k/100k ownership payloads through a mocked durable sink, plus CLI diagnostic precedence, fractional window-id rejection, action-call-site window-target exclusivity, plain-text click-count recovery copy, incomplete click/drag targeting, mouse/modifier/direction allowlist samples and inline/stdin text exclusivity. These CLI cases exercise real argument/handler validation before mocked runtime calls; they are deliberately retired for marginal value, not declared tautologies. Retained cache I/O and CLI cases are not equivalent replacements for these alarms. Existing historical raw receipts remain unchanged and do not validate the deleted or reduced drivers. No fresh execution claim is made. Audits3758/3763 intentionally remove9 authored/11 finite registrations from6 changed drivers, including the entire pane-title-notification, window-linear-notices and worktree-card-lifecycle-effects suites. This gate retains an unfiltered root Vitest command admitting these paths. Accepted losses are same-account linked-row success-notice fanout, sidebar-switch channel forwarding, Linear-only notification forwarding/non-terminal-consumer selection/closed-window detach, destroyed-window refusal and first-send-failure suspension through the pane-title adapter, the100-card synthetic focus/poll absence sample, stored-source local folder badge refresh, unobserved-row badge refusal, and immediate reposChanged lineage invalidation. These exercise real owners with controlled ports; they are retired for marginal value, without equivalent replacement claims. The no-badge-work fixture does not seed its title-promised collection-only cache. Preserved historical receipts do not validate deleted or reduced drivers; no fresh execution is claimed. Audit3759 retires the entire one-case Tailwind compiler/scanner smoke. Accept loss of the direct CSS production/test/spec source-exclusion and rescan alarm; no replacement or current execution is claimed. Audit3752 independently approves audit3749: retire five authored/five finite watcher-process registrations, retaining18 raw-exact registrations. Accept loss of healthy shared-pool joint recovery, last-pending-failure idle retirement/respawn, late VITEST fallback release, missing-entry fail-closed selection and independent-supervisor fuse locality alarms. These are real bounded host-policy alarms intentionally retired for low marginal value; no equivalent replacement is asserted. Remaining driver selections exercise controlled FakeChild supervisor lifecycle, cancellation, physical-exit fencing, recovery and fuse behavior. This source review supplies no fresh native/process/platform/remote/SSH execution; historical receipts retain original source and selector scopes. Previous oracle (preserved verbatim): Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered root Vitest command. Current UNIT_INCLUDE admits the partial push-service, metadata-dialog and two config/scripts browser drivers:10 authored/16 finite removals. Accepted losses: actual retry30s/60s progression and register bucket/refill wiring, explicit seven-day lease arithmetic (its notification lacked seq/epoch and never reached send), equal-name edit latch/save payload, real image/font/meta-refresh/form/popup browser refusal controls, and broad rich-markdown bridge/command/edit-select smoke. Actual production state, callback routing and browser enforcement run in these cases; these alarms are deliberately retired on marginal value. All drivers and selectors survive. Existing unrelated receipts remain historical evidence for their unchanged selectors, not proof of the reduced cases. Audit3732 removes 2 authored/3 finite registrations from two partial suites: nominal custom/Kimi local naming success and deferred context usage row presentation. Real losses: custom/Kimi successful extraction through conversation-name sanitization and agentLabel composition; separate ordered counted/deferred lists and exact percentage/token formatting. No replacement or equivalent coverage claimed. Retain 11 authored/13 finite raw-exact registrations for bounded naming instruction/refusal/cancellation, menu dismissal focus ownership and hover/composer Escape/timer cleanup. Source-only bounded value review, no runtime/CI/native/remote/mobile/folder workspace or global completion credit. Previous oracle (preserved verbatim): Audit3733 removes2authored/2finite terminal input checks: fixed custom-cap error/secret fixture and three-emoji cap5refusal whose6UTF16units already trip length fast guard (no UTF8-dependent boundary). Accept exact non-disclosure/oversized-refusal alarm losses; no replacement/equivalence claim. Retain13/13scalar/pending input, OSC state and cron DST/cadence outcomes after bounded material reads. Source-only zero runtime/novelty credit; original historical reasons preserved. Previous oracle (preserved verbatim): Audit3729 removes1authored/3finite by deleting whole CLI runtime pairing advisory-close suite. Accept losing post-real-close injected EIO preservation of native/script/unreadable pairing, env identity/preservation and exact close/release assertions; no actual failed-close leak or replacement coverage claimed. Two retained URL grammar/identity suites11authored16finite raw unchanged. Bounded source/owner/caller value review, zero novelty/runtime credit; other seven3724deferred closures remain. Historical receipts preserve original limits. Previous oracle (preserved verbatim): Audit3724 removes3authored/3finite checks by deleting two whole suites: TUI clear burst-size singleton and terminal-file-URL target two-case wrapper suite. Deliberate losses: derived widest burst<64byte alarm, UNC authority+line-column anchor composition, and malformed-percent null refusal. Real production algorithms execute in those tests; no mocked-output tautology, equivalent replacement, actual Claude/file-navigation delivery or universal safety-irrelevance claim. TUI58byte bound and URI examples have low marginal value as standalone suites. Actual1262/1264/1742KEEP superseded explicitly. Remaining14drivers83authored136finite raw unchanged. Bounded source-only review; ten closures deferred, four bounded keep judgments repeated with zero new semantic-frontier credit. No runtime/CI/native/remote/mobile/folder/global completion claim; historical receipts retain original scope. Previous oracle (preserved verbatim): Audit3723 removes 4 authored/4 finite registrations in two whole suites: keybinding cache freeze/token spellings and host-dependent Orca command name examples. Real losses include returned-object freeze, repeated Mod+P key, Space/PageDown/NumpadSubtract mapping, unknown/empty/prototype-token rejection, and headless Linux versus Windows-server/WSL command choice. No equivalent or replacement coverage claimed. Retain 12 authored/21 finite raw-exact registrations exercising generated scaffold validation, artifact failures, shipped editor/hook/worker/panel tests, actual generated typing compilation, independent CLI root routing and intent-name precedence. Source-only bounded audit; no runtime, CI, native, remote, mobile, folder workspace or global completion credit. Previous oracle (preserved verbatim): Audit3720 removes17authored/23finite checks: whole main catalog-date adapter2 and shared date-helper7, seven renderer nominal ranking/cap/no-date/composition cases, and one browser registration expanding to seven forced-container/DOM-child boundary cases. Deliberate real losses: community oldest-date UTC forwarding, official/undated omission, date sorting/window/invalid/future/skew/clamp and default/override cap; nominal ranking/cap and combined Featured/Newly-added outputs; real CSS459/460,719/720,1055/1056breakpoint, five-card partial-row and720px two-card first-row alarms. Browser cases really measure rendered geometry but force width/remove DOM children; no fake-pixel or tautology rationale. No replacement/equivalent coverage claimed. Retain14authored/19finite raw-exact registrations across4drivers: adversarial featured category/order/tie and installability, date order/window selection, actual PluginManager failure/escaping/duplicate-card suppression, real browser viewport/odd-count geometry/phone catalog visibility, syntax ingress/depth/include/printability and68dlong-bracket auto-close fill-in. No tests/browser/native/UI/provider/remote/mobile/folder/CI/global execution or completion credit. Previous oracle (preserved verbatim): Audit3717 removes6 authored/6finite checks in two whole thin-adapter/presentation suites. Deliberate real losses: ordinary recipe repository-URL withholding and provisioned-root credential scrubbing/forwarding; repository label lockstep suffix expansion, host-scoped map identity/collision grouping, Windows crosshost paths and WSL distro suffixes. Actual provision options, label/sort consumers and host/scrubber delegates inspected; no replacement/equivalence claim. Retain40 authored/84finite registrations raw exact in14 drivers with bounded owner/context review. Prior KEEP superseded for removed suites; no runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous oracle (preserved verbatim): Audit3714 removes8 authored/39finite checks: whole CLI selector-recovery, task display-text and ANSI grammar suites plus two name joiner/blank tables. Deliberate real losses: selector flag/value/identity and mutation recovery merge/serialization; exact task suffix, transcript fallback, input immutability, cache reuse and edited blocks; independent failed-escape/resumption and OSC/DCS/BEL/ST/C1/nested/unfinished stripping outputs; meaningful-language joiner preservation and invisible/blank-name rejection. These are real bounded alarms, removed as narrow supplied-error examples, helper/token inventories and repeated internal-work fixtures. Prior2936,1195/1196,1214/1215 and1082 KEEP superseded; no replacement or equivalent coverage claimed. Keep9authored/9finite raw-exact registrations in5surviving drivers: screenshot export/failure filesystem behavior, CLI local tree query, event-local reply provenance, vault role-sensitive content and four hostile/UTF16/dangling/tag-name regressions. No native/UI/provider/remote/mobile/folder/runtime/CI/global completion credit. Previous oracle (preserved verbatim): Audit3711 retires2authored/4finite cases by deleting whole clipboard-image-temp-file signature-to-name inventory (HEIC/TIFF/unrecognised bytes) and workspace-last-active switch-on supplied visit/reason singleton, plus its now-orphan test fixture. This intentionally loses real generated-filename suffix/extensionless alarms and real newer-visit archived7day versus inactive30day filtering/older-visit identity alarms. Filesystem writing and production reason pruning really execute; no equivalent replacement or universal absence of safety relevance is claimed. The clipboard test does not inspect written bytes, native delivery or decode; the visit test supplies candidate/timestamps and does not exercise persisted visit routing or actual removal.20authored/20finite cases remain unchanged across4bounded Git/sidecar/removal drivers. No new runner/test/module evaluation or runtime result; historical notes and receipts remain historical. Previous oracle (preserved verbatim): Audit3707 removes10 authored/11finite checks: three whole renderer adapter/assembled-stage suites and two native projection cases. Deliberate losses: plugin URL/ref/default-version/local-path and unsafe credential refusal forwarding; real Task hook/store A→B→A late-save/list/count fences, owner disappearance, legacy-host convergence, query/history/eviction and same-ID host history; native child append ordered-ID/replacement and compound fallback/order/optimistic-admission/child-turn/duplicate/shrink/revision alarms. These are real bounded alarms; removal follows thin adapter, manually assembled Task pipeline and repetitive fixture value judgment, with no replacement or equivalent coverage claim. Prior1179/1182,1220/1221 and1885 KEEP superseded as applicable. Keep36 authored/38finite registrations raw exact across13 surviving drivers. No runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous oracle (preserved verbatim): Audit3706 removes7authored/7potential cases from3renderer sources: whole usage-label3case and130000-distinct-day usage-overview singleton suites, plus3SSH grouping/ordinary-range examples. Retain11authored/11potential cases across6drivers in this bounded selection; no equivalent replacement or fresh runtime result. Existing bare root-unit commands admit this selection statically; prior command/receipt strings remain historical. Audit3706 intentionally retires first/second-order usage-group label collision alarms; equal50%-weekly bucket versus derived-weekly selection identity and Gemini wk label alarm;130000distinct-day aggregation no-spread-crash/max/intensity alarm; legacy absent-source SSH grouping and ordinary reverse-select/selected-target deselect range alarms. Actual label ambiguity and pathological-input crash are accepted losses. Distinct-day fixture spans~356years; no hard producer/date bound is claimed. Retained filtered-anchor/grouped-order guards do not replace removed deselection/reverse-range/legacy-group coverage. No native SSH, mounted renderer, live provider, remote/folder/mobile end-to-end or current runtime pass was obtained. Previous oracle (preserved verbatim): Audit3699 removes4 authored/4finite checks, including one whole xterm copy-policy suite and one root/group CLI help case. Deliberate losses: direct copy-chord admission for platform, selection, Kitty mode, defaultPrevented, logical/physical key and key phase; command-group disclosure and group help routing including claude-teams early return without RuntimeClient construction. These are real bounded policy/wiring alarms; no replacement or equivalent coverage claimed. Retain14 authored/19finite raw-exact registrations across6 drivers: unsafe CLI refusal, Claude model event carry and disk reconstruction/OSC-first case, attachment ownership/upload lifetime and mixed BMP file-reference/PNG-chip delivery, actual SQLite authority/admission/mutation, and Electron geometry/hit-testing. No runtime, CI, native-key delivery, external provider, mobile, remote, folder or global completion credit. Previous oracle (preserved verbatim): Audit3692 removes5 authored/5finite marginal Codex checks: unrelated login URL without notice; ordinary per-account launch resource/config materialization; no-retained-pane skip; preservation of a previously owed full scan through actual preparation and pending-marker update (no actual history scan/settlement); ordinary later-config refresh. Accept these exact branch/wiring alarms as deliberate losses without replacement. Retain32 authored/34finite raw callbacks/registrations/table bytes exact across14suites, including credential/admission refusal, grace/reset readiness, filesystem ownership, commit-dependent queue state, streaming/host trust, path canonicalization and private-state preservation. All14whole suites challenged without keeper quota; no whole deletion warranted on current concrete signals. No runtime/CI/native WSL/remote/mobile/folder/global completion credit Previous oracle (preserved verbatim): Audit3691 removes two complete runtime-home routing singleton suites (2 authored/2 finite): catalog wrapper mirror login-copy and passive transcript-lookup filesystem noncreation. Exact accepted losses are recorded in knownGaps; no replacement or equivalent coverage claimed. Audit3691: no dedicated alarm remains in the deleted sources for post-launch system login import through prepareHostCodexHomeForReadOnlyAppServer, or for repeated missing-transcript lookups leaving removed Codex account/runtime directories absent and userData entries unchanged. Ownership-marker read avoidance was never independently measured. No real catalog probe, provider, native Windows or crash was validated by those fixtures. Previous oracle (preserved verbatim): Audit3686 current Claude profile/account review removes5 authored/5 finite cases: whole structured-auth diagnostic-label suite3 and Windows-only command suite1 whose advertised cache alarm is ineffective because cache lifetime is per invocation; remove duplicate setup namespace-link refusal1 at wrapper layer. All5 exact historical KEEP are consciously superseded. Retain49 authored/50 finite unchanged, including filesystem privacy/recovery, route identity and concurrency, built worker/helper, legacy WSL alias compatibility and sign-in handoff. These are deliberate coverage losses without replacement. No runtime/CI/native WSL/macOS Keychain, remote/mobile/folder or global completion credit. Explicit accepted real losses: unknown-account host fallback and mixed-version/WSL-only structured auth diagnostic labels; Windows-only sentinel ENOENT-to-friendly-error translation plus fresh-call successful dispatch smoke; setup catch-to-refused wrapper and no-write outcome for a namespace symlink. The command case does not discriminate removal of its per-invocation noncache guard; it still supplies the error-translation alarm, which is intentionally retired. No replacement/equivalence promise. Previous oracle (preserved verbatim): Audit3680 removes eleven authored/eleven finite unit cases across four files, including entire launch setup row projection, structured legacy-model metadata, and legacy classifier suites. Accept loss of exact row partition/start selection, Codex supersession/default/unknown and Claude alias/suffix folding examples, other-agent exemption, getter/cache read budgets, same-array per-agent cache isolation, replaced-catalog metadata, and tracked-only model exclusion from structured and PTY legacy inventories. These are real narrow policy/metadata alarms intentionally retired without equivalent replacements. Retain real menu collapse/reopen in dropdown/select, AI picker cancel/accept and stale-effort filing, IME carry/gesture/frame transitions, and typed-flip versus held-dispatch fencing. No production or shared fixtures change. No dead timing entry exists for the three deleted drivers; retained timing keys stay unchanged. Static source-value review only; no project import, test runner, native/app execution or runtime validation established. Earlier receipts retain historical scope. Previous oracle (preserved verbatim): Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit. Previous oracle (preserved verbatim): Audit3672 renewed by3676 removes four authored/four finite cases from federation-output.test.ts: nominal show/read routing and terminal-fallback projection; initial archive-table SELECT failure returning retained/no-close; simulated old-peer read/fleet/refusal and method inventory; and absent archive-release capability refusing release. These actual compatibility/guard alarms are intentionally lost without equivalent replacement; the dropped-table case never reaches capture or commit. Current selected frontier9 becomes5: retain actual temporary transcript parsing/path omission, current no-transcript release/unavailable-output/restart/replay regression, and three home deadline/stop nonmutation cases. Prior held-capture case was already removed upstream and receives no new removal credit; prior redacted snapshot archive behavior was rewritten upstream and is not claimed retained here. The surviving driver timing entry stays. Static review/private composition only; no actual peer/network/native/platform or fresh runtime validation. Previous oracle (preserved verbatim): Audit3671 removes14 authored/32 finite root-unit cases, including the whole WSL move-handler refusal suite, WSL preload object-presence suite and internal gate spelling truth table. Also retire the weak withheld-command non-array shape assertion, static serve-only Add/capability/mock-remove example, grammar scope equality and basic configuration/payload schema roundtrips. Genuine wrong-window/malformed-request/gate-before-work, exact gate spellings/platform/argv precedence, static serve-only routing, declaration mismatch and empty grammar/pair admission alarms are consciously lost without replacement; prior KEEP decisions are reconsidered. Seven unchanged authored/finite root-unit cases retain real image/provider/line budgets, live policy transition/capability broadcast, grammar resource/reference traversal and strict-versus-tolerant literal salvage. Source-value evidence only; no runner/compiler/build/app/native/provider/remote/mobile/folder validation or historical fault claim. Previous oracle (preserved verbatim): Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence. Audit3634: Remove five authored/five finite cases, including the complete structured chat terminal-refusal, terminal-plus-agent worker-start validation, and canonical Git common-directory parser suites. Also remove the gh free-text -R argument projection case. Consciously supersede prior KEEP decisions and accept chat-versus-stale redirect classification, real RPC refusal-before-SQLite-Dispatch, old-Git echoed-option relative-path parsing, WSL execution-space resolution, and free-text preservation/bare-repo qualification alarms. These are genuine narrow alarms, intentionally retired without equivalent replacements. Retain real Git stdin/EOF delivery, bound-account host admission, naming environment/account precedence, upload iterator cancellation and remote path confinement. Shared fixtures and production code remain. Remove only the dead canonical-repo-key timing entry. Static source-value evidence only; all prior evidence retains historical scope. Audit3636: Remove the entire maintenance opportunity internal-count driver (one authored/two finite cases), the mocked remote worker start-card argument case (one/one), and the follow-up heading mapping table (one/two). Root-unit discovery loses three authored/five finite cases. Independently remove four Python native screenshot methods/five statically enumerated subTest scenarios: grim argv/stub payload, failure-code mapping, X11 mocked capture payload, and capability flags. The Python lane is verify:computer-native and is not root Vitest. Accept loss of exact native command/projection and exception/capability alarms, ready-only card publication arguments/agent forwarding, and serialized follow-up heading mapping; no equivalent replacement is claimed. Retain actual ownership/mail/queue/reopen transitions, remote lost-response fencing and first-result settlement, filesystem/maintenance admission and successor progress, wrong-region screenshot refusal and Sway geometry. The whole-deleted new driver has no timing key; this component requires no timing cleanup. No production changes. Static source-value review only; no project import, runner, app, native desktop or runtime validation established. All prior evidence retains historical scope. Audit3629 removes two singleton parser suites: WSL Claude plugin metadata out-of-range index rejection and Git checkout unlink-warning path extraction. Their real range-refusal and quoted-path extraction alarms are intentionally lost without replacement; no WSL execution, checkout recovery or equivalent remaining coverage is claimed. Audit3630 removes the sole orphan automation availability test (1 authored/1 finite). Its real policy kind, orphan precondition, delete/toggle enablement and run/edit refusal alarms are intentionally lost. The test did not dispatch an action, enforce a server generation fence or observe a remote mutation. No equivalent replacement, actual renderer/transport execution or new platform/provider evidence is claimed. Previous account (preserved verbatim): Audit3628: remove the entire one-authored/one-finite RepositoryRemoveProjectSection happy-dom suite. Accept losing the local zero-to-one-terminal stale-count revalidation alarm: first confirmation defers the removal callback and second confirmation invokes it after the count snapshot updates. The test never asserts updated warning text/count, actual terminal creation or removal/PTY teardown, host/scope routing, cancellation or folder/mobile behavior. No equivalent replacement or end-to-end warning-before-teardown proof asserted. Static evidence only; historical receipts retain original scope. Audit3624: Remove one authored/five finite positive Gemini identity table from the Claude/Gemini title collision driver. The real normalization, legacy label and explicit title evidence owners execute, so ordinary Gemini marker/name/wrapper recognition and normalized-label composition alarms are consciously retired without equivalent replacement; these five supplied title-to-literal identity examples have low marginal value. Preserve the six-row Claude task-text collision oracle, whose unrelated CLI mentions must not rebrand or destructively normalize titles. The other audited drivers preserve real permission-mode session transitions, prompt secret/fence/bounds defenses, JSON-to-Ask option/preview preservation, and optional GitLab failure summary/trace composition. Root-unit discovery loses one authored/five finite cases; no whole driver or timing key is removed. No actual terminal stream, UI routing, application/native or runtime execution established; all prior evidence retains historical scope. Audit3618: Remove three authored/three finite browser reload cases, including the complete renderer reload-actions suite. Agent bridge fake did-fail-load plus permanently supplied manager error projects description/code into a rejection. Renderer seeded empty metadata projects a saved URL into plain webview src; its earlier not-ready case projects a live-id/throwing fake reload into absence of a loading patch. Real queue/wait/error/cache/classifier/hook code executes, but these narrow supplied-state and exception-to-callback wirings have low marginal value; no rerender, lifecycle, actual cache generation/retirement or guest commit is asserted. Explicitly supersede audit1822 not-ready KEEP and preliminary3617 cross-module retain opinion, accepting offline-reload failure reporting, empty guest to saved URL routing, native-reload bypass and premature-loading/stranded-state alarms without replacement. Retain distinct main cancellation queue progression and absent queued side-effect dispatch. Root-unit discovery loses three/three. No Electron guest, network failure, restored navigation/commit, app/native focus or runtime execution established; earlier evidence retains its historical scope. Audit3614: Remove thirty-one authored/thirty-nine finite potential cases across CLI format and argument drivers, including three whole suites: search-result/status sanitation sites, Linear issue/list/warning sanitation sites, and quote-stripped JSON diagnostic secret non-echo. Those real formatter/guard transformations execute on supplied strings; intentionally retire their field-specific CSI/OSC/C1/newline/bell and diagnostic secrecy alarms as low-value caller/output inventories, without replacement. Also retire twenty-one search registrations/twenty-four finite cases covering minimal positional request/default omission, exhaustive all-flags request projection, nominal named query/index routes, repeated syntax/agent examples, enum/agent/path-count/timestamp/numeric/cursor admission examples, unknown/browser flag examples and postcommand last-wins projections; retire one parser sentinel-only case. Keep actual ambiguity, conflicting index request, precommand/crosscommand scoping, variadic reference parsing and missing-repeatable-value controls, without claiming equivalent coverage. Root-unit discovery loses all twenty-nine/thirty-seven. No CLI/RPC/terminal/PowerShell/host/schema/runtime execution is established by this source-only audit; earlier evidence retains its historical scope. Audit3613: remove six authored/six finite callbacks, including whole reviewer-display oversize-input and explorer-root record-filter suites, plus plugin family-emoji/invisible-only-name and pool legacy-name/urgent-countdown samples. Accept losing oversized-input empty-result/no-split, malformed-record/prototype-sensitive-key/nonstring filtering, exact ZWJ family preservation, invisible-only name refusal, no-group old-host full-name preservation, and80/79/null-reset countdown composition alarms. No equivalent replacement asserted. Retained strict/runtime sanitization, SVG parser, mobile focus recovery and collision/tie cases have different scopes. Static evidence only; historical receipts retain original scope. Audit3609: Remove the complete pnpm CLI invocation literal-selection suite (eleven authored/nineteen finite potential cases), with no replacement claimed. Root-unit discovery loses JavaScript-versus-native command selection, npm/npx executable rejection, Windows cmd/bat casing and shell selection, non-Windows cmd behavior, native PNPM_HOME flat/bin preference, explicit-path priority, relative-home rejection, missing-native fallback and non-Windows home-probe refusal alarms. The suite called the real resolver with independently expected objects, but exercised no pnpm/node/cmd process, installed native executable or real filesystem probe. Earlier KEEP decisions are consciously superseded by accepting these narrow branch and probe-inventory alarms as low value. Real symlink entry, Git signing isolation, Bun filesystem/Node child normalization and compiler scheduling/continuation tests remain distinct tests, not equivalent coverage. No runner, compiler, app, platform or remote execution was performed in this source-only audit. Earlier evidence retains its historical scope. Audit3608: remove five authored/five finite callbacks, including whole owner-slug and remote favicon URL suites and two repository-label projections. Lose five owner acceptance samples, eleven negative owner samples plus nonstring refusal, six host-local icon refusal samples, legacy-SSH same-path label-map cardinality, and explicit runtime ownership over stale legacy metadata at label level. These are accepted narrow grammar/presentation alarms with no equivalent replacement claimed. Retained binary parser, React recovery and label grouping/platform cases do not replace these losses. Static evidence only; historical receipts retain their original scope. Audit3606 adopts the enhanced3604/3605 icon cuts: nine authored/nine finite cases removed, including the whole tray-attention-icon suite. Retires the no-encoder oversized-upload null sample, missing-ID/request-order sample, encoder-null PNG-prefix fallback, SVG/404 rejection samples, transparent amber-dot placement and half-alpha white-tint sample, exact small fetched-byte passthrough, host-qualified image-key inventory and constant-encoder large-upload projection. These specific admission, formatting and bitmap alarms are intentionally lost without equivalent replacements. Retained queue/cache, bounded fetch and Dock lifecycle checks do not establish actual raster decoding, native image conversion or rendered appearance. Historical receipts below are preserved evidence for earlier test sets, not fresh validation of this reduced selection. Audit3601 scope: remove the whole custom-sound happy-path IPC suite and one custom-label/multiline notification formatting example (2 authored/2 finite). Intentionally lose configured .ogg selection, exact byte/MIME success wiring, successful dispatch for the formatting fixture, custom-label whitespace/title normalization and assistant-body whitespace/180-character-cap alarms. Retain prompt-exclusion, persisted qualified dismissal/restart, theme ownership/restore and Ghostty precedence/collision cases; none replaces the retired sound/formatting alarms. No actual playback, native delivery, phone/network, cross-platform or new runtime evidence is claimed; historical execution keeps its original scope. Audit3598: Remove seven authored/nine finite literal-table potential test registrations across workflow routing, Claude cold-start and real-zsh preexec drivers. Root-unit discovery loses six authored/six finite: three test-local workflow parser fixtures, the five-positive/three-negative explicit command-paint route inventory, a boot-banner-before-composer sample and an already-painted bare-title positive sample. The separately selected shell_contracts live-shell driver loses one authored/three finite raw-capture paint-only cases across three hook configurations; its real-wrapper launch-order, four rechunkings (twelve finite) and runtime-wait replay remain, without claiming equivalent replacement. Intentionally lose those parser, exact routing-list, banner, post-paint subscription and native-read-boundary paint alarms. Retained workflow/UNIT_EXCLUDE/classifier cross-source routing checks and readiness-race-to-writer timing are distinct bounded alarms. No runner, real shell, PTY, app, native focus, remote delivery, cross-platform execution or full-feature correctness is established by this source-only audit. Earlier evidence retains its historical scope. Audit3597 scope: remove two renderer-hang-capture examples (2 authored/2 finite): an invalid repeated-token oversized reducer fixture and a shorter unanswered-request fixture. Intentionally lose the direct truncated flag/sanitized frame fixture and request-pending status/zero-sample alarms. Retain window-death/stale-result exclusion, generation reconciliation, and baseline-publication cancellation lifecycles; they are not equivalent bound, redaction or pending-status replacements. Historical execution retains its original source scope; no new runtime evidence is claimed. Audit3591: Retire the whole one-case background journal-producer attribution suite and the fabricated malformed-details-block case (two authored/two finite cases). Intentionally lose the fixed own-task versus output/foreign-task attribution examples across flat/message row shapes, missing-root classification, and direct unbalanced/detailsish fabricated-block rejection alarms. Retained parser sibling/depth and editor navigation tests do not replace these alarms. No equivalent replacement or fresh runtime, transport, persistence, native focus or rendered UI validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3592: Retire the whole three-case shared agent smart-key resolver suite, explicitly superseding its Audit3238/3237 keep decisions. Intentionally lose literal permission-versus-question classification, longest-question digit selection, Codex async-question opener/digit/Enter/skip mapping, and unsupported-agent/state/prompt refusal examples. These were real parser/selection and literal-byte alarms; they did not exercise terminal delivery or timing. No equivalent replacement or fresh runtime, native TUI, mobile, remote or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3587/3588: Retire six authored/fourteen finite cases, including the whole WSL stopped-notice and connecting-status selector suites. Intentionally lose direct WSL retry connection field/target/ready-epoch/null-guard examples, connecting/reconnecting distro and absent-state selector samples, and stopped/connecting notice text/button/data-attribute examples. Retained host-ready retry and content-loader/reload lifecycles do not replace these alarms. No equivalent replacement or fresh runtime, native WSL, remote, rendered UI or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed. Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions. Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): The main IPC contract test subscribes terminal.multiplex through the real handler, disconnects the environment, and asserts the renderer received exactly one {type: close} subscription event. Two isolation tests subscribe a second stream to the same environment and make the first one fail -- in its socket close, and in the liveness probe inside notifyClosed -- then assert the disconnect does not throw, both transports closed, and every close the renderer could still receive was delivered. A third drives a host-initiated close through the transport callback, which is the one notifyClosed call site with no surrounding guard, with a renderer send that throws, and asserts it cannot escape into the WebSocket close handler. A fourth test asserts that after retirement a late response frame is not forwarded and a late transport close does not re-send. The paired-server journey runs three reveal scenarios against one real host and one real paired desktop client, and for each records buffer restore, host-side receipt of the typed marker through an out-of-band host sink file, live paint without a tab flip, and PTY-versus-pane grid convergence.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts",
"pnpm exec playwright test tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
@@ -4147,6 +4076,48 @@
"Add real sleep/wake and network-loss transport drops alongside the explicit disconnect trigger."
],
"knownGaps": [
+ "Audit3814 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle from a Codex ready prompt even when stale startup lines remain :: Stale MCP startup lines must not block a later Codex ready header.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle when a stale Codex prompt is followed by the ready header :: A Codex ready header following a stale resume prompt must satisfy tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for an idle Cursor lane past its dismissed trust dialog (#8210) :: Later Cursor idle banner overrides retained trust dialog.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not block a mid-run Cursor lane on its dismissed trust dialog (#8210) :: Dismissed trust dialog must not report blocked for later busy Cursor; wait times out.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not classify unrelated press-enter prompts as Codex blocked prompts :: Unidentified press-enter text must time out rather than be classified Codex blocked.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for quiet background PTY agents without OSC titles :: Quiet Codex background terminal without OSC title eventually resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: sends agent prompts as bracketed paste before submit :: Driving prompt escapes embedded paste-end ESC, writes one framed paste then CR, and counts bytes.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: settles a foreground Codex prompt when launch metadata has not arrived :: Codex inferred from foreground without launch metadata waits for composer marker/quiescence before one CR.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: gives a late Codex render marker a fresh quiescence window :: Marker arriving at7.9s re-arms fresh quiet window instead of submitting at initial cap.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: writes large agent prompt paste frames atomically before delayed submit :: A prompt larger than input chunk budget is a single paste write before delayed CR with exact byte count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects oversized terminal.send text before provider writes :: Oversized ordinary terminal.send rejects input-too-large before any provider write.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects focusing an exited background terminal session :: focusTerminal refuses terminal_exited before invoking background reveal.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: pastes the same bytes the desktop draft paste sent for the prompt :: Launch-ready prompt normalizes CR/LF and renders embedded ESC visibly identically to desktop bracketed paste.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: keeps a prompt into a running agent behind the render settle, as before :: Driving prompt remains held through7s repaint activity then submits once by9s.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reports a queued PTY focus as not navigated when its notifier disappears :: Queued PTY focus and completed active reveal report not navigated after notifier removal; no second reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: does not invoke a stale graph-leaf focus notifier after queued PTY work :: Queued graph-leaf focus must not invoke old notifier after preceding PTY reveal and notifier removal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: paginates retained terminal output with explicit limits and truncation metadata :: Preview120lines, fractional limits,50/200 pages, retained2000line truncation and future-cursor metadata stay consistent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: falls back to renderer visible screen when uncursored TUI tail is blank :: Substantial blank uncursored tail uses mounted renderer visible screen with zero scrollback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reads and shows the runtime-owned alternate-screen grid without serialization :: Actual runtime alternate-screen grid provides read/show content without renderer/provider serialization.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: classifies older provider alternate-screen snapshots from ANSI :: Older provider without alternateScreen metadata classifies ANSI alternate entry and returns Remote Vim screen.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: honors the last ANSI screen transition when older provider metadata is absent :: Last ANSI alternate exit overrides earlier entry when explicit provider mode metadata is absent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: rejects a full provider screen frame after live output advances :: Live output arriving during second full-screen capture causes screen-unavailable rather than stale full frame.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: shares one provider snapshot between concurrent read and show calls :: Concurrent read/show share one successful provider snapshot and both receive Shared TUI content.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps cursor reads provider-free on restored alternate-screen PTYs :: Restored alternate-screen cursor transcript reads never acquire provider snapshot.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: backs off after a provider snapshot failure instead of retrying for show :: Failed provider capture is cached/backed off so later show does not retry.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: falls back once to a mounted renderer when a known alternate provider fails :: A known-alternate failed provider capture falls back exactly once to newly mounted renderer.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: bounds provider visible frames for read and show responses :: Provider visible read/show use six bounded lines and300character preview.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps renderer-fallback composer drafts separate from terminal output :: Renderer fallback strips dim composer draft from terminal output and exposes draft separately.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: does not use renderer visible-screen fallback for a short blank shell tail :: Two blank shell lines must not trigger renderer screen fallback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: trims terminal tail character budget without per-line array shifts :: Tail builder trims to256KiB with correct retained suffix and no Array.shift calls.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains ANSI-only status redraws instead of appending every frame :: Repeated erase/redraw replaces preview until newline then publishes one completed cursor row.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains split multi-line ANSI footer redraw state across chunks :: CUU state across chunks retains corrected footer rows and publishes new cursor entries.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not let stale lower rows hide earlier corrected footer rows from cursor reads :: Earlier corrected footer row must not be hidden by stale lower rows in cursor reads.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: bounds completed transcript entries from a single multi-line redraw chunk :: Single redraw chunk bounds completed transcript to2000retained lines and correct oldest/next/latest cursors.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains multi-line ANSI redraws when the last footer row stays partial :: Partial final redrawn row appears in preview but cursor sees it only after newline.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not retain split ANSI controls as visible terminal preview text :: Split color/mode escapes never leak preview fragments; long split OSC title truncates at MAX_OSC_TITLE_CHARS.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains same-line redraw cursor position across split full-line erase chunks :: Full-line erase preserves column across chunks so XY follows three spaces rather than old ABC.\nsrc/main/runtime/orca-runtime-tests/conpty-stream-read.spec.ts :: fills the requested line count even when blank rows sit below the prompt :: Blank rows below a ConPTY prompt must not consume the requested nonempty-line count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: does not retain split ST-terminated string controls as preview text :: Split ST-terminated Kitty/string controls must remain excluded from preview text.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects split OSC titles before retaining terminal previews :: Split BEL OSC title must update working title/status without leaking into preview.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects ST-terminated OSC titles split before the final backslash :: ST OSC split before final backslash must update title without leaking framing.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: preserves a trailing escape after a completed OSC title :: Completed OSC followed by pending ESC must preserve the next idle-title transition.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: seeds newly synced leaves from PTY pending ANSI state :: A newly synced graph leaf inherits pending ANSI so a split color fragment cannot leak.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: bounds retained partial terminal output before preview reads :: Partial terminal state stays capped at 4000, preserves retained array identity, and preview truncation/cursor output remains correct.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: submits the mail pointer to Cursor Agent only after the paste-burst delay :: Cursor mailbox pointer Enter must wait through the paste-burst delay; this is a real input-timing alarm intentionally retired.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts :: adopts a v1.4.150-shaped agent, setup, and shell orphan as one topology transaction :: Stale incarnation refuses without topology change; three agent/setup/shell lanes adopt atomically with layout/group/revision and preserved read/input/resize; exact replay is idempotent and competing owner refuses.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: retires the exact worker when it exits after renderer reveal :: Exact worker exit after reveal retires that worker and its surface.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: re-reveals a recovered worker after the renderer graph epoch changes :: Changed renderer graph epoch invalidates reveal receipt and forces another reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: defers recovery when the renderer omits the exact reveal identity :: Missing exact reveal identity defers recovery after two attempts.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: reconciles a same-id process replacement before headless adoption :: A process replacement before headless adoption must fence off stale ownership.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retires provider resume only after authoritative inventory proves the legacy PTY exited :: Authoritative owning-host inventory overrides false local hasPty, avoids SSH scanning, retires exited provider resume/surface, adopts live workers without headless reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retries inventory and unknown liveness without revealing a ghost worker :: Inventory failure and unknown liveness must retry without ghost reveal, eventually adopt, and stop retrying.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: refuses a live reserved pane before issuing a handle or revealing it :: A requireFreshPane launch receiving a live reserved owner must reject before handle/reveal/kill, and release its claim. No equivalent replacement claimed.",
+ "Audit3806 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: skips a listener unsubscribed mid-fan-out even with mobile exclusions active :: A listener removed by an earlier listener during one fanout is not called, including with a side-effect-excluded mobile listener present.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: retains bytes emitted before a fresh daemon spawn resolves :: Bytes and title arriving before an initial zero/reset provider response survive in the serialized headless buffer with their counted sequence.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits command-finished facts with best-effort exit codes across chunk splits :: A split OSC133 D exit code becomes130 and a missing code becomes null in ordered command-finished facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits pr-link facts once per URL with batch attribution :: A split GitHub PR URL yields42 rather than4, emits42/43 once each, and carries PTY/worktree/tab attribution.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits 2031-subscribe facts across chunk splits :: Split ESC[?20 then31h emits exactly one2031-subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: restores a provisional 2031 subscribe when daemon scan authority returns :: Returning daemon scan authority with partial scan seed and pending2031 subscription restores exactly one subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers the tracked title over the renderer snapshot lastTitle :: A synthetic live Cursor title overrides stale renderer lastTitle while preserving renderer snapshot source.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers provider history over a partial headless mirror for requested snapshots :: Authoritative requested snapshots return supplied provider frame/history/seq rather than a partial headless mirror, requesting5000rows.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: tracks live alternate-screen transitions after a provider snapshot :: Provider alternateScreen true is accepted, then live1049l/1049h update isTerminalAlternateScreen false/true.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: translates reset provider snapshots without retaining the old title :: A reset provider snapshot translates new local seq into the runtime domain and replaces Old process title with New process.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits the chunk agentStatus events before its side-effect batch :: Agent status callback precedes side-effect batch callback for one coalesced OSC9999/title/bell chunk.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: still emits a throwing chunk’s facts under its own seq, not the next chunk’s :: A tracker throw still flushes first chunk title facts under its own seq, and second chunk does not inherit those facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: seeds the lazily created tracker from the daemon-snapshot title :: A lazy tracker hydrated from renderer snapshot title Codex working emits agent-idle on later Codex done.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits command-code-working facts only after the banner arms the scrape :: Unarmed Thinking text emits no facts; a Command Code0.27.3 banner then hardcoded colored spinner text emits attributed command-code-working with the submitted prompt.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits a command-code-done fact when the idle composer returns :: After hardcoded banner/working text, returned idle composer emits command-code-done with the earlier submitted prompt.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: resizes the headless mirror after an accepted desktop PTY resize :: An external accepted resize produces the resized dimensions and same status-frame lines as a separately driven reference emulator.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: replaces suffix-only headless state with the recovered renderer snapshot :: Replacing suffix-only state removes old suffix, retains renderer history plus later output/cwd, and returns the live47x40PTY grid.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: stamps SSH connection identity on runtime terminal status :: A synthetic mounted-leaf OSC9999 status after registerPty carries the supplied SSH connectionId.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: does not retain WSL context when a PTY id is reused :: After exit and same-ID new null distro context, OSC7 file://server/share/repo uses UNC server path rather than old Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: preserves immutable context while a live daemon attach is unresolved :: preparePtyExecutionContext with preserveExisting refuses a supplied Debian replacement and subsequent OSC7 keeps original Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts :: projects frame-independent live state through main buffer snapshots :: Main-buffer snapshot puts focus-report/cursor-visibility modes in frameRestoreAnsi, excludes STATIC-FRAME there and includes it in data.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts :: continues terminal agent status fanout when a callback throws :: Throwing on the first status callback does not prevent second payload delivery and logs contextual error.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: returns a title-only replay snapshot and never historical attention :: Lose replay:true/title-only fact projection despite earlierbell and unknownPTYnull. No actual delivered-history notification or reattach behavior was exercised. No equivalent replacement claimed.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects a handle rebind while a controller-less status check yields :: A handle rebound while the null-controller status continuation yields must throw terminal_handle_stale.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects confirmation evidence when the owning PTY exits :: A pending strong confirmation resolving after owning PTY exit must reject terminal_exited.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts :: keeps ordinary terminal send suffix failures on the existing not-writable contract :: Ordinary send writes text but refused CR must throw terminal_not_writable with beforeWrite twice and afterWrite once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell the execution host cannot apply instead of spawning its default :: Requested Windows shell on POSIX must refuse before spawning a default shell.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: quotes the agent startup command for the requested shell, not the host default :: Requested cmd shell must override PowerShell default quoting for agent startup command.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: keeps restored receipts outside a targeted worktree scan :: Targeted scan removes the moved-worktree receipt while preserving another worktree receipt.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: observes setup command completion without waiting for its interactive shell to exit :: Nonzero completion marker 17 resolves while interactive shell remains running.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: falls back to setup terminal exit when no completion signal is available :: Setup completion observer without token falls back to actual exit code 9.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: cancels setup completion observation when the caller aborts :: Abort rejects with the original reason and unsubscribes once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps observing after an uncertain setup terminal status :: Unknown exit waiter result must leave observation pending until completion marker arrives.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh omits a record :: Controller inventory omission disconnects the record but preserves its retained transcript.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh times out :: Hung inventory timeout leaves connected record and retained transcript intact.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle for adopted background PTY handles from the renderer title :: An adopted background handle resolves tui-idle from ready Codex renderer title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves live-leaf tui-idle from an OpenCode native title :: A live leaf resolves tui-idle from an OpenCode native title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from a Codex ready prompt preview :: A supplied Codex prompt preview resolves tui-idle without an actual agent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from an Antigravity prompt before the model line :: A supplied Antigravity prompt before model line resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell with no workspace instead of creating a default-shell tab :: Workspace-less explicit shell must reject before renderer default-tab request or spawn. This real guard/wiring alarm is deliberately retired.",
+ "Audit3798 per-case accepted losses:\nsrc/main/runtime/orca-runtime-tests/paired-settings.spec.ts :: awaits navigation-only updates from paired clients (%s) :: Updating only claudeSubagentNavigationEnabled waits for the actual controller call to the supplied pending Claude-view reconcile for both on/off values.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: drops a client page record even when its close command cannot be issued :: A removed workspace loses its runtime client-page record and headless browser projection despite close delivery_required rejection, and emits the asynchronous warning.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: leaves client-hosted pages alone when another host still owns the same worktree id :: Removing runtime:env-b metadata with local ownership leaves the local same-ID client page unchanged and issues no close command.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: marks live bindings again when reopening after a promoted window closes :: A reopened window marks its still-registered live worktree in activeWorktreeIdsOnShutdown after the first promoted window closes.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: preserves live SSH session identities when promoting a headless runtime :: Headless-to-desktop promotion records active worktree, SSH connection and remoteSessionIdsByTabId from the supplied surviving SSH PTY/session.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores a surviving renderer when its reload is cancelled :: A sole ready renderer reload cancelled under its current renderer fence returns true and becomes ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores headless authority when desktop promotion navigation is cancelled :: A cancelled desktop promotion with headless recovery returns false while headless authority remains ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: moves a desktop graph to unavailable when its reload times out :: A ready desktop graph without a headless fallback becomes unavailable at the reload deadline and retains its window/epoch.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: recovers a failed headless promotion and accepts a later renderer generation :: A promotion failure restores ready headless authority; a later valid same-window graph publishes ready desktop authority.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: clears a failed pane recovery so a later reconnect can retry :: After relay_reconnecting rejection, the pending recovery lock clears and the same pane/handle can call createTerminal a second time and return its supplied replacement.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: still preserves a CLI agent leaf when the reloaded renderer has not rebound its PTY :: An empty graph published during renderer reload preserves a preallocated live CLI PTY as one listable terminal before renderer rebind.\nsrc/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts :: keeps a no-incarnation handle across an in-graph pane remint :: Within one graph lifetime an unversioned PTY reminted onto another leaf retains its issued handle and resolves its old exit waiter after onPtyExit.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: matches explicit-id cwd PTYs when the resolved worktree cache is incomplete :: An explicit target absent from a fresh incomplete resolved cache adopts only its cwd PTY, rejects nested cwd PTY and does not rescan Git.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: ignores cwd-only controller PTYs for malformed explicit worktree IDs :: Malformed id:repo-1:: returns no terminals, does not adopt cwd-only controller PTY and avoids Git rescanning.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: refuses an SSH-backed create for mobile/runtime callers instead of creating locally :: Loss of this public unserved SSH create error-class/no-local-add/no-local-list alarm.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: records an app-selected parent workspace as a manual action :: Loss of the local runtime folder-parent manual origin, active-workspace source and explicit confidence projection alarm; no claim that SSH or cleanup coverage replaces it.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: browses runtime server directories before projects are added :: Loss of this public runtime alarm for browse availability before registration, directories-first lexical ordering and native path flavor.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: lists drive roots for a server-root browse :: Loss of the Windows public slash-root drive enumeration smoke and presence of the temporary directory drive.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations-part-02.spec.ts :: creates a missing runtime parent before creating the project directory :: Loss of this runtime createRepo recursive missing-parent/child existence and registered-path alarm.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: preserves selected project %s when a hosted parent is known :: Loss of both parent-selected and origin-selected normal fork-link projection/persisted upstream alarms plus exact single-probe count.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: links a current enterprise remote despite unavailable metadata and a retained %s :: Loss of normal current-enterprise-origin linking with stale automatic GitHub avatar or protected file image, unchanged icon assertion, and serialized project identity under unavailable metadata.",
+ "Audit3788 retires10 authored/11 expanded cases across six changed drivers, including the entire screencast pending-frame-retry and usage-source-cache-streaming suites. Deliberate losses are false-refused last-frame retry/once-only delivery, ordinary stable-pane reattachment, cleared-chat Dispatch completion, terminal-declared chat-caller refusal, at-rest worker liveness projection, nested depth/cap policy, small unsigned6/sealed7 plain-format and verified-bit examples, generic malformed-ISIZE footer refusal examples, and synthetic10k/100k chunk-size/work-count budgets in gzip and general cache I/O. These include real state/disk/RPC outcomes consciously retired for marginal value; retained E2EE-backlog, receipt/custody/uncertain-ack, integrity/migration and staging-cleanup cases are not equivalent replacements. The footer test did not prove early rejection or bounded allocation; staging cleanup did not seed unrelated files. No replacement or fresh native/remote/performance execution is claimed. Earlier raw selectors and dated receipts remain historical.",
+ "Audit3779 retires17 authored/17 expanded registrations across six changed drivers, including the entire shared-Codex-home and prompt-telemetry suites. Accepted losses are shared-home wrapper noninterference/opt-out preservation, mocked metric count/provenance filters, SSH activity labeling/clearing and handover idle timing, VM ownership/capability/status projections and asleep-worktree refusal, a link-only external conversation replay sample, and two narrow input-credit noninterference/expiry examples. Retain the direct exact-tab/single-use input-credit case. These bounded real disk/state/routing alarms are intentionally retired for marginal value without equivalent replacement or fresh execution claims; earlier receipts remain historical.",
+ "Audit3772 retires18 authored/27 expanded cases, including whole Codex service opt-out, RPC capability-parser, creator-provenance, short-ciphertext and readiness-null suites. Accepted losses include service ledger/symlink/mode cleanup, user TOML substring preservation, old-hash cleanup, description pass-through, malformed-file/pending-hash examples, coordinator write/probe counts, capability array bounds, positive creator projections, early short-payload refusal and readiness helper null shape. Two redundant Codex exit-cause rows are also retired; Pi shares their direct-idle path only in this empty-output immediate-exit fixture, and future agent-config drift coverage is lost. Real bounded filesystem/parser/runtime alarms are deliberately retired for marginal value; no equivalent replacements or fresh execution are claimed. Earlier receipts retain their historical scope.",
+ "Audits3754/3755 intentionally remove9 authored/9 finite registrations: the entire one-case usage-source-cache-streaming.test.ts driver and8 cases from the surviving computer-action-validation.test.ts driver. This gate retains an unfiltered root Vitest command; UNIT_INCLUDE admits both source paths. Accepted losses are the real encoder output chunk-size/work-count alarm on repetitive10k/100k ownership payloads through a mocked durable sink, plus CLI diagnostic precedence, fractional window-id rejection, action-call-site window-target exclusivity, plain-text click-count recovery copy, incomplete click/drag targeting, mouse/modifier/direction allowlist samples and inline/stdin text exclusivity. These CLI cases exercise real argument/handler validation before mocked runtime calls; they are deliberately retired for marginal value, not declared tautologies. Retained cache I/O and CLI cases are not equivalent replacements for these alarms. Existing historical raw receipts remain unchanged and do not validate the deleted or reduced drivers. No fresh execution claim is made. Audits3758/3763 intentionally remove9 authored/11 finite registrations from6 changed drivers, including the entire pane-title-notification, window-linear-notices and worktree-card-lifecycle-effects suites. This gate retains an unfiltered root Vitest command admitting these paths. Accepted losses are same-account linked-row success-notice fanout, sidebar-switch channel forwarding, Linear-only notification forwarding/non-terminal-consumer selection/closed-window detach, destroyed-window refusal and first-send-failure suspension through the pane-title adapter, the100-card synthetic focus/poll absence sample, stored-source local folder badge refresh, unobserved-row badge refusal, and immediate reposChanged lineage invalidation. These exercise real owners with controlled ports; they are retired for marginal value, without equivalent replacement claims. The no-badge-work fixture does not seed its title-promised collection-only cache. Preserved historical receipts do not validate deleted or reduced drivers; no fresh execution is claimed. Audit3759 retires the entire one-case Tailwind compiler/scanner smoke. Accept loss of the direct CSS production/test/spec source-exclusion and rescan alarm; no replacement or current execution is claimed.",
+ "Audit3752 independently approves audit3749: retire five authored/five finite watcher-process registrations, retaining18 raw-exact registrations. Accept loss of healthy shared-pool joint recovery, last-pending-failure idle retirement/respawn, late VITEST fallback release, missing-entry fail-closed selection and independent-supervisor fuse locality alarms. These are real bounded host-policy alarms intentionally retired for low marginal value; no equivalent replacement is asserted. Remaining driver selections exercise controlled FakeChild supervisor lifecycle, cancellation, physical-exit fencing, recovery and fuse behavior. This source review supplies no fresh native/process/platform/remote/SSH execution; historical receipts retain original source and selector scopes.",
+ "Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered root Vitest command. Current UNIT_INCLUDE admits the partial push-service, metadata-dialog and two config/scripts browser drivers:10 authored/16 finite removals. Accepted losses: actual retry30s/60s progression and register bucket/refill wiring, explicit seven-day lease arithmetic (its notification lacked seq/epoch and never reached send), equal-name edit latch/save payload, real image/font/meta-refresh/form/popup browser refusal controls, and broad rich-markdown bridge/command/edit-select smoke. Actual production state, callback routing and browser enforcement run in these cases; these alarms are deliberately retired on marginal value. All drivers and selectors survive. Existing unrelated receipts remain historical evidence for their unchanged selectors, not proof of the reduced cases.",
+ "Audit3732 removes 2 authored/3 finite registrations from two partial suites: nominal custom/Kimi local naming success and deferred context usage row presentation. Real losses: custom/Kimi successful extraction through conversation-name sanitization and agentLabel composition; separate ordered counted/deferred lists and exact percentage/token formatting. No replacement or equivalent coverage claimed. Retain 11 authored/13 finite raw-exact registrations for bounded naming instruction/refusal/cancellation, menu dismissal focus ownership and hover/composer Escape/timer cleanup. Source-only bounded value review, no runtime/CI/native/remote/mobile/folder workspace or global completion credit.",
+ "Audit3733 removes2authored/2finite terminal input checks: fixed custom-cap error/secret fixture and three-emoji cap5refusal whose6UTF16units already trip length fast guard (no UTF8-dependent boundary). Accept exact non-disclosure/oversized-refusal alarm losses; no replacement/equivalence claim. Retain13/13scalar/pending input, OSC state and cron DST/cadence outcomes after bounded material reads. Source-only zero runtime/novelty credit; original historical reasons preserved.",
+ "Audit3729 removes1authored/3finite by deleting whole CLI runtime pairing advisory-close suite. Accept losing post-real-close injected EIO preservation of native/script/unreadable pairing, env identity/preservation and exact close/release assertions; no actual failed-close leak or replacement coverage claimed. Two retained URL grammar/identity suites11authored16finite raw unchanged. Bounded source/owner/caller value review, zero novelty/runtime credit; other seven3724deferred closures remain. Historical receipts preserve original limits.",
+ "Audit3724 removes3authored/3finite checks by deleting two whole suites: TUI clear burst-size singleton and terminal-file-URL target two-case wrapper suite. Deliberate losses: derived widest burst<64byte alarm, UNC authority+line-column anchor composition, and malformed-percent null refusal. Real production algorithms execute in those tests; no mocked-output tautology, equivalent replacement, actual Claude/file-navigation delivery or universal safety-irrelevance claim. TUI58byte bound and URI examples have low marginal value as standalone suites. Actual1262/1264/1742KEEP superseded explicitly. Remaining14drivers83authored136finite raw unchanged. Bounded source-only review; ten closures deferred, four bounded keep judgments repeated with zero new semantic-frontier credit. No runtime/CI/native/remote/mobile/folder/global completion claim; historical receipts retain original scope.",
+ "Audit3723 removes 4 authored/4 finite registrations in two whole suites: keybinding cache freeze/token spellings and host-dependent Orca command name examples. Real losses include returned-object freeze, repeated Mod+P key, Space/PageDown/NumpadSubtract mapping, unknown/empty/prototype-token rejection, and headless Linux versus Windows-server/WSL command choice. No equivalent or replacement coverage claimed. Retain 12 authored/21 finite raw-exact registrations exercising generated scaffold validation, artifact failures, shipped editor/hook/worker/panel tests, actual generated typing compilation, independent CLI root routing and intent-name precedence. Source-only bounded audit; no runtime, CI, native, remote, mobile, folder workspace or global completion credit.",
+ "Audit3720 removes17authored/23finite checks: whole main catalog-date adapter2 and shared date-helper7, seven renderer nominal ranking/cap/no-date/composition cases, and one browser registration expanding to seven forced-container/DOM-child boundary cases. Deliberate real losses: community oldest-date UTC forwarding, official/undated omission, date sorting/window/invalid/future/skew/clamp and default/override cap; nominal ranking/cap and combined Featured/Newly-added outputs; real CSS459/460,719/720,1055/1056breakpoint, five-card partial-row and720px two-card first-row alarms. Browser cases really measure rendered geometry but force width/remove DOM children; no fake-pixel or tautology rationale. No replacement/equivalent coverage claimed. Retain14authored/19finite raw-exact registrations across4drivers: adversarial featured category/order/tie and installability, date order/window selection, actual PluginManager failure/escaping/duplicate-card suppression, real browser viewport/odd-count geometry/phone catalog visibility, syntax ingress/depth/include/printability and68dlong-bracket auto-close fill-in. No tests/browser/native/UI/provider/remote/mobile/folder/CI/global execution or completion credit.",
+ "Audit3717 removes6 authored/6finite checks in two whole thin-adapter/presentation suites. Deliberate real losses: ordinary recipe repository-URL withholding and provisioned-root credential scrubbing/forwarding; repository label lockstep suffix expansion, host-scoped map identity/collision grouping, Windows crosshost paths and WSL distro suffixes. Actual provision options, label/sort consumers and host/scrubber delegates inspected; no replacement/equivalence claim. Retain40 authored/84finite registrations raw exact in14 drivers with bounded owner/context review. Prior KEEP superseded for removed suites; no runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit.",
+ "Audit3714 removes8 authored/39finite checks: whole CLI selector-recovery, task display-text and ANSI grammar suites plus two name joiner/blank tables. Deliberate real losses: selector flag/value/identity and mutation recovery merge/serialization; exact task suffix, transcript fallback, input immutability, cache reuse and edited blocks; independent failed-escape/resumption and OSC/DCS/BEL/ST/C1/nested/unfinished stripping outputs; meaningful-language joiner preservation and invisible/blank-name rejection. These are real bounded alarms, removed as narrow supplied-error examples, helper/token inventories and repeated internal-work fixtures. Prior2936,1195/1196,1214/1215 and1082 KEEP superseded; no replacement or equivalent coverage claimed. Keep9authored/9finite raw-exact registrations in5surviving drivers: screenshot export/failure filesystem behavior, CLI local tree query, event-local reply provenance, vault role-sensitive content and four hostile/UTF16/dangling/tag-name regressions. No native/UI/provider/remote/mobile/folder/runtime/CI/global completion credit.",
+ "Audit3711 retires2authored/4finite cases by deleting whole clipboard-image-temp-file signature-to-name inventory (HEIC/TIFF/unrecognised bytes) and workspace-last-active switch-on supplied visit/reason singleton, plus its now-orphan test fixture. This intentionally loses real generated-filename suffix/extensionless alarms and real newer-visit archived7day versus inactive30day filtering/older-visit identity alarms. Filesystem writing and production reason pruning really execute; no equivalent replacement or universal absence of safety relevance is claimed. The clipboard test does not inspect written bytes, native delivery or decode; the visit test supplies candidate/timestamps and does not exercise persisted visit routing or actual removal.20authored/20finite cases remain unchanged across4bounded Git/sidecar/removal drivers. No new runner/test/module evaluation or runtime result; historical notes and receipts remain historical.",
+ "Audit3707 removes10 authored/11finite checks: three whole renderer adapter/assembled-stage suites and two native projection cases. Deliberate losses: plugin URL/ref/default-version/local-path and unsafe credential refusal forwarding; real Task hook/store A→B→A late-save/list/count fences, owner disappearance, legacy-host convergence, query/history/eviction and same-ID host history; native child append ordered-ID/replacement and compound fallback/order/optimistic-admission/child-turn/duplicate/shrink/revision alarms. These are real bounded alarms; removal follows thin adapter, manually assembled Task pipeline and repetitive fixture value judgment, with no replacement or equivalent coverage claim. Prior1179/1182,1220/1221 and1885 KEEP superseded as applicable. Keep36 authored/38finite registrations raw exact across13 surviving drivers. No runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit.",
+ "Audit3706 removes7authored/7potential cases from3renderer sources: whole usage-label3case and130000-distinct-day usage-overview singleton suites, plus3SSH grouping/ordinary-range examples. Retain11authored/11potential cases across6drivers in this bounded selection; no equivalent replacement or fresh runtime result. Existing bare root-unit commands admit this selection statically; prior command/receipt strings remain historical. Audit3706 intentionally retires first/second-order usage-group label collision alarms; equal50%-weekly bucket versus derived-weekly selection identity and Gemini wk label alarm;130000distinct-day aggregation no-spread-crash/max/intensity alarm; legacy absent-source SSH grouping and ordinary reverse-select/selected-target deselect range alarms. Actual label ambiguity and pathological-input crash are accepted losses. Distinct-day fixture spans~356years; no hard producer/date bound is claimed. Retained filtered-anchor/grouped-order guards do not replace removed deselection/reverse-range/legacy-group coverage. No native SSH, mounted renderer, live provider, remote/folder/mobile end-to-end or current runtime pass was obtained.",
+ "Audit3699 removes4 authored/4finite checks, including one whole xterm copy-policy suite and one root/group CLI help case. Deliberate losses: direct copy-chord admission for platform, selection, Kitty mode, defaultPrevented, logical/physical key and key phase; command-group disclosure and group help routing including claude-teams early return without RuntimeClient construction. These are real bounded policy/wiring alarms; no replacement or equivalent coverage claimed. Retain14 authored/19finite raw-exact registrations across6 drivers: unsafe CLI refusal, Claude model event carry and disk reconstruction/OSC-first case, attachment ownership/upload lifetime and mixed BMP file-reference/PNG-chip delivery, actual SQLite authority/admission/mutation, and Electron geometry/hit-testing. No runtime, CI, native-key delivery, external provider, mobile, remote, folder or global completion credit.",
+ "Audit3692 removes5 authored/5finite marginal Codex checks: unrelated login URL without notice; ordinary per-account launch resource/config materialization; no-retained-pane skip; preservation of a previously owed full scan through actual preparation and pending-marker update (no actual history scan/settlement); ordinary later-config refresh. Accept these exact branch/wiring alarms as deliberate losses without replacement. Retain32 authored/34finite raw callbacks/registrations/table bytes exact across14suites, including credential/admission refusal, grace/reset readiness, filesystem ownership, commit-dependent queue state, streaming/host trust, path canonicalization and private-state preservation. All14whole suites challenged without keeper quota; no whole deletion warranted on current concrete signals. No runtime/CI/native WSL/remote/mobile/folder/global completion credit",
+ "Audit3691 removes two complete runtime-home routing singleton suites (2 authored/2 finite): catalog wrapper mirror login-copy and passive transcript-lookup filesystem noncreation. Exact accepted losses are recorded in knownGaps; no replacement or equivalent coverage claimed. Audit3691: no dedicated alarm remains in the deleted sources for post-launch system login import through prepareHostCodexHomeForReadOnlyAppServer, or for repeated missing-transcript lookups leaving removed Codex account/runtime directories absent and userData entries unchanged. Ownership-marker read avoidance was never independently measured. No real catalog probe, provider, native Windows or crash was validated by those fixtures.",
+ "Audit3686 current Claude profile/account review removes5 authored/5 finite cases: whole structured-auth diagnostic-label suite3 and Windows-only command suite1 whose advertised cache alarm is ineffective because cache lifetime is per invocation; remove duplicate setup namespace-link refusal1 at wrapper layer. All5 exact historical KEEP are consciously superseded. Retain49 authored/50 finite unchanged, including filesystem privacy/recovery, route identity and concurrency, built worker/helper, legacy WSL alias compatibility and sign-in handoff. These are deliberate coverage losses without replacement. No runtime/CI/native WSL/macOS Keychain, remote/mobile/folder or global completion credit. Explicit accepted real losses: unknown-account host fallback and mixed-version/WSL-only structured auth diagnostic labels; Windows-only sentinel ENOENT-to-friendly-error translation plus fresh-call successful dispatch smoke; setup catch-to-refused wrapper and no-write outcome for a namespace symlink. The command case does not discriminate removal of its per-invocation noncache guard; it still supplies the error-translation alarm, which is intentionally retired. No replacement/equivalence promise.",
+ "Audit3680 removes eleven authored/eleven finite unit cases across four files, including entire launch setup row projection, structured legacy-model metadata, and legacy classifier suites. Accept loss of exact row partition/start selection, Codex supersession/default/unknown and Claude alias/suffix folding examples, other-agent exemption, getter/cache read budgets, same-array per-agent cache isolation, replaced-catalog metadata, and tracked-only model exclusion from structured and PTY legacy inventories. These are real narrow policy/metadata alarms intentionally retired without equivalent replacements. Retain real menu collapse/reopen in dropdown/select, AI picker cancel/accept and stale-effort filing, IME carry/gesture/frame transitions, and typed-flip versus held-dispatch fencing. No production or shared fixtures change. No dead timing entry exists for the three deleted drivers; retained timing keys stay unchanged. Static source-value review only; no project import, test runner, native/app execution or runtime validation established. Earlier receipts retain historical scope.",
+ "Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit.",
+ "Audit3672 renewed by3676 removes four authored/four finite cases from federation-output.test.ts: nominal show/read routing and terminal-fallback projection; initial archive-table SELECT failure returning retained/no-close; simulated old-peer read/fleet/refusal and method inventory; and absent archive-release capability refusing release. These actual compatibility/guard alarms are intentionally lost without equivalent replacement; the dropped-table case never reaches capture or commit. Current selected frontier9 becomes5: retain actual temporary transcript parsing/path omission, current no-transcript release/unavailable-output/restart/replay regression, and three home deadline/stop nonmutation cases. Prior held-capture case was already removed upstream and receives no new removal credit; prior redacted snapshot archive behavior was rewritten upstream and is not claimed retained here. The surviving driver timing entry stays. Static review/private composition only; no actual peer/network/native/platform or fresh runtime validation.",
+ "Audit3671 removes14 authored/32 finite root-unit cases, including the whole WSL move-handler refusal suite, WSL preload object-presence suite and internal gate spelling truth table. Also retire the weak withheld-command non-array shape assertion, static serve-only Add/capability/mock-remove example, grammar scope equality and basic configuration/payload schema roundtrips. Genuine wrong-window/malformed-request/gate-before-work, exact gate spellings/platform/argv precedence, static serve-only routing, declaration mismatch and empty grammar/pair admission alarms are consciously lost without replacement; prior KEEP decisions are reconsidered. Seven unchanged authored/finite root-unit cases retain real image/provider/line budgets, live policy transition/capability broadcast, grammar resource/reference traversal and strict-versus-tolerant literal salvage. Source-value evidence only; no runner/compiler/build/app/native/provider/remote/mobile/folder validation or historical fault claim. Independently remove one authored/finite Playwright closed-gate app-boot inventory: accept loss of real renderer/preload/main refusal composition, saved-host row and Add/Move hiding/Remove visibility alarms. Keep the unchanged scripted-move rendered dialog lifecycle/reload case. It runs no real WSL migration, host connection, file copy or automation restoration. No selector or Playwright participation cleanup is required because the spec remains.",
+ "Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence.",
+ "Audit3634: Remove five authored/five finite cases, including the complete structured chat terminal-refusal, terminal-plus-agent worker-start validation, and canonical Git common-directory parser suites. Also remove the gh free-text -R argument projection case. Consciously supersede prior KEEP decisions and accept chat-versus-stale redirect classification, real RPC refusal-before-SQLite-Dispatch, old-Git echoed-option relative-path parsing, WSL execution-space resolution, and free-text preservation/bare-repo qualification alarms. These are genuine narrow alarms, intentionally retired without equivalent replacements. Retain real Git stdin/EOF delivery, bound-account host admission, naming environment/account precedence, upload iterator cancellation and remote path confinement. Shared fixtures and production code remain. Remove only the dead canonical-repo-key timing entry. Static source-value evidence only; all prior evidence retains historical scope.",
+ "Audit3636: Remove the entire maintenance opportunity internal-count driver (one authored/two finite cases), the mocked remote worker start-card argument case (one/one), and the follow-up heading mapping table (one/two). Root-unit discovery loses three authored/five finite cases. Independently remove four Python native screenshot methods/five statically enumerated subTest scenarios: grim argv/stub payload, failure-code mapping, X11 mocked capture payload, and capability flags. The Python lane is verify:computer-native and is not root Vitest. Accept loss of exact native command/projection and exception/capability alarms, ready-only card publication arguments/agent forwarding, and serialized follow-up heading mapping; no equivalent replacement is claimed. Retain actual ownership/mail/queue/reopen transitions, remote lost-response fencing and first-result settlement, filesystem/maintenance admission and successor progress, wrong-region screenshot refusal and Sway geometry. The whole-deleted new driver has no timing key; this component requires no timing cleanup. No production changes. Static source-value review only; no project import, runner, app, native desktop or runtime validation established. All prior evidence retains historical scope.",
+ "Audit3630 removed orphan delete/toggle capability/precondition and run/edit refusal assertions. Real dispatch, mutation fencing, mixed-version and host outcomes are not established by this removal or by a substitute test.",
+ "Audit3624: Remove one authored/five finite positive Gemini identity table from the Claude/Gemini title collision driver. The real normalization, legacy label and explicit title evidence owners execute, so ordinary Gemini marker/name/wrapper recognition and normalized-label composition alarms are consciously retired without equivalent replacement; these five supplied title-to-literal identity examples have low marginal value. Preserve the six-row Claude task-text collision oracle, whose unrelated CLI mentions must not rebrand or destructively normalize titles. The other audited drivers preserve real permission-mode session transitions, prompt secret/fence/bounds defenses, JSON-to-Ask option/preview preservation, and optional GitLab failure summary/trace composition. Root-unit discovery loses one authored/five finite cases; no whole driver or timing key is removed. No actual terminal stream, UI routing, application/native or runtime execution established; all prior evidence retains historical scope.",
+ "Audit3618: Remove three authored/three finite browser reload cases, including the complete renderer reload-actions suite. Agent bridge fake did-fail-load plus permanently supplied manager error projects description/code into a rejection. Renderer seeded empty metadata projects a saved URL into plain webview src; its earlier not-ready case projects a live-id/throwing fake reload into absence of a loading patch. Real queue/wait/error/cache/classifier/hook code executes, but these narrow supplied-state and exception-to-callback wirings have low marginal value; no rerender, lifecycle, actual cache generation/retirement or guest commit is asserted. Explicitly supersede audit1822 not-ready KEEP and preliminary3617 cross-module retain opinion, accepting offline-reload failure reporting, empty guest to saved URL routing, native-reload bypass and premature-loading/stranded-state alarms without replacement. Retain distinct main cancellation queue progression and absent queued side-effect dispatch. Root-unit discovery loses three/three. No Electron guest, network failure, restored navigation/commit, app/native focus or runtime execution established; earlier evidence retains its historical scope.",
+ "Audit3614: Remove thirty-one authored/thirty-nine finite potential cases across CLI format and argument drivers, including three whole suites: search-result/status sanitation sites, Linear issue/list/warning sanitation sites, and quote-stripped JSON diagnostic secret non-echo. Those real formatter/guard transformations execute on supplied strings; intentionally retire their field-specific CSI/OSC/C1/newline/bell and diagnostic secrecy alarms as low-value caller/output inventories, without replacement. Also retire twenty-one search registrations/twenty-four finite cases covering minimal positional request/default omission, exhaustive all-flags request projection, nominal named query/index routes, repeated syntax/agent examples, enum/agent/path-count/timestamp/numeric/cursor admission examples, unknown/browser flag examples and postcommand last-wins projections; retire one parser sentinel-only case. Keep actual ambiguity, conflicting index request, precommand/crosscommand scoping, variadic reference parsing and missing-repeatable-value controls, without claiming equivalent coverage. Root-unit discovery loses all twenty-nine/thirty-seven. No CLI/RPC/terminal/PowerShell/host/schema/runtime execution is established by this source-only audit; earlier evidence retains its historical scope.",
+ "Audit3609: Remove the complete pnpm CLI invocation literal-selection suite (eleven authored/nineteen finite potential cases), with no replacement claimed. Root-unit discovery loses JavaScript-versus-native command selection, npm/npx executable rejection, Windows cmd/bat casing and shell selection, non-Windows cmd behavior, native PNPM_HOME flat/bin preference, explicit-path priority, relative-home rejection, missing-native fallback and non-Windows home-probe refusal alarms. The suite called the real resolver with independently expected objects, but exercised no pnpm/node/cmd process, installed native executable or real filesystem probe. Earlier KEEP decisions are consciously superseded by accepting these narrow branch and probe-inventory alarms as low value. Real symlink entry, Git signing isolation, Bun filesystem/Node child normalization and compiler scheduling/continuation tests remain distinct tests, not equivalent coverage. No runner, compiler, app, platform or remote execution was performed in this source-only audit. Earlier evidence retains its historical scope.",
+ "Audit3598: Remove seven authored/nine finite literal-table potential test registrations across workflow routing, Claude cold-start and real-zsh preexec drivers. Root-unit discovery loses six authored/six finite: three test-local workflow parser fixtures, the five-positive/three-negative explicit command-paint route inventory, a boot-banner-before-composer sample and an already-painted bare-title positive sample. The separately selected shell_contracts live-shell driver loses one authored/three finite raw-capture paint-only cases across three hook configurations; its real-wrapper launch-order, four rechunkings (twelve finite) and runtime-wait replay remain, without claiming equivalent replacement. Intentionally lose those parser, exact routing-list, banner, post-paint subscription and native-read-boundary paint alarms. Retained workflow/UNIT_EXCLUDE/classifier cross-source routing checks and readiness-race-to-writer timing are distinct bounded alarms. No runner, real shell, PTY, app, native focus, remote delivery, cross-platform execution or full-feature correctness is established by this source-only audit. Earlier evidence retains its historical scope.",
+ "Audit3591: Retire the whole one-case background journal-producer attribution suite and the fabricated malformed-details-block case (two authored/two finite cases). Intentionally lose the fixed own-task versus output/foreign-task attribution examples across flat/message row shapes, missing-root classification, and direct unbalanced/detailsish fabricated-block rejection alarms. Retained parser sibling/depth and editor navigation tests do not replace these alarms. No equivalent replacement or fresh runtime, transport, persistence, native focus or rendered UI validation is claimed. Earlier dated text and evidence retain their historical scopes.",
+ "Audit3592: Retire the whole three-case shared agent smart-key resolver suite, explicitly superseding its Audit3238/3237 keep decisions. Intentionally lose literal permission-versus-question classification, longest-question digit selection, Codex async-question opener/digit/Enter/skip mapping, and unsupported-agent/state/prompt refusal examples. These were real parser/selection and literal-byte alarms; they did not exercise terminal delivery or timing. No equivalent replacement or fresh runtime, native TUI, mobile, remote or performance validation is claimed. Earlier dated text and evidence retain their historical scopes.",
+ "Audit3587/3588: Retire six authored/fourteen finite cases, including the whole WSL stopped-notice and connecting-status selector suites. Intentionally lose direct WSL retry connection field/target/ready-epoch/null-guard examples, connecting/reconnecting distro and absent-state selector samples, and stopped/connecting notice text/button/data-attribute examples. Retained host-ready retry and content-loader/reload lifecycles do not replace these alarms. No equivalent replacement or fresh runtime, native WSL, remote, rendered UI or performance validation is claimed. Earlier dated text and evidence retain their historical scopes.",
+ "Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed.",
+ "Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions.",
"Launch direct-owner cleanup current scope: This gate’s unfiltered unit command now selects a suite reduced by 82 whole registrations / 159 potential table examples in 10 whole test Programs, including 8 registrations / 15 examples from five once-registered create-message factory closures. Lost alarms include frozen first-message/options and legacy-host fallback; distinct actions and redelivery; uncertain/refused/reloaded input custody, Retry and late proof; rich prompt/attachment upload Stop/close and handback; ordinary draft/editor/IME/StrictMode lifetime and accepted topology; provisional fallback tab placement/group/pin/order and rich worktree handoff. Four whole consent/resume-identity cases remain in two Programs; they do not replace these alarms. This entry governs current reduced-unit scope and qualifies any broader implication of unchanged oracle/coverageNotes history. Entire dated evidenceRuns, original commands/currentCommand values, counts/results and existing history retain their original scopes only; no fresh execution, transferred pass, replacement equivalence or prior upstream-removal credit is claimed.",
"Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/persistence/worktree-sort-order-write.test.ts: re-ranks every writable row when a blocked row sits in the requested order. src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts: continues skill management after startup recovery fails. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts: uses bounded ownership lookup for direct arrivals while the agent cannot take input; wakes a bound Run waiter when same-Run direct mail arrives; keeps an unowned detached-recipient message in its direct mailbox; uses primary-key lookups for bounded routing updates. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts: remove only literal registration import/call pairs import './orchestration-mailbox-pointer-cli-command.spec'; no additional authored credit. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts: renders the %s CLI command in a mailbox pointer. src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts: sizes a slow high-latency link near twice its bandwidth-delay product; never paces a LAN, even when its client parses slowly; never paces a fast link; returns to legacy windows when the path RTT jumps. src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts: steps down the row ladder when history is over the byte budget; tries the larger first row count, then the usual ladder within the same byte budget. src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts: returns unknown when route inspection fails or emits malformed data; does not inspect routes outside Windows. src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts: is refused to a paired %s client; reports a failed widening instead of advertising an unreachable address. src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts: reports exited only when the owning runtime completes the exit waiter; reports unverifiable when the runtime cannot observe the exit waiter; reports unverifiable when a disconnected PTY resolves with unknown liveness. src/main/runtime/session-graph/headless-runtime-graph.spec.ts: lets a session tab inventory settle on a host no renderer publishes for. src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts: remove only literal registration import/call pairs import { registerHeadlessRuntimeGraphTests } from './headless-runtime-graph.spec', registerHeadlessRuntimeGraphTests(); no additional authored credit. src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts: bumps the stored snapshot version only when the title changes. src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts: keeps the healthy aggregate verification and delayed physical exit behavior; uses a stamped exit for the incarnation that was actually being closed. src/main/runtime/terminal/identity/terminal-identity-probe.test.ts: answers live for a structured worker without touching the PTY graph; answers live for a PTY handle the runtime still holds; runs the full leaf check for a handle with no live PTY; answers not-live for a stale handle; propagates \"could not look\" rather than reporting it as a dead handle. src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts: names the tab in main’s layout through terminal.rename; takes a window-style layout.apply close as already stopped, so the terminal runs on. src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts: retains no lifecycle generation after a spawn/exit cycle. src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts: reads a freshly spawned terminal as used once a user opens its tab, not on a probe; keeps the open mark on the process a user open starts. src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts: from a desktop window that mounts both panes; from a server with no window. src/main/runtime/terminal/surface/workspace-layout-projection.test.ts: carries views for a partition that holds none yet. src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts: releases a signalled exit-waiter when the signal aborts. src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts: selects a local hook status for a local pane. src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts: keeps the footer and the bare caret on screen mid-turn; %s: the screen alone reads ready during %s. src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts: uses per-launch arguments and preserves launch telemetry; attributes a startup agent whose caller named no surface as unknown; launches %s bare for an absent or blank prompt; attributes a %s draft launch named %s as %s; merges an automation's extras over the host defaults; threads worktree-create extras into the startup build; returns an enabled requested agent without detecting; returns the default when nothing was requested; detects instead of using the default when the requested agent is disabled; starts no agent when the default is blank; detects an enabled agent on this host when nothing usable was named; starts no agent when detection finds none. src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts: pastes and submits through composer readiness, never typing raw input; types the follow-up on WSL or SSH-to-Windows once the agent is in front, as before; cleans up the deadline when the composer was already captured; a draft that is not submitted is pasted on the box cursor, as before; takes the box after the grace when the row never comes, whatever repaints; takes the box at the deadline when the grace would outlast the budget; lets a dialog on screen veto a grace; refuses the deadline inside a pending grace while a shell is in front; takes the box at the deadline inside a pending grace with the agent in front; takes the box at the deadline after a refused grace once the agent is in front. src/main/skills/skill-install-transaction.test.ts: installs, previews unchanged bytes, and updates a clean receipt-owned skill; preserves the old version after a %s filesystem failure. src/main/speech/model-manager-download-resume.test.ts: requests the remaining bytes when a clean range response ends before the file total; bounds a server that advances by pathologically tiny segments forever. src/main/ssh/config/ssh-config-parser.test.ts: parses a basic host block; parses multiple host blocks; skips wildcard-only Host entries; skips Host entries with only pattern characters; parses IdentityFile with ~ expansion; parses Windows-style IdentityFile with ~ expansion; parses quoted scalar values like OpenSSH; parses equals-form scalar directives; parses IdentityAgent with ~ expansion; parses IdentitiesOnly; parses GSSAPIAuthentication; keeps the first GSSAPIAuthentication value like OpenSSH; parses ProxyCommand, ProxyUseFdpass, and ProxyJump; ignores comments and blank lines; handles case-insensitive keywords; stops current block on Match directive; returns empty array for empty input; creates one parsed host per concrete alias on a multi-pattern Host line; applies identity agent settings to every concrete alias on a multi-pattern Host line; defaults port to 22 for invalid port values; converts hosts to SshTarget objects; uses host alias as hostname when HostName is missing; skips hosts that are already imported; defaults username to empty string when not specified; carries through identityFile, identityAgent, identitiesOnly, proxyCommand, and jumpHost; carries through gssapiAuthentication; imports duplicate aliases only once and keeps the first concrete host; maps hosts for the picker and flags aliases already in Orca; de-dupes aliases and defaults missing fields; parses hostname, user, port from ssh -G output; collects multiple identity files; parses forwardagent yes; defaults port to 22 when missing; returns empty hostname when missing; returns undefined user when missing; handles empty output; skips lines without spaces; parses proxycommand and filters \"none\"; parses proxyusefdpass yes; parses proxyjump and filters \"none\"; handles ~ expansion in identity file paths; handles Windows-style ~ expansion in identity file paths; parses identityagent with ~ expansion; preserves identityagent none so auth can disable agent fallback; parses identitiesonly yes; parses gssapiauthentication; parses controlmaster options and filters controlpath none. src/main/ssh/config/ssh-known-hosts-source.test.ts: splits the space-separated list ssh -G prints on one line; expands ~ in a reported path; keeps a double-quoted path containing spaces whole; falls back to the default files when ssh -G reported nothing; drops an explicit none without falling back to the defaults; splits both known_hosts lists on one line each; reads StrictHostKeyChecking, including accept-new; reads HostKeyAlias and prefers it for the lookup; reads the non-default port; reports that the lookup came from an alias, so the port is not appended; reports no alias when the dialed host is used; unions the entries of every file; skips a path that is a directory; returns nothing when no file can be read; reports nothing unreadable when every file parses; does not count an empty file as unreadable; prefers HostKeyAlias over the resolved hostname; uses the dialed host, because a resolved hostname can just echo the label; still prefers an explicit HostKeyAlias over the dialed host; falls back to the dialed host when nothing was resolved; is rejoined when the split fragments resolve to nothing; leaves a single unresolvable path alone rather than inventing one; expands the __PROGRAMDATA__ token rather than passing it through as a path; does not rewrite a path that merely BEGINS with the token characters; keeps a drive-letter path with mixed separators intact; splits a spaced Windows home into the fragments the rejoin has to put back. src/main/ssh/config/ssh-known-hosts.test.ts: reads the algorithm from the blob rather than trusting the line; rejects %s; refuses a malformed blob: %s; uses the bare host on the default port; tries the bracketed form first and falls back to bare off-port; matches an exact line; matches case-insensitively; reports a changed key of the same type; reports unknown for %s; matches any host in a comma list; matches the bracketed form on its port; does not apply a bracketed entry to the default port; falls back to a bare line when off-port; never reports a change from the fallback pass; matches a bare literal on the default port; matches a bracketed literal on its port; reports a change for a literal; handles %s; still reports a change for a different key on a revoked host; skips a line carrying an unrecognised marker; does not report a change when only another key type is on file; matches within the same type; accepts CRLF terminators; skips blanks, comments and surrounding whitespace; accepts a hit regardless of which file holds it (%s); never brackets the alias, whatever the port; still brackets an ordinary host on a non-default port; matches a bare alias entry on a non-default port; still accepts the unmodified key field; accepts a hashed entry whose salt is a full SHA1 digest; still accepts the unmutated ssh-keygen -H vector; falls back to the bare host line on a non-default port, as ssh did; refuses a key type it has not seen for a host it knows, as ssh did. src/main/ssh/connection/ssh-connect-config.test.ts: returns undefined when no default keys exist; returns the first existing key file; probes regular and FIDO2 keys in stable default order; keeps a regular default ahead of a malformed FIDO2 default; uses target host/port/username; falls back to resolved config when target fields are empty; keeps imported endpoint fields as the fallback when ssh -G is unavailable; sets readyTimeout to CONNECT_TIMEOUT_MS; sets keepaliveInterval to 15s; enables keyboard-interactive auth so MFA challenges can be answered; uses agent auth when no explicit key and SSH_AUTH_SOCK is set; enables agent forwarding when OpenSSH config requests it and an agent is available; does not enable agent forwarding without a usable agent; resolves IdentityAgent SSH_AUTH_SOCK from the environment; uses the Windows OpenSSH agent pipe when no environment socket is available on Windows; wraps agent auth with IdentityFile filtering when IdentitiesOnly is enabled; applies a manual target IdentitiesOnly setting when ssh -G reports it off; includes unencrypted target.identityFile auth when an agent is available; defers encrypted target.identityFile auth when an agent is available; uses keyFile auth when target.identityFile is set and no agent is available; includes unencrypted resolved identityFile auth when an agent is available; defers a default-path resolved identityFile to the no-agent retry; offers the keyboard-interactive challenge when the agent defers no key; provides fallback key when no agent is available; can force private key inclusion for the post-agent fallback path; falls back to resolved proxyCommand; returns structured jump-host config for target.jumpHost; returns structured jump-host config for resolved proxyJump; returns undefined when no proxy is configured. src/main/ssh/connection/ssh-connection-auth-fallback.test.ts: resolves OpenSSH config using configHost when present; tries ssh-agent before reading an explicit private key; falls back to direct private key auth when agent auth fails; falls back to direct private key auth after too many agent authentication failures; answers bounded keyboard-interactive challenges such as Duo 2FA. src/main/ssh/connection/ssh-connection-store.test.ts: lists picker suppression aliases without consulting re-adoption tombstones; getTarget delegates to store; addTarget generates an id and persists; saves the CLI control switch as given, with no consent stamp; addTarget stamps source as manual by default; addTarget preserves an explicitly provided source; inserts a new config host stamped as ssh-config; asks the parser for all hosts — reconciliation happens in the store; updates an existing config-sourced target when the port changed; refreshes gssapiAuthentication on sync; never overwrites a manual target that owns the alias; does not rewrite an unchanged config-sourced target; returns empty array when nothing changed; tombstones a deleted config-sourced host so re-import skips it; suppresses a deleted manual target from config discovery; re-adding a deleted host reclaims its alias so sync stops suppressing it; editing a target reclaims its alias from the deleted set; records a tombstone when removing any user-facing target; re-adopts orphaned repos when the same host is re-added. src/main/ssh/connection/ssh-connection.test.ts: transitions to connected on successful connect; captures the negotiated SSH server key fingerprint; allows concurrent exec commands for ssh2 transport; removes startup listeners after ssh2 connect succeeds; scopes lifecycle events and pending handshake timers to one mock client; enables TCP_NODELAY on the new ssh2 client after a reconnect cycle; transitions through connecting → connected states; reports error state on connection failure; disconnect cleans up and sets state to disconnected; getTarget returns a copy of the target; getState returns a copy of the state; throws when connecting a disposed connection. src/main/ssh/orcad-migration-stuck-host-profiles.test.ts: never leaves a running terminal behind; is offered only when leaving saved state behind would clear the refusal. src/main/ssh/orcad-runtime-maintenance.test.ts: keeps a connect from retrying a build an explicit Update also failed; offers Force when Update was refused by policy; forwards anew after an activation, since the new slot may bind another port; passes a refusal through and leaves the server linked; forwards anew once a serving slot is restored, which may have bound another port. src/main/ssh/port-forwarding/ssh-port-forward.test.ts: reports the port the OS bound when an ssh2 forward asks for port 0; adds an ssh2 port forward and returns entry; adds a system SSH port forward when no ssh2 client is available; reports the port a system SSH forward resolved when asked for port 0; passes resolved OpenSSH config to system SSH port forwards; disposes a system SSH tunnel when removing the forward; lists forwards filtered by connectionId; removes a forward by id; awaits forward close when removing a forward for user actions; returns null when removing nonexistent forward; removes all forwards for a connection; dispose removes all forwards; stores label in the entry; preserves the existing id when updating a forward succeeds. src/main/ssh/ssh-channel-multiplexer.test.ts: sends a JSON-RPC request and resolves on response; assigns unique request IDs; sends notifications without expecting a response; dispatches incoming notifications to handler; sends one keepalive frame per cadence tick; drives keepalive sends AND dead-link detection from a single interval; resolves false immediately on a disposed mux; throws on request after dispose; reports isDisposed correctly; clears registered handlers on dispose; does not retain handlers registered after dispose. src/main/ssh/system-transport/system-ssh-forward-process.test.ts: spawns exactly the argv the orphan matcher is given, LogLevel=INFO included; runs port forwards unmultiplexed even when ssh_config disables muxing; preserves manual target port and identity options in the forwarded ssh command; does not spawn ssh when the requested local forward port is already in use; spawns ssh after the requested local forward port preflight succeeds; resolves startup after the grace period when ssh keeps running; sends SIGTERM then SIGKILL when the process does not exit; does not resolve stop until the process exits. src/main/ssh/system-transport/system-ssh-loopback-route.test.ts: dials the held forward ahead of the alias so OpenSSH keeps these over ssh_config; drops a manual target's own port and proxies, which would fight the route; never routes a forward, whose argv must stay stable for orphan recovery; %s → %s; opens the forward over the real proxy, then proves a login over the route; lands the forward on the sshd and known_hosts name the direct route resolved; holds the forward with server-alive probes; never lets the background forward or probe ask for credentials; starts no forward when admission refuses the route; stops the forward when sshd refuses logins over it; stops the whole forward process tree on Windows, once; reports a forward that already exited before anyone listened for it. src/main/startup/browser-process-user-agent-ordering.test.ts: explains admission refusal before a desktop launch exits; explains an orcad holding the profile instead of exiting silently; does not acquire profile admission for a duplicate launch; executes after the dev app name and before later preflight work; exits and releases admission after pending profile move recovery fails; keeps Linux background startup failures console-only and immediate; keeps Linux serve startup failures console-only and immediate. src/main/startup/quit/quit-path-durable-write-blocking.test.ts: store.flushAsync() issues no synchronous fs syscalls; store.flushAsync() also moves the active-view and github-cache sidecars off the thread; stats.flushAsync() issues no synchronous fs syscalls; Grok session cleanup issues no synchronous fs syscalls; stats.flushAsync() closes out live agents before it returns, not when its write lands; a stalled mount leaves the event loop live instead of parking it; store.flushAsync() is one idempotent final barrier; store.flushAsync() resolves instead of throwing when the profile mount rejects writes. src/main/stats/agent-session-transition-recorder.test.ts: counts a hook-only agent that never writes an agent-shaped terminal title; never opens a session from a replayed or disk-restored working status; still closes a live session when the terminating status arrives as a replay; counts one session per turn across repeated working/done cycles; closes an open session when its pane is torn down; bounds the mirror and closes what it evicts; stops the session when the main agent settles and only a watch loop holds the row working; keeps the session open while a subagent outlives the main agent, and closes it when the child settles; dates the stop by the evidence when a shell outlives the last subagent; opens a new session dated by the observation when the main agent resumes after monitoring; never dates a reopen before the close a fact-less OSC repaint caused; dates the first live row after a restored one by the evidence, not the restored clock; treats an unchanged answer as a snapshot, never a transition; opens only on a live working edge; closes only a session it opened. src/main/text-generation/commit-message-text-generation-model-discovery.test.ts: returns static catalog models without spawning for static agents; discovers dynamic models through the agent CLI; discovers dynamic models through the configured agent command override; falls back to static models when dynamic discovery returns no parseable models; falls back to the first discovered non-Pi model when its static default is unavailable. src/main/text-generation/pull-request-context.test.ts: does not fetch unrelated fork remotes before generating PR context; bounds exact remote-ref probe concurrency for a large remote list; reports no branch change because PR context preparation is read-only; keeps a remote-qualified base when the selected base includes the remote. src/main/text-generation/source-control-local-process.test.ts: asks the supervisor to stop and leaves its group to it; signals nothing once the supervisor has exited; stops an agent that ignores its stdin end through its supervisor. src/main/updater/linux-package/linux-package-update-recovery.test.ts: retains the downloaded package with the digest from the event metadata; requires a string downloaded path; accepts an uppercase extension; requires a non-empty string version; matches an absolute file URL by basename; accepts duplicate entries that agree on the digest; refuses an entry with a missing or non-string digest; refuses a digest that is not base64 at all; refuses a malformed percent-encoded URL; refuses a missing or non-array file list; tolerates a non-object event; replaces the retained artifact with a newer download; keeps the retained artifact when a new download has no usable digest; keeps the retained artifact when an unrelated download event arrives; clears the retained artifact; preserves the artifact across a recheck of the same version; clears the artifact when another version takes over; preserves the artifact for an unknown or empty version; is a no-op without a retained artifact; returns the built command and package file name for a verified package; reports missing without a retained artifact; propagates a package-manager discovery failure; rejects a well-formed digest that belongs to another file; never hashes a package that a malformed digest failed to arm; rejects a path outside the cache root; rejects the cache root itself; rejects a package in the updater directory itself; rejects a pending directory that is a symlink out of the cache; performs one hash pass for concurrent requests; revalidates once the in-flight pass settles; does not reuse an in-flight pass for a different artifact; starts a fresh proof when the same package is captured again; returns the verified package path; returns missing without a retained artifact. src/main/updater/releases/updater-prerelease-feed-readiness.test.ts: accepts a GitHub %s asset redirect as ready; reports a GitHub asset request error as unavailable; reports not-ready with a verified last-good tag when the newest assets are unavailable; does not classify a non-positive tag limit as feed unavailability; reproduces the v1.4.142 publishing incident as not-ready; reports transport failures as unavailable instead of not-ready; treats an explicit asset 404 as not-ready when another asset is unavailable; accepts absolute manifest asset URLs without rewriting them to release asset paths; returns not-ready with an older ready update as last-good while newest is publishing. src/main/updater/releases/updater-release-builds.test.ts: lists hourly builds from the dedicated repo, newest first; lists daily builds from the dedicated repo, newest first; separates stable from rc in the shared main repo; skips drafts and unparseable tags; keeps a composed release title and drops one that repeats the tag; hides builds that published no artifact for this platform; returns an empty list when no build has this platform artifact; keeps mac builds visible on macOS regardless of the Windows leg; resolves the platform installer download url; leaves the installer url null when the release published no installer; tolerates a release whose assets are missing or malformed; sends the local gh token as a bearer header when one is available; sends no authorization header when gh has no token; retries unauthenticated once when GitHub rejects the token; does not retry a 401 that was already unauthenticated; falls back to the per-IP bucket when the token is rate limited and tells the gh breaker; reports a secondary limit carrying retry-after without retrying or tripping the breaker; records a primary limit in the token scope %s; keeps %s authenticated when only %s is blocked; skips the token while its scope %s is blocked; surfaces a rate limit with its reset time and a sign-in hint when unauthenticated; omits the sign-in hint when the rate-limited request was authenticated; treats 429 as a rate limit; reports a 403 without rate-limit headers as a plain HTTP error; reports a missing hourly repo distinctly; is null when GitHub sent no reset; prefers retry-after over the primary reset epoch; falls back to the primary reset epoch when there is no retry-after; reads retry-after as seconds; reads retry-after as an HTTP date; pins an hourly tag at the hourly repo download path; pins a daily tag at the daily repo download path; pins a stable tag at the main repo download path; rejects a tag that is not a version. src/main/updater/updater.build-channel-selection.test.ts: uses the display label in the unsupported-platform %s pinned-build error; still pins %s from an unsigned Windows dev build; restores ordinary release checks after local build selection fails; opts into the RC channel when checkForUpdatesFromMenu is called with includePrerelease; pins the generic feed to a perf-tagged prerelease when requested; surfaces no-update feedback when no newer perf-tagged prerelease exists; keeps prerelease publishing-window misses on the generic retry path; leaves the feed URL alone for a normal user-initiated check. src/main/updater/updater.check-preflight.test.ts: ignores a stale update-not-available event after a new check starts preflight; deduplicates repeated manual checks while the immediate checking status is active. src/main/updater/updater.prerelease-fallback.test.ts: retries a prerelease check once against the previous feed tag when the manifest is missing; surfaces a promise-only prerelease fallback failure after the primary error event. src/main/updater/updater.publishing-window-feed.test.ts: repins the generic feed to the newest RC tag for a prerelease user; repins the generic feed to a newer stable tag for a prerelease user; pins a stable fallback when Atom has no newer prerelease; uses last-good concrete feed when a user-initiated check lands during publishing; can offer an older fully published update while the newest release is publishing; keeps background publishing-window fallback on the short retry cadence. src/main/updater/updater.quit-and-install.test.ts: surfaces an accepted retry before electron-updater emits download progress; defers quitAndInstall and runs its launcher within the launch PATH scope; runs pre-quit cleanup before local PTY cleanup during update install; keeps optional pre-quit cleanup fail-and-continue behavior by default; ignores duplicate quitAndInstall requests while the shared delay is pending; arms the forced-exit watchdog once the install commits; disarms the forced-exit watchdog when sync install error recovery keeps the app open. src/main/window/createMainWindow-markdown-editor-focus.test.ts: ignores traffic light sync IPC on non-macOS; still intercepts Cmd+Shift+B and Cmd+Alt+B when the markdown editor is focused; coerces non-boolean setMarkdownEditorFocused payloads to false; opens a table-aware context menu synchronously without a renderer query; builds the plain edit menu for the one right-click the renderer marks as plain text. src/main/window/createMainWindow-renderer-crash-recovery.test.ts: notifies the caller when the renderer process is gone; passes the renderer webContents id through crash recording and recovery callbacks; forwards expected renderer teardowns so the recorder can diagnose suppression; reloads the app shell after an unexpected renderer process loss; does not reload after renderer loss when recovery is disabled; stops auto-reloading after a rapid renderer crash loop trips the breaker. src/main/window/dashboard-popout-window.test.ts: updates the title after language initialization and unsubscribes when closed; lets its preload expose saved WSL hosts in serve-only, and passes nothing otherwise; creates a native-frame window with the shared preload and no webview surface; shows the window on ready-to-show; loads the prod file entry; loads the dev server URL when in dev; focuses the existing window instead of creating a second one; trusts only the live popout webContents; restores a minimized window when re-requested; restores valid persisted bounds; discards off-screen persisted bounds and falls back to defaults; persists bounds on resize after the debounce, guarding near-minimum sizes; keeps saving bounds after a vetoed quit and freezes them only on an allowed quit; closeDashboardPopout closes an open window; applies the persisted app zoom level on dom-ready; follows app zoom changes while open and unsubscribes on close; zoomDashboardPopoutIfFocused steps the popout zoom only while focused; handles the zoom-in chord via before-input-event and ignores other keys; handles mouse-wheel zoom requests outside before-input-event; respects zoom keybinding overrides for keyboard and mouse-wheel paths. src/main/window/dropped-path-preparation.test.ts: opens and stores each unique source once as drop size grows tenfold; passes ordinary paths without copying for %s; preserves ordinary successes and copied successes when another file fails; serializes copy requests from different owners; reports all lost paths without a shared reason when their failures differ. src/main/window/main-window-updater-deferred-setup.test.ts: releases all 64 completed fallback handles without repeating initialization; keeps setup after ready-to-show and releases its fallback afterward; preserves the 15-second fallback when first paint never arrives; preserves destroyed-window guard reads before and at the fallback deadline; keeps the exact %s error and releases its completed fallback; keeps the exact fallback %s error without retrying initialization; preserves pending manual setup after failed ready registration; keeps setup options, live store reads, nudge writes and required quit flush. src/main/worker-threads/worker-thread-request-queue.test.ts: posts one request at a time and in the order it was dispatched; fires a posted call at its own deadline; stops respawning and fails the rest of the queue once deaths hit the cap; clears the death count when a fresh burst starts from full idle. src/main/workspace-hooks/hooks-setup-runner-script.test.ts: builds Windows runners for newline-heavy scripts without line-array splitting; builds POSIX runners without regex-wide CRLF normalization; writes POSIX setup runners for shebang-declared scripts on native Windows paths; keeps batch setup scripts on cmd.exe when the terminal is Git Bash; hands a Git Bash pane a launch command MSYS cannot rewrite for a cmd runner; replays interpreter flags declared on the shebang line; preserves cmd.exe setup runner semantics for configured cmd users; keeps POSIX runner behavior on POSIX platforms; waits when either local or project policy requires completed setup; marks setup-runner terminals for the always-on credential guard; maps git-bash to POSIX setup launch metadata on Windows; falls back to the cmd runner when the git-bash setting has no installed Git Bash; keeps the cmd runner for a non-Git bash such as Cygwin; keeps the cmd runner for a bare bash whose flavor cannot be resolved; uses the POSIX runner for a bare bash that resolves to Git Bash; uses the POSIX runner for an extension-less Git Bash path; preserves the existing cmd runner for PowerShell terminals; preserves cmd setup compatibility when a Windows-host project has a WSL shell setting; classifies an installed explicit Git Bash executable as a POSIX runner; falls back to the cmd runner when the explicit Git Bash path no longer exists. src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts: schedules remote identity enrichment without blocking the caller; probes a drive project whose runtime is WSL %s; sweeps a local repo: %s; probes an SSH row that carries only executionHostId on its own host; keeps same-path rows on two different SSH hosts from sharing one backoff; coalesces concurrent probes for the same repo location; caches no-identity probes briefly so list calls do not retry every time; does not rewrite the no-remote marker on a later retry; resolves a settled no-remote repo once it gains a remote; does not re-probe a resolved identity before the refresh window elapses; re-probes a resolved identity after the refresh window elapses; bounds re-probes per sweep so a large repo list drains gradually; forgets a removed repo location so its deadline cannot outlive the repo; keeps a surviving repo backoff when a sibling repo is removed; probes again when the same location is re-added after its probe was retired; coalesces concurrent sweeps instead of running one pass per list call. src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts: preserves create priority through claim probes on %s; starts the checkout only once the async workspace root resolves; still deduplicates when both callers await the same pending root lookup; namespaces native Windows preparation directories for long paths; deduplicates preparation for the same repo, base, runtime, and workspace root; does not spend a divergence walk when the base matches exactly; claims when the two sides spell the same ref differently; evicts a repo's own stale preparation before another repo's; still discards armed checkouts when the project runtime needs repair; routes preparation and finalization through the selected WSL runtime; retries stale cleanup after a transient listing failure; does not discard a detached worktree with caller-controlled preparation metadata; does not re-arm after an isolated create; re-arms a preparation once creates arrive in a burst; holds the re-arm checkout until the create runs the deferred thunk; starts one explicit prefetch after the create completes; does not re-arm when finalization failed; reports a pending create while a stale-cleanup scan is running. src/main/workspaces/removal/local-worktree-removal-recovery.test.ts: recovers Git for Windows partial filesystem deletion failures; finishes a clean non-force deletion after Git leaves a Windows directory behind; recovers localized Windows failures after Git already removed the registration; does not recover unrelated localized failures while Git still owns the row; finishes a macOS deletion Git deregistered before failing with Directory not empty; leaves an orphaned checkout to the orphan cleanup instead of deleting it; prunes and strictly verifies on the selected WSL host without deleting files or branches. src/main/workspaces/removal/worktree-removal-safety.test.ts: rejects deleting a worktree that contains another registered worktree; rejects POSIX home directories even when host homedir has a different path shape; refuses a home the host reported even when no path rule recognises it; refuses the Windows host's home directory from a POSIX client; refuses the Windows host's home directory even when the host reported nothing. src/main/wsl/discovery/distro-catalog.test.ts: retries asynchronous discovery after a transient wsl.exe failure; retries synchronous discovery after a transient wsl.exe failure; retries asynchronous discovery after wsl.exe reports no distros yet; retries synchronous discovery after wsl.exe reports no distros yet; bounds the wsl.exe spawn rate while no distros are installed; bounds the asynchronous spawn rate while no distros are installed; still caches a non-empty distro list for the process lifetime; re-probes a docker-desktop-only machine once a user distro can appear; backs off while the list keeps coming back empty; backs off after repeated distro-list failures; caps the empty-list backoff at five minutes; keeps reporting an empty result after it goes stale; keeps reporting a known distro list indefinitely; bounds cached homes while retaining the most recently used distros; still lists distros, and an excluded distro home probe fails like any other probe; gives the async home probe time for a cold boot instead of killing it at 5 s; retries availability after a probe timeout instead of latching false; bounds the probe rate while the failure window is open; caches a successful probe for the process lifetime; names an explicit spawn directory, so no deleted cwd can read as ENOENT; shares one wsl.exe spawn between concurrent probes; keeps reporting the last observed answer after it goes stale; holds a definitive failure far longer than a timeout when %s; backs off after repeated probe failures; re-probes a seeded retryable failure once its window lapses; re-probes availability once a distro list succeeds after %s; does not drop an availability failure for an empty distro list; keeps reporting unavailable off Windows without probing. src/main/wsl/discovery/wsl-distro-holder.test.ts: runs a busybox-safe loop through --exec and names the distro; spawns a detached-style holder, records it, and waits for the distro to run; a holder exiting with code 1 notes its distro may have stopped (E9); rejects a pid whose command line is not our holder for that distro; cleans up stale and corrupt records; keeps a holder and its record when release cannot verify it; reports unverifiable when the command line is unreadable even with a matching pid; release kills a verified holder and removes its record; release never kills a pid that is no longer our holder; reports a spawned holder exit so liveness can re-check. src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts: skips 9p shares that are not drvfs, and malformed lines. src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts: plans the update on the census the running orcad reports, not an unknown one; forwards force to the update planner; does not serve the incumbent past a refusal that is not a wait; does not re-activate the build this host rolled back from; labels the launch with the build the adoption found serving, not the stale record; defers while another run holds the host fence; lets an explicit force deploy past both skips; names a newer host refusal apart from a rolled-back one, so only Force is offered; updates an older host as before, without asking to adopt it; never asks the incumbent when it already runs this build. src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts: keeps a completed listing usable when the host rejects the wait parameter. src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts: delivers to chat-default users in all targeting while holding out not-switched users. src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts: completes the row on a pick, even when the command is already typed; ignores a pick of the row while side chats are unavailable. src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts: explains a too-large refusal that arrives through the IPC error prefix. src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts: keeps the question with the caller and says once that it never went; tells the user to check the side chat when delivery is unconfirmed; reports a delivered question as sent, silently. src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts: decides each of %i tool-only turns once per layout, and nothing without a listener. src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx: places a side chat whose question was %s: %o. src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts: calls back once for %s; stops watching once unsubscribed. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts: records a mode 2031 subscribe from the raw chunk boundary without answering. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts: routes terminal input through deferPtyInput so the host can withhold it; forwards terminal input directly when the host supplies no deferPtyInput. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts: forwards onBell to pane attention and notification policy; hands the bell to the attention module with its pane even when pane attention is off. src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts: repaints from the main-owned snapshot when main drops pending output at the cap. src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts: retries a fresh-spawn native follow reset when renderer dimensions return. src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts: requests a tab remount for an unbound spawn; leaves recovery to a remote transport that armed its own retry; requests a remount when the transport reports no recovery of its own; settles the spawn as failed before requesting a remount; prefers the restored leaf id when reporting the anomaly; falls back to the pane leaf id when no restored leaf exists. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionDeferredInputForwardingTests } from '../input/pty-connection-deferred-input-forwarding.spec', registerPtyConnectionDeferredInputForwardingTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts: structural support changed only; no new authored removal credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionFreshNativeFollowResetTests } from '../output/pty-connection-fresh-native-follow-reset.spec', registerPtyConnectionFreshNativeFollowResetTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionTerminalBellAttentionTests } from '../notifications/pty-connection-terminal-bell-attention.spec', registerPtyConnectionTerminalBellAttentionTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts: registers interest on the first sidecar and releases on the last unsubscribe; releases sidecar interest only once for repeated unsubscribes; does not let an eager pre-mount buffer defeat hidden delivery gating; keeps eager buffers outside delivery interest when the PTY exits before mount; lets a sidecar exclusively own interest while an eager buffer overlaps. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts: blackholed delivery reproduces the wedge: no handler dispatch, no ACK ever. src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts: sends preferences to the execution host and attaches only to its returned PTY; preserves one operation ID across a lost reply and reconnect; preserves ordinary raw startup and captured-session attachment. src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts: sums registered gauges and drops disposed ones; ignores a repeated dispose instead of dropping another gauge; stops tracking new gauges past the cap so a missed dispose cannot grow it; tracks a live output processor queue through enqueue, drain, and dispose; excludes cleared consumed entries from retention after a bounded drain. src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts: says nothing once the pane is closed. src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts: refreshes after each scheduled atlas reset; falls back to a timeout when animation frames are unavailable; continues recovery when a manager throws after scheduling. src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts: tracks a remounted quiet title source even when the stale owner unregisters later; preserves the renderer-parsed output sequence in the response; preserves a pending escape tail for snapshot replay; routes a host's Reset Terminal request to the pane that owns the PTY. src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts: marks panes with restored scrollback for fresh-shell viewport blanking. src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts: recovers a 0x0 spawn whose container is briefly unmeasurable then settles. src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts: removes global listeners when the last pane unregisters. src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx: keeps trust text readable on a host-owned dialog surface; applies the hostile surface to ordinary dialogs, so the case above is exercised. src/renderer/src/components/use-terminal-parking-pass.test.tsx: does not queue a render when a pass produces the same parking sets; keeps parking transitions working under StrictMode. src/renderer/src/hooks/client-workspace-view-report.test.ts: reports an away user’s screen with no presence, and renews as soon as input returns; retries a failed send, empty or not, no sooner than a refresh. src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts: is new work in a workspace with no live terminal: its first bind moves it up in Recent. src/renderer/src/hooks/use-bundled-skill-install.test.tsx: ignores a repeated click while the install runs; retries the last requested skills on this host. src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx: adds seeds to a successful empty list but not to loading or failed results; retains seed projection after expiry and fetches fresh metadata for a new reader. src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx: retranslates the settings nav labels when the UI language changes live. src/renderer/src/lib/codex-stale-pane-account-identity.test.ts: keeps the prompt when the roster read fails and every label collapses. src/renderer/src/lib/image-blob-png.test.ts: downscales a pasted image above the pixel cap; releases its temporary URL on a decode error; releases its temporary URL when PNG encoding fails or exceeds the byte cap. src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts: names callers above the frame the write came from; restores Error.stackTraceLimit when the capture throws; stops collecting after the sample cap when captureStackTrace is unavailable; caps reported changed keys from a single wide write. src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts: applies the rendered text hard cap last and reserves the final overflow marker. src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts: keeps the runtime target identity stable across unrelated store writes. src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts: keeps creation available on old hosts and explains the missing operation; preserves landed warnings and direct collision recovery data; propagates remote discovery failure instead of a false empty page. src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts: reuses unchanged worktree tab projections when one worktree title changes; bumps only the changed worktree version when a sibling stays byte-identical. src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts: shares safe-auto fork sync cooldown attempts across store instances. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts: collapses a 193-workspace hydration to one store write; leaves the store byte-identical to the per-workspace path; re-reconciling the batched result is a no-op, as it is for the per-workspace path. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts: dedicated zero-case helper retirement; no authored test credit. src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts: persists each batch metadata update to its workspace owner. src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts: dismisses a rename error on its capable remote owner; clears pending first-agent rename when the title is updated. src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts: orders capture, guards, handlers, main's stop, commit, cleanup, and exit settlement. src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts: publishes the first terminal and root tab group atomically; publishes the first terminal and root tab group atomically, then marks it starting in main. src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts: restores daemon terminal wake hints before declaring the session ready. src/renderer/src/web/web-runtime-connection-auth-framing.test.ts: keeps legacy framing for sockets that cannot absorb a refused attempt. src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts: moves the old Windows default to Regular once and queues the notice; keeps custom weights and fresh profiles without a notice; leaves macOS and Linux profiles untouched. tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/persistence/worktree-sort-order-write.test.ts, src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts, src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts, src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts, src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts, src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts, src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts, src/main/runtime/session-graph/headless-runtime-graph.spec.ts, src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts, src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts, src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts, src/main/runtime/terminal/identity/terminal-identity-probe.test.ts, src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts, src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts, src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts, src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts, src/main/runtime/terminal/surface/workspace-layout-projection.test.ts, src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts, src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts, src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts, src/main/skills/skill-install-transaction.test.ts, src/main/speech/model-manager-download-resume.test.ts, src/main/ssh/config/ssh-config-parser.test.ts, src/main/ssh/config/ssh-known-hosts-source.test.ts, src/main/ssh/config/ssh-known-hosts.test.ts, src/main/ssh/connection/ssh-connect-config.test.ts, src/main/ssh/connection/ssh-connection-auth-fallback.test.ts, src/main/ssh/connection/ssh-connection-store.test.ts, src/main/ssh/connection/ssh-connection.test.ts, src/main/ssh/orcad-migration-stuck-host-profiles.test.ts, src/main/ssh/orcad-runtime-maintenance.test.ts, src/main/ssh/port-forwarding/ssh-port-forward.test.ts, src/main/ssh/ssh-channel-multiplexer.test.ts, src/main/ssh/system-transport/system-ssh-forward-process.test.ts, src/main/ssh/system-transport/system-ssh-loopback-route.test.ts, src/main/startup/browser-process-user-agent-ordering.test.ts, src/main/startup/quit/quit-path-durable-write-blocking.test.ts, src/main/stats/agent-session-transition-recorder.test.ts, src/main/text-generation/commit-message-text-generation-model-discovery.test.ts, src/main/text-generation/pull-request-context.test.ts, src/main/text-generation/source-control-local-process.test.ts, src/main/updater/linux-package/linux-package-update-recovery.test.ts, src/main/updater/releases/updater-prerelease-feed-readiness.test.ts, src/main/updater/releases/updater-release-builds.test.ts, src/main/updater/updater.build-channel-selection.test.ts, src/main/updater/updater.check-preflight.test.ts, src/main/updater/updater.prerelease-fallback.test.ts, src/main/updater/updater.publishing-window-feed.test.ts, src/main/updater/updater.quit-and-install.test.ts, src/main/window/createMainWindow-markdown-editor-focus.test.ts, src/main/window/createMainWindow-renderer-crash-recovery.test.ts, src/main/window/dashboard-popout-window.test.ts, src/main/window/dropped-path-preparation.test.ts, src/main/window/main-window-updater-deferred-setup.test.ts, src/main/worker-threads/worker-thread-request-queue.test.ts, src/main/workspace-hooks/hooks-setup-runner-script.test.ts, src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts, src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts, src/main/workspaces/removal/local-worktree-removal-recovery.test.ts, src/main/workspaces/removal/worktree-removal-safety.test.ts, src/main/wsl/discovery/distro-catalog.test.ts, src/main/wsl/discovery/wsl-distro-holder.test.ts, src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts, src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts, src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts, src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts, src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts, src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts, src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx, src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts, src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts, src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts, src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts, src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts, src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts, src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts, src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts, src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts, src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx, src/renderer/src/components/use-terminal-parking-pass.test.tsx, src/renderer/src/hooks/client-workspace-view-report.test.ts, src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts, src/renderer/src/hooks/use-bundled-skill-install.test.tsx, src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx, src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx, src/renderer/src/lib/codex-stale-pane-account-identity.test.ts, src/renderer/src/lib/image-blob-png.test.ts, src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts, src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts, src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts, src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts, src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts, src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts, src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts, src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts, src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts, src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts, src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts, src/renderer/src/web/web-runtime-connection-auth-framing.test.ts, src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts, tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
"Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts: stops paged routing when the check is cancelled; keeps an unfiltered redrive unrestricted when reservations merge; keeps an unfiltered parked delivery unrestricted when reservations merge; uses a bounded indexed pane lookup for reminted Dispatch identity. src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts: removes the reported wedged automation workspace without --force; clears PTY state once a failed stop is proven to have exited; names only the PTYs that are actually live, not every failed stop; warns with the specific sweep failure, not the generic deadline; still fails closed on a sweep-level failure without force. src/main/skills/bundled-skill-install/layouts.test.ts: links into a project only where its agent folder already exists; reads a pending cloud transaction as busy and a cloud receipt as another skill. src/main/skills/skill-upload-session-service.test.ts: joins concurrent disposal callers through exact cleanup completion. src/main/source-control/hosted-review-creation.test.ts: creates the pull request after fresh main-process validation passes; routes local WSL git and GitHub review creation through the selected runtime; creates a pull request on a GitHub Enterprise Server remote (#8312); creates a GitLab merge request after fresh main-process validation passes; creates an Azure DevOps pull request after fresh main-process validation passes; creates a Gitea pull request after fresh main-process validation passes. src/main/source-control/hosted-review-execution-host-routing.test.ts: reads a GitHub review on the SSH host a row names only in executionHostId; reads a GitLab review on the executionHostId host when connectionId names a different one; does not dial this client for a runtime row whose nested target shares a local name; keeps a runtime row with no nested target on this process (self-addressed stamp); keeps a legacy connectionId-only SSH row on its target; does not share a cached answer between two rows at one path on different hosts; creates a Bitbucket review locally for a runtime row rather than dialing its nested target; reports creation eligibility from the executionHostId-only SSH host; resolves the GitHub slug for a repo listing on the row it is asked about; refuses to dial a runtime host from this process; answers with the SSH target for both spellings and local otherwise; reads a runtime stamp on a row in this store as self-addressing, not a second machine. src/main/source-control/hosted-review-inflight-invalidation.test.ts: keeps other hosts, paths and their pending promises isolated. src/main/speech/model-manager.test.ts: requires pinned, internally consistent metadata for every model file; verifies downloaded model file hashes before installation; rejects non-HTTPS model downloads; marks OpenAI transcription models ready only when an API key is configured. src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts: writes to the SFTP namespace path discovered on the same session; uploads the bundle into the SFTP namespace directory; issues no discovery requests when the caller supplies no mapping; ignores a mapping on a Windows host; never resolves on the system-SSH transport; leaves writeBuffer and openFileUploadSession on the shell path; keeps the shell path when discovery is inconclusive; preserves a session-limit channel-open error unchanged. src/main/ssh/connection/ssh-connection-system-transport.test.ts: uses system SSH transport when ProxyUseFdpass is resolved by OpenSSH; allows concurrent exec commands for system SSH with an Orca ControlMaster socket; keeps concurrent exec commands disabled for system SSH without a reusable socket; uses system SSH transport for ProxyCommand targets before ssh2 auth; keeps the original ssh2 reachability error when the system SSH probe fails; reports the system SSH failure when ssh2 cannot negotiate with the host; uses system transport for target or resolved OpenSSH proxy directives; allows an environment override for e2e coverage; ignores stale imported proxy fields when fresh OpenSSH config has no proxy. src/main/ssh/orcad-migration-catalog-client.test.ts: keeps each server project’s execution host, so a nested SSH row is never read as local; reads the server’s folder workspaces and the groups that place them on a host; sends and validates the %s operation; validates an abort result without letting it erase committed state; validates a committed receipt against the requested manifest; rejects malformed stage timestamps and abort envelopes; fails closed for method absence, malformed identity, and invalid pairing; refuses a destination without the capability before sending any migration request; reads method-not-found as the same refusal, not as a lost answer. src/main/ssh/runtime-ssh-access.test.ts: persists intent then claim before connecting and publishes redacted authenticated access; names the saved dependency when dependent state blocks an SSH access link; handles lost link responses without connecting or verifying again; invalidates old transport only after authenticated access is published; rejects changed request tuple after a completed link; rejects provisioning and missing durable generations without connecting; treats a lost successful unlink response as an idempotent no-op; hashes connection identity, not display state or owner; strictly validates ports and request IDs. src/main/startup/cli-launch-redirect.test.ts: detects a launch that received the unpacked CLI entrypoint; ignores normal desktop launches; ignores the entrypoint when it is only the executable itself (argv[0]); applies on Linux too; strips injected Chromium switches before node-mode CLI arguments; keeps user flags after the command and malformed boolean assignments; does not treat a later positional entrypoint path as the launcher; redirects a direct binary launch with no AppImage env at all; strips Chromium switches node mode would reject; preserves desktop-shaped switches after the command; leaves direct serve in-process but redirects its help; treats help as a CLI launch even without a command; treats %s as a CLI launch even without a command; does not treat a value of %s as a CLI early-exit flag; does not treat a serve option value as a help request; does not reinterpret help after the argument terminator; leaves a plain desktop launch alone; skips flag values when looking for the command positional; preserves a project selector in %j; does not apply the command form on macOS or Windows; never redirects an unpackaged build; runs the in-package CLI in Electron node mode with sanitized env; refuses to redirect twice so a dropped ELECTRON_RUN_AS_NODE cannot loop; reports a missing CLI entrypoint instead of booting the desktop app; execs a direct serve into the CLI so it keeps its pid and honours profile and supervise; keeps ORCA_USER_DATA_PATH for a direct serve without --user-data-dir; serves in-process when this runtime cannot exec or the exec fails; never execs the --serve child the CLI itself spawns, or serve on other platforms; surfaces a spawn failure as a non-zero exit; re-execs a direct --serve onto X11 when Electron resolved Wayland; leaves $name alone. src/main/startup/main-process-runtime-launch-activation.test.ts: marks startup settled for the launch record only after the window has loaded and settled; loads SSH targets on a windowless serve before paired clients can connect (#25886); pins the serve listener to loopback only for orcad browser sidecars (sidecar=$sidecar, #31895); saves Codex auth before a headless serve update restart, like the desktop does. src/main/startup/run-electron-vite-dev.test.ts: forwards dev instance identity to electron-vite; prepares userData orca and orca-dev wrappers for dev terminals; consumes the stable-name flag before forwarding args to electron-vite. src/main/updater/releases/updater-prerelease-feed.test.ts: returns the newest stable tag when the user is on an RC and a newer stable exists; returns the newest RC tag when no stable is newer than the current RC; can exclude prerelease tags for stable-channel checks; probes the %s %s platform manifest; returns null for stable-channel checks when only prereleases are newer; returns null when nothing in the feed is newer than the current version; ignores entries with unparseable tags; returns null when the fetch is not ok; returns null when the fetch throws; picks semver-newest across a mixed-order feed; ignores perf-tagged prereleases for regular RC checks; reports no RC update when only perf-tagged prereleases are newer; picks the semver-newest perf-tagged prerelease; matches only literal rc.N.perf prerelease tags for perf checks; reports no perf update instead of falling back to stable or RC tags; returns a bounded fallback candidate after the newest newer tag; returns null when the only newer tag has a manifest but its asset still 404s; requires a known old timestamp for a stable-fallback tag. src/main/updater/updater-events.test.ts: hands the whole downloaded event to artifact capture; publishes manual-install recovery after a %s download; publishes the normal downloaded state for AppImage builds; blocks downloaded-state handling when the packaged marker is unusable; passes the actual updater error into the install-failure handler; keeps manual-install recovery when a later check finds only the installed release; drops the artifact when another version takes over the cycle; ignores a downloaded event for an older target; accepts a matching event when the pending cache target was cleared; drops the artifact when progress reports a different pending version. src/main/updater/updater-linux-package-recovery-actions.test.ts: rejects both actions while no package-install recovery is active; validates the retained package on every invocation; restores recovery after a recheck resolves without a terminal event; restores recovery after a recheck fails; restores recovery when a pinned check resolves to the current version; restores recovery when resolving a pinned check fails; clears recovery for both actions once the package is gone; resolves %s as a result and keeps the card usable instead of rejecting; keeps recovery available after a transient read failure. src/main/updater/updater.check-settlement.test.ts: leaves a dismissed release update on the release source; surfaces net::ERR_FAILED to user-initiated checks with a friendly message; shows checking immediately for a user-initiated check while feed pinning is pending; keeps background checks event-driven before checking-for-update fires. src/main/usage/usage-provider-store-lifecycle.test.ts: persists identities for a whole first scan with one write; skips disabled and fresh matching states; invalidates prior sources on fingerprint changes and reuses them for forced scans. src/main/window/createMainWindow-close-confirmation.test.ts: clears the quit latch when the renderer prevents unload; does not notify the crash recorder when renderer teardown follows a confirmed window close; allows close when Electron reports a crashed webContents; requests confirmation for a hung-but-alive renderer instead of bypassing. src/main/workspaces/catalog/worktree-identity-persistence.test.ts: stores independent metadata for colliding locators on two hosts; projects canonical-only metadata for exactly one host; keeps canonical metadata current for legacy writers on a known owner; removes only the selected legacy-owner metadata when locators collide; keeps the canonical identity stable when the locator changes; leaves other hosts at the old locator when one host renames its folder. src/main/wsl/filesystem/wsl-drive-unc-conversion-startup.test.ts: leaves a journaled conversion untouched with the gate closed, %s. src/main/wsl/orcad/wsl-orcad-deploy.test.ts: holds the distro before it deploys and launches, and reports what C5 dials; passes its connect-state read (%s) on as hints; applies the SSH census and downgrade admission to the first deploy; refuses a WSL 1 distro before holding it or touching its files; tells an unregistered distro how to find the installed ones, before holding anything; surfaces an unsupported libc as the SSH host refusal does; starts an already-active slot the distro stop ended, instead of reporting it ready; deploys over an adopted unrecorded orcad under the SSH terminal gate, never a fresh launch; reports the adopted instance once the same version is serving; returns a deferral rather than launching over live terminals; hands a failed first deploy to the fresh-install cleanup before reporting it. src/main/zcode/zcode-v2-plan-credentials.test.ts: prefers migrated credentials over a stale legacy account; keeps legacy support when no personal v2 file exists; honors the upstream personal config override independently of the credential directory; does not borrow credentials from another execution host; preserves the protected Orca key priority even if v2 is corrupt; rejects upstream-invalid selection %j without legacy fallback; accepts a valid optional reasoning level; rejects upstream-invalid rule containers %j without legacy fallback; accepts a valid selected-provider empty personal rule and smart model rule; cannot establish selected credentials from %s rules; leaves encrypted CLI files unchanged across repeated account reads. tests/e2e/automation-terminal-launch.unit.test.ts: launches explicit Chat for %s through the common entry and keeps its actual fallback; does not apply stored Terminal extras to Chat; forwards only complete Chat-consumed values, with no Terminal startup base; refuses an expired admission without minting another launch identity; records the actual chat identity and delegates new workspace setup and provenance. tests/e2e/github-project-provider-columns.unit.test.ts: renders %s through one bounded items request on a named cloud host; preserves zero and complete counters: %j; preserves populated and legacy rows through shared sorting, grouping and cells. tests/e2e/structured-agent-session-launch-continuation.unit.test.ts: carries renderer lifetime through host intent to the real %s provider builders. tests/e2e/terminal-account-restart.unit.test.ts: replaces a tombstoned owner while its persisted pane binding has not yet been cleared; paired restart retains the old owner (host authority: %s). tests/e2e/terminal-hidden-view-parking.spec.ts: does not park excluded tabs; reproduces a static frame byte-for-byte across 25 park/reveal cycles. tests/e2e/terminal-long-table-scroll-restore.spec.ts: reproduces long markdown table artifacts after workspace switch and scroll; keeps narrow wrapped signer markdown table coherent after restore and scroll; keeps real emoji markdown table right edge clean after restore and scroll. tests/e2e/terminal-long-table-fixtures.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-paste-ownership.spec.ts: Windows multiline keyboard paste normalizes terminal newlines with one PTY owner; right-click paste sends clipboard text to the focused terminal exactly once. tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts: uses WebGL by default for ordinary terminal output when available @terminal-rendering-golden. tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. tests/e2e/workspace-board-lane-virtualization.spec.ts: mounts a window of cards for a large lane and keeps lane indexes; renders later lane indexes after the lane scrolls. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts, src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts, src/main/skills/bundled-skill-install/layouts.test.ts, src/main/skills/skill-upload-session-service.test.ts, src/main/source-control/hosted-review-creation.test.ts, src/main/source-control/hosted-review-execution-host-routing.test.ts, src/main/source-control/hosted-review-inflight-invalidation.test.ts, src/main/speech/model-manager.test.ts, src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts, src/main/ssh/connection/ssh-connection-system-transport.test.ts, src/main/ssh/orcad-migration-catalog-client.test.ts, src/main/ssh/runtime-ssh-access.test.ts, src/main/startup/cli-launch-redirect.test.ts, src/main/startup/main-process-runtime-launch-activation.test.ts, src/main/startup/run-electron-vite-dev.test.ts, src/main/updater/releases/updater-prerelease-feed.test.ts, src/main/updater/updater-events.test.ts, src/main/updater/updater-linux-package-recovery-actions.test.ts, src/main/updater/updater.check-settlement.test.ts, src/main/usage/usage-provider-store-lifecycle.test.ts, src/main/window/createMainWindow-close-confirmation.test.ts, src/main/workspaces/catalog/worktree-identity-persistence.test.ts, src/main/wsl/filesystem/wsl-drive-unc-conversion-startup.test.ts, src/main/wsl/orcad/wsl-orcad-deploy.test.ts, src/main/zcode/zcode-v2-plan-credentials.test.ts, tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts. Unresolved local/computed edges remain explicit debt.",
@@ -4211,7 +4182,15 @@
"Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
"Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. All prior notes and dated/archived evidence retain original scopes.",
"Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
- "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Earlier notes, complete dated receipts and archived gaps retain their original scopes."
+ "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
+ "Audit3597 scope: remove two renderer-hang-capture examples (2 authored/2 finite): an invalid repeated-token oversized reducer fixture and a shorter unanswered-request fixture. Intentionally lose the direct truncated flag/sanitized frame fixture and request-pending status/zero-sample alarms. Retain window-death/stale-result exclusion, generation reconciliation, and baseline-publication cancellation lifecycles; they are not equivalent bound, redaction or pending-status replacements. Historical execution retains its original source scope; no new runtime evidence is claimed.",
+ "Audit3601 scope: remove the whole custom-sound happy-path IPC suite and one custom-label/multiline notification formatting example (2 authored/2 finite). Intentionally lose configured .ogg selection, exact byte/MIME success wiring, successful dispatch for the formatting fixture, custom-label whitespace/title normalization and assistant-body whitespace/180-character-cap alarms. Retain prompt-exclusion, persisted qualified dismissal/restart, theme ownership/restore and Ghostty precedence/collision cases; none replaces the retired sound/formatting alarms. No actual playback, native delivery, phone/network, cross-platform or new runtime evidence is claimed; historical execution keeps its original scope.",
+ "Audit3606 adopts the enhanced3604/3605 icon cuts: nine authored/nine finite cases removed, including the whole tray-attention-icon suite. Retires the no-encoder oversized-upload null sample, missing-ID/request-order sample, encoder-null PNG-prefix fallback, SVG/404 rejection samples, transparent amber-dot placement and half-alpha white-tint sample, exact small fetched-byte passthrough, host-qualified image-key inventory and constant-encoder large-upload projection. These specific admission, formatting and bitmap alarms are intentionally lost without equivalent replacements. Retained queue/cache, bounded fetch and Dock lifecycle checks do not establish actual raster decoding, native image conversion or rendered appearance. Historical receipts below are preserved evidence for earlier test sets, not fresh validation of this reduced selection.",
+ "Audit3608: remove five authored/five finite callbacks, including whole owner-slug and remote favicon URL suites and two repository-label projections. Lose five owner acceptance samples, eleven negative owner samples plus nonstring refusal, six host-local icon refusal samples, legacy-SSH same-path label-map cardinality, and explicit runtime ownership over stale legacy metadata at label level. These are accepted narrow grammar/presentation alarms with no equivalent replacement claimed. Retained binary parser, React recovery and label grouping/platform cases do not replace these losses. Static evidence only; historical receipts retain their original scope.",
+ "Audit3613: remove six authored/six finite callbacks, including whole reviewer-display oversize-input and explorer-root record-filter suites, plus plugin family-emoji/invisible-only-name and pool legacy-name/urgent-countdown samples. Accept losing oversized-input empty-result/no-split, malformed-record/prototype-sensitive-key/nonstring filtering, exact ZWJ family preservation, invisible-only name refusal, no-group old-host full-name preservation, and80/79/null-reset countdown composition alarms. No equivalent replacement asserted. Retained strict/runtime sanitization, SVG parser, mobile focus recovery and collision/tie cases have different scopes. Static evidence only; historical receipts retain original scope.",
+ "Audit3628: remove the entire one-authored/one-finite RepositoryRemoveProjectSection happy-dom suite. Accept losing the local zero-to-one-terminal stale-count revalidation alarm: first confirmation defers the removal callback and second confirmation invokes it after the count snapshot updates. The test never asserts updated warning text/count, actual terminal creation or removal/PTY teardown, host/scope routing, cancellation or folder/mobile behavior. No equivalent replacement or end-to-end warning-before-teardown proof asserted. Static evidence only; historical receipts retain original scope.",
+ "Audit3629 removes two singleton parser suites: WSL Claude plugin metadata out-of-range index rejection and Git checkout unlink-warning path extraction. Their real range-refusal and quoted-path extraction alarms are intentionally lost without replacement; no WSL execution, checkout recovery or equivalent remaining coverage is claimed.",
+ "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed."
],
"demotionRule": "Demote if a retired runtime transport can leave a renderer subscription without a close event, if a close is delivered more than once, if one failing teardown strands its sibling subscriptions, if payload frames from a retired transport reach the renderer, or if a revealed remote terminal can stay blank or reject input after a reconnect."
},
@@ -4329,7 +4308,7 @@
"providers": ["remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
- "coverageNotes": "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked session-close routing suite is removed, including the explicit cross-worktree cleanup alarm. Remove its active file, command token and assertion reference; historical selectors and receipts retain their original scope. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3342 retires the complete mobile editor/diff tab-publication projection suite: editor/diff serialization, workspace-document privacy withholding, pending/focus and capability/options projections are intentionally lost without equivalent replacement. The surviving focused selectors are unexecuted in this source composition. Six complete compound macOS receipts whose command fields select the changed source are retired verbatim as history; their other selected tests receive no promoted evidence. Other dated receipts keep their original scope; no fresh runtime/UI/mobile/mixed-version or cross-platform validation is claimed. Audit3335 retires the complete three-case browser-tabs snapshot assembly suite: canonical snapshot replay/placement/focus, local host-page adoption and unstamped host echo leaving a local page untouched alarms are intentionally lost without equivalent replacement. The surviving focused selector is unexecuted in this source composition. Unrelated dated receipts keep their original scope; no fresh runtime/network, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the caller-chat-target precedence over host selection example from web-session-tabs-sync-focus-intent.test.ts. The snapshot-before-RPC replay and split-sibling-first exact-leaf focus cases remain unchanged and match the existing assertion reference. Preserve current selectors, assertion references, unrelated active receipts and complete archived history. These mocked state-composition survivors provide no equivalent replacement, rendered, native, network or fresh execution proof. Audit3108: doc-preview-grants.test.ts now retains only the stale grant-rejection race: a late rejected grant request must not evict a newer grant registry entry, witnessed by later revocation of grant-2. Retire stable minted-location and outside-workspace POSIX/Windows request-projection alarms without replacement. The direct nonempty grant selector remains unchanged; no real grant-server/file authorization, SSH/HTML delivery or native-focus result is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2043: Remove the registration-wait, webview-security, preview-authorization, guest-lifecycle and grant-IPC unit suites and the sibling-directory assertion reference. Runtime and browser capability consumers also lose removed imported examples. Remaining document-policy, file-reader and grant-registry assertions do not replace those alarms. Preserve the 27 independent dated receipts at their original unchanged selectors; reduced prospective unit selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1973: Delete the browser RPC forwarding/schema/scalar suite and its prospective selector. Preserve all27 unrelated dated receipts; no actual browser operation alarm is replaced. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): The complete terminal-file-link-actions suite is removed. Lose supplied local/remote menu-row inventories, browser label/order/download/reveal callback forwarding, platform-copy and source-group pinning examples. No OS reveal/download, real remote preview or browser navigation was exercised; the other real document-preview sources are not equivalent replacements. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1899 replays sealed Audit1895: workspace-doc-history.test.ts is entirely removed from its current command and testFiles. Supplied recency/dedupe/cap/title/identity examples and the10000-row getter-read budget alarm are intentionally lost. No current assertionRef or active receipt selects that file. Unrelated active receipts and all prior gap literals remain verbatim; no replacement history/index-work coverage or new browser/paired-preview gate execution is claimed. Historical coverage account before Audit1899: Audit1853 reduces LinkActionPopover.test.tsx and archives its complete 2026-09-06 mixed-selector receipt. The lost copy/open-state and Settings callback-order/omission alarms are accepted without equivalent replacement coverage. No fresh execution of this gate is credited. Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1630 removes low-value Git, GitHub/GitLab and IPC projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1571 removes mock forwarding, capability/schema inventories, private predicates, supplied error/result replays, and filesystem-mocked persistence checks without equivalent replacement claims. Retained changed tests also exercise real local permission-file reread, registry proxy rollback/credential retirement, site display recovery, and pending sender/credential/document admission with injected Electron/UI producers. Retained network tests exercise owned stream credit/cleanup, generation and retirement fences, real loopback proxy/SOCKS bytes and file-backed binding state. SSH/WSL/paired runtime, native sessions, authority producers and storage clears remain injected; simulated relaunch uses filesystem mocks. The unchanged profile-retirement suite was statically reviewed and not rerun. No actual SSH/WSL runtime, native Chromium jar deletion, durable process restart, remote DNS or external site proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1568 removes API inventories, supplied mock-value/forwarding assertions, implementation-shape tables and negative/setup cases that do not reach their intended boundary, without equivalent replacement claims. Retained changed definitions exercise owned manager lifetime/queue/refcount/clamp and real synthetic process/files/staging boundaries. Seventeen unchanged native Electron definitions across this combined audit are statically reviewed and not rerun. Changed native suites exercise local popup wire/cookie/session and clean/native process-identity behavior; known popup-admission flaws remain unfixed. Unit native/event/session/registry inputs remain injected. No actual OS focus, registry/host execution, CRX verification or durable restart proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1564 retires copied cookie key recipes, mock bridge/preview forwarding and flag tables, source-spelling/script inventories and setup-only alarms without equivalent replacement coverage. Retained changed cases exercise actual scoped SQLite merge/rollback/schema refusal, owned cancellation and grant authority/canonical containment, ranged response consistency, replacement guest ownership and executed guest-script promise/DOM cleanup behavior. Session, host response, geometry/observer and transport producers remain injected where documented. One unchanged native extension definition is not rerun locally; no actual remote filesystem, native layout/focus or authentication claim. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain unchanged. Historical scope before this audit: Audit1412 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1386 changes referenced sources; no new execution result validates reduced selectors. Retained unchanged receipts apply only to unchanged commands. Historical coverage: Audit1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): A macOS desktop host and a separate paired Electron client exercise the Explorer preview action end to end: the document renders inside the client-local orca-preview guest, the client gains exactly one browser workspace and it is the document one, the host's own page registry and tab snapshot gain nothing, the split does not take focus from the source editor, an explicit click activates the preview, and closing it with its X leaves the editor and terminal intact. Both host oracles are read in a run where an ordinary URL browser tab from the same client does arrive in them, because a host that cannot project browser pages at all would otherwise answer the absence question the same way. A second journey quits that client with a document tab open and relaunches it on the same profile, which is the restore the user's original report turned on: the same workspace row comes back blank and named by the document, renders again, and does so over a grant URL that differs from the one that was quit. The same journey pins the guest URL to the orca-preview scheme, so a regression back to file:// or to a host browser page is visible. The rewritten journey caught a live gap the old one could not see: since previews became browser pages they had no chrome to hand focus to their guest, so main refused every reported link click as coming from an unfocused guest and the one route out of a preview was dead. Main's own log answered it — registered true, grant live, focused false — after the embedder reported the anchor really taking six real presses. The pane now hands focus over when it is the reader's surface, and the journey routes. The preview's own components moved out of the editor folder into browser-pane/workspace-doc/ with this change, since a preview is a browser pane and no longer an editor one; their i18n keys keep the historical auto.components.editor.HtmlDocPreview prefix rather than dropping thirty translated strings across four locales for a tidier key path. Seven gate commands named those files by their old paths and were re-issued at the new ones, and the nine dated runs behind them were retired rather than left naming files that are no longer there, on the same principle this gate already applied twice: vitest treats a missing named file as a filter and exits 0, so such a command reports green while silently running only the half that still exists. Each retired record's finding is carried into the replacement run recorded below it, including the red half of the entry/subresource pair, which was re-measured by re-applying its mutant at the new path rather than being dropped. The fence over the page-management channels was decided channel by channel before it was built, and that decision record is: of the 23 channels that can name a page, 6 are allowed for a workspace-document page — the tool channels the reader drives, which reach it through the one authority that reads both halves of the registry — 9 refuse (download accept and cancel, devtools, certificate proceed, client page metadata publish, viewport override, WebAuthn account response, registration probe, registration repair), 3 cannot name a page at all because they take a profile or a worktree instead, and the rest are the registration and activation doors, refused on membership. What shipped is not the per-channel guard that classification implies: eleven call sites read the browsing map directly, so a guard per channel is exactly the caller-flag seam that has to be remembered at every future call site. The registry was split in two instead, which makes the classification structural — a document guest is absent from the browsing map, so every refusing channel refuses by absence rather than by a guard, and a channel added later inherits the refusal without being classified at all. Unit contracts cover grant scoping and path containment, per-owner read routing, refusal of a truncated or over-cap read, the old-server binary degradation, scheme admission on will-attach-webview, the guest navigation policy, the plan layer's local/SSH/paired/out-of-worktree routing, and the distinct sentence the reader sees for each failure reason. The paired browser-creation surfaces this gate still owns — capability rejection cleanup, canonical page identity, reconciliation rollback, close convergence — keep their existing headed and headless journeys. Linux and Windows live journeys remain gaps. A refused subresource is a notice on a rendered document rather than a failure panel, since only the entry document's failure leaves the reader with nothing; the entry document is served as text by every owner and cannot be refused for its format at all. Grants die with the renderer document that minted them, at window creation and on every reload, because the renderer holds the only record of which preview owns which grant. The mint and revoke channels answer only the trusted renderer, and a preview tab is never republished to mobile clients, which have no grant to read it with. External URLs leave the preview only via a trusted user click on an anchor while the preview is focused; script-driven navigation and popups reach nothing. The guest's navigation sinks are deny-only and route no URL at all, and the guest carries a preview-only preload, pinned by will-attach-webview and denied to every other attach path, whose capture-phase click handler reports an anchor's URL to main; main answers only a report from a preview guest with a live bound grant that is the focused contents, and only for http(s). Two earlier reader-facing records from 2026-08-26, which measured a shape where a subresource failure was filtered out and the panel still carried an unsupported-asset sentence, were retired with that shape rather than left contradicting the 10/10 runs of the command they share. Two more were retired on the same principle when the external-link design changed: a record showing that removing a recent-input gate let the unattended document open two browser tabs, and a record showing that dropping the webview's allowpopups attribute left a target=_blank press with nothing to route. Both measured machinery that no longer exists — the input gate could not tell a script's navigation from the click it followed, which is the case now recorded below, and the preload intercepts the press before Chromium considers a popup at all, so allowpopups was removed. WebRTC is fenced by the guest's IP-handling policy alone: this Chromium answers a webrtc content-security-policy directive as unrecognized and gathers candidates anyway, so the directive is deliberately absent from the served policy and a unit assertion keeps it out. A standalone Electron probe on the same version gathered 7 candidates including a STUN reflexive one without the policy and 0 with it. Two command paths this gate used to carry no longer exist, and their structured evidence was retired with them rather than left naming files that are no longer there: vitest treats a missing named file as a filter and exits 0, so such a command reports green while silently running only the half that still exists. The first is src/renderer/src/lib/file-preview-capability-cleanup.test.ts, deleted in STA-5557 when HTML previews stopped creating paired browser tabs: on 2026-08-12 its five-assertion STA-4063 oracle ran red 5/5 on scan e4c278eb52 and on main bc2e30000b, partially green 2/5 on pre-fix PR #14100, and green 5/5 on candidate 14b5877a75; the surviving half of that oracle is web-runtime-browser-capability-cleanup.test.ts, still commanded above. The second is tests/e2e/paired-remote-html-browser-focus.spec.ts, renamed in STA-5557 to paired-remote-html-preview-local-render.spec.ts because the journey no longer proves anything about browser focus: its 2026-08-12 runs established the owning-runtime routing and no-focus-steal behavior of the then-current browser-tab preview (red on main 346e59c879 and a90a18d43d, green on candidates d05217c40d and b7de9c0961, red again with only the side-preview focus or routing seam disabled), and its 2026-08-26 runs are recorded below under the current path. An adversarial pass after the journey landed found four coverage gaps rather than shipping defects, and all four are pinned here. The page url had a third door: the navigation commit wrote whatever url was reported, unfenced, and while nothing reaches it for a document page today it sat one report away from giving a document page a URL that persistence, the publish boundary and the address bar all read. The group projection was the load-bearing half of the mobile publish boundary that no test had: removing it alone left the whole suite green, because no test in it had tab groups, while the phone payload gained a group whose order and active tab named a document tab it was never sent. The focus handoff was covered only in the narrowing direction, so widening it — dropping the page-activity check, or either half of the reader-surface check — survived both suites. And the handoff itself was offered once and never again, so another app taking the front left the preview's one route out shut until the pane remounted, which is a desktop gap rather than a test-only one. The standalone capability-cleanup and browser-placement ledger suites were removed, including their mixed-version rejection, cleanup transfer, capacity and partition alarms. web-runtime-session.test.ts no longer supplies browser creation, rollback or recovery assertions. The grouped workspace-document exclusion remains; the separate no-group publication example was removed. Existing live/browser-store evidence does not establish equivalent replacement alarms. Earlier descriptions of the removed fixtures and their run results are historical. The client-owned-placement and layout-groups suites are removed. The broad mirror fixture no longer supplies preview placement/reservation/move assertions. Browser rows retain pre-response replay and real local-workspace reuse; focus intent retains response ordering and exact-leaf sibling ordering. Supplied browser-layout and placement/focus projection alarms are lost; retained evidence is narrower and not equivalent. The test-value audit retires renderer grant-release mock ledgers, direct creation/title/session-field copies, notification/onboarding calls and several placement/per-page projections. Canonical-ID rejection, document reopen/restore and preview URL fences remain; they do not prove close-to-registry revocation or replace every lost alarm. Historical execution evidence is unchanged. The test-value audit removed the direct legacy editor-preview hydration example from tabs-hydration.test.ts. Dropping legacy preview chrome while preserving the same-document ordinary editor no longer has that alarm. The surviving corrupt-id deduplication case does not cover that migration, and retained preview journeys are not equivalent replacement coverage. Historical run counts and migration mutation findings describe the earlier suite. Audit1308: src/renderer/src/components/editor/EditorPanelShell.header.test.tsx removed. Header visibility and mocked editor-surface inventory alarms disappear. No equivalent replacement coverage is claimed. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1386: src/renderer/src/lib/doc-preview-grants.test.ts reduced. Repeated-mount mint count, ordinary release/remint and failed-mint cache retry standalone alarms removed; no actual grant server/access test. No equivalent replacement coverage is claimed. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/browser/guest-lifecycle/manager/browser-manager-guest-policy-profile.test.ts removed. Loses workspace-document in-grant navigation/popup refusal, cleanup/re-attach, cross-registry guest authorization and browsing-map separation alarms. No equivalent browser policy coverage is claimed. No equivalent replacement coverage is claimed. Audit1421 removes browser-address-bar-suggestions.test.ts. Document suggestion title/path matching, recency merging and path-prefix ranking alarms are lost. No equivalent replacement coverage is claimed. Historical receipts remain scoped to unchanged selectors; the reduced command has no new execution result. Audit2452 removes the whole fake-effect browser-close routing suite. Active selectors and assertion references no longer select it. Its requested-worktree default close, sibling-page close and explicit missing-page typed reply alarms are intentionally retired without equivalent replacement. Prior dated receipts remain unchanged and scoped to their original sources; no fresh execution of the reduced gate, rendered browser, live remote, mobile or cross-platform validation is claimed.",
+ "coverageNotes": "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked session-close routing suite is removed, including the explicit cross-worktree cleanup alarm. Remove its active file, command token and assertion reference; historical selectors and receipts retain their original scope. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3342 retires the complete mobile editor/diff tab-publication projection suite: editor/diff serialization, workspace-document privacy withholding, pending/focus and capability/options projections are intentionally lost without equivalent replacement. The surviving focused selectors are unexecuted in this source composition. Six complete compound macOS receipts whose command fields select the changed source are retired verbatim as history; their other selected tests receive no promoted evidence. Other dated receipts keep their original scope; no fresh runtime/UI/mobile/mixed-version or cross-platform validation is claimed. Audit3335 retires the complete three-case browser-tabs snapshot assembly suite: canonical snapshot replay/placement/focus, local host-page adoption and unstamped host echo leaving a local page untouched alarms are intentionally lost without equivalent replacement. The surviving focused selector is unexecuted in this source composition. Unrelated dated receipts keep their original scope; no fresh runtime/network, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the caller-chat-target precedence over host selection example from web-session-tabs-sync-focus-intent.test.ts. The snapshot-before-RPC replay and split-sibling-first exact-leaf focus cases remain unchanged and match the existing assertion reference. Preserve current selectors, assertion references, unrelated active receipts and complete archived history. These mocked state-composition survivors provide no equivalent replacement, rendered, native, network or fresh execution proof. Audit3108: doc-preview-grants.test.ts now retains only the stale grant-rejection race: a late rejected grant request must not evict a newer grant registry entry, witnessed by later revocation of grant-2. Retire stable minted-location and outside-workspace POSIX/Windows request-projection alarms without replacement. The direct nonempty grant selector remains unchanged; no real grant-server/file authorization, SSH/HTML delivery or native-focus result is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2043: Remove the registration-wait, webview-security, preview-authorization, guest-lifecycle and grant-IPC unit suites and the sibling-directory assertion reference. Runtime and browser capability consumers also lose removed imported examples. Remaining document-policy, file-reader and grant-registry assertions do not replace those alarms. Preserve the 27 independent dated receipts at their original unchanged selectors; reduced prospective unit selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1973: Delete the browser RPC forwarding/schema/scalar suite and its prospective selector. Preserve all27 unrelated dated receipts; no actual browser operation alarm is replaced. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): The complete terminal-file-link-actions suite is removed. Lose supplied local/remote menu-row inventories, browser label/order/download/reveal callback forwarding, platform-copy and source-group pinning examples. No OS reveal/download, real remote preview or browser navigation was exercised; the other real document-preview sources are not equivalent replacements. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1899 replays sealed Audit1895: workspace-doc-history.test.ts is entirely removed from its current command and testFiles. Supplied recency/dedupe/cap/title/identity examples and the10000-row getter-read budget alarm are intentionally lost. No current assertionRef or active receipt selects that file. Unrelated active receipts and all prior gap literals remain verbatim; no replacement history/index-work coverage or new browser/paired-preview gate execution is claimed. Historical coverage account before Audit1899: Audit1853 reduces LinkActionPopover.test.tsx and archives its complete 2026-09-06 mixed-selector receipt. The lost copy/open-state and Settings callback-order/omission alarms are accepted without equivalent replacement coverage. No fresh execution of this gate is credited. Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1630 removes low-value Git, GitHub/GitLab and IPC projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1571 removes mock forwarding, capability/schema inventories, private predicates, supplied error/result replays, and filesystem-mocked persistence checks without equivalent replacement claims. Retained changed tests also exercise real local permission-file reread, registry proxy rollback/credential retirement, site display recovery, and pending sender/credential/document admission with injected Electron/UI producers. Retained network tests exercise owned stream credit/cleanup, generation and retirement fences, real loopback proxy/SOCKS bytes and file-backed binding state. SSH/WSL/paired runtime, native sessions, authority producers and storage clears remain injected; simulated relaunch uses filesystem mocks. The unchanged profile-retirement suite was statically reviewed and not rerun. No actual SSH/WSL runtime, native Chromium jar deletion, durable process restart, remote DNS or external site proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1568 removes API inventories, supplied mock-value/forwarding assertions, implementation-shape tables and negative/setup cases that do not reach their intended boundary, without equivalent replacement claims. Retained changed definitions exercise owned manager lifetime/queue/refcount/clamp and real synthetic process/files/staging boundaries. Seventeen unchanged native Electron definitions across this combined audit are statically reviewed and not rerun. Changed native suites exercise local popup wire/cookie/session and clean/native process-identity behavior; known popup-admission flaws remain unfixed. Unit native/event/session/registry inputs remain injected. No actual OS focus, registry/host execution, CRX verification or durable restart proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1564 retires copied cookie key recipes, mock bridge/preview forwarding and flag tables, source-spelling/script inventories and setup-only alarms without equivalent replacement coverage. Retained changed cases exercise actual scoped SQLite merge/rollback/schema refusal, owned cancellation and grant authority/canonical containment, ranged response consistency, replacement guest ownership and executed guest-script promise/DOM cleanup behavior. Session, host response, geometry/observer and transport producers remain injected where documented. One unchanged native extension definition is not rerun locally; no actual remote filesystem, native layout/focus or authentication claim. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain unchanged. Historical scope before this audit: Audit1412 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1386 changes referenced sources; no new execution result validates reduced selectors. Retained unchanged receipts apply only to unchanged commands. Historical coverage: Audit1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): A macOS desktop host and a separate paired Electron client exercise the Explorer preview action end to end: the document renders inside the client-local orca-preview guest, the client gains exactly one browser workspace and it is the document one, the host's own page registry and tab snapshot gain nothing, the split does not take focus from the source editor, an explicit click activates the preview, and closing it with its X leaves the editor and terminal intact. Both host oracles are read in a run where an ordinary URL browser tab from the same client does arrive in them, because a host that cannot project browser pages at all would otherwise answer the absence question the same way. A second journey quits that client with a document tab open and relaunches it on the same profile, which is the restore the user's original report turned on: the same workspace row comes back blank and named by the document, renders again, and does so over a grant URL that differs from the one that was quit. The same journey pins the guest URL to the orca-preview scheme, so a regression back to file:// or to a host browser page is visible. The rewritten journey caught a live gap the old one could not see: since previews became browser pages they had no chrome to hand focus to their guest, so main refused every reported link click as coming from an unfocused guest and the one route out of a preview was dead. Main's own log answered it — registered true, grant live, focused false — after the embedder reported the anchor really taking six real presses. The pane now hands focus over when it is the reader's surface, and the journey routes. The preview's own components moved out of the editor folder into browser-pane/workspace-doc/ with this change, since a preview is a browser pane and no longer an editor one; their i18n keys keep the historical auto.components.editor.HtmlDocPreview prefix rather than dropping thirty translated strings across four locales for a tidier key path. Seven gate commands named those files by their old paths and were re-issued at the new ones, and the nine dated runs behind them were retired rather than left naming files that are no longer there, on the same principle this gate already applied twice: vitest treats a missing named file as a filter and exits 0, so such a command reports green while silently running only the half that still exists. Each retired record's finding is carried into the replacement run recorded below it, including the red half of the entry/subresource pair, which was re-measured by re-applying its mutant at the new path rather than being dropped. The fence over the page-management channels was decided channel by channel before it was built, and that decision record is: of the 23 channels that can name a page, 6 are allowed for a workspace-document page — the tool channels the reader drives, which reach it through the one authority that reads both halves of the registry — 9 refuse (download accept and cancel, devtools, certificate proceed, client page metadata publish, viewport override, WebAuthn account response, registration probe, registration repair), 3 cannot name a page at all because they take a profile or a worktree instead, and the rest are the registration and activation doors, refused on membership. What shipped is not the per-channel guard that classification implies: eleven call sites read the browsing map directly, so a guard per channel is exactly the caller-flag seam that has to be remembered at every future call site. The registry was split in two instead, which makes the classification structural — a document guest is absent from the browsing map, so every refusing channel refuses by absence rather than by a guard, and a channel added later inherits the refusal without being classified at all. Unit contracts cover grant scoping and path containment, per-owner read routing, refusal of a truncated or over-cap read, the old-server binary degradation, scheme admission on will-attach-webview, the guest navigation policy, the plan layer's local/SSH/paired/out-of-worktree routing, and the distinct sentence the reader sees for each failure reason. The paired browser-creation surfaces this gate still owns — capability rejection cleanup, canonical page identity, reconciliation rollback, close convergence — keep their existing headed and headless journeys. Linux and Windows live journeys remain gaps. A refused subresource is a notice on a rendered document rather than a failure panel, since only the entry document's failure leaves the reader with nothing; the entry document is served as text by every owner and cannot be refused for its format at all. Grants die with the renderer document that minted them, at window creation and on every reload, because the renderer holds the only record of which preview owns which grant. The mint and revoke channels answer only the trusted renderer, and a preview tab is never republished to mobile clients, which have no grant to read it with. External URLs leave the preview only via a trusted user click on an anchor while the preview is focused; script-driven navigation and popups reach nothing. The guest's navigation sinks are deny-only and route no URL at all, and the guest carries a preview-only preload, pinned by will-attach-webview and denied to every other attach path, whose capture-phase click handler reports an anchor's URL to main; main answers only a report from a preview guest with a live bound grant that is the focused contents, and only for http(s). Two earlier reader-facing records from 2026-08-26, which measured a shape where a subresource failure was filtered out and the panel still carried an unsupported-asset sentence, were retired with that shape rather than left contradicting the 10/10 runs of the command they share. Two more were retired on the same principle when the external-link design changed: a record showing that removing a recent-input gate let the unattended document open two browser tabs, and a record showing that dropping the webview's allowpopups attribute left a target=_blank press with nothing to route. Both measured machinery that no longer exists — the input gate could not tell a script's navigation from the click it followed, which is the case now recorded below, and the preload intercepts the press before Chromium considers a popup at all, so allowpopups was removed. WebRTC is fenced by the guest's IP-handling policy alone: this Chromium answers a webrtc content-security-policy directive as unrecognized and gathers candidates anyway, so the directive is deliberately absent from the served policy and a unit assertion keeps it out. A standalone Electron probe on the same version gathered 7 candidates including a STUN reflexive one without the policy and 0 with it. Two command paths this gate used to carry no longer exist, and their structured evidence was retired with them rather than left naming files that are no longer there: vitest treats a missing named file as a filter and exits 0, so such a command reports green while silently running only the half that still exists. The first is src/renderer/src/lib/file-preview-capability-cleanup.test.ts, deleted in STA-5557 when HTML previews stopped creating paired browser tabs: on 2026-08-12 its five-assertion STA-4063 oracle ran red 5/5 on scan e4c278eb52 and on main bc2e30000b, partially green 2/5 on pre-fix PR #14100, and green 5/5 on candidate 14b5877a75; the surviving half of that oracle is web-runtime-browser-capability-cleanup.test.ts, still commanded above. The second is tests/e2e/paired-remote-html-browser-focus.spec.ts, renamed in STA-5557 to paired-remote-html-preview-local-render.spec.ts because the journey no longer proves anything about browser focus: its 2026-08-12 runs established the owning-runtime routing and no-focus-steal behavior of the then-current browser-tab preview (red on main 346e59c879 and a90a18d43d, green on candidates d05217c40d and b7de9c0961, red again with only the side-preview focus or routing seam disabled), and its 2026-08-26 runs are recorded below under the current path. An adversarial pass after the journey landed found four coverage gaps rather than shipping defects, and all four are pinned here. The page url had a third door: the navigation commit wrote whatever url was reported, unfenced, and while nothing reaches it for a document page today it sat one report away from giving a document page a URL that persistence, the publish boundary and the address bar all read. The group projection was the load-bearing half of the mobile publish boundary that no test had: removing it alone left the whole suite green, because no test in it had tab groups, while the phone payload gained a group whose order and active tab named a document tab it was never sent. The focus handoff was covered only in the narrowing direction, so widening it — dropping the page-activity check, or either half of the reader-surface check — survived both suites. And the handoff itself was offered once and never again, so another app taking the front left the preview's one route out shut until the pane remounted, which is a desktop gap rather than a test-only one. The standalone capability-cleanup and browser-placement ledger suites were removed, including their mixed-version rejection, cleanup transfer, capacity and partition alarms. web-runtime-session.test.ts no longer supplies browser creation, rollback or recovery assertions. The grouped workspace-document exclusion remains; the separate no-group publication example was removed. Existing live/browser-store evidence does not establish equivalent replacement alarms. Earlier descriptions of the removed fixtures and their run results are historical. The client-owned-placement and layout-groups suites are removed. The broad mirror fixture no longer supplies preview placement/reservation/move assertions. Browser rows retain pre-response replay and real local-workspace reuse; focus intent retains response ordering and exact-leaf sibling ordering. Supplied browser-layout and placement/focus projection alarms are lost; retained evidence is narrower and not equivalent. The test-value audit retires renderer grant-release mock ledgers, direct creation/title/session-field copies, notification/onboarding calls and several placement/per-page projections. Canonical-ID rejection, document reopen/restore and preview URL fences remain; they do not prove close-to-registry revocation or replace every lost alarm. Historical execution evidence is unchanged. The test-value audit removed the direct legacy editor-preview hydration example from tabs-hydration.test.ts. Dropping legacy preview chrome while preserving the same-document ordinary editor no longer has that alarm. The surviving corrupt-id deduplication case does not cover that migration, and retained preview journeys are not equivalent replacement coverage. Historical run counts and migration mutation findings describe the earlier suite. Audit1308: src/renderer/src/components/editor/EditorPanelShell.header.test.tsx removed. Header visibility and mocked editor-surface inventory alarms disappear. No equivalent replacement coverage is claimed. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1386: src/renderer/src/lib/doc-preview-grants.test.ts reduced. Repeated-mount mint count, ordinary release/remint and failed-mint cache retry standalone alarms removed; no actual grant server/access test. No equivalent replacement coverage is claimed. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/browser/guest-lifecycle/manager/browser-manager-guest-policy-profile.test.ts removed. Loses workspace-document in-grant navigation/popup refusal, cleanup/re-attach, cross-registry guest authorization and browsing-map separation alarms. No equivalent browser policy coverage is claimed. No equivalent replacement coverage is claimed. Audit1421 removes browser-address-bar-suggestions.test.ts. Document suggestion title/path matching, recency merging and path-prefix ranking alarms are lost. No equivalent replacement coverage is claimed. Historical receipts remain scoped to unchanged selectors; the reduced command has no new execution result. Audit2452 removes the whole fake-effect browser-close routing suite. Active selectors and assertion references no longer select it. Its requested-worktree default close, sibling-page close and explicit missing-page typed reply alarms are intentionally retired without equivalent replacement. Prior dated receipts remain unchanged and scoped to their original sources; no fresh execution of the reduced gate, rendered browser, live remote, mobile or cross-platform validation is claimed.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-5557/remote-html-preview-render-workspace-files-locally-over-the-file",
"https://linear.app/stably/issue/STA-3872/unable-to-open-html-files-in-remote-server",
@@ -4340,7 +4319,7 @@
"https://github.com/stablyai/orca/pull/13876"
],
"invariant": "Opening one HTML preview from a paired client renders the workspace document in exactly one client-local browser tab, located by that document and served over the orca-preview scheme. The client gains exactly that one browser workspace and it is the document one — blank where a URL page carries a URL, named by the document, with the chip naming the file — while the host gains no browser page at all, neither in its own page registry nor in the tab snapshot its clients publish into. The preview occupies its own split without taking focus from the source editor; an explicit click activates it, and closing it removes only the preview. Following a document from a file link is the other half of that switch and does move the reader to it, tab group included, whether the preview is new or already open, because opening a file is a request to look at it. A document tab quit with the client comes back as the same row on a grant the relaunched client mints afresh. A preview is named by the browser page it is open in, not by a namespace of its own, and the page registry has two halves: a workspace-document guest is registered in its own map and is absent from the browsing one entirely. That absence is the fence. Page, session and profile management, agent tab enumeration and command targeting, download routing and certificate attribution all read the browsing map directly, in more places than a per-channel guard could be remembered in, so none of them can name a document page and none of them carries a guard. Browser tools the reader drives (element grab, hover describe, selection capture, the annotation viewport bridge) are the one operation that legitimately spans the halves, and they go through the single authority that reads both, keyed by the page and its hosting renderer. The halves are disjoint in both directions: browsing registration refuses a page the document half already holds, and minting a grant refuses a page the browsing half already holds, so one id can never name a surface in both. The headless backend acts on that refusal by destroying the window it had already opened rather than leaving a policy-less page behind an id nothing can drive, keeping nothing under that id for its own shutdown to hand back. Registration refuses on the same terms when the guest it was asked about is already gone. The exit door is guarded in both its halves: a preview withdraws by revoking its grant and never through the unregister channel, so a page the document half holds arriving there is refused before either the registration teardown or the grab-state disposal beside it, which would otherwise drop the intent an in-flight preview grab compares by identity and leave that grab answering ok without ever arming its guest. A bridge request whose guest does not resolve is refused without tearing down the page it named, so a misaddressed request cannot cancel a healthy page's in-flight downloads and grabs. The annotation viewport bridge resolves its guest when its serialized op actually runs rather than when the request arrived, so a cross-process navigation while it waited cannot leave the bridge installed in a retired guest while the reader looks at a new one. State main keys by a preview's page is disposed when that page's grant is revoked, which is the only signal a preview's surface is gone. A tool asking for a page whose guest has not attached yet waits for that registration and arms when it arrives, rather than answering not-ready at the reader; that wait resolves only the request already naming this page, never the worktree-wide or any-tab waits the CLI and agents use to ask for a browser tab to drive. Handing the previewed document to the reader's own machine routes on the owners its grant was minted against — the file's own connection owner and the worktree's own runtime owner, neither read from the tab's stored fields. Only a document proven to live on this machine reaches the client OS; one with a resolved remote owner is downloaded first; and one whose owner cannot be resolved at all, workspace root included, is refused with a message naming that, because the download route would otherwise read the same absolute path on the client and hand back a same-named local file under the remote document's name. A runtime-owned path that falls outside its worktree root is refused by that route itself and surfaces as a failure toast rather than a download. Nothing the document does writes a file to this machine either: the preview partition denies downloads outright instead of routing them through the browser download flow, which has no page to attribute a preview's bytes to and would otherwise reserve a name in this desktop's Downloads folder and write them there unprompted. That refusal is visible to the reader and invisible to the document: the preview's shell carries a fixed sentence saying downloads are off, published at most once per preview per interval so a document asking in a loop cannot fill Orca's chrome, while the page itself gets back exactly what it got before, which is nothing. The sentence names no file, because the document chooses the name it offers; and a refusal never takes the document away the way an entry document's own failure does, whatever it names. A preview is a browser tab, not an editor tab in a preview mode: it is named the way a browser tab is named — by the document it shows when that document declares a title, and by the file it shows when it does not — while the chip goes on naming the file and the host whatever the document calls itself. A title is refused on the same terms the url is: a document that declares none has Chromium report the grant URL as its title, and that title is stored, mirrored onto the tab and written to disk, so anything carrying the scheme falls back to the file instead. It is created by the preview action as a page located by its document, it carries the workspace-relative path copy the editor's path header owned, and closing it revokes the grant that made the document readable while a URL tab closing beside it revokes nothing. Chrome persisted by builds that made previews editor tabs is dropped on restore rather than coming back naming a surface no restore can produce, and the ordinary editor tab for the same document is left alone. A document tab is held back at the mobile publish boundary — no client holds its grant, and the wire has no tab kind for it — while an ordinary browser tab beside it still publishes. It is held back from the group projection that publishes tab order, recency and group activity as well as from the tab list itself, so no published group names a tab the phone is never sent. A browser page can be located by a workspace document instead of a URL, and the document is the whole of its stored identity. The grant and the orca-preview URL that document is served over are minted when the page mounts and replaced by a hard reload, so neither is ever written to the page's url, mirrored onto its tab, persisted or published: such a page's url is the blank URL from creation through restore, including when a session written elsewhere carries a grant URL in, and what the session carries is the worktree and path a restored page mints afresh against today's owners. Every door onto a page's url holds that line — creation, the title update, and the navigation commit alike — so a report about a document page cannot give it a URL it never had, and the title fallback and the loading affordance follow the url each door actually wrote. The mirror carries the document too, so a tab entry cannot go on naming a document its active page has left. Every guest in the app is policy-attached through one door: a workspace document takes a restricted profile there rather than a separate installer beside it, so the attachment bookkeeping that door owns — what registration refuses, and what teardown frees — covers a preview on the same terms as a browsing page, and a preview takes none of the browsing machinery that door installs. That authority answers from the moment the embedder hands the guest over rather than only after a later navigation: the guest binds to the grant it is already showing, so the tools reach the document the reader opened and not just one they navigated to. A read the host reports as truncated or over-cap is refused rather than served partially, and a document outside the paired worktree is refused with a message naming that boundary instead of a bare read failure. The rendered document reaches nothing off-machine on its own: every served response carries a self-only content security policy, the preview session cancels any request that is not in-document, subframes cannot navigate outside the grant, a guest no document has yet bound to a grant may not navigate at all, the guest gathers no ICE candidates, and an SSH path that canonicalizes outside the grant root is refused before it is read. The one route out is a link the reader presses: a trusted click on an anchor, reported by the preview's own preload from a guest still bound to a live grant, leaves through the configured browser destination and captured source route — and only after the reader confirms the exact destination URL, so a document cannot spend a single stray press exfiltrating what it can read into a link it authored. The preview hands its guest that focus itself whenever it is the surface the reader is in — a browsing page gets it from the chrome around it, and a preview has no chrome to get it from — and it does so only then, so a preview mounted behind a terminal or an editor never takes the keyboard from what the reader is actually in. It offers again when the window itself takes focus back and nothing in the embedder has claimed that focus, because another app coming to the front lands focus on the embedder rather than the guest and the route out would otherwise stay shut until something remounted the pane — while the same window focus also arrives when the reader presses a tab, that being the guest's own blur returning, and taking focus back from there would fight the reader for their own click. Nothing else does. A navigation or popup the document starts by itself is swallowed whatever else is happening, including immediately after a genuine press elsewhere in the document, so a page that can read its grant cannot hand it to a browser tab; a middle click opens nothing; and a fragment link is answered inside the document. A preview attach carries the preview preload and no renderer-supplied one, and no other attach path can acquire it. A subresource the workspace will not send degrades the document to a notice naming that file, never to a failure panel over a page that rendered. A grant outlives neither the tab that owns it nor the renderer document that minted it, and only the trusted renderer can mint or revoke one. For the browser creations this gate still owns, owner-pinned creation returns the canonical host page identity before navigation readiness; delayed navigation cannot turn a created page into an unidentifiable failure or a duplicate retry. Capability rejection before host mutation must preserve the original error, issue no RPC, surface a failure toast, and remove only a caller-declared newly-created empty split. Post-create reconciliation failure requires exact rollback; ambiguous rollback rejects without local fallback.",
- "oracle": "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked session-close routing suite is removed, including the explicit cross-worktree cleanup alarm. Remove its active file, command token and assertion reference; historical selectors and receipts retain their original scope. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3342 retires the complete mobile editor/diff tab-publication projection suite: editor/diff serialization, workspace-document privacy withholding, pending/focus and capability/options projections are intentionally lost without equivalent replacement. The surviving focused selectors are unexecuted in this source composition. Six complete compound macOS receipts whose command fields select the changed source are retired verbatim as history; their other selected tests receive no promoted evidence. Other dated receipts keep their original scope; no fresh runtime/UI/mobile/mixed-version or cross-platform validation is claimed. Audit3335 retires the complete three-case browser-tabs snapshot assembly suite: canonical snapshot replay/placement/focus, local host-page adoption and unstamped host echo leaving a local page untouched alarms are intentionally lost without equivalent replacement. The surviving focused selector is unexecuted in this source composition. Unrelated dated receipts keep their original scope; no fresh runtime/network, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the caller-chat-target precedence over host selection example from web-session-tabs-sync-focus-intent.test.ts. The snapshot-before-RPC replay and split-sibling-first exact-leaf focus cases remain unchanged and match the existing assertion reference. Preserve current selectors, assertion references, unrelated active receipts and complete archived history. These mocked state-composition survivors provide no equivalent replacement, rendered, native, network or fresh execution proof. Audit3108: doc-preview-grants.test.ts now retains only the stale grant-rejection race: a late rejected grant request must not evict a newer grant registry entry, witnessed by later revocation of grant-2. Retire stable minted-location and outside-workspace POSIX/Windows request-projection alarms without replacement. The direct nonempty grant selector remains unchanged; no real grant-server/file authorization, SSH/HTML delivery or native-focus result is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2043: Remove the registration-wait, webview-security, preview-authorization, guest-lifecycle and grant-IPC unit suites and the sibling-directory assertion reference. Runtime and browser capability consumers also lose removed imported examples. Remaining document-policy, file-reader and grant-registry assertions do not replace those alarms. Preserve the 27 independent dated receipts at their original unchanged selectors; reduced prospective unit selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1973: Delete the browser RPC forwarding/schema/scalar suite and its prospective selector. Preserve all27 unrelated dated receipts; no actual browser operation alarm is replaced. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): The complete terminal-file-link-actions suite is removed. Lose supplied local/remote menu-row inventories, browser label/order/download/reveal callback forwarding, platform-copy and source-group pinning examples. No OS reveal/download, real remote preview or browser navigation was exercised; the other real document-preview sources are not equivalent replacements. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1687 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1421 narrows renderer unit coverage as recorded in coverageNotes. Prior oracle descriptions are historical for the changed suite. The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Retained unchanged-selector receipts are the only current execution evidence. Reduced-source assertions await validation. Historical prior oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): In paired Electron, write an HTML fixture that declares its own title on the host, invoke the Explorer preview action on the client, and require the document text to be readable out of the orca-preview guest before judging any absence. With that presence established, require the client to hold exactly one browser workspace more than its baseline and that workspace to be the document one: page and tab url blank, the document path mirrored onto both, the tab named by the document's title, the chip naming the file, no editor row of the retired preview species anywhere, and the guest URL carrying the orca-preview scheme. Ask the host through its own page registry as well as through the tab snapshot, and in the same run open an ordinary URL browser tab from the same client and require that one to arrive in both — the presence precondition without which “the host gained nothing” is satisfied just as well by an oracle that cannot see browser pages at all. Require the preview to sit in a group other than the source editor's while the active group and tab remain the source editor's. Then click away to the terminal, click the preview tab, require it to reactivate and still render, close it with its own X, and require the document tab to be gone while the host still holds only the URL tab and the source group, source editor and terminal survive. Quit the client with a document tab open and relaunch it on the same profile: require the same workspace row to come back, blank and named by the document, rendering the document again over a grant URL that differs from the one that was quit, with no preview-scheme or document-named page anywhere in what the host holds. Prove the halves are live by flipping one product property at a time and requiring the run to fail: publish document workspaces to the host like ordinary ones, and stop mirroring the document onto the workspace row. Have the fixture document attempt its own egress on every load — an unattended window.open and location.href to an off-machine URL, plus an inline ICE gathering probe — and require the same baseline counts and a candidate count of zero, so the document's own attempts are measured rather than assumed. Then, as a separate phase after the close oracle has already run, bring the client window to the front, press the document's heading with a real mouse event, and require the document to report that the same press drove it to attempt a second window.open and location.href while both browser counts stay at that phase's baseline and nothing routes — the case a recent-input gate cannot distinguish from the press's own effect. Only then press the target=_blank link with a real mouse event and require both a recorded routing call that returned success and a browser count above that baseline, with the preview tab still open. Drive the preload's click policy as a unit oracle over a real document: a dispatched click, a trusted press on an external anchor, an anchor reached through what it wraps, an SVG animated href, a sibling preview link, fragment and percent-encoded fragment targets, a bare hash, and a middle click. Create a browser page located by a workspace document, handing creation a live grant URL, and require its stored url, its mirrored tab url and the written session payload all to be blank with no orca-preview string anywhere in what was written, while an ordinary page created the same way keeps the URL it was given and asks for the address bar the document page never does. Parse the written page and tab through the session schema and require the document to survive both halves. Hydrate them back and require the document page to return blank and still named — including when its page row was salvaged away and only the tab's own copy remains, and when a foreign session carried a grant URL into both rows. Drive the mirror across a page switch out of the document and back, and across a repair in which the document is the only mirrored field that differs. Name a document page from its document and require the tab to take that name, name it with an empty title and require the file, name it with a live grant URL and require the file again with no preview scheme anywhere in the written session, and require an ordinary blank browser tab beside it to still be called New Tab. Dispatch a title update out of a rendered preview's own guest and require it to reach the page state while the identity chip still reads the document's workspace-relative path. Attach a browsing guest and a workspace-document guest through the same method in one run and require the browsing one to take clicked-link routing, popup handling and auth-identity detach tracking while the document guest takes none of them, stays inside the grant it is showing, denies every window it asks for, and is dropped from the page-keyed document registry by the same teardown that frees its id for a later attach. Register a browsing guest and attach a workspace-document guest in one run against the real manager, require the one door to answer each page with the guest of its own half, and require the document page to be absent from the browsing map and from its enumeration. Drive both browsing registration entry points with a page the document half already holds and require them to register nothing, and drive the mint channel with a page the browsing half already holds and require it to refuse; and drive the offscreen one with a guest that is missing and with one already destroyed, requiring the same refusal. Arm a grab on a live preview target, drive the unregister channel at that same target in the window before the queued operation runs, and require the grab to reach the guest anyway — then drive the same sequence for an ordinary browser page and require its grab state to be disposed after all. Hold one viewport-bridge op open, queue a second behind it, swap the page's guest while that second op waits, and require the injection to land in the guest the page has then. Revoke a grant after a tool has run against its page and require that page's grab state to be cancelled and disposed. Ask a tool for a document page whose guest has not attached, require the request to park in the registration wait, attach the guest, and require the same request to arm on it; require a page nothing ever renders to answer not-ready once that wait elapses. With a document open, ask a tool for a browsing page id and require it to be answered by the browsing half or not at all, with the same channel reaching the document guest under the page it really renders. Drive open-externally for a document whose per-file owner is remote while the workspace-scoped owner is unresolved, for a runtime-owned worktree whose preview tab carries no runtime id of its own, and for a worktree that resolves no runtime owner while the tab still carries one, requiring the download route in each; and for an owner that cannot be resolved at all, and for an unknown workspace root while nothing names another host, requiring a refusal that neither opens nor downloads. Drive the headless backend with a page the document half already holds and require it to reject, destroy the window, and unregister nothing — then shut the backend down and require it still to have unregistered nothing. Navigate a bound preview guest at a second grant through both latch events and require it to stay on the grant it bound to. Mount a preview while a renderer drag is already in flight and require its guest to be click-through at the moment it is appended, not a turn later. Render the editor panel shell in each remaining tab mode and require the path header exactly where the surface does not already name itself. Drive the preview action and require a browser tab located by the document rather than an editor tab, require a second open of the same document to activate the tab it is already in, and require closing that tab to revoke its grant while a URL tab closed beside it revokes none. Publish a worktree holding a document tab and a URL tab and require only the URL tab to reach the mobile snapshot. Install the shared partition policies for a preview partition and for an ordinary browsing partition in the same run, fire each one's own will-download listener, and require the preview's to cancel while the browsing one still reaches the download router — then require the preview protocol installer to be what asks for that deny. In the same run, require the cancelled download to raise a reader-facing notice and the routed one to raise none. require the guest registry to name the bound grant for a live preview guest and nothing for a contents that is not one, has committed no document, or is gone. Drive the shell with a refusal and require one fixed sentence, still one row after three more refusals, standing beside an asset failure rather than being counted with it, gone behind the failure panel, and ignored when it names another preview's grant. Drive the main-side report gate directly for a sender that is no preview guest, a guest with no bound or a revoked grant, a genuine press Electron's webview focus flag misreports as unfocused, and non-web URLs; drive the reader-facing confirmation for accept, cancel, and a confirmed tab the browser refuses; and drive will-attach-webview in both preload directions. Run the per-owner reader, grant-containment, scheme-admission, guest-policy, and plan-routing contracts as unit oracles, including a host-reported truncation, an over-cap binary, and an out-of-worktree paired path. Drive the reader-facing component with the payloads the reader can actually produce — the entry document fails only as truncated or unreadable, a subresource additionally as a refused format — and require the asset case to leave the guest mounted. Drive the closed-tab cleanup hook, the window installer, and the grant IPC handlers directly, requiring the grant to be released when the preview tab closes, cleared at window creation and on a cross-document main-frame navigation, and refused to any sender that is not the trusted renderer. For the browser creations this gate still owns, run the unchanged contract oracle for direct create and side-preview callers with absent status, unknown capabilities, and a mixed-version host, requiring the original unsupported error or visible toast, zero RPCs, and no retained new split; hold a real navigation response beyond the 15-second client deadline after host creation and require the first RPC to return the exact host inventory page ID, one host page, and no retry; repeat reconciliation faults against headless serve and retain the separate exact-page reconciliation rollback oracle. Audit2452 removes the whole fake-effect browser-close routing suite. Active selectors and assertion references no longer select it. Its requested-worktree default close, sibling-page close and explicit missing-page typed reply alarms are intentionally retired without equivalent replacement. Prior dated receipts remain unchanged and scoped to their original sources; no fresh execution of the reduced gate, rendered browser, live remote, mobile or cross-platform validation is claimed.",
+ "oracle": "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed. Historical prior account (preserved verbatim): Audit3814 deliberately retires60 authored/60 finite cases:53runtime compatibility cases,4native XCTest methods and3Python clipboard methods, including the entire StableElementIndexes suite. Clipboard cuts retire the one-over-cap sample, incoming-offer destruction trace and sequential20-copy replay; actual wire, FD/pipe, startup and Xvfb/GTK boundaries remain without equivalent replacement claims. Accepted losses include narrow terminal-send payload/provider projections, legacy and direct no-op/error permutations, timing/work-count examples, private state/title/activity projections and fixture-driven readiness examples, individually enumerated below. These include real bounded production alarms consciously retired for marginal value; retained failed writes, duplicate submission, stale capture, transcript/ring and allocation fences are not equivalent replacements. No fresh native/remote/browser execution or complete transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3806 deliberately retires40 authored/40 finite runtime compatibility cases, including the terminal-side-effect-facts-part03 headless-snapshots-part02 and agent-status-and-waits-part03 fragments, plus20 scalar Swift precondition sites. Lost runtime alarms include status/title/attention projection examples, simple renderer/headless frame restoration and status waiting outcomes detailed in the accepted-loss ledger. Swift cuts retire duplicate generation-map/schema/navigation/bridge and notification-wrapper assertions; no standalone native program is deleted. These include real bounded production alarms consciously retired for marginal value. Retained races, pending writes/reflow, namespace and waiter ownership are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3798 deliberately retires21 authored/24 finite compatibility cases, including the entire SSH-worktree-lifecycle and repository-project-operations fragments. Accepted losses include navigation-only settings acknowledgement, browser session cleanup and host preservation projections, window positive/policy-state examples, terminal recovery/reload and no-incarnation remint examples, terminal listing compatibility/malformed IDs, directory browse/sort/Windows path smoke, SSH create refusal/manual lineage, recursive parent-folder creation and fork/origin/avatar/icon projections. Real bounded production alarms are consciously retired for marginal value; retained authority races, cleanup/clone ownership, pending waiters, nested-folder and scan invalidation cases are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked session-close routing suite is removed, including the explicit cross-worktree cleanup alarm. Remove its active file, command token and assertion reference; historical selectors and receipts retain their original scope. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3342 retires the complete mobile editor/diff tab-publication projection suite: editor/diff serialization, workspace-document privacy withholding, pending/focus and capability/options projections are intentionally lost without equivalent replacement. The surviving focused selectors are unexecuted in this source composition. Six complete compound macOS receipts whose command fields select the changed source are retired verbatim as history; their other selected tests receive no promoted evidence. Other dated receipts keep their original scope; no fresh runtime/UI/mobile/mixed-version or cross-platform validation is claimed. Audit3335 retires the complete three-case browser-tabs snapshot assembly suite: canonical snapshot replay/placement/focus, local host-page adoption and unstamped host echo leaving a local page untouched alarms are intentionally lost without equivalent replacement. The surviving focused selector is unexecuted in this source composition. Unrelated dated receipts keep their original scope; no fresh runtime/network, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the caller-chat-target precedence over host selection example from web-session-tabs-sync-focus-intent.test.ts. The snapshot-before-RPC replay and split-sibling-first exact-leaf focus cases remain unchanged and match the existing assertion reference. Preserve current selectors, assertion references, unrelated active receipts and complete archived history. These mocked state-composition survivors provide no equivalent replacement, rendered, native, network or fresh execution proof. Audit3108: doc-preview-grants.test.ts now retains only the stale grant-rejection race: a late rejected grant request must not evict a newer grant registry entry, witnessed by later revocation of grant-2. Retire stable minted-location and outside-workspace POSIX/Windows request-projection alarms without replacement. The direct nonempty grant selector remains unchanged; no real grant-server/file authorization, SSH/HTML delivery or native-focus result is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2043: Remove the registration-wait, webview-security, preview-authorization, guest-lifecycle and grant-IPC unit suites and the sibling-directory assertion reference. Runtime and browser capability consumers also lose removed imported examples. Remaining document-policy, file-reader and grant-registry assertions do not replace those alarms. Preserve the 27 independent dated receipts at their original unchanged selectors; reduced prospective unit selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1973: Delete the browser RPC forwarding/schema/scalar suite and its prospective selector. Preserve all27 unrelated dated receipts; no actual browser operation alarm is replaced. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): The complete terminal-file-link-actions suite is removed. Lose supplied local/remote menu-row inventories, browser label/order/download/reveal callback forwarding, platform-copy and source-group pinning examples. No OS reveal/download, real remote preview or browser navigation was exercised; the other real document-preview sources are not equivalent replacements. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1687 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1421 narrows renderer unit coverage as recorded in coverageNotes. Prior oracle descriptions are historical for the changed suite. The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Retained unchanged-selector receipts are the only current execution evidence. Reduced-source assertions await validation. Historical prior oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): In paired Electron, write an HTML fixture that declares its own title on the host, invoke the Explorer preview action on the client, and require the document text to be readable out of the orca-preview guest before judging any absence. With that presence established, require the client to hold exactly one browser workspace more than its baseline and that workspace to be the document one: page and tab url blank, the document path mirrored onto both, the tab named by the document's title, the chip naming the file, no editor row of the retired preview species anywhere, and the guest URL carrying the orca-preview scheme. Ask the host through its own page registry as well as through the tab snapshot, and in the same run open an ordinary URL browser tab from the same client and require that one to arrive in both — the presence precondition without which “the host gained nothing” is satisfied just as well by an oracle that cannot see browser pages at all. Require the preview to sit in a group other than the source editor's while the active group and tab remain the source editor's. Then click away to the terminal, click the preview tab, require it to reactivate and still render, close it with its own X, and require the document tab to be gone while the host still holds only the URL tab and the source group, source editor and terminal survive. Quit the client with a document tab open and relaunch it on the same profile: require the same workspace row to come back, blank and named by the document, rendering the document again over a grant URL that differs from the one that was quit, with no preview-scheme or document-named page anywhere in what the host holds. Prove the halves are live by flipping one product property at a time and requiring the run to fail: publish document workspaces to the host like ordinary ones, and stop mirroring the document onto the workspace row. Have the fixture document attempt its own egress on every load — an unattended window.open and location.href to an off-machine URL, plus an inline ICE gathering probe — and require the same baseline counts and a candidate count of zero, so the document's own attempts are measured rather than assumed. Then, as a separate phase after the close oracle has already run, bring the client window to the front, press the document's heading with a real mouse event, and require the document to report that the same press drove it to attempt a second window.open and location.href while both browser counts stay at that phase's baseline and nothing routes — the case a recent-input gate cannot distinguish from the press's own effect. Only then press the target=_blank link with a real mouse event and require both a recorded routing call that returned success and a browser count above that baseline, with the preview tab still open. Drive the preload's click policy as a unit oracle over a real document: a dispatched click, a trusted press on an external anchor, an anchor reached through what it wraps, an SVG animated href, a sibling preview link, fragment and percent-encoded fragment targets, a bare hash, and a middle click. Create a browser page located by a workspace document, handing creation a live grant URL, and require its stored url, its mirrored tab url and the written session payload all to be blank with no orca-preview string anywhere in what was written, while an ordinary page created the same way keeps the URL it was given and asks for the address bar the document page never does. Parse the written page and tab through the session schema and require the document to survive both halves. Hydrate them back and require the document page to return blank and still named — including when its page row was salvaged away and only the tab's own copy remains, and when a foreign session carried a grant URL into both rows. Drive the mirror across a page switch out of the document and back, and across a repair in which the document is the only mirrored field that differs. Name a document page from its document and require the tab to take that name, name it with an empty title and require the file, name it with a live grant URL and require the file again with no preview scheme anywhere in the written session, and require an ordinary blank browser tab beside it to still be called New Tab. Dispatch a title update out of a rendered preview's own guest and require it to reach the page state while the identity chip still reads the document's workspace-relative path. Attach a browsing guest and a workspace-document guest through the same method in one run and require the browsing one to take clicked-link routing, popup handling and auth-identity detach tracking while the document guest takes none of them, stays inside the grant it is showing, denies every window it asks for, and is dropped from the page-keyed document registry by the same teardown that frees its id for a later attach. Register a browsing guest and attach a workspace-document guest in one run against the real manager, require the one door to answer each page with the guest of its own half, and require the document page to be absent from the browsing map and from its enumeration. Drive both browsing registration entry points with a page the document half already holds and require them to register nothing, and drive the mint channel with a page the browsing half already holds and require it to refuse; and drive the offscreen one with a guest that is missing and with one already destroyed, requiring the same refusal. Arm a grab on a live preview target, drive the unregister channel at that same target in the window before the queued operation runs, and require the grab to reach the guest anyway — then drive the same sequence for an ordinary browser page and require its grab state to be disposed after all. Hold one viewport-bridge op open, queue a second behind it, swap the page's guest while that second op waits, and require the injection to land in the guest the page has then. Revoke a grant after a tool has run against its page and require that page's grab state to be cancelled and disposed. Ask a tool for a document page whose guest has not attached, require the request to park in the registration wait, attach the guest, and require the same request to arm on it; require a page nothing ever renders to answer not-ready once that wait elapses. With a document open, ask a tool for a browsing page id and require it to be answered by the browsing half or not at all, with the same channel reaching the document guest under the page it really renders. Drive open-externally for a document whose per-file owner is remote while the workspace-scoped owner is unresolved, for a runtime-owned worktree whose preview tab carries no runtime id of its own, and for a worktree that resolves no runtime owner while the tab still carries one, requiring the download route in each; and for an owner that cannot be resolved at all, and for an unknown workspace root while nothing names another host, requiring a refusal that neither opens nor downloads. Drive the headless backend with a page the document half already holds and require it to reject, destroy the window, and unregister nothing — then shut the backend down and require it still to have unregistered nothing. Navigate a bound preview guest at a second grant through both latch events and require it to stay on the grant it bound to. Mount a preview while a renderer drag is already in flight and require its guest to be click-through at the moment it is appended, not a turn later. Render the editor panel shell in each remaining tab mode and require the path header exactly where the surface does not already name itself. Drive the preview action and require a browser tab located by the document rather than an editor tab, require a second open of the same document to activate the tab it is already in, and require closing that tab to revoke its grant while a URL tab closed beside it revokes none. Publish a worktree holding a document tab and a URL tab and require only the URL tab to reach the mobile snapshot. Install the shared partition policies for a preview partition and for an ordinary browsing partition in the same run, fire each one's own will-download listener, and require the preview's to cancel while the browsing one still reaches the download router — then require the preview protocol installer to be what asks for that deny. In the same run, require the cancelled download to raise a reader-facing notice and the routed one to raise none. require the guest registry to name the bound grant for a live preview guest and nothing for a contents that is not one, has committed no document, or is gone. Drive the shell with a refusal and require one fixed sentence, still one row after three more refusals, standing beside an asset failure rather than being counted with it, gone behind the failure panel, and ignored when it names another preview's grant. Drive the main-side report gate directly for a sender that is no preview guest, a guest with no bound or a revoked grant, a genuine press Electron's webview focus flag misreports as unfocused, and non-web URLs; drive the reader-facing confirmation for accept, cancel, and a confirmed tab the browser refuses; and drive will-attach-webview in both preload directions. Run the per-owner reader, grant-containment, scheme-admission, guest-policy, and plan-routing contracts as unit oracles, including a host-reported truncation, an over-cap binary, and an out-of-worktree paired path. Drive the reader-facing component with the payloads the reader can actually produce — the entry document fails only as truncated or unreadable, a subresource additionally as a refused format — and require the asset case to leave the guest mounted. Drive the closed-tab cleanup hook, the window installer, and the grant IPC handlers directly, requiring the grant to be released when the preview tab closes, cleared at window creation and on a cross-document main-frame navigation, and refused to any sender that is not the trusted renderer. For the browser creations this gate still owns, run the unchanged contract oracle for direct create and side-preview callers with absent status, unknown capabilities, and a mixed-version host, requiring the original unsupported error or visible toast, zero RPCs, and no retained new split; hold a real navigation response beyond the 15-second client deadline after host creation and require the first RPC to return the exact host inventory page ID, one host page, and no retry; repeat reconciliation faults against headless serve and retain the separate exact-page reconciliation rollback oracle. Audit2452 removes the whole fake-effect browser-close routing suite. Active selectors and assertion references no longer select it. Its requested-worktree default close, sibling-page close and explicit missing-page typed reply alarms are intentionally retired without equivalent replacement. Prior dated receipts remain unchanged and scoped to their original sources; no fresh execution of the reduced gate, rendered browser, live remote, mobile or cross-platform validation is claimed.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-grant-registry.test.ts src/main/browser/document-preview/doc-preview-file-reader.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/main/browser/document-preview/doc-preview-failure-notice.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/lib/browser/documents/doc-preview-grants.test.ts src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts",
@@ -4696,6 +4675,10 @@
"Collect 100 consecutive focused CI passes or 14 days without an unexplained flake."
],
"knownGaps": [
+ "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed.",
+ "Audit3814 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle from a Codex ready prompt even when stale startup lines remain :: Stale MCP startup lines must not block a later Codex ready header.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle when a stale Codex prompt is followed by the ready header :: A Codex ready header following a stale resume prompt must satisfy tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for an idle Cursor lane past its dismissed trust dialog (#8210) :: Later Cursor idle banner overrides retained trust dialog.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not block a mid-run Cursor lane on its dismissed trust dialog (#8210) :: Dismissed trust dialog must not report blocked for later busy Cursor; wait times out.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not classify unrelated press-enter prompts as Codex blocked prompts :: Unidentified press-enter text must time out rather than be classified Codex blocked.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for quiet background PTY agents without OSC titles :: Quiet Codex background terminal without OSC title eventually resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: sends agent prompts as bracketed paste before submit :: Driving prompt escapes embedded paste-end ESC, writes one framed paste then CR, and counts bytes.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: settles a foreground Codex prompt when launch metadata has not arrived :: Codex inferred from foreground without launch metadata waits for composer marker/quiescence before one CR.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: gives a late Codex render marker a fresh quiescence window :: Marker arriving at7.9s re-arms fresh quiet window instead of submitting at initial cap.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: writes large agent prompt paste frames atomically before delayed submit :: A prompt larger than input chunk budget is a single paste write before delayed CR with exact byte count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects oversized terminal.send text before provider writes :: Oversized ordinary terminal.send rejects input-too-large before any provider write.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects focusing an exited background terminal session :: focusTerminal refuses terminal_exited before invoking background reveal.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: pastes the same bytes the desktop draft paste sent for the prompt :: Launch-ready prompt normalizes CR/LF and renders embedded ESC visibly identically to desktop bracketed paste.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: keeps a prompt into a running agent behind the render settle, as before :: Driving prompt remains held through7s repaint activity then submits once by9s.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reports a queued PTY focus as not navigated when its notifier disappears :: Queued PTY focus and completed active reveal report not navigated after notifier removal; no second reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: does not invoke a stale graph-leaf focus notifier after queued PTY work :: Queued graph-leaf focus must not invoke old notifier after preceding PTY reveal and notifier removal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: paginates retained terminal output with explicit limits and truncation metadata :: Preview120lines, fractional limits,50/200 pages, retained2000line truncation and future-cursor metadata stay consistent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: falls back to renderer visible screen when uncursored TUI tail is blank :: Substantial blank uncursored tail uses mounted renderer visible screen with zero scrollback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reads and shows the runtime-owned alternate-screen grid without serialization :: Actual runtime alternate-screen grid provides read/show content without renderer/provider serialization.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: classifies older provider alternate-screen snapshots from ANSI :: Older provider without alternateScreen metadata classifies ANSI alternate entry and returns Remote Vim screen.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: honors the last ANSI screen transition when older provider metadata is absent :: Last ANSI alternate exit overrides earlier entry when explicit provider mode metadata is absent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: rejects a full provider screen frame after live output advances :: Live output arriving during second full-screen capture causes screen-unavailable rather than stale full frame.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: shares one provider snapshot between concurrent read and show calls :: Concurrent read/show share one successful provider snapshot and both receive Shared TUI content.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps cursor reads provider-free on restored alternate-screen PTYs :: Restored alternate-screen cursor transcript reads never acquire provider snapshot.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: backs off after a provider snapshot failure instead of retrying for show :: Failed provider capture is cached/backed off so later show does not retry.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: falls back once to a mounted renderer when a known alternate provider fails :: A known-alternate failed provider capture falls back exactly once to newly mounted renderer.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: bounds provider visible frames for read and show responses :: Provider visible read/show use six bounded lines and300character preview.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps renderer-fallback composer drafts separate from terminal output :: Renderer fallback strips dim composer draft from terminal output and exposes draft separately.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: does not use renderer visible-screen fallback for a short blank shell tail :: Two blank shell lines must not trigger renderer screen fallback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: trims terminal tail character budget without per-line array shifts :: Tail builder trims to256KiB with correct retained suffix and no Array.shift calls.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains ANSI-only status redraws instead of appending every frame :: Repeated erase/redraw replaces preview until newline then publishes one completed cursor row.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains split multi-line ANSI footer redraw state across chunks :: CUU state across chunks retains corrected footer rows and publishes new cursor entries.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not let stale lower rows hide earlier corrected footer rows from cursor reads :: Earlier corrected footer row must not be hidden by stale lower rows in cursor reads.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: bounds completed transcript entries from a single multi-line redraw chunk :: Single redraw chunk bounds completed transcript to2000retained lines and correct oldest/next/latest cursors.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains multi-line ANSI redraws when the last footer row stays partial :: Partial final redrawn row appears in preview but cursor sees it only after newline.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not retain split ANSI controls as visible terminal preview text :: Split color/mode escapes never leak preview fragments; long split OSC title truncates at MAX_OSC_TITLE_CHARS.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains same-line redraw cursor position across split full-line erase chunks :: Full-line erase preserves column across chunks so XY follows three spaces rather than old ABC.\nsrc/main/runtime/orca-runtime-tests/conpty-stream-read.spec.ts :: fills the requested line count even when blank rows sit below the prompt :: Blank rows below a ConPTY prompt must not consume the requested nonempty-line count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: does not retain split ST-terminated string controls as preview text :: Split ST-terminated Kitty/string controls must remain excluded from preview text.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects split OSC titles before retaining terminal previews :: Split BEL OSC title must update working title/status without leaking into preview.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects ST-terminated OSC titles split before the final backslash :: ST OSC split before final backslash must update title without leaking framing.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: preserves a trailing escape after a completed OSC title :: Completed OSC followed by pending ESC must preserve the next idle-title transition.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: seeds newly synced leaves from PTY pending ANSI state :: A newly synced graph leaf inherits pending ANSI so a split color fragment cannot leak.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: bounds retained partial terminal output before preview reads :: Partial terminal state stays capped at 4000, preserves retained array identity, and preview truncation/cursor output remains correct.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: submits the mail pointer to Cursor Agent only after the paste-burst delay :: Cursor mailbox pointer Enter must wait through the paste-burst delay; this is a real input-timing alarm intentionally retired.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts :: adopts a v1.4.150-shaped agent, setup, and shell orphan as one topology transaction :: Stale incarnation refuses without topology change; three agent/setup/shell lanes adopt atomically with layout/group/revision and preserved read/input/resize; exact replay is idempotent and competing owner refuses.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: retires the exact worker when it exits after renderer reveal :: Exact worker exit after reveal retires that worker and its surface.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: re-reveals a recovered worker after the renderer graph epoch changes :: Changed renderer graph epoch invalidates reveal receipt and forces another reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: defers recovery when the renderer omits the exact reveal identity :: Missing exact reveal identity defers recovery after two attempts.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: reconciles a same-id process replacement before headless adoption :: A process replacement before headless adoption must fence off stale ownership.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retires provider resume only after authoritative inventory proves the legacy PTY exited :: Authoritative owning-host inventory overrides false local hasPty, avoids SSH scanning, retires exited provider resume/surface, adopts live workers without headless reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retries inventory and unknown liveness without revealing a ghost worker :: Inventory failure and unknown liveness must retry without ghost reveal, eventually adopt, and stop retrying.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: refuses a live reserved pane before issuing a handle or revealing it :: A requireFreshPane launch receiving a live reserved owner must reject before handle/reveal/kill, and release its claim. No equivalent replacement claimed.",
+ "Audit3806 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: skips a listener unsubscribed mid-fan-out even with mobile exclusions active :: A listener removed by an earlier listener during one fanout is not called, including with a side-effect-excluded mobile listener present.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: retains bytes emitted before a fresh daemon spawn resolves :: Bytes and title arriving before an initial zero/reset provider response survive in the serialized headless buffer with their counted sequence.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits command-finished facts with best-effort exit codes across chunk splits :: A split OSC133 D exit code becomes130 and a missing code becomes null in ordered command-finished facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits pr-link facts once per URL with batch attribution :: A split GitHub PR URL yields42 rather than4, emits42/43 once each, and carries PTY/worktree/tab attribution.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits 2031-subscribe facts across chunk splits :: Split ESC[?20 then31h emits exactly one2031-subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: restores a provisional 2031 subscribe when daemon scan authority returns :: Returning daemon scan authority with partial scan seed and pending2031 subscription restores exactly one subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers the tracked title over the renderer snapshot lastTitle :: A synthetic live Cursor title overrides stale renderer lastTitle while preserving renderer snapshot source.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers provider history over a partial headless mirror for requested snapshots :: Authoritative requested snapshots return supplied provider frame/history/seq rather than a partial headless mirror, requesting5000rows.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: tracks live alternate-screen transitions after a provider snapshot :: Provider alternateScreen true is accepted, then live1049l/1049h update isTerminalAlternateScreen false/true.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: translates reset provider snapshots without retaining the old title :: A reset provider snapshot translates new local seq into the runtime domain and replaces Old process title with New process.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits the chunk agentStatus events before its side-effect batch :: Agent status callback precedes side-effect batch callback for one coalesced OSC9999/title/bell chunk.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: still emits a throwing chunk’s facts under its own seq, not the next chunk’s :: A tracker throw still flushes first chunk title facts under its own seq, and second chunk does not inherit those facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: seeds the lazily created tracker from the daemon-snapshot title :: A lazy tracker hydrated from renderer snapshot title Codex working emits agent-idle on later Codex done.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits command-code-working facts only after the banner arms the scrape :: Unarmed Thinking text emits no facts; a Command Code0.27.3 banner then hardcoded colored spinner text emits attributed command-code-working with the submitted prompt.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits a command-code-done fact when the idle composer returns :: After hardcoded banner/working text, returned idle composer emits command-code-done with the earlier submitted prompt.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: resizes the headless mirror after an accepted desktop PTY resize :: An external accepted resize produces the resized dimensions and same status-frame lines as a separately driven reference emulator.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: replaces suffix-only headless state with the recovered renderer snapshot :: Replacing suffix-only state removes old suffix, retains renderer history plus later output/cwd, and returns the live47x40PTY grid.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: stamps SSH connection identity on runtime terminal status :: A synthetic mounted-leaf OSC9999 status after registerPty carries the supplied SSH connectionId.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: does not retain WSL context when a PTY id is reused :: After exit and same-ID new null distro context, OSC7 file://server/share/repo uses UNC server path rather than old Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: preserves immutable context while a live daemon attach is unresolved :: preparePtyExecutionContext with preserveExisting refuses a supplied Debian replacement and subsequent OSC7 keeps original Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts :: projects frame-independent live state through main buffer snapshots :: Main-buffer snapshot puts focus-report/cursor-visibility modes in frameRestoreAnsi, excludes STATIC-FRAME there and includes it in data.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts :: continues terminal agent status fanout when a callback throws :: Throwing on the first status callback does not prevent second payload delivery and logs contextual error.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: returns a title-only replay snapshot and never historical attention :: Lose replay:true/title-only fact projection despite earlierbell and unknownPTYnull. No actual delivered-history notification or reattach behavior was exercised. No equivalent replacement claimed.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects a handle rebind while a controller-less status check yields :: A handle rebound while the null-controller status continuation yields must throw terminal_handle_stale.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects confirmation evidence when the owning PTY exits :: A pending strong confirmation resolving after owning PTY exit must reject terminal_exited.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts :: keeps ordinary terminal send suffix failures on the existing not-writable contract :: Ordinary send writes text but refused CR must throw terminal_not_writable with beforeWrite twice and afterWrite once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell the execution host cannot apply instead of spawning its default :: Requested Windows shell on POSIX must refuse before spawning a default shell.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: quotes the agent startup command for the requested shell, not the host default :: Requested cmd shell must override PowerShell default quoting for agent startup command.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: keeps restored receipts outside a targeted worktree scan :: Targeted scan removes the moved-worktree receipt while preserving another worktree receipt.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: observes setup command completion without waiting for its interactive shell to exit :: Nonzero completion marker 17 resolves while interactive shell remains running.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: falls back to setup terminal exit when no completion signal is available :: Setup completion observer without token falls back to actual exit code 9.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: cancels setup completion observation when the caller aborts :: Abort rejects with the original reason and unsubscribes once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps observing after an uncertain setup terminal status :: Unknown exit waiter result must leave observation pending until completion marker arrives.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh omits a record :: Controller inventory omission disconnects the record but preserves its retained transcript.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh times out :: Hung inventory timeout leaves connected record and retained transcript intact.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle for adopted background PTY handles from the renderer title :: An adopted background handle resolves tui-idle from ready Codex renderer title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves live-leaf tui-idle from an OpenCode native title :: A live leaf resolves tui-idle from an OpenCode native title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from a Codex ready prompt preview :: A supplied Codex prompt preview resolves tui-idle without an actual agent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from an Antigravity prompt before the model line :: A supplied Antigravity prompt before model line resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell with no workspace instead of creating a default-shell tab :: Workspace-less explicit shell must reject before renderer default-tab request or spawn. This real guard/wiring alarm is deliberately retired.",
+ "Audit3798 per-case accepted losses:\nsrc/main/runtime/orca-runtime-tests/paired-settings.spec.ts :: awaits navigation-only updates from paired clients (%s) :: Updating only claudeSubagentNavigationEnabled waits for the actual controller call to the supplied pending Claude-view reconcile for both on/off values.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: drops a client page record even when its close command cannot be issued :: A removed workspace loses its runtime client-page record and headless browser projection despite close delivery_required rejection, and emits the asynchronous warning.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: leaves client-hosted pages alone when another host still owns the same worktree id :: Removing runtime:env-b metadata with local ownership leaves the local same-ID client page unchanged and issues no close command.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: marks live bindings again when reopening after a promoted window closes :: A reopened window marks its still-registered live worktree in activeWorktreeIdsOnShutdown after the first promoted window closes.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: preserves live SSH session identities when promoting a headless runtime :: Headless-to-desktop promotion records active worktree, SSH connection and remoteSessionIdsByTabId from the supplied surviving SSH PTY/session.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores a surviving renderer when its reload is cancelled :: A sole ready renderer reload cancelled under its current renderer fence returns true and becomes ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores headless authority when desktop promotion navigation is cancelled :: A cancelled desktop promotion with headless recovery returns false while headless authority remains ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: moves a desktop graph to unavailable when its reload times out :: A ready desktop graph without a headless fallback becomes unavailable at the reload deadline and retains its window/epoch.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: recovers a failed headless promotion and accepts a later renderer generation :: A promotion failure restores ready headless authority; a later valid same-window graph publishes ready desktop authority.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: clears a failed pane recovery so a later reconnect can retry :: After relay_reconnecting rejection, the pending recovery lock clears and the same pane/handle can call createTerminal a second time and return its supplied replacement.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: still preserves a CLI agent leaf when the reloaded renderer has not rebound its PTY :: An empty graph published during renderer reload preserves a preallocated live CLI PTY as one listable terminal before renderer rebind.\nsrc/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts :: keeps a no-incarnation handle across an in-graph pane remint :: Within one graph lifetime an unversioned PTY reminted onto another leaf retains its issued handle and resolves its old exit waiter after onPtyExit.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: matches explicit-id cwd PTYs when the resolved worktree cache is incomplete :: An explicit target absent from a fresh incomplete resolved cache adopts only its cwd PTY, rejects nested cwd PTY and does not rescan Git.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: ignores cwd-only controller PTYs for malformed explicit worktree IDs :: Malformed id:repo-1:: returns no terminals, does not adopt cwd-only controller PTY and avoids Git rescanning.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: refuses an SSH-backed create for mobile/runtime callers instead of creating locally :: Loss of this public unserved SSH create error-class/no-local-add/no-local-list alarm.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: records an app-selected parent workspace as a manual action :: Loss of the local runtime folder-parent manual origin, active-workspace source and explicit confidence projection alarm; no claim that SSH or cleanup coverage replaces it.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: browses runtime server directories before projects are added :: Loss of this public runtime alarm for browse availability before registration, directories-first lexical ordering and native path flavor.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: lists drive roots for a server-root browse :: Loss of the Windows public slash-root drive enumeration smoke and presence of the temporary directory drive.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations-part-02.spec.ts :: creates a missing runtime parent before creating the project directory :: Loss of this runtime createRepo recursive missing-parent/child existence and registered-path alarm.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: preserves selected project %s when a hosted parent is known :: Loss of both parent-selected and origin-selected normal fork-link projection/persisted upstream alarms plus exact single-probe count.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: links a current enterprise remote despite unavailable metadata and a retained %s :: Loss of normal current-enterprise-origin linking with stale automatic GitHub avatar or protected file image, unchanged icon assertion, and serialized project identity under unavailable metadata.",
"Audit2643 deletes the seven fake-manager browser IPC cases: renderer-owned registration repair, untrusted download cancellation refusal, exact certificate approval, cancelled pending grab enablement, in-flight grab serialization, stale guest registration waits, and annotation ownership refusal. These alarms are intentionally lost without replacement; dated evidence retains its original scope and no fresh gate execution is claimed.",
"Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
"Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts. Unresolved local/computed edges remain explicit debt.",
@@ -4778,7 +4761,8 @@
"Audit3342 historical original evidenceRuns object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n \"date\": \"2026-08-27\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/workspace-doc-page-pane.test.tsx src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"result\": \"failed\",\n \"durationSeconds\": 3,\n \"summary\": \"One sole-delta mutant dropping the window-focus re-offer: the guest is focused once at mount and never again after the window comes back, which is the desktop gap behind it — another app taking the front leaves the preview's only route out shut until the pane remounts. It fails only the new re-offer test, and the refusing-preview case beside it stays green, so the re-offer is pinned as gated rather than unconditional.\"\n }",
"Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
"Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked session-close routing suite is removed, including the explicit cross-worktree cleanup alarm. Remove its active file, command token and assertion reference; historical selectors and receipts retain their original scope. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
- "Audit3460 historical original active selectors (verbatim JSON values; not current coverage):\ncommands: [\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-grant-registry.test.ts src/main/browser/document-preview/doc-preview-file-reader.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/main/browser/document-preview/doc-preview-failure-notice.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/lib/browser/documents/doc-preview-grants.test.ts src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/sessions/partition-policies/browser-session-partition-policies.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/sessions/partition-policies/browser-session-partition-policies.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx src/shared/document-preview/doc-preview-scheme.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/link-actions/LinkActionPopover.test.tsx\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-page-conversion.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-conversion-publish.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-preview-address-bar-convergence.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=list\",\n \"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line\",\n \"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line --repeat-each=3\",\n \"npx playwright test --config tests/playwright.config.ts --project=electron-headless tests/e2e/paired-remote-html-preview-local-render.spec.ts --workers=1\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts src/renderer/src/store/slices/browser/browser.test.ts\",\n \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-browser-create-navigation-deadline.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line\",\n \"SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line\"\n ]\ntestFiles: [\n \"src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts\",\n \"src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts\",\n \"src/renderer/src/store/slices/browser/browser.test.ts\",\n \"src/main/browser/document-preview/doc-preview-grant-registry.test.ts\",\n \"src/main/browser/document-preview/doc-preview-file-reader.test.ts\",\n \"src/main/browser/sessions/partition-policies/browser-session-partition-policies.test.ts\",\n \"src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n \"src/main/browser/document-preview/doc-preview-failure-notice.test.ts\",\n \"src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts\",\n \"src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts\",\n \"src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts\",\n \"src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts\",\n \"src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"src/shared/document-preview/doc-preview-scheme.test.ts\",\n \"src/renderer/src/lib/browser/documents/doc-preview-grants.test.ts\",\n \"src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts\",\n \"src/renderer/src/components/link-actions/LinkActionPopover.test.tsx\",\n \"src/renderer/src/store/slices/browser/pages/browser-page-conversion.test.ts\",\n \"src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-conversion-publish.test.ts\",\n \"tests/e2e/paired-remote-html-preview-local-render.spec.ts\",\n \"tests/e2e/paired-preview-address-bar-convergence.spec.ts\",\n \"tests/e2e/paired-browser-create-navigation-deadline.spec.ts\",\n \"tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts\",\n \"src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\"\n ]\nassertionRefs: [\n {\n \"file\": \"src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts\",\n \"assertions\": [\"explicit cleanup cannot close a page owned by another worktree\"]\n },\n {\n \"file\": \"src/renderer/src/store/slices/browser/browser.test.ts\",\n \"assertions\": [\n \"a requested canonical page ID is stored on the page rather than reused as its workspace ID\",\n \"duplicate canonical page IDs are rejected before a second tab can materialize\"\n ]\n },\n {\n \"file\": \"tests/e2e/paired-remote-html-preview-local-render.spec.ts\",\n \"assertions\": [\n \"the host's HTML document renders inside the client-local orca-preview guest\",\n \"neither the client browser-workspace count nor the host browser-tab count moves off baseline\",\n \"the preview opens in its own split with mode html-preview and leaves the source editor active\",\n \"an explicit click reactivates the preview, and closing it preserves the source editor, its group, and the terminal\",\n \"the document reports having attempted both its unattended and its post-press egress, so neither absence assertion can pass on a document that never tried\",\n \"a scripted window.open and location.href driven by a real press elsewhere in the document route nothing and move no browser count\",\n \"a real target=_blank press in the rendered document routes out as an Orca browser tab while the preview stays open\"\n ]\n },\n {\n \"file\": \"src/main/browser/document-preview/doc-preview-file-reader.test.ts\",\n \"assertions\": [\n \"reads a document too large for one reply by range under the same grant\",\n \"refuses a document rewritten between ranges instead of splicing versions\",\n \"requires approval for a sibling directory before touching the runtime\"\n ]\n },\n {\n \"file\": \"src/main/browser/document-preview/doc-preview-grant-registry.test.ts\",\n \"assertions\": [\n \"keeps silent authority over a document directory strictly inside the workspace, and only there\",\n \"uses Windows semantics when authorizing a sibling directory\",\n \"keeps an approved SSH directory inside the canonical workspace boundary\"\n ]\n },\n {\n \"file\": \"src/main/browser/document-preview/doc-preview-failure-notice.test.ts\",\n \"assertions\": [\"413 and 415 map to distinct reasons and everything else stays generic\"]\n },\n {\n \"file\": \"src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n \"assertions\": [\n \"never rebinds a bound guest onto a second grant\",\n \"leaves a re-minted preview registered when the guest it replaced tears down\"\n ]\n },\n {\n \"file\": \"src/shared/document-preview/doc-preview-scheme.test.ts\",\n \"assertions\": [\n \"malformed grant ids and unsupported schemes are refused\",\n \"undecodable percent escapes are refused\"\n ]\n },\n {\n \"file\": \"src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts\",\n \"assertions\": [\n \"a document page's url is blank in the store, in the written session and after restore\",\n \"a document navigation report leaves its URL blank, its title standing and nothing loading; its session excludes preview URLs\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"assertions\": [\n \"a preview that is the reader's surface hands its guest focus, and one that is not leaves focus alone\",\n \"the window taking focus back re-offers it to the guest, and re-offers nothing for a preview that was refusing\"\n ]\n },\n {\n \"file\": \"tests/e2e/paired-browser-create-navigation-deadline.spec.ts\",\n \"assertions\": [\n \"a held navigation exceeds the former create deadline while the first RPC returns the exact authoritative host page ID\",\n \"host inventory contains exactly one new page and the user retry branch is never entered\"\n ]\n },\n {\n \"file\": \"tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts\",\n \"assertions\": [\n \"the exact created page exists on the host while publication is held and no browser tab materializes on the client\",\n \"a forced post-create reconciliation timeout closes the exact host page and removes only the reserved empty split\",\n \"a forced capability rejection after caller preflight shows a toast and restores exact host and client inventories\",\n \"headed and headless hosts preserve the unrelated editor and terminal without local fallback\"\n ]\n },\n {\n \"file\": \"src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\",\n \"assertions\": [\n \"replays a snapshot that beat the RPC response and focuses the exact adopted leaf\",\n \"retains exact-leaf focus intent when a split sibling publishes first\"\n ]\n }\n ]"
+ "Audit3460 historical original active selectors (verbatim JSON values; not current coverage):\ncommands: [\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-grant-registry.test.ts src/main/browser/document-preview/doc-preview-file-reader.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/main/browser/document-preview/doc-preview-failure-notice.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/lib/browser/documents/doc-preview-grants.test.ts src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/sessions/partition-policies/browser-session-partition-policies.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/sessions/partition-policies/browser-session-partition-policies.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx src/shared/document-preview/doc-preview-scheme.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/link-actions/LinkActionPopover.test.tsx\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-page-conversion.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-conversion-publish.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-preview-address-bar-convergence.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=list\",\n \"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line\",\n \"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line --repeat-each=3\",\n \"npx playwright test --config tests/playwright.config.ts --project=electron-headless tests/e2e/paired-remote-html-preview-local-render.spec.ts --workers=1\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts src/renderer/src/store/slices/browser/browser.test.ts\",\n \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-browser-create-navigation-deadline.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line\",\n \"SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line\"\n ]\ntestFiles: [\n \"src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts\",\n \"src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts\",\n \"src/renderer/src/store/slices/browser/browser.test.ts\",\n \"src/main/browser/document-preview/doc-preview-grant-registry.test.ts\",\n \"src/main/browser/document-preview/doc-preview-file-reader.test.ts\",\n \"src/main/browser/sessions/partition-policies/browser-session-partition-policies.test.ts\",\n \"src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n \"src/main/browser/document-preview/doc-preview-failure-notice.test.ts\",\n \"src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts\",\n \"src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts\",\n \"src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts\",\n \"src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts\",\n \"src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"src/shared/document-preview/doc-preview-scheme.test.ts\",\n \"src/renderer/src/lib/browser/documents/doc-preview-grants.test.ts\",\n \"src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts\",\n \"src/renderer/src/components/link-actions/LinkActionPopover.test.tsx\",\n \"src/renderer/src/store/slices/browser/pages/browser-page-conversion.test.ts\",\n \"src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-conversion-publish.test.ts\",\n \"tests/e2e/paired-remote-html-preview-local-render.spec.ts\",\n \"tests/e2e/paired-preview-address-bar-convergence.spec.ts\",\n \"tests/e2e/paired-browser-create-navigation-deadline.spec.ts\",\n \"tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts\",\n \"src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\"\n ]\nassertionRefs: [\n {\n \"file\": \"src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts\",\n \"assertions\": [\"explicit cleanup cannot close a page owned by another worktree\"]\n },\n {\n \"file\": \"src/renderer/src/store/slices/browser/browser.test.ts\",\n \"assertions\": [\n \"a requested canonical page ID is stored on the page rather than reused as its workspace ID\",\n \"duplicate canonical page IDs are rejected before a second tab can materialize\"\n ]\n },\n {\n \"file\": \"tests/e2e/paired-remote-html-preview-local-render.spec.ts\",\n \"assertions\": [\n \"the host's HTML document renders inside the client-local orca-preview guest\",\n \"neither the client browser-workspace count nor the host browser-tab count moves off baseline\",\n \"the preview opens in its own split with mode html-preview and leaves the source editor active\",\n \"an explicit click reactivates the preview, and closing it preserves the source editor, its group, and the terminal\",\n \"the document reports having attempted both its unattended and its post-press egress, so neither absence assertion can pass on a document that never tried\",\n \"a scripted window.open and location.href driven by a real press elsewhere in the document route nothing and move no browser count\",\n \"a real target=_blank press in the rendered document routes out as an Orca browser tab while the preview stays open\"\n ]\n },\n {\n \"file\": \"src/main/browser/document-preview/doc-preview-file-reader.test.ts\",\n \"assertions\": [\n \"reads a document too large for one reply by range under the same grant\",\n \"refuses a document rewritten between ranges instead of splicing versions\",\n \"requires approval for a sibling directory before touching the runtime\"\n ]\n },\n {\n \"file\": \"src/main/browser/document-preview/doc-preview-grant-registry.test.ts\",\n \"assertions\": [\n \"keeps silent authority over a document directory strictly inside the workspace, and only there\",\n \"uses Windows semantics when authorizing a sibling directory\",\n \"keeps an approved SSH directory inside the canonical workspace boundary\"\n ]\n },\n {\n \"file\": \"src/main/browser/document-preview/doc-preview-failure-notice.test.ts\",\n \"assertions\": [\"413 and 415 map to distinct reasons and everything else stays generic\"]\n },\n {\n \"file\": \"src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n \"assertions\": [\n \"never rebinds a bound guest onto a second grant\",\n \"leaves a re-minted preview registered when the guest it replaced tears down\"\n ]\n },\n {\n \"file\": \"src/shared/document-preview/doc-preview-scheme.test.ts\",\n \"assertions\": [\n \"malformed grant ids and unsupported schemes are refused\",\n \"undecodable percent escapes are refused\"\n ]\n },\n {\n \"file\": \"src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts\",\n \"assertions\": [\n \"a document page's url is blank in the store, in the written session and after restore\",\n \"a document navigation report leaves its URL blank, its title standing and nothing loading; its session excludes preview URLs\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n \"assertions\": [\n \"a preview that is the reader's surface hands its guest focus, and one that is not leaves focus alone\",\n \"the window taking focus back re-offers it to the guest, and re-offers nothing for a preview that was refusing\"\n ]\n },\n {\n \"file\": \"tests/e2e/paired-browser-create-navigation-deadline.spec.ts\",\n \"assertions\": [\n \"a held navigation exceeds the former create deadline while the first RPC returns the exact authoritative host page ID\",\n \"host inventory contains exactly one new page and the user retry branch is never entered\"\n ]\n },\n {\n \"file\": \"tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts\",\n \"assertions\": [\n \"the exact created page exists on the host while publication is held and no browser tab materializes on the client\",\n \"a forced post-create reconciliation timeout closes the exact host page and removes only the reserved empty split\",\n \"a forced capability rejection after caller preflight shows a toast and restores exact host and client inventories\",\n \"headed and headless hosts preserve the unrelated editor and terminal without local fallback\"\n ]\n },\n {\n \"file\": \"src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\",\n \"assertions\": [\n \"replays a snapshot that beat the RPC response and focuses the exact adopted leaf\",\n \"retains exact-leaf focus intent when a split sibling publishes first\"\n ]\n }\n ]",
+ "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed."
],
"demotionRule": "Demote if a paired HTML preview creates a browser workspace on either side, renders from anything other than the orca-preview scheme, serves a read the host reported as truncated or over-cap, serves a document without the self-only content security policy, lets the preview session carry an off-machine request, reads an SSH path that canonicalizes outside its grant root, steals focus from the source editor when it opens, removes unrelated editor or terminal state on close, hides a document that rendered because one subresource was refused, leaves a grant readable after the tab or renderer that owns it is gone, mints one for a sender that is not the trusted renderer, opens a browser tab for a navigation the document started with no one at the keyboard, or lets the guest gather an ICE candidate; or if a paired browser creation this gate still owns produces duplicate client or host identities or loses its requested split."
},
@@ -4810,32 +4794,31 @@
"providers": ["local", "remote-runtime", "ssh", "wsl"],
"coveredPlatforms": ["macos", "linux"],
"coveredProviders": [],
- "coverageNotes": "Audit3381 intentionally removes the entire browser network tunnel protocol suite and active selectors/assertion. Static envelope/dispatch protocol alarms are lost without equivalent replacement. Remaining tunnel session and stream tests have narrower scopes. All three unrelated complete dated receipts are preserved verbatim with their original selectors; no fresh execution claimed. Module layout SSH policy: Retire the dynamic-forward launch argument/default inventory. The retained actual startup-cancellation entry case covers cancellation classification and termination/probe cleanup requests with supplied process/socket boundaries, not real SSH launch flags or live forwarding. Remove only the retired launch-flags assertion; unrelated dated receipts and their executed commands remain unchanged. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1991: Remove the ordinary browser-host release/sub-cap and exact socket-close counter aliases. Retain the two actual admitted-device fairness and shared ask/browser/wait budget callbacks, which call server handlers with fake WebSockets and controlled pending RPCs. Preserve all3 unrelated dated receipts. No real browser placement or remote tunnel deployment is proved by this admission suite. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked browser placement mutation and projection suites and both prospective selectors. Preserve3 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove stale production-registration and negotiated metadata aliases, compound refusal/cleanup aliases, isolated descriptor/route/memory/cleanup microcases. Retain exact negotiated command settlement, duplicate/conflict fencing, ready/replay ordering, superseded-connection cleanup, second-host refusal, ungranted target refusal, public connector redaction, revocation race and route replacement aliases within injected-port scope. Reconciliation and all3 unrelated dated receipts remain unchanged. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1918 narrows browser-host-command-ledger-capacity: intentionally loses injected per-page/global cache expiry-count ceilings and authority/command/result cloning inventory alarms. Retain valid commands/testFile and the oversized-wire pre-admission and delivery-failure outstanding-outcome assertions, backed by unchanged retained real-ledger callbacks with supplied browser delivery. These survivors are not equivalent replacement coverage for the deleted cache/cloning examples. Existing three exact unrelated tunnel/wire receipts retain their original scope; no fresh reduced-gate, real browser/provider, native/platform, soak or measured-budget result is added. Historical prior account (preserved verbatim): Audit1900 reduces ws-outbound-backpressure-queue by seven authored definitions while retaining ten. Current source19 assertions still describe distinct direct/queued aggregate admission, cooperative drain ordering and aggregate claim release. Existing commands, testFiles and all three source19 assertions remain valid and unchanged. The affected2026-11-04 Linux44tests/4files/5.58s receipt is retired whole as historical evidence. The other three unchanged-selector browser receipts retain their exact original scope. Reduced selectors have no fresh integrated, physical-device, mixed-host, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1686 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1571 removes mock forwarding, capability/schema inventories, private predicates, supplied error/result replays, and filesystem-mocked persistence checks without equivalent replacement claims. Retained changed tests also exercise real local permission-file reread, registry proxy rollback/credential retirement, site display recovery, and pending sender/credential/document admission with injected Electron/UI producers. Retained network tests exercise owned stream credit/cleanup, generation and retirement fences, real loopback proxy/SOCKS bytes and file-backed binding state. SSH/WSL/paired runtime, native sessions, authority producers and storage clears remain injected; simulated relaunch uses filesystem mocks. The unchanged profile-retirement suite was statically reviewed and not rerun. No actual SSH/WSL runtime, native Chromium jar deletion, durable process restart, remote DNS or external site proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1563 retires mock cookie inventories, summary/flag/counter checks, historical replacement/replay narratives and setup-only alarms without equivalent replacement coverage. Retained changed cases exercise owned admission and cleanup, real staged-file lifetime, JSON/SQLite/WAL/schema compatibility, synthetic encryption and native Electron SameSite storage. Session/CDP/credential/write/renderer producers remain injected where recorded. Seven unchanged native definitions are not rerun locally; known stale registry-stub fixtures are not executable proof. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain unchanged. Historical scope before this audit: Audit1559 removes mocked host/lease/reconciliation, event/flag/counter, forwarding, inventory and retry-budget alarms without equivalent replacement coverage. Retained cases establish owned promise, registry, rollback, admission and cleanup boundaries with injected Electron/renderer/host inputs; actual local sockets, file staging and Buffer collection are scoped in the PR. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain historical evidence only. No live paired runtime, rendered browser/profile/TLS or device claim. Historical scope before this audit: Audit1401 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1340 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic protocol, registry, injected-socket, and loopback-listener tests cover strict framing, remote-DNS targets, exact destination-write and source-consumption credit, at most 256 streams per route with pending opens counted inside that cap, 1024 admitted opens per 10-second monotonic window, an 8 MiB per-route application-buffer ledger, shared 32 MiB browser-host and 128 MiB process ledgers across application copies, encrypted client queues, and native WebSocket bufferedAmount, bounded byte/claim/socket-source counts, a four-frame queued-drain quantum, authority epochs, exact host selection, one host per authenticated connection, four hosts per paired device, eight global browser-host polls with four per authenticated paired device, a shared ask/host ceiling that retains one quarter for waits, bounded initial and reconnect runtime_busy recovery, long-poll metering and disconnect abort, monotonic host/page/route generations without page tombstones, two-phase exact page retirement with cancellation, connection-owned cleanup, exact client revocation, stale and replaced fences, retired stream IDs, half-close and close ordering, SOCKS CONNECT, bind/close races, listener wildcard normalization, unsupported commands, unavailable routes, and raw/terminal binary-handler isolation. Page commands use a separately echoed v1 attach negotiation, exact authority/host/page generations, bounded command IDs and sequences, and bounded create/navigate payloads; legacy attaches still receive only the unchanged ready/revoked event shapes. A second optional reconciliation subprotocol gates bounded reclaim, close, and restore payloads behind exact attach/ready echo, complete inventory, command negotiation, reconnect authority, and command-result authority; the production client advertises it only with the matching command and inventory capabilities. Exact guest or app-renderer loss marks one page generation outcome-unknown, coalesces a bounded negotiated inventory reattach, closes or retires the dead generation, and allocates a fresh generation before URL restore; explicit close is not misclassified as a crash. Mixed-version mutation tests project hidden client pages before activate, close, split, reorder, and move-to-group admission, preserve hidden raw order slots, translate visible insertion indices, and project mutation snapshots. A production server orchestrator consumes each immutable inventory once, reserves target generations without exposing placement, emits only negotiated ledger commands, commits after exact completed proof, preserves unrelated and server placements, aborts an attempt when connection authority enters reconnect grace, and requires fresh inventory after failure or abort. The production client dispatcher additionally proves per-page FIFO execution, exact payload-matched duplicate replay, frozen command/result snapshots, a global retired-generation floor, transactional admission, bounded pages/active commands/queues/per-page and global result cache/concurrency, create dependency failure, cancellation, deduplicated retirement joining, and bounded close without late-result overwrite. The server ledger owns issue order and immutable command/result snapshots, bounds outstanding commands, active pages, and per-page/global replay caches, releases active-page capacity after an exact completed close while retaining bounded result replay, validates the shared wire payload before admission, requires live delivery and exact placement, authenticates results to the negotiated connection and paired lease, rejects gaps and conflicting replay, and fences outstanding outcomes at exact retirement. Negotiated command results reuse the authenticated attach socket through bounded nested JSON requests; exact ID routing, reverse-order replies, unknown and duplicate IDs, timeout teardown, serialization failure, aggregate queue accounting, acknowledgement validation, and the unchanged non-v1 path are deterministic. A stable local listener rejects CONNECT while offline or reconnecting, retains its address across replacement, requires a strictly increasing tunnel generation, ignores late superseded callbacks, propagates tunnel protocol failure to the route owner, and recycles exhausted stream IDs only after generation replacement. Reconnect uses the unchanged native v1 attach payload and capability pair; SSH descriptors alone add an execution-host capability and require a runtime-minted grant bound to the exact browser-host lease. Exact SSH provider epoch and connection generation fence ssh2 forwardOut and one non-interactive standalone system-SSH dynamic forward per route. Unit tests preserve domain-form SOCKS requests, sanitize remote errors, bound stderr, cancel startup, release timed-out and synchronously failed sockets, and release routes once. An ephemeral Docker sshd resolves a container-only domain and returns a unique HTTP marker through both ssh2 and the actual system-OpenSSH dynamic-forward adapter without touching the user's SSH files; authority loss fences the ssh2 route. The execution runtime charges route application bytes to the same per-host/process policy; its existing E2EE owner separately caps native outbound buffers process-wide. Production-registered browser-host and paired-runtime methods lease one exact host, prove attach, command delivery, and result settlement share one exact connection identity, then carry SOCKS and HTTP bytes over a dedicated E2EE socket to the fenced execution-host revision and prove route close destroys the destination socket. The production desktop adapter now composes one exact host per environment pairing revision with the page executor, current renderer selector, route Session/WebContents registries, and one reference-counted route per canonical execution-host key. Negotiated same-client control reconnect retains exact authority, placements, grants, dispatcher dedupe, executor guests, and listener addresses; it fences tunnels immediately, blocks route admission, reattaches command delivery only after ready, and replays unsettled commands without repeating completed mutations. Terminal release, replacement, legacy disconnect, and reconnect-grace expiry make only the exact host generation's client placements non-cancellable retirement-pending while retaining capacity until exact cleanup; reconnect grace preserves them. Environment replacement and app shutdown still serialize transport closure before page cleanup and force-close every remaining route. The production placement preparation starts the exact desktop adapter and advertises host/tunnel capabilities only when the paired Electron client is eligible. Node stream-internal high-water bytes, strict cross-route scheduling, and physical cross-platform evidence remain uncovered. The two Docker remote-only SSH browser routing journeys now run in the dedicated Linux ssh-browser-network-route CI job on full runs and their mapped source/test changes; 2 baseline and 6 repeated cases passed with no skips/retries on 2026-09-06. The removed retry-arithmetic and attach-request inventory suites are not current coverage; retained lease and composition suites exercise admission retry, cleanup, inventory negotiation, and reconnect behavior. Test-value audit1293 removes src/main/browser/network/tunnels/browser-network-tunnel-client-memory-budget.test.ts (4 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1302: src/main/browser/client-pages/lifecycle/browser-client-page-unavailability.test.ts: Every route/guest lifecycle/currentness/navigation/renderer/automation authority is supplied by fake callbacks, then unavailability listener is invoked manually and private inventory/mock calls are checked. No guest destruction, renderer disconnect or actual reconciliation/close consumer. Lose generation fence/reconcile-once/missing-renderer-close branch alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1318: src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts: Retain actual local encrypted WebSocket subscription concurrency routing when host replies out of order, plus an exception thrown by a real ws consumer callback being turned into a subscription error. Server is a test-shaped handshake/response producer using production crypto, not actual runtime host/auth authority or independent cryptographic oracle. Remove happy second-request duplicate, unknown/duplicate-ID branches, fixed32 capacity, serialization/capacity/timeouts and fake memory release/admission call-count scenarios; intentionally lose those alarms. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1340: src/main/runtime/runtime-binary-message-router.test.ts removed. Connection mode conflict exceptions and one terminal/raw callback each. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1371 removes the reconciliation protocol/capability echo inventory from browser-client-host-reconciliation.test.ts. The pending command result refusal without exact authority and later accepted acknowledgement callback remains byte-identical. The narrow negotiation echo alarm is intentionally lost; no equivalent browser/authenticated transport proof is claimed. Existing receipts with unchanged selectors retain only their original scope. Audit1401: src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts reduced. Loses deterministic equal-length URL compaction tie-breaking and reversed-input invariance alarm. No equivalent replacement coverage is claimed.",
+ "coverageNotes": "Audit4014 removes the complete browser client page command integration suite and its active command token, test selector and assertion reference. Its synthetic guest lifecycle still exercised real executor/dispatcher/Session/WebContents registry composition: navigation normalization, generation reclaim, spontaneous destruction inventory revocation, and exactly-once route/policy retirement alarms are intentionally lost. Electron guest navigation, proxy resolution and renderer lifecycle were supplied test ports; no equivalent replacement or fresh execution is claimed. The three unrelated active dated receipts and all prior historical strings remain unchanged. Historical prior account (preserved verbatim): Audit3381 intentionally removes the entire browser network tunnel protocol suite and active selectors/assertion. Static envelope/dispatch protocol alarms are lost without equivalent replacement. Remaining tunnel session and stream tests have narrower scopes. All three unrelated complete dated receipts are preserved verbatim with their original selectors; no fresh execution claimed. Module layout SSH policy: Retire the dynamic-forward launch argument/default inventory. The retained actual startup-cancellation entry case covers cancellation classification and termination/probe cleanup requests with supplied process/socket boundaries, not real SSH launch flags or live forwarding. Remove only the retired launch-flags assertion; unrelated dated receipts and their executed commands remain unchanged. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1991: Remove the ordinary browser-host release/sub-cap and exact socket-close counter aliases. Retain the two actual admitted-device fairness and shared ask/browser/wait budget callbacks, which call server handlers with fake WebSockets and controlled pending RPCs. Preserve all3 unrelated dated receipts. No real browser placement or remote tunnel deployment is proved by this admission suite. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked browser placement mutation and projection suites and both prospective selectors. Preserve3 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove stale production-registration and negotiated metadata aliases, compound refusal/cleanup aliases, isolated descriptor/route/memory/cleanup microcases. Retain exact negotiated command settlement, duplicate/conflict fencing, ready/replay ordering, superseded-connection cleanup, second-host refusal, ungranted target refusal, public connector redaction, revocation race and route replacement aliases within injected-port scope. Reconciliation and all3 unrelated dated receipts remain unchanged. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1918 narrows browser-host-command-ledger-capacity: intentionally loses injected per-page/global cache expiry-count ceilings and authority/command/result cloning inventory alarms. Retain valid commands/testFile and the oversized-wire pre-admission and delivery-failure outstanding-outcome assertions, backed by unchanged retained real-ledger callbacks with supplied browser delivery. These survivors are not equivalent replacement coverage for the deleted cache/cloning examples. Existing three exact unrelated tunnel/wire receipts retain their original scope; no fresh reduced-gate, real browser/provider, native/platform, soak or measured-budget result is added. Historical prior account (preserved verbatim): Audit1900 reduces ws-outbound-backpressure-queue by seven authored definitions while retaining ten. Current source19 assertions still describe distinct direct/queued aggregate admission, cooperative drain ordering and aggregate claim release. Existing commands, testFiles and all three source19 assertions remain valid and unchanged. The affected2026-11-04 Linux44tests/4files/5.58s receipt is retired whole as historical evidence. The other three unchanged-selector browser receipts retain their exact original scope. Reduced selectors have no fresh integrated, physical-device, mixed-host, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1686 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1571 removes mock forwarding, capability/schema inventories, private predicates, supplied error/result replays, and filesystem-mocked persistence checks without equivalent replacement claims. Retained changed tests also exercise real local permission-file reread, registry proxy rollback/credential retirement, site display recovery, and pending sender/credential/document admission with injected Electron/UI producers. Retained network tests exercise owned stream credit/cleanup, generation and retirement fences, real loopback proxy/SOCKS bytes and file-backed binding state. SSH/WSL/paired runtime, native sessions, authority producers and storage clears remain injected; simulated relaunch uses filesystem mocks. The unchanged profile-retirement suite was statically reviewed and not rerun. No actual SSH/WSL runtime, native Chromium jar deletion, durable process restart, remote DNS or external site proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1563 retires mock cookie inventories, summary/flag/counter checks, historical replacement/replay narratives and setup-only alarms without equivalent replacement coverage. Retained changed cases exercise owned admission and cleanup, real staged-file lifetime, JSON/SQLite/WAL/schema compatibility, synthetic encryption and native Electron SameSite storage. Session/CDP/credential/write/renderer producers remain injected where recorded. Seven unchanged native definitions are not rerun locally; known stale registry-stub fixtures are not executable proof. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain unchanged. Historical scope before this audit: Audit1559 removes mocked host/lease/reconciliation, event/flag/counter, forwarding, inventory and retry-budget alarms without equivalent replacement coverage. Retained cases establish owned promise, registry, rollback, admission and cleanup boundaries with injected Electron/renderer/host inputs; actual local sockets, file staging and Buffer collection are scoped in the PR. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain historical evidence only. No live paired runtime, rendered browser/profile/TLS or device claim. Historical scope before this audit: Audit1401 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1340 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic protocol, registry, injected-socket, and loopback-listener tests cover strict framing, remote-DNS targets, exact destination-write and source-consumption credit, at most 256 streams per route with pending opens counted inside that cap, 1024 admitted opens per 10-second monotonic window, an 8 MiB per-route application-buffer ledger, shared 32 MiB browser-host and 128 MiB process ledgers across application copies, encrypted client queues, and native WebSocket bufferedAmount, bounded byte/claim/socket-source counts, a four-frame queued-drain quantum, authority epochs, exact host selection, one host per authenticated connection, four hosts per paired device, eight global browser-host polls with four per authenticated paired device, a shared ask/host ceiling that retains one quarter for waits, bounded initial and reconnect runtime_busy recovery, long-poll metering and disconnect abort, monotonic host/page/route generations without page tombstones, two-phase exact page retirement with cancellation, connection-owned cleanup, exact client revocation, stale and replaced fences, retired stream IDs, half-close and close ordering, SOCKS CONNECT, bind/close races, listener wildcard normalization, unsupported commands, unavailable routes, and raw/terminal binary-handler isolation. Page commands use a separately echoed v1 attach negotiation, exact authority/host/page generations, bounded command IDs and sequences, and bounded create/navigate payloads; legacy attaches still receive only the unchanged ready/revoked event shapes. A second optional reconciliation subprotocol gates bounded reclaim, close, and restore payloads behind exact attach/ready echo, complete inventory, command negotiation, reconnect authority, and command-result authority; the production client advertises it only with the matching command and inventory capabilities. Exact guest or app-renderer loss marks one page generation outcome-unknown, coalesces a bounded negotiated inventory reattach, closes or retires the dead generation, and allocates a fresh generation before URL restore; explicit close is not misclassified as a crash. Mixed-version mutation tests project hidden client pages before activate, close, split, reorder, and move-to-group admission, preserve hidden raw order slots, translate visible insertion indices, and project mutation snapshots. A production server orchestrator consumes each immutable inventory once, reserves target generations without exposing placement, emits only negotiated ledger commands, commits after exact completed proof, preserves unrelated and server placements, aborts an attempt when connection authority enters reconnect grace, and requires fresh inventory after failure or abort. The production client dispatcher additionally proves per-page FIFO execution, exact payload-matched duplicate replay, frozen command/result snapshots, a global retired-generation floor, transactional admission, bounded pages/active commands/queues/per-page and global result cache/concurrency, create dependency failure, cancellation, deduplicated retirement joining, and bounded close without late-result overwrite. The server ledger owns issue order and immutable command/result snapshots, bounds outstanding commands, active pages, and per-page/global replay caches, releases active-page capacity after an exact completed close while retaining bounded result replay, validates the shared wire payload before admission, requires live delivery and exact placement, authenticates results to the negotiated connection and paired lease, rejects gaps and conflicting replay, and fences outstanding outcomes at exact retirement. Negotiated command results reuse the authenticated attach socket through bounded nested JSON requests; exact ID routing, reverse-order replies, unknown and duplicate IDs, timeout teardown, serialization failure, aggregate queue accounting, acknowledgement validation, and the unchanged non-v1 path are deterministic. A stable local listener rejects CONNECT while offline or reconnecting, retains its address across replacement, requires a strictly increasing tunnel generation, ignores late superseded callbacks, propagates tunnel protocol failure to the route owner, and recycles exhausted stream IDs only after generation replacement. Reconnect uses the unchanged native v1 attach payload and capability pair; SSH descriptors alone add an execution-host capability and require a runtime-minted grant bound to the exact browser-host lease. Exact SSH provider epoch and connection generation fence ssh2 forwardOut and one non-interactive standalone system-SSH dynamic forward per route. Unit tests preserve domain-form SOCKS requests, sanitize remote errors, bound stderr, cancel startup, release timed-out and synchronously failed sockets, and release routes once. An ephemeral Docker sshd resolves a container-only domain and returns a unique HTTP marker through both ssh2 and the actual system-OpenSSH dynamic-forward adapter without touching the user's SSH files; authority loss fences the ssh2 route. The execution runtime charges route application bytes to the same per-host/process policy; its existing E2EE owner separately caps native outbound buffers process-wide. Production-registered browser-host and paired-runtime methods lease one exact host, prove attach, command delivery, and result settlement share one exact connection identity, then carry SOCKS and HTTP bytes over a dedicated E2EE socket to the fenced execution-host revision and prove route close destroys the destination socket. The production desktop adapter now composes one exact host per environment pairing revision with the page executor, current renderer selector, route Session/WebContents registries, and one reference-counted route per canonical execution-host key. Negotiated same-client control reconnect retains exact authority, placements, grants, dispatcher dedupe, executor guests, and listener addresses; it fences tunnels immediately, blocks route admission, reattaches command delivery only after ready, and replays unsettled commands without repeating completed mutations. Terminal release, replacement, legacy disconnect, and reconnect-grace expiry make only the exact host generation's client placements non-cancellable retirement-pending while retaining capacity until exact cleanup; reconnect grace preserves them. Environment replacement and app shutdown still serialize transport closure before page cleanup and force-close every remaining route. The production placement preparation starts the exact desktop adapter and advertises host/tunnel capabilities only when the paired Electron client is eligible. Node stream-internal high-water bytes, strict cross-route scheduling, and physical cross-platform evidence remain uncovered. The two Docker remote-only SSH browser routing journeys now run in the dedicated Linux ssh-browser-network-route CI job on full runs and their mapped source/test changes; 2 baseline and 6 repeated cases passed with no skips/retries on 2026-09-06. The removed retry-arithmetic and attach-request inventory suites are not current coverage; retained lease and composition suites exercise admission retry, cleanup, inventory negotiation, and reconnect behavior. Test-value audit1293 removes src/main/browser/network/tunnels/browser-network-tunnel-client-memory-budget.test.ts (4 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1302: src/main/browser/client-pages/lifecycle/browser-client-page-unavailability.test.ts: Every route/guest lifecycle/currentness/navigation/renderer/automation authority is supplied by fake callbacks, then unavailability listener is invoked manually and private inventory/mock calls are checked. No guest destruction, renderer disconnect or actual reconciliation/close consumer. Lose generation fence/reconcile-once/missing-renderer-close branch alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1318: src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts: Retain actual local encrypted WebSocket subscription concurrency routing when host replies out of order, plus an exception thrown by a real ws consumer callback being turned into a subscription error. Server is a test-shaped handshake/response producer using production crypto, not actual runtime host/auth authority or independent cryptographic oracle. Remove happy second-request duplicate, unknown/duplicate-ID branches, fixed32 capacity, serialization/capacity/timeouts and fake memory release/admission call-count scenarios; intentionally lose those alarms. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1340: src/main/runtime/runtime-binary-message-router.test.ts removed. Connection mode conflict exceptions and one terminal/raw callback each. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1371 removes the reconciliation protocol/capability echo inventory from browser-client-host-reconciliation.test.ts. The pending command result refusal without exact authority and later accepted acknowledgement callback remains byte-identical. The narrow negotiation echo alarm is intentionally lost; no equivalent browser/authenticated transport proof is claimed. Existing receipts with unchanged selectors retain only their original scope. Audit1401: src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts reduced. Loses deterministic equal-length URL compaction tie-breaking and reversed-input invariance alarm. No equivalent replacement coverage is claimed.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4150/refactor-remote-browser-to-client-hosted-electron-webviews"
],
"invariant": "A client-hosted browser network route exists only for an exact live server-owned browser-host lease, authority epoch, host generation, paired identity, execution-host revision or SSH provider authority, and server-owned route generation. A client page is usable only when its runtime ID, authority epoch, host identity and generation, logical page ID, page-host generation, current placement, and still-live lease all match atomically; a retired, retirement-pending, or server-placed page cannot be claimed as live client placement. Live logical placements and their identities are bounded, an occupied logical page cannot change placement until exact two-phase retirement completes, cancellation restores the same authority, and the runtime-wide page generation stays monotonic without tombstones. Server-issued page commands and results remain bounded, FIFO per page, immutable after admission, authenticated to the exact paired lease, attach connection, and live placement, and replayable only when byte-equivalent. Negotiated transient result-transport loss retains exact authority and replays unsettled commands through the preserved client dedupe cache; terminal authority loss makes outstanding outcomes unknown and makes only the exact host generation's placements non-cancellable retirement-pending until exact cleanup or reconciliation proof. Desktop composition installs exact command authority before delivery, keeps result settlements below nested-request capacity, suspends every tunnel without closing guests on negotiated loss, gates handlers through route recovery, and synchronously suspends routes and revokes exact retained navigation grants before asynchronous transport or handler cleanup on terminal loss. Navigation-revocation failure remains observable without preventing guest destruction and route cleanup. One environment pairing revision owns at most one composed desktop host and one reference-counted route per canonical execution-host key; pairing replacement and shutdown close control transport before pages and force-close routes even when guest cleanup remains ambiguous. Non-native descriptors require explicit capability negotiation and an exact runtime-minted lease-bound execution-host grant. Host selection never chooses arbitrarily, stale cleanup or settlement cannot remove a replacement, destination names remain unresolved until the execution host, credit returns only after writes settle, and route loss never falls back to desktop DNS or sockets. A main-owned local listener remains stable across upstream transport loss, rejects CONNECT while offline, accepts only a strictly newer tunnel generation, ignores superseded callbacks, and never reuses a stream ID within one generation. Pending opens, admitted open rate, nested control requests, per-route application bytes, aggregate browser-host/process bytes, claims, and socket sources remain bounded with exact release on settlement and retirement. Queued transport drain yields after a bounded quantum. The local SOCKS endpoint accepts only loopback CONNECT and rejects unsupported commands.",
- "oracle": "Test-value audit removes the retired suite and its active selectors/assertions. Retire the paired-host late subscription smoke: it checks a mocked close count and startup rejection, without remote unsubscribe or successor outcomes. Audit3381 intentionally removes the entire browser network tunnel protocol suite and active selectors/assertion. Static envelope/dispatch protocol alarms are lost without equivalent replacement. Remaining tunnel session and stream tests have narrower scopes. All three unrelated complete dated receipts are preserved verbatim with their original selectors; no fresh execution claimed. Module layout SSH policy: Retire the dynamic-forward launch argument/default inventory. The retained actual startup-cancellation entry case covers cancellation classification and termination/probe cleanup requests with supplied process/socket boundaries, not real SSH launch flags or live forwarding. Remove only the retired launch-flags assertion; unrelated dated receipts and their executed commands remain unchanged. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1991: Remove the ordinary browser-host release/sub-cap and exact socket-close counter aliases. Retain the two actual admitted-device fairness and shared ask/browser/wait budget callbacks, which call server handlers with fake WebSockets and controlled pending RPCs. Preserve all3 unrelated dated receipts. No real browser placement or remote tunnel deployment is proved by this admission suite. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked browser placement mutation and projection suites and both prospective selectors. Preserve3 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove stale production-registration and negotiated metadata aliases, compound refusal/cleanup aliases, isolated descriptor/route/memory/cleanup microcases. Retain exact negotiated command settlement, duplicate/conflict fencing, ready/replay ordering, superseded-connection cleanup, second-host refusal, ungranted target refusal, public connector redaction, revocation race and route replacement aliases within injected-port scope. Reconciliation and all3 unrelated dated receipts remain unchanged. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1918 narrows browser-host-command-ledger-capacity: intentionally loses injected per-page/global cache expiry-count ceilings and authority/command/result cloning inventory alarms. Retain valid commands/testFile and the oversized-wire pre-admission and delivery-failure outstanding-outcome assertions, backed by unchanged retained real-ledger callbacks with supplied browser delivery. These survivors are not equivalent replacement coverage for the deleted cache/cloning examples. Existing three exact unrelated tunnel/wire receipts retain their original scope; no fresh reduced-gate, real browser/provider, native/platform, soak or measured-budget result is added. Historical prior account (preserved verbatim): Audit1900 reduces ws-outbound-backpressure-queue by seven authored definitions while retaining ten. Current source19 assertions still describe distinct direct/queued aggregate admission, cooperative drain ordering and aggregate claim release. Existing commands, testFiles and all three source19 assertions remain valid and unchanged. The affected2026-11-04 Linux44tests/4files/5.58s receipt is retired whole as historical evidence. The other three unchanged-selector browser receipts retain their exact original scope. Reduced selectors have no fresh integrated, physical-device, mixed-host, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1687 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1686 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Attach two browser hosts and require unqualified selection to fail ambiguous while exact selection succeeds. Reject a second identity on one connection and a fifth identity for one paired device, release one exact lease, then admit its replacement without starving another device. Admit four hosts from one authenticated device and a host from a second, reject the first device's fifth host, and release only the first device's exact counters while the second remains live. Fill asks and hosts to their shared ceiling, retain a quarter of the total budget for ordinary waits, close both sockets, and prove every global, class, and device counter releases. Reject one initial host attach with the unchanged runtime_busy response, then require bounded client-specific jitter to attach when capacity returns; repeated rejection and explicit close must release every timer and subscription. Replace one same-device connection, require the old subscription and route to fence, then prove late old cleanup leaves the new generation live. Mint an exact execution-host grant, reject a different key, prove late old grant cleanup leaves its replacement, and invalidate every grant with lease replacement. Reject client-to-client, client-to-server, server-to-server, and server-to-client placement overwrite until exact retirement. Begin retirement once idempotently, reject client use and every replacement while pending, cancel the exact token to restore the same placement, and reject delayed cancellation or completion after a newer retirement begins. On explicit release, replacement, legacy disconnect, and reconnect-grace expiry, require only the exact host generation's client placements to become non-cancellable retirement-pending before lease settlement; preserve negotiated grace, other hosts, server placements, replacements, and capacity until exact completion. Complete only the exact pending token, retain capacity until completion, and require a reused client page ID to receive a higher global generation without retaining a tombstone. Require a client page through the exact runtime, epoch, host, and page tuple; reject every mismatch, released or replaced leases, retirement-pending pages, retired pages, server placements, invalid identities, and the 257th live placement. Admit 1024 opens in one monotonic 10-second window and reject the 1025th until the window expires. Fill 8 MiB across destination-to-client queues and separately across unsettled client-to-destination writes, release one exact retired stream, admit one replacement, and require the next byte claim to close the route without stale-callback or reentrant-close underflow. Across multiple routes, charge application copies, encrypted queue entries, and dynamic native socket bytes to one 32 MiB browser-host and 128 MiB process ceiling; reject zero-byte claim/socket-source floods, fence released leases, synchronously release JavaScript queue claims while retaining native claims through exact socket close, and yield a parked queue after four frames without reordering. Route nested responses by exact ID under reordering, reject unknown and duplicate IDs, cap pending requests and queued bytes, and tear down every concurrent waiter once on timeout or close. Drive one real paired attach, command, and result through one exact connection ID; reject missing send support and malformed or wrong-runtime acknowledgements while preserving old non-v1 attaches. Drop an authenticated transport, require the same listener to reject CONNECT before and during reconnect, attach the exact existing native v1 payload and capability pair to a strictly newer generation, ignore late old callbacks, and roll an exhausted stream-ID ledger only by replacing the generation. Require SSH descriptors to add an execution-host capability and exact grant, reject missing grants and stale provider authority before resolver or binary registration, pass exact domains to ssh2 and system-SSH SOCKS without local resolution, sanitize connector diagnostics, and close every stream and standalone route process once on timeout, synchronous failure, or rotation. Drive the accepted lease through real paired E2EE native SOCKS-to-HTTP and ephemeral Docker ssh2 remote-only DNS journeys, then exercise exact frame, credit, half-close, stale-stream, remote-DNS, unsupported-command, offline, and teardown assertions.",
+ "oracle": "Audit4014 removes the complete browser client page command integration suite and its active command token, test selector and assertion reference. Its synthetic guest lifecycle still exercised real executor/dispatcher/Session/WebContents registry composition: navigation normalization, generation reclaim, spontaneous destruction inventory revocation, and exactly-once route/policy retirement alarms are intentionally lost. Electron guest navigation, proxy resolution and renderer lifecycle were supplied test ports; no equivalent replacement or fresh execution is claimed. The three unrelated active dated receipts and all prior historical strings remain unchanged. Historical prior account (preserved verbatim): Test-value audit3842 retires four ws-outbound queue unit probes: direct empty-queue send failure, configured drain quantum/zero-delay reschedule, injected aggregate claim/release accounting, and supplied unwritable drain guard. Their exact alarms are intentionally lost; retained queue behaviors are not equivalent replacements. All source-file commands remain valid. No fresh execution or measured-budget evidence is claimed. Historical prior account (preserved verbatim): Test-value audit removes the retired suite and its active selectors/assertions. Retire the paired-host late subscription smoke: it checks a mocked close count and startup rejection, without remote unsubscribe or successor outcomes. Audit3381 intentionally removes the entire browser network tunnel protocol suite and active selectors/assertion. Static envelope/dispatch protocol alarms are lost without equivalent replacement. Remaining tunnel session and stream tests have narrower scopes. All three unrelated complete dated receipts are preserved verbatim with their original selectors; no fresh execution claimed. Module layout SSH policy: Retire the dynamic-forward launch argument/default inventory. The retained actual startup-cancellation entry case covers cancellation classification and termination/probe cleanup requests with supplied process/socket boundaries, not real SSH launch flags or live forwarding. Remove only the retired launch-flags assertion; unrelated dated receipts and their executed commands remain unchanged. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1991: Remove the ordinary browser-host release/sub-cap and exact socket-close counter aliases. Retain the two actual admitted-device fairness and shared ask/browser/wait budget callbacks, which call server handlers with fake WebSockets and controlled pending RPCs. Preserve all3 unrelated dated receipts. No real browser placement or remote tunnel deployment is proved by this admission suite. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked browser placement mutation and projection suites and both prospective selectors. Preserve3 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove stale production-registration and negotiated metadata aliases, compound refusal/cleanup aliases, isolated descriptor/route/memory/cleanup microcases. Retain exact negotiated command settlement, duplicate/conflict fencing, ready/replay ordering, superseded-connection cleanup, second-host refusal, ungranted target refusal, public connector redaction, revocation race and route replacement aliases within injected-port scope. Reconciliation and all3 unrelated dated receipts remain unchanged. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1918 narrows browser-host-command-ledger-capacity: intentionally loses injected per-page/global cache expiry-count ceilings and authority/command/result cloning inventory alarms. Retain valid commands/testFile and the oversized-wire pre-admission and delivery-failure outstanding-outcome assertions, backed by unchanged retained real-ledger callbacks with supplied browser delivery. These survivors are not equivalent replacement coverage for the deleted cache/cloning examples. Existing three exact unrelated tunnel/wire receipts retain their original scope; no fresh reduced-gate, real browser/provider, native/platform, soak or measured-budget result is added. Historical prior account (preserved verbatim): Audit1900 reduces ws-outbound-backpressure-queue by seven authored definitions while retaining ten. Current source19 assertions still describe distinct direct/queued aggregate admission, cooperative drain ordering and aggregate claim release. Existing commands, testFiles and all three source19 assertions remain valid and unchanged. The affected2026-11-04 Linux44tests/4files/5.58s receipt is retired whole as historical evidence. The other three unchanged-selector browser receipts retain their exact original scope. Reduced selectors have no fresh integrated, physical-device, mixed-host, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1687 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1686 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Attach two browser hosts and require unqualified selection to fail ambiguous while exact selection succeeds. Reject a second identity on one connection and a fifth identity for one paired device, release one exact lease, then admit its replacement without starving another device. Admit four hosts from one authenticated device and a host from a second, reject the first device's fifth host, and release only the first device's exact counters while the second remains live. Fill asks and hosts to their shared ceiling, retain a quarter of the total budget for ordinary waits, close both sockets, and prove every global, class, and device counter releases. Reject one initial host attach with the unchanged runtime_busy response, then require bounded client-specific jitter to attach when capacity returns; repeated rejection and explicit close must release every timer and subscription. Replace one same-device connection, require the old subscription and route to fence, then prove late old cleanup leaves the new generation live. Mint an exact execution-host grant, reject a different key, prove late old grant cleanup leaves its replacement, and invalidate every grant with lease replacement. Reject client-to-client, client-to-server, server-to-server, and server-to-client placement overwrite until exact retirement. Begin retirement once idempotently, reject client use and every replacement while pending, cancel the exact token to restore the same placement, and reject delayed cancellation or completion after a newer retirement begins. On explicit release, replacement, legacy disconnect, and reconnect-grace expiry, require only the exact host generation's client placements to become non-cancellable retirement-pending before lease settlement; preserve negotiated grace, other hosts, server placements, replacements, and capacity until exact completion. Complete only the exact pending token, retain capacity until completion, and require a reused client page ID to receive a higher global generation without retaining a tombstone. Require a client page through the exact runtime, epoch, host, and page tuple; reject every mismatch, released or replaced leases, retirement-pending pages, retired pages, server placements, invalid identities, and the 257th live placement. Admit 1024 opens in one monotonic 10-second window and reject the 1025th until the window expires. Fill 8 MiB across destination-to-client queues and separately across unsettled client-to-destination writes, release one exact retired stream, admit one replacement, and require the next byte claim to close the route without stale-callback or reentrant-close underflow. Across multiple routes, charge application copies, encrypted queue entries, and dynamic native socket bytes to one 32 MiB browser-host and 128 MiB process ceiling; reject zero-byte claim/socket-source floods, fence released leases, synchronously release JavaScript queue claims while retaining native claims through exact socket close, and yield a parked queue after four frames without reordering. Route nested responses by exact ID under reordering, reject unknown and duplicate IDs, cap pending requests and queued bytes, and tear down every concurrent waiter once on timeout or close. Drive one real paired attach, command, and result through one exact connection ID; reject missing send support and malformed or wrong-runtime acknowledgements while preserving old non-v1 attaches. Drop an authenticated transport, require the same listener to reject CONNECT before and during reconnect, attach the exact existing native v1 payload and capability pair to a strictly newer generation, ignore late old callbacks, and roll an exhausted stream-ID ledger only by replacing the generation. Require SSH descriptors to add an execution-host capability and exact grant, reject missing grants and stale provider authority before resolver or binary registration, pass exact domains to ssh2 and system-SSH SOCKS without local resolution, sanitize connector diagnostics, and close every stream and standalone route process once on timeout, synchronous failure, or rotation. Drive the accepted lease through real paired E2EE native SOCKS-to-HTTP and ephemeral Docker ssh2 remote-only DNS journeys, then exercise exact frame, credit, half-close, stale-stream, remote-DNS, unsupported-command, offline, and teardown assertions.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/runtime/browser/client-pages/runtime-browser-client-page-recovery.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/reconciliation/browser-host-page-retirement.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement-replacement.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/browser/browser-client-host-reconciliation.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-pages/lifecycle/browser-client-page-reconciliation-adapters.test.ts src/main/browser/routing/sessions/browser-route-prepared-page-rekey.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/remote-runtime-client.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/browser/network/execution-routes/browser-network-deferred-socket.test.ts src/main/browser/network/execution-routes/browser-network-execution-route.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/network/execution-routes/ssh-browser-network-execution-route.test.ts src/main/browser/network/tunnels/system-ssh-socks-client-socket.test.ts src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts src/main/ssh/system-transport/forwarding/system-ssh-forward-process.test.ts src/main/ssh/system-transport/system-ssh-operations.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts",
@@ -4851,7 +4834,6 @@
"src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts",
"src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts",
"src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts",
- "src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts",
"src/main/runtime/rpc/methods/browser/browser-client-host.test.ts",
"src/main/runtime/rpc/methods/browser/browser-client-host-reconciliation.test.ts",
"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts",
@@ -4859,7 +4841,6 @@
"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts",
"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts",
"src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts",
- "src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts",
"src/main/browser/client-pages/lifecycle/browser-client-page-reconciliation-adapters.test.ts",
"src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts",
"src/main/browser/routing/sessions/browser-route-prepared-page-rekey.test.ts",
@@ -4884,13 +4865,6 @@
"tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts"
],
"assertionRefs": [
- {
- "file": "src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts",
- "assertions": [
- "one paired device cannot consume the second device's reserved browser-host share",
- "asks and browser hosts share a ceiling that retains one quarter of total capacity for waits"
- ]
- },
{
"file": "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts",
"assertions": [
@@ -4922,12 +4896,6 @@
"stale, occupied, cross-page, and cross-renderer targets fail without mutation"
]
},
- {
- "file": "src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts",
- "assertions": [
- "spontaneous exact guest destruction revokes active inventory before explicit page retirement"
- ]
- },
{
"file": "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts",
"assertions": ["keeps a failed authority transition tombstoned until cleanup settles"]
@@ -5110,9 +5078,7 @@
{
"file": "src/shared/ws-outbound-backpressure-queue.test.ts",
"assertions": [
- "direct and already-retained queued frames use distinct aggregate admission semantics",
- "queued drain yields after its configured frame quantum without reordering",
- "aggregate queue claims release on drain, denial, disposal, and close"
+ "direct and already-retained queued frames use distinct aggregate admission semantics"
]
}
],
@@ -5171,6 +5137,7 @@
"Prove an Electron partition routes loopback, DNS, HTTP, HTTPS, WebSocket, workers, and speculative traffic without desktop fallback."
],
"knownGaps": [
+ "Audit4014 removes the complete browser client page command integration suite and its active command token, test selector and assertion reference. Its synthetic guest lifecycle still exercised real executor/dispatcher/Session/WebContents registry composition: navigation normalization, generation reclaim, spontaneous destruction inventory revocation, and exactly-once route/policy retirement alarms are intentionally lost. Electron guest navigation, proxy resolution and renderer lifecycle were supplied test ports; no equivalent replacement or fresh execution is claimed. The three unrelated active dated receipts and all prior historical strings remain unchanged. Historical prior account (preserved verbatim):",
"Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/ssh/system-transport/system-ssh-forward-process.test.ts: spawns exactly the argv the orphan matcher is given, LogLevel=INFO included; runs port forwards unmultiplexed even when ssh_config disables muxing; preserves manual target port and identity options in the forwarded ssh command; does not spawn ssh when the requested local forward port is already in use; spawns ssh after the requested local forward port preflight succeeds; resolves startup after the grace period when ssh keeps running; sends SIGTERM then SIGKILL when the process does not exit; does not resolve stop until the process exits. src/main/ssh/port-forwarding/ssh-port-forward.test.ts: reports the port the OS bound when an ssh2 forward asks for port 0; adds an ssh2 port forward and returns entry; adds a system SSH port forward when no ssh2 client is available; reports the port a system SSH forward resolved when asked for port 0; passes resolved OpenSSH config to system SSH port forwards; disposes a system SSH tunnel when removing the forward; lists forwards filtered by connectionId; removes a forward by id; awaits forward close when removing a forward for user actions; returns null when removing nonexistent forward; removes all forwards for a connection; dispose removes all forwards; stores label in the entry; preserves the existing id when updating a forward succeeds. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/ssh/port-forwarding/ssh-port-forward.test.ts, src/main/ssh/system-transport/system-ssh-forward-process.test.ts. Unresolved local/computed edges remain explicit debt. Retired active assertionRefs (raw original objects retained as historical only): {\n \"file\": \"src/main/ssh/port-forwarding/ssh-port-forward.test.ts\",\n \"assertions\": [\n \"static system-SSH forwards receive the connection's complete resolved build options\"\n ]\n }",
"Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded.",
"Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
@@ -5226,7 +5193,8 @@
"Module layout SSH policy: Retire the dynamic-forward launch argument/default inventory. The retained actual startup-cancellation entry case covers cancellation classification and termination/probe cleanup requests with supplied process/socket boundaries, not real SSH launch flags or live forwarding. Remove only the retired launch-flags assertion; unrelated dated receipts and their executed commands remain unchanged.",
"Historical dynamic-forward assertion metadata before inventory retirement, preserved verbatim:\n{\n \"file\": \"src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts\",\n \"assertions\": [\n \"system SSH uses BatchMode=yes, disables ControlMaster, and positions one dynamic forward before the destination\",\n \"authority invalidation cancels an in-progress SSH launch and destroys its active readiness probe immediately\"\n ]\n }",
"Audit3381 intentionally removes the entire browser network tunnel protocol suite and active selectors/assertion. Static envelope/dispatch protocol alarms are lost without equivalent replacement. Remaining tunnel session and stream tests have narrower scopes. All three unrelated complete dated receipts are preserved verbatim with their original selectors; no fresh execution claimed.\nOriginal active selector fields, historical raw native JSON values:\ncommands: [\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/runtime/browser/client-pages/runtime-browser-client-page-recovery.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/reconciliation/browser-host-page-retirement.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement-replacement.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/browser/browser-client-host-reconciliation.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-pages/lifecycle/browser-client-page-reconciliation-adapters.test.ts src/main/browser/routing/sessions/browser-route-prepared-page-rekey.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser/network/tunnels/browser-network-tunnel-protocol.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/remote-runtime-client.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/browser/network/execution-routes/browser-network-deferred-socket.test.ts src/main/browser/network/execution-routes/browser-network-execution-route.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/network/execution-routes/ssh-browser-network-execution-route.test.ts src/main/browser/network/tunnels/system-ssh-socks-client-socket.test.ts src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts src/main/ssh/system-transport/forwarding/system-ssh-forward-process.test.ts src/main/ssh/system-transport/system-ssh-operations.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts\",\n \"ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts\",\n \"ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 node_modules/.bin/vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts\"\n ]\ntestFiles: [\n \"src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts\",\n \"src/main/runtime/browser/client-pages/runtime-browser-client-page-recovery.test.ts\",\n \"src/shared/browser/network/tunnels/browser-network-tunnel-protocol.test.ts\",\n \"src/main/runtime/browser-host/reconciliation/browser-host-page-retirement.test.ts\",\n \"src/main/runtime/browser-host/reconciliation/browser-host-page-placement-replacement.test.ts\",\n \"src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts\",\n \"src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts\",\n \"src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts\",\n \"src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts\",\n \"src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts\",\n \"src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n \"src/main/runtime/rpc/methods/browser/browser-client-host-reconciliation.test.ts\",\n \"src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts\",\n \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts\",\n \"src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts\",\n \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts\",\n \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts\",\n \"src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts\",\n \"src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts\",\n \"src/main/browser/client-pages/lifecycle/browser-client-page-reconciliation-adapters.test.ts\",\n \"src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts\",\n \"src/main/browser/routing/sessions/browser-route-prepared-page-rekey.test.ts\",\n \"src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n \"src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts\",\n \"src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts\",\n \"src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts\",\n \"src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts\",\n \"src/main/browser/network/execution-routes/browser-network-deferred-socket.test.ts\",\n \"src/main/browser/network/execution-routes/browser-network-execution-route.test.ts\",\n \"src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts\",\n \"src/main/browser/network/execution-routes/ssh-browser-network-execution-route.test.ts\",\n \"src/main/browser/network/tunnels/system-ssh-socks-client-socket.test.ts\",\n \"src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts\",\n \"src/main/ssh/port-forwarding/ssh-port-forward.test.ts\",\n \"src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n \"src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts\",\n \"src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts\",\n \"src/shared/remote-runtime/remote-runtime-client.test.ts\",\n \"src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts\",\n \"src/shared/ws-outbound-backpressure-queue.test.ts\",\n \"tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts\"\n ]\nassertionRefs: [\n {\n \"file\": \"src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts\",\n \"assertions\": [\n \"one paired device cannot consume the second device's reserved browser-host share\",\n \"asks and browser hosts share a ceiling that retains one quarter of total capacity for waits\"\n ]\n },\n {\n \"file\": \"src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts\",\n \"assertions\": [\"closes a subscription acquired after local teardown\"]\n },\n {\n \"file\": \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts\",\n \"assertions\": [\n \"an acknowledged mutation replay uses the preserved dispatcher result without rerunning its handler\"\n ]\n },\n {\n \"file\": \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts\",\n \"assertions\": [\n \"waits for old handlers and ignores their late callbacks before replacement\",\n \"keeps one command gate across repeated loss while fencing stale route recovery\",\n \"fails closed without racing page cleanup when handlers do not settle\"\n ]\n },\n {\n \"file\": \"src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts\",\n \"assertions\": [\"holds Session and route release for the exact destroyed acknowledgement\"]\n },\n {\n \"file\": \"src/main/browser/client-pages/lifecycle/browser-client-page-reconciliation-adapters.test.ts\",\n \"assertions\": [\n \"destroys a guest rekeyed during an authority transition instead of granting navigation\"\n ]\n },\n {\n \"file\": \"src/main/browser/routing/sessions/browser-route-prepared-page-rekey.test.ts\",\n \"assertions\": [\n \"prepared authority rekeys without changing its opaque capability token\",\n \"stale, occupied, cross-page, and cross-renderer targets fail without mutation\"\n ]\n },\n {\n \"file\": \"src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts\",\n \"assertions\": [\n \"spontaneous exact guest destruction revokes active inventory before explicit page retirement\"\n ]\n },\n {\n \"file\": \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts\",\n \"assertions\": [\"keeps a failed authority transition tombstoned until cleanup settles\"]\n },\n {\n \"file\": \"src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts\",\n \"assertions\": [\n \"retains one exact route until its final page releases it\",\n \"keeps an ambiguously closed route fenced until final registry cleanup\",\n \"retires old authority routes without destroying them before exact page cleanup\",\n \"aborts a stale route recovery without retaining its retry timer\",\n \"fails bounded recovery after one route exhausts grace without leaking timers\",\n \"mints a fresh route for a retain that lands while the previous one is closing\",\n \"waits for a route still closing before reporting retirement\",\n \"rejects a retain the moment its signal aborts mid-startup\",\n \"refuses a retain that waited out a closing route onto a retired registry\",\n \"reports a failed final cleanup to an awaiting retirement\"\n ]\n },\n {\n \"file\": \"src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n \"assertions\": [\n \"keeps a timed-out retirement fenced until its handler actually settles\",\n \"bounds close while canceling queued and non-cooperative handlers\"\n ]\n },\n {\n \"file\": \"src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts\",\n \"assertions\": [\n \"oversized wire payloads fail before page, sequence, or delivery admission\",\n \"new issue delivery failure closes the ledger and fences every outstanding outcome\"\n ]\n },\n {\n \"file\": \"src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n \"assertions\": [\n \"negotiated exact reattach emits ready before replaying the unchanged unsettled command\",\n \"reattach before old cleanup preserves the same authority and ends only the superseded connection stream\",\n \"only the exact negotiated connection, paired device, and live page placement can settle a server-owned command\",\n \"exact duplicate results are idempotent while conflicts and stale or retired placement fail closed\",\n \"a second browser-host identity on one authenticated connection is rejected\"\n ]\n },\n {\n \"file\": \"src/main/runtime/rpc/methods/browser/browser-client-host-reconciliation.test.ts\",\n \"assertions\": [\n \"command result settlement requires the exact negotiated reconciliation authority\"\n ]\n },\n {\n \"file\": \"src/shared/browser/network/tunnels/browser-network-tunnel-protocol.test.ts\",\n \"assertions\": [\n \"remote DNS names round-trip without client resolution\",\n \"unknown versions, opcodes, oversized payloads, and length mismatches fail closed\"\n ]\n },\n {\n \"file\": \"src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts\",\n \"assertions\": [\n \"replenishes client credit only after the destination write settles\",\n \"keeps concurrent streams alive when late data arrives for a retired stream\",\n \"flushes credited destination bytes before close\",\n \"caps aggregate retained destination bytes and releases exact stream accounting\",\n \"caps unsettled destination writes and releases retirement exactly once\",\n \"releases queued bytes once when an accepted send closes reentrantly\"\n ]\n },\n {\n \"file\": \"src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts\",\n \"assertions\": [\n \"multiple execution-host routes share browser-host application-byte admission in both traffic directions\",\n \"route close releases aggregate claims exactly before stale destination-write callbacks\"\n ]\n },\n {\n \"file\": \"src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts\",\n \"assertions\": [\n \"preserves remote DNS and waits for an opened acknowledgement\",\n \"sends only credited bytes in bounded frames and replenishes consumed input\",\n \"ignores a retired stream frame but rejects a never-allocated stream ID\",\n \"never reuses stream IDs within one generation after its bounded ledger exhausts\",\n \"replenishes only bytes settled after the readable consumer takes them\",\n \"fails closed when pending tiny destination frames exceed the chunk cap\",\n \"drains data that precedes a remote close before retiring the socket\"\n ]\n },\n {\n \"file\": \"src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts\",\n \"assertions\": [\n \"application, encrypted-queue, and native socket bytes share one host ceiling\",\n \"distinct hosts share one process ceiling with exact release\",\n \"zero-byte claims, socket sources, hosts, and leases have independent bounds\",\n \"released leases cannot admit work and retained owners keep exact accounting alive\",\n \"unavailable native-buffer evidence fails closed until its exact source releases\"\n ]\n },\n {\n \"file\": \"src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n \"assertions\": [\n \"domain CONNECT preserves the final execution-host DNS target\",\n \"unsupported commands and unavailable routes open no fallback destination\"\n ]\n },\n {\n \"file\": \"src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts\",\n \"assertions\": [\n \"ungranted or wrong-key SSH routes are rejected before resolver or binary registration\",\n \"connector diagnostics are mapped to a stable public error without local path disclosure\",\n \"grant revocation aborts connector startup immediately and cannot race through route admission\",\n \"the server allocates route generations and fences the replaced route\"\n ]\n },\n {\n \"file\": \"src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts\",\n \"assertions\": [\n \"closes a subscription that resolves after route teardown\",\n \"settles startup when close follows subscription acquisition before readiness\",\n \"bounds the post-auth readiness wait\",\n \"binds and releases the exact browser-host outbound memory lease\",\n \"keeps one listener fail-closed and accepts an increasing replacement generation\",\n \"ignores late callbacks from a superseded transport\",\n \"recovers again after a second transport death\",\n \"rejects a non-increasing replacement generation and remains retryable\",\n \"fences a ready generation even when the replacement closes before its await resumes\",\n \"replaces the tunnel generation before recycling a bounded stream ID\"\n ]\n },\n {\n \"file\": \"src/main/browser/network/execution-routes/browser-network-deferred-socket.test.ts\",\n \"assertions\": [\n \"destroy before source attachment emits one close and destroys a late source\",\n \"source close after destroy cannot emit duplicate wrapper close\"\n ]\n },\n {\n \"file\": \"src/main/browser/network/execution-routes/browser-network-execution-route.test.ts\",\n \"assertions\": [\n \"execution-host route keys cannot collide on delimiter-containing identities\",\n \"native routing accepts only the exact runtime revision without retaining an invalidation callback\"\n ]\n },\n {\n \"file\": \"src/main/browser/network/execution-routes/ssh-browser-network-execution-route.test.ts\",\n \"assertions\": [\n \"does not adopt a replacement ssh2 client under the captured authority\",\n \"releases a deferred socket when forwardOut throws during disconnect\",\n \"aborts system SSH startup when route authorization is revoked\",\n \"reaches external sites over ssh2 through the host proxy and keeps local names direct\",\n \"dials directly while the host environment is unreadable and adopts it once a retry reads it\",\n \"reaches external sites over system SSH through the host proxy\"\n ]\n },\n {\n \"file\": \"src/main/browser/network/tunnels/system-ssh-socks-client-socket.test.ts\",\n \"assertions\": [\n \"the internal SOCKS5 client encodes the exact destination as a domain request\"\n ]\n },\n {\n \"file\": \"src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts\",\n \"assertions\": [\n \"authority invalidation cancels an in-progress SSH launch and destroys its active readiness probe immediately\"\n ]\n },\n {\n \"file\": \"tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts\",\n \"assertions\": [\n \"an ephemeral sshd resolves a container-only domain and returns a unique HTTP marker\",\n \"the real ssh2 forwardOut receives that exact domain and provider loss fences the route\",\n \"one non-interactive system-OpenSSH dynamic forward passes the same remote-only oracle and closes cleanly\"\n ]\n },\n {\n \"file\": \"src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts\",\n \"assertions\": [\n \"nested JSON responses route by exact request ID under reverse-order delivery\"\n ]\n },\n {\n \"file\": \"src/shared/remote-runtime/remote-runtime-client.test.ts\",\n \"assertions\": [\n \"the authenticated socket binds the optional tunnel capability\",\n \"the dedicated outbound queue reports hard overflow instead of dropping a frame\",\n \"encrypted queue claims release synchronously while native socket ownership remains charged through exact close\"\n ]\n },\n {\n \"file\": \"src/shared/ws-outbound-backpressure-queue.test.ts\",\n \"assertions\": [\n \"direct and already-retained queued frames use distinct aggregate admission semantics\",\n \"queued drain yields after its configured frame quantum without reordering\",\n \"aggregate queue claims release on drain, denial, disposal, and close\"\n ]\n }\n ]",
- "Test-value audit: Retire the paired-host late subscription smoke: it checks a mocked close count and startup rejection, without remote unsubscribe or successor outcomes. No equivalent replacement or fresh execution is claimed."
+ "Test-value audit: Retire the paired-host late subscription smoke: it checks a mocked close count and startup rejection, without remote unsubscribe or successor outcomes. No equivalent replacement or fresh execution is claimed.",
+ "Test-value audit3842 removes four authored/four finite outbound queue probes and the count80 row from each of three inbound queue declarations (zero extra authored removals, three extra finite removals). Direct fast-path failure, synthetic work quantum, injected aggregate callback accounting, supplied unwritable guard, and repeated eighty-payload alarms are accepted losses without equivalent replacement claims. Remaining inbound count8 cases retain actual WeakRef/GC and FIFO/rejection observations. All three unrelated dated gate receipts retain their original command/results/counts and are not fresh validation of changed sources."
],
"demotionRule": "Keep experimental or demote if a self-asserted or ambiguous host can receive a route, an SSH descriptor bypasses capability, lease-bound grant, or provider-authority checks, late cleanup can remove a replacement, a route can resolve names on the desktop, exceed a byte or stream bound, replenish credit before destination settlement, accept a stale or non-increasing generation, reuse a stream ID within one generation, lose or bypass its fail-closed listener during reconnect, expose the SOCKS listener off-loopback, accept BIND/UDP, or fall back when the selected route is unavailable."
},
@@ -5809,12 +5777,12 @@
"providers": ["local", "daemon", "ssh", "remote-runtime", "wsl"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon", "remote-runtime"],
- "coverageNotes": "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial mobile-presence suite retains only five authored callbacks: admitted preview-paste completion across phone takeover, desktop take-back superseding mobile input, desktop viewport write/restore geometry, and held-fit reclaim convergence. Other supplied floor/rollback/selection/viewport/grace/disconnect/reconnect/orphan-state alarms are lost. No per-source assertion object exists to reassign. The one affected dated mobile-view-authority receipt is retired whole into historical notes with its full original/currentCommand/raw data preserved; it is not active corroboration for reduced candidate bytes. Imported mobile-subscribe registrations and retained callbacks remain bounded to their actual source obligations, without equivalent replacement or physical-phone/native-PTY claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1320 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic host/parser, process-classifier, snapshot-publication, mixed-version, renderer, and macOS Electron coverage proves the local and shared paired-runtime contracts. Direct SSH intentionally publishes no shell proof and immediately preserves incumbent behavior. WSL, Windows ConPTY, Linux desktop, and paired headed/headless journeys remain gaps. The audit removed the isolated terminal-multiplex pending-escape-tail forwarding test. Its direct RPC snapshot field-copy alarm is lost; retained parser, snapshot and lifecycle suites do not establish equivalent RPC field coverage. Audit1320: src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-escape-tail.test.ts removed. Snapshot pending escape/alternate-screen/shell metadata forwarding and negative app-store-read alarm disappears. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/daemon/terminal-host-concurrent-create.test.ts reduced. Loses race deduplication, attach during unsettled ownership proof, retry after failed spawn, distinct-session parallelism, disposal waiting and shutdown retry-fencing alarms bundled with removed internal-call counts or real-time waits. No replacement-equivalence claim. src/main/daemon/terminal-checkpoint-serializer.test.ts reduced. Loses bounded native conversion/no-whole-candidate materialization and snapshot getter single-read alarms. Retained byte-size outcomes do not establish CPU/allocation bounds. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
+ "coverageNotes": "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed. Audit3984 retires all nine mobile-presence and imported subscribe callbacks plus their orphan store fixture. Accepted losses include desktop/phone restore geometry, echo filtering, held reconnect/reclaim notifications, and the real headless snapshot sequence race. No equivalent replacement or fresh gate execution is claimed. Audit 3959 retires the whole session.test.ts driver (27 authored / 33 finite cases): startup/echo filtering, readiness input gates, ownership confirmation, detach authority, and termination retry/exit ordering alarms are intentionally lost. No equivalent replacement or fresh runtime validation is claimed. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial mobile-presence suite retains only five authored callbacks: admitted preview-paste completion across phone takeover, desktop take-back superseding mobile input, desktop viewport write/restore geometry, and held-fit reclaim convergence. Other supplied floor/rollback/selection/viewport/grace/disconnect/reconnect/orphan-state alarms are lost. No per-source assertion object exists to reassign. The one affected dated mobile-view-authority receipt is retired whole into historical notes with its full original/currentCommand/raw data preserved; it is not active corroboration for reduced candidate bytes. Imported mobile-subscribe registrations and retained callbacks remain bounded to their actual source obligations, without equivalent replacement or physical-phone/native-PTY claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1320 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic host/parser, process-classifier, snapshot-publication, mixed-version, renderer, and macOS Electron coverage proves the local and shared paired-runtime contracts. Direct SSH intentionally publishes no shell proof and immediately preserves incumbent behavior. WSL, Windows ConPTY, Linux desktop, and paired headed/headless journeys remain gaps. The audit removed the isolated terminal-multiplex pending-escape-tail forwarding test. Its direct RPC snapshot field-copy alarm is lost; retained parser, snapshot and lifecycle suites do not establish equivalent RPC field coverage. Audit1320: src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-escape-tail.test.ts removed. Snapshot pending escape/alternate-screen/shell metadata forwarding and negative app-store-read alarm disappears. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/daemon/terminal-host-concurrent-create.test.ts reduced. Loses race deduplication, attach during unsettled ownership proof, retry after failed spawn, distinct-session parallelism, disposal waiting and shutdown retry-fencing alarms bundled with removed internal-call counts or real-time waits. No replacement-equivalence claim. src/main/daemon/terminal-checkpoint-serializer.test.ts reduced. Loses bounded native conversion/no-whole-candidate materialization and snapshot getter single-read alarms. Retained byte-size outcomes do not establish CPU/allocation bounds. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
"motivatingLinks": ["https://github.com/stablyai/orca/pull/16379"],
"invariant": "After a TUI exits or is killed, reveal, reattach, snapshot replay, or renderer remount must not deliver terminal-owned mouse or alternate-screen protocol bytes to the surviving shell. Recovery is an ordered output barrier in the daemon session data path: an OSC 133;D completing while the alternate screen is still active pauses the stream at that exact byte boundary, a fresh execution-host process inspection proves shell ownership, and on proof a mode reset is injected as in-stream output so every consumer converges by parsing the same bytes and the queued post-boundary shell output (the prompt) lands on the normal buffer. Snapshots are pure reads. Any failure — refuted proof, timeout, queue overflow, session death, disposal — flushes the queue unmodified, preserving incumbent behavior; later command or mode bytes revoke proof. Clean alternate-screen exits prove ownership asynchronously without pausing.",
- "oracle": "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial mobile-presence suite retains only five authored callbacks: admitted preview-paste completion across phone takeover, desktop take-back superseding mobile input, desktop viewport write/restore geometry, and held-fit reclaim convergence. Other supplied floor/rollback/selection/viewport/grace/disconnect/reconnect/orphan-state alarms are lost. No per-source assertion object exists to reassign. The one affected dated mobile-view-authority receipt is retired whole into historical notes with its full original/currentCommand/raw data preserved; it is not active corroboration for reduced candidate bytes. Imported mobile-subscribe registrations and retained callbacks remain bounded to their actual source obligations, without equivalent replacement or physical-phone/native-PTY claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Run one fixed child-TUI journey for normal exit and cleanup-free SIGKILL. Assert renderer and host normal-buffer/non-mouse state, host snapshot terminalOwner metadata, exact PTY writes with no post-exit mouse report, unrelated-pane survival, post-boundary prompt output preserved (normal exit), ordered proof invalidation, bounded settlement and bail-out flush, one inspection per unclean episode with zero scans for ordinary output, split-escape safety at every chunk boundary, and old/new client-host fallback parity.",
+ "oracle": "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed. Historical prior account (preserved verbatim): Audit3814 deliberately retires60 authored/60 finite cases:53runtime compatibility cases,4native XCTest methods and3Python clipboard methods, including the entire StableElementIndexes suite. Clipboard cuts retire the one-over-cap sample, incoming-offer destruction trace and sequential20-copy replay; actual wire, FD/pipe, startup and Xvfb/GTK boundaries remain without equivalent replacement claims. Accepted losses include narrow terminal-send payload/provider projections, legacy and direct no-op/error permutations, timing/work-count examples, private state/title/activity projections and fixture-driven readiness examples, individually enumerated below. These include real bounded production alarms consciously retired for marginal value; retained failed writes, duplicate submission, stale capture, transcript/ring and allocation fences are not equivalent replacements. No fresh native/remote/browser execution or complete transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3806 deliberately retires40 authored/40 finite runtime compatibility cases, including the terminal-side-effect-facts-part03 headless-snapshots-part02 and agent-status-and-waits-part03 fragments, plus20 scalar Swift precondition sites. Lost runtime alarms include status/title/attention projection examples, simple renderer/headless frame restoration and status waiting outcomes detailed in the accepted-loss ledger. Swift cuts retire duplicate generation-map/schema/navigation/bridge and notification-wrapper assertions; no standalone native program is deleted. These include real bounded production alarms consciously retired for marginal value. Retained races, pending writes/reflow, namespace and waiter ownership are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3798 deliberately retires21 authored/24 finite compatibility cases, including the entire SSH-worktree-lifecycle and repository-project-operations fragments. Accepted losses include navigation-only settings acknowledgement, browser session cleanup and host preservation projections, window positive/policy-state examples, terminal recovery/reload and no-incarnation remint examples, terminal listing compatibility/malformed IDs, directory browse/sort/Windows path smoke, SSH create refusal/manual lineage, recursive parent-folder creation and fork/origin/avatar/icon projections. Real bounded production alarms are consciously retired for marginal value; retained authority races, cleanup/clone ownership, pending waiters, nested-folder and scan invalidation cases are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial mobile-presence suite retains only five authored callbacks: admitted preview-paste completion across phone takeover, desktop take-back superseding mobile input, desktop viewport write/restore geometry, and held-fit reclaim convergence. Other supplied floor/rollback/selection/viewport/grace/disconnect/reconnect/orphan-state alarms are lost. No per-source assertion object exists to reassign. The one affected dated mobile-view-authority receipt is retired whole into historical notes with its full original/currentCommand/raw data preserved; it is not active corroboration for reduced candidate bytes. Imported mobile-subscribe registrations and retained callbacks remain bounded to their actual source obligations, without equivalent replacement or physical-phone/native-PTY claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Run one fixed child-TUI journey for normal exit and cleanup-free SIGKILL. Assert renderer and host normal-buffer/non-mouse state, host snapshot terminalOwner metadata, exact PTY writes with no post-exit mouse report, unrelated-pane survival, post-boundary prompt output preserved (normal exit), ordered proof invalidation, bounded settlement and bail-out flush, one inspection per unclean episode with zero scans for ordinary output, split-escape safety at every chunk boundary, and old/new client-host fallback parity.",
"commands": [
- "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts src/main/daemon/sessions/testing/session-shell-recovery.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host-concurrent-create.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/history/restoration/testing/daemon-restore-scrollback-depth.test.ts src/main/daemon/history/restoration/testing/terminal-checkpoint-serializer.test.ts src/main/providers/agent-foreground-process.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/terminal/layout/mobile-presence-lock.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts src/main/daemon/sessions/testing/session-shell-recovery.test.ts src/main/daemon/terminal-host/testing/terminal-host-concurrent-create.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/history/restoration/testing/daemon-restore-scrollback-depth.test.ts src/main/daemon/history/restoration/testing/terminal-checkpoint-serializer.test.ts src/main/providers/agent-foreground-process.test.ts src/main/runtime/construction/orca-runtime.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts --reporter=dot",
"pnpm exec electron-vite build --mode e2e",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
@@ -5822,14 +5790,12 @@
"testFiles": [
"src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts",
"src/main/daemon/sessions/testing/session-shell-recovery.test.ts",
- "src/main/daemon/sessions/testing/session.test.ts",
"src/main/daemon/terminal-host/testing/terminal-host-concurrent-create.test.ts",
"src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts",
"src/main/daemon/history/restoration/testing/daemon-restore-scrollback-depth.test.ts",
"src/main/daemon/history/restoration/testing/terminal-checkpoint-serializer.test.ts",
"src/main/providers/agent-foreground-process.test.ts",
"src/main/runtime/construction/orca-runtime.test.ts",
- "src/main/runtime/terminal/layout/mobile-presence-lock.test.ts",
"src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts",
"src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts",
"tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts",
@@ -5894,6 +5860,11 @@
"Keep missing-proof mixed-version behavior identical to the incumbent client path."
],
"knownGaps": [
+ "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed.",
+ "Audit3984 retires all nine mobile-presence and imported subscribe callbacks plus their orphan store fixture. Accepted losses include desktop/phone restore geometry, echo filtering, held reconnect/reclaim notifications, and the real headless snapshot sequence race. No equivalent replacement or fresh gate execution is claimed.",
+ "Audit3814 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle from a Codex ready prompt even when stale startup lines remain :: Stale MCP startup lines must not block a later Codex ready header.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle when a stale Codex prompt is followed by the ready header :: A Codex ready header following a stale resume prompt must satisfy tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for an idle Cursor lane past its dismissed trust dialog (#8210) :: Later Cursor idle banner overrides retained trust dialog.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not block a mid-run Cursor lane on its dismissed trust dialog (#8210) :: Dismissed trust dialog must not report blocked for later busy Cursor; wait times out.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not classify unrelated press-enter prompts as Codex blocked prompts :: Unidentified press-enter text must time out rather than be classified Codex blocked.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for quiet background PTY agents without OSC titles :: Quiet Codex background terminal without OSC title eventually resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: sends agent prompts as bracketed paste before submit :: Driving prompt escapes embedded paste-end ESC, writes one framed paste then CR, and counts bytes.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: settles a foreground Codex prompt when launch metadata has not arrived :: Codex inferred from foreground without launch metadata waits for composer marker/quiescence before one CR.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: gives a late Codex render marker a fresh quiescence window :: Marker arriving at7.9s re-arms fresh quiet window instead of submitting at initial cap.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: writes large agent prompt paste frames atomically before delayed submit :: A prompt larger than input chunk budget is a single paste write before delayed CR with exact byte count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects oversized terminal.send text before provider writes :: Oversized ordinary terminal.send rejects input-too-large before any provider write.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects focusing an exited background terminal session :: focusTerminal refuses terminal_exited before invoking background reveal.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: pastes the same bytes the desktop draft paste sent for the prompt :: Launch-ready prompt normalizes CR/LF and renders embedded ESC visibly identically to desktop bracketed paste.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: keeps a prompt into a running agent behind the render settle, as before :: Driving prompt remains held through7s repaint activity then submits once by9s.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reports a queued PTY focus as not navigated when its notifier disappears :: Queued PTY focus and completed active reveal report not navigated after notifier removal; no second reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: does not invoke a stale graph-leaf focus notifier after queued PTY work :: Queued graph-leaf focus must not invoke old notifier after preceding PTY reveal and notifier removal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: paginates retained terminal output with explicit limits and truncation metadata :: Preview120lines, fractional limits,50/200 pages, retained2000line truncation and future-cursor metadata stay consistent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: falls back to renderer visible screen when uncursored TUI tail is blank :: Substantial blank uncursored tail uses mounted renderer visible screen with zero scrollback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reads and shows the runtime-owned alternate-screen grid without serialization :: Actual runtime alternate-screen grid provides read/show content without renderer/provider serialization.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: classifies older provider alternate-screen snapshots from ANSI :: Older provider without alternateScreen metadata classifies ANSI alternate entry and returns Remote Vim screen.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: honors the last ANSI screen transition when older provider metadata is absent :: Last ANSI alternate exit overrides earlier entry when explicit provider mode metadata is absent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: rejects a full provider screen frame after live output advances :: Live output arriving during second full-screen capture causes screen-unavailable rather than stale full frame.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: shares one provider snapshot between concurrent read and show calls :: Concurrent read/show share one successful provider snapshot and both receive Shared TUI content.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps cursor reads provider-free on restored alternate-screen PTYs :: Restored alternate-screen cursor transcript reads never acquire provider snapshot.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: backs off after a provider snapshot failure instead of retrying for show :: Failed provider capture is cached/backed off so later show does not retry.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: falls back once to a mounted renderer when a known alternate provider fails :: A known-alternate failed provider capture falls back exactly once to newly mounted renderer.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: bounds provider visible frames for read and show responses :: Provider visible read/show use six bounded lines and300character preview.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps renderer-fallback composer drafts separate from terminal output :: Renderer fallback strips dim composer draft from terminal output and exposes draft separately.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: does not use renderer visible-screen fallback for a short blank shell tail :: Two blank shell lines must not trigger renderer screen fallback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: trims terminal tail character budget without per-line array shifts :: Tail builder trims to256KiB with correct retained suffix and no Array.shift calls.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains ANSI-only status redraws instead of appending every frame :: Repeated erase/redraw replaces preview until newline then publishes one completed cursor row.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains split multi-line ANSI footer redraw state across chunks :: CUU state across chunks retains corrected footer rows and publishes new cursor entries.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not let stale lower rows hide earlier corrected footer rows from cursor reads :: Earlier corrected footer row must not be hidden by stale lower rows in cursor reads.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: bounds completed transcript entries from a single multi-line redraw chunk :: Single redraw chunk bounds completed transcript to2000retained lines and correct oldest/next/latest cursors.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains multi-line ANSI redraws when the last footer row stays partial :: Partial final redrawn row appears in preview but cursor sees it only after newline.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not retain split ANSI controls as visible terminal preview text :: Split color/mode escapes never leak preview fragments; long split OSC title truncates at MAX_OSC_TITLE_CHARS.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains same-line redraw cursor position across split full-line erase chunks :: Full-line erase preserves column across chunks so XY follows three spaces rather than old ABC.\nsrc/main/runtime/orca-runtime-tests/conpty-stream-read.spec.ts :: fills the requested line count even when blank rows sit below the prompt :: Blank rows below a ConPTY prompt must not consume the requested nonempty-line count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: does not retain split ST-terminated string controls as preview text :: Split ST-terminated Kitty/string controls must remain excluded from preview text.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects split OSC titles before retaining terminal previews :: Split BEL OSC title must update working title/status without leaking into preview.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects ST-terminated OSC titles split before the final backslash :: ST OSC split before final backslash must update title without leaking framing.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: preserves a trailing escape after a completed OSC title :: Completed OSC followed by pending ESC must preserve the next idle-title transition.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: seeds newly synced leaves from PTY pending ANSI state :: A newly synced graph leaf inherits pending ANSI so a split color fragment cannot leak.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: bounds retained partial terminal output before preview reads :: Partial terminal state stays capped at 4000, preserves retained array identity, and preview truncation/cursor output remains correct.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: submits the mail pointer to Cursor Agent only after the paste-burst delay :: Cursor mailbox pointer Enter must wait through the paste-burst delay; this is a real input-timing alarm intentionally retired.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts :: adopts a v1.4.150-shaped agent, setup, and shell orphan as one topology transaction :: Stale incarnation refuses without topology change; three agent/setup/shell lanes adopt atomically with layout/group/revision and preserved read/input/resize; exact replay is idempotent and competing owner refuses.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: retires the exact worker when it exits after renderer reveal :: Exact worker exit after reveal retires that worker and its surface.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: re-reveals a recovered worker after the renderer graph epoch changes :: Changed renderer graph epoch invalidates reveal receipt and forces another reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: defers recovery when the renderer omits the exact reveal identity :: Missing exact reveal identity defers recovery after two attempts.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: reconciles a same-id process replacement before headless adoption :: A process replacement before headless adoption must fence off stale ownership.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retires provider resume only after authoritative inventory proves the legacy PTY exited :: Authoritative owning-host inventory overrides false local hasPty, avoids SSH scanning, retires exited provider resume/surface, adopts live workers without headless reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retries inventory and unknown liveness without revealing a ghost worker :: Inventory failure and unknown liveness must retry without ghost reveal, eventually adopt, and stop retrying.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: refuses a live reserved pane before issuing a handle or revealing it :: A requireFreshPane launch receiving a live reserved owner must reject before handle/reveal/kill, and release its claim. No equivalent replacement claimed.",
+ "Audit3806 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: skips a listener unsubscribed mid-fan-out even with mobile exclusions active :: A listener removed by an earlier listener during one fanout is not called, including with a side-effect-excluded mobile listener present.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: retains bytes emitted before a fresh daemon spawn resolves :: Bytes and title arriving before an initial zero/reset provider response survive in the serialized headless buffer with their counted sequence.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits command-finished facts with best-effort exit codes across chunk splits :: A split OSC133 D exit code becomes130 and a missing code becomes null in ordered command-finished facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits pr-link facts once per URL with batch attribution :: A split GitHub PR URL yields42 rather than4, emits42/43 once each, and carries PTY/worktree/tab attribution.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits 2031-subscribe facts across chunk splits :: Split ESC[?20 then31h emits exactly one2031-subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: restores a provisional 2031 subscribe when daemon scan authority returns :: Returning daemon scan authority with partial scan seed and pending2031 subscription restores exactly one subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers the tracked title over the renderer snapshot lastTitle :: A synthetic live Cursor title overrides stale renderer lastTitle while preserving renderer snapshot source.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers provider history over a partial headless mirror for requested snapshots :: Authoritative requested snapshots return supplied provider frame/history/seq rather than a partial headless mirror, requesting5000rows.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: tracks live alternate-screen transitions after a provider snapshot :: Provider alternateScreen true is accepted, then live1049l/1049h update isTerminalAlternateScreen false/true.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: translates reset provider snapshots without retaining the old title :: A reset provider snapshot translates new local seq into the runtime domain and replaces Old process title with New process.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits the chunk agentStatus events before its side-effect batch :: Agent status callback precedes side-effect batch callback for one coalesced OSC9999/title/bell chunk.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: still emits a throwing chunk’s facts under its own seq, not the next chunk’s :: A tracker throw still flushes first chunk title facts under its own seq, and second chunk does not inherit those facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: seeds the lazily created tracker from the daemon-snapshot title :: A lazy tracker hydrated from renderer snapshot title Codex working emits agent-idle on later Codex done.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits command-code-working facts only after the banner arms the scrape :: Unarmed Thinking text emits no facts; a Command Code0.27.3 banner then hardcoded colored spinner text emits attributed command-code-working with the submitted prompt.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits a command-code-done fact when the idle composer returns :: After hardcoded banner/working text, returned idle composer emits command-code-done with the earlier submitted prompt.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: resizes the headless mirror after an accepted desktop PTY resize :: An external accepted resize produces the resized dimensions and same status-frame lines as a separately driven reference emulator.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: replaces suffix-only headless state with the recovered renderer snapshot :: Replacing suffix-only state removes old suffix, retains renderer history plus later output/cwd, and returns the live47x40PTY grid.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: stamps SSH connection identity on runtime terminal status :: A synthetic mounted-leaf OSC9999 status after registerPty carries the supplied SSH connectionId.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: does not retain WSL context when a PTY id is reused :: After exit and same-ID new null distro context, OSC7 file://server/share/repo uses UNC server path rather than old Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: preserves immutable context while a live daemon attach is unresolved :: preparePtyExecutionContext with preserveExisting refuses a supplied Debian replacement and subsequent OSC7 keeps original Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts :: projects frame-independent live state through main buffer snapshots :: Main-buffer snapshot puts focus-report/cursor-visibility modes in frameRestoreAnsi, excludes STATIC-FRAME there and includes it in data.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts :: continues terminal agent status fanout when a callback throws :: Throwing on the first status callback does not prevent second payload delivery and logs contextual error.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: returns a title-only replay snapshot and never historical attention :: Lose replay:true/title-only fact projection despite earlierbell and unknownPTYnull. No actual delivered-history notification or reattach behavior was exercised. No equivalent replacement claimed.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects a handle rebind while a controller-less status check yields :: A handle rebound while the null-controller status continuation yields must throw terminal_handle_stale.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects confirmation evidence when the owning PTY exits :: A pending strong confirmation resolving after owning PTY exit must reject terminal_exited.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts :: keeps ordinary terminal send suffix failures on the existing not-writable contract :: Ordinary send writes text but refused CR must throw terminal_not_writable with beforeWrite twice and afterWrite once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell the execution host cannot apply instead of spawning its default :: Requested Windows shell on POSIX must refuse before spawning a default shell.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: quotes the agent startup command for the requested shell, not the host default :: Requested cmd shell must override PowerShell default quoting for agent startup command.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: keeps restored receipts outside a targeted worktree scan :: Targeted scan removes the moved-worktree receipt while preserving another worktree receipt.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: observes setup command completion without waiting for its interactive shell to exit :: Nonzero completion marker 17 resolves while interactive shell remains running.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: falls back to setup terminal exit when no completion signal is available :: Setup completion observer without token falls back to actual exit code 9.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: cancels setup completion observation when the caller aborts :: Abort rejects with the original reason and unsubscribes once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps observing after an uncertain setup terminal status :: Unknown exit waiter result must leave observation pending until completion marker arrives.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh omits a record :: Controller inventory omission disconnects the record but preserves its retained transcript.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh times out :: Hung inventory timeout leaves connected record and retained transcript intact.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle for adopted background PTY handles from the renderer title :: An adopted background handle resolves tui-idle from ready Codex renderer title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves live-leaf tui-idle from an OpenCode native title :: A live leaf resolves tui-idle from an OpenCode native title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from a Codex ready prompt preview :: A supplied Codex prompt preview resolves tui-idle without an actual agent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from an Antigravity prompt before the model line :: A supplied Antigravity prompt before model line resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell with no workspace instead of creating a default-shell tab :: Workspace-less explicit shell must reject before renderer default-tab request or spawn. This real guard/wiring alarm is deliberately retired.",
+ "Audit3798 per-case accepted losses:\nsrc/main/runtime/orca-runtime-tests/paired-settings.spec.ts :: awaits navigation-only updates from paired clients (%s) :: Updating only claudeSubagentNavigationEnabled waits for the actual controller call to the supplied pending Claude-view reconcile for both on/off values.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: drops a client page record even when its close command cannot be issued :: A removed workspace loses its runtime client-page record and headless browser projection despite close delivery_required rejection, and emits the asynchronous warning.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: leaves client-hosted pages alone when another host still owns the same worktree id :: Removing runtime:env-b metadata with local ownership leaves the local same-ID client page unchanged and issues no close command.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: marks live bindings again when reopening after a promoted window closes :: A reopened window marks its still-registered live worktree in activeWorktreeIdsOnShutdown after the first promoted window closes.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: preserves live SSH session identities when promoting a headless runtime :: Headless-to-desktop promotion records active worktree, SSH connection and remoteSessionIdsByTabId from the supplied surviving SSH PTY/session.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores a surviving renderer when its reload is cancelled :: A sole ready renderer reload cancelled under its current renderer fence returns true and becomes ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores headless authority when desktop promotion navigation is cancelled :: A cancelled desktop promotion with headless recovery returns false while headless authority remains ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: moves a desktop graph to unavailable when its reload times out :: A ready desktop graph without a headless fallback becomes unavailable at the reload deadline and retains its window/epoch.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: recovers a failed headless promotion and accepts a later renderer generation :: A promotion failure restores ready headless authority; a later valid same-window graph publishes ready desktop authority.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: clears a failed pane recovery so a later reconnect can retry :: After relay_reconnecting rejection, the pending recovery lock clears and the same pane/handle can call createTerminal a second time and return its supplied replacement.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: still preserves a CLI agent leaf when the reloaded renderer has not rebound its PTY :: An empty graph published during renderer reload preserves a preallocated live CLI PTY as one listable terminal before renderer rebind.\nsrc/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts :: keeps a no-incarnation handle across an in-graph pane remint :: Within one graph lifetime an unversioned PTY reminted onto another leaf retains its issued handle and resolves its old exit waiter after onPtyExit.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: matches explicit-id cwd PTYs when the resolved worktree cache is incomplete :: An explicit target absent from a fresh incomplete resolved cache adopts only its cwd PTY, rejects nested cwd PTY and does not rescan Git.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: ignores cwd-only controller PTYs for malformed explicit worktree IDs :: Malformed id:repo-1:: returns no terminals, does not adopt cwd-only controller PTY and avoids Git rescanning.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: refuses an SSH-backed create for mobile/runtime callers instead of creating locally :: Loss of this public unserved SSH create error-class/no-local-add/no-local-list alarm.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: records an app-selected parent workspace as a manual action :: Loss of the local runtime folder-parent manual origin, active-workspace source and explicit confidence projection alarm; no claim that SSH or cleanup coverage replaces it.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: browses runtime server directories before projects are added :: Loss of this public runtime alarm for browse availability before registration, directories-first lexical ordering and native path flavor.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: lists drive roots for a server-root browse :: Loss of the Windows public slash-root drive enumeration smoke and presence of the temporary directory drive.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations-part-02.spec.ts :: creates a missing runtime parent before creating the project directory :: Loss of this runtime createRepo recursive missing-parent/child existence and registered-path alarm.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: preserves selected project %s when a hosted parent is known :: Loss of both parent-selected and origin-selected normal fork-link projection/persisted upstream alarms plus exact single-probe count.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: links a current enterprise remote despite unavailable metadata and a retained %s :: Loss of normal current-enterprise-origin linking with stale automatic GitHub avatar or protected file image, unchanged icon assertion, and serialized project identity under unavailable metadata.",
"NEXT65 current scope qualification: The NEXT65 knownGaps entries below govern the changed selectors and qualify any broader coverage implication in this gate’s unchanged oracle/coverageNotes narratives. Those narratives and preserved dated evidenceRuns retain their historical text and original exact execution scopes only; no fresh execution, transferred pass or equivalent replacement coverage is claimed. Upstream case removals remain upstream; original NEXT65 proposal descriptions grant no duplicate retirement credit.",
"NEXT65 active selector scope reduction (including directory-selected whole-file retirements): src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts. Remove complete registrations or registrar files within the selected scope for src/renderer/src/components/terminal-pane/pty-connection/reattach/pty-connection-daemon-snapshot-replay.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode-2031-subscriptions.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/geometry/pty-connection-visibility-resume-size.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/reattach/pty-connection-stale-daemon-snapshot-replay.spec.ts. Intentionally lose these named regression alarms without replacement: catches a subscribed pane up once per mode change across repeated reconnects — Mode2031 theme reporting catch-up/deduplication across repeated reconnects loses this direct protocol example.; defers to the viewer holding the grid, then catches up once on release — Held-grid viewer deferral and one catch-up/current-mode resending on release lose this direct protocol example.; repairs grid drift with a trailing probe when output stops inside the settled interval — A trailing drift probe after the last output frame loses this direct alarm.; skips foreground grid drift repair while mobile owns the PTY without a fit override — Mobile driver ownership suppressing foreground drift repair without override loses this direct alarm.; reports desktop geometry without resizing while a mobile-fit override is active — Desktop geometry reporting without resizing a mobile-owned grid loses this direct alarm.; defers a remote-desktop viewport claim until structural replay completes — Remote-desktop viewport claim waiting for structural replay completion loses this direct alarm.; skips observed desktop reassertion while mobile owns the PTY without a fit override — Observed desktop reassertion suppression under mobile ownership loses this direct alarm.; queues re-asserted resizes while pane resize holds are active — Resize hold release flushing the latest reasserted grid loses this direct alarm.; reasserts a remote grid only when visible (%s) — Visible-only remote grid reassertion loses its visible and hidden examples.; claims a focused visible remote mirror once when its passive fit hold arrives — Focused visible passive mirror claiming once, with unfocused and late repeat suppression, loses this direct sequence alarm.; does NOT re-assert while a mobile-fit override parks the PTY at phone dims — Phone fit hold suppressing visibility-resume PTY reassertion loses this direct alarm.; does NOT forward when the pane is hidden again before getSize resolves (stale hop) — Late size lookup after re-hide refusing a hidden-tab SIGWINCH loses this direct adverse-ordering alarm.; clears the captured pen for a normal-buffer fallback reattach — Fallback normal-buffer reattach clearing captured pen and dirty background loses this direct example.; waits for a recovered destination fit before forwarding its grid or live output — Recovered destination fitting before forwarding grid or live output loses this direct example.; suppresses the deferred reattach grid push when mobile claims the PTY while hidden — Mobile takeover while hidden suppressing deferred reattach grid forwarding loses this direct example.; drops stale callbacks but delivers fresh replacement output after an old replay clear — Fresh replacement output winning over stale callbacks after old replay clear loses this direct example.. Surviving parent statements and sibling registrations are preserved, but these reduced parent selectors have no fresh execution or transferred historical pass. Unrelated complete dated receipts retain only their original exact scopes; no equivalent replacement, rendered UI, provider, mobile, or cross-platform coverage is claimed.",
"NEXT65 historical original active parent-selector fields (verbatim native JSON values; not current coverage):\ncommands: [\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts src/main/daemon/sessions/testing/session-shell-recovery.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host-concurrent-create.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/history/restoration/testing/daemon-restore-scrollback-depth.test.ts src/main/daemon/history/restoration/testing/terminal-checkpoint-serializer.test.ts src/main/providers/agent-foreground-process.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/terminal/layout/mobile-presence-lock.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts --reporter=dot\",\n \"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts --reporter=dot\",\n \"pnpm exec electron-vite build --mode e2e\",\n \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"\n ]\ntestFiles: [\n \"src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts\",\n \"src/main/daemon/sessions/testing/session-shell-recovery.test.ts\",\n \"src/main/daemon/sessions/testing/session.test.ts\",\n \"src/main/daemon/terminal-host/testing/terminal-host-concurrent-create.test.ts\",\n \"src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\n \"src/main/daemon/history/restoration/testing/daemon-restore-scrollback-depth.test.ts\",\n \"src/main/daemon/history/restoration/testing/terminal-checkpoint-serializer.test.ts\",\n \"src/main/providers/agent-foreground-process.test.ts\",\n \"src/main/runtime/construction/orca-runtime.test.ts\",\n \"src/main/runtime/terminal/layout/mobile-presence-lock.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n \"src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts\",\n \"src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts\",\n \"tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts\",\n \"tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts\"\n ]\nassertionRefs: [\n {\n \"file\": \"src/main/daemon/sessions/testing/session-shell-recovery.test.ts\",\n \"assertions\": [\n \"post-kill shell output survives into the normalized snapshot instead of the discarded alt buffer\",\n \"a snapshot taken during a split escape keeps the pending tail intact and stale proof is revoked by the completing bytes\"\n ]\n },\n {\n \"file\": \"src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts\",\n \"assertions\": [\n \"the pending tail this gate threads over the wire folds identically at every code-unit split of the combined stream, including boundaries landing inside oscEsc/stringEsc\",\n \"the split sweep runs over an alphabet carrying CAN, SUB, doubled ESC inside OSC/DCS/SOS/PM/APC, BEL, C1 ST, NUL, DEL, intermediates, CJK, astral, and lone surrogates\"\n ]\n },\n {\n \"file\": \"tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts\",\n \"assertions\": [\n \"normal exit and cleanup-free SIGKILL both restore a visible clean shell marker\",\n \"renderer logical buffer is normal and mouse tracking is disabled after host-proven recovery\",\n \"real pointer input writes no SGR mouse report to the surviving shell\",\n \"an unrelated pane remains live\"\n ]\n }\n ]",
@@ -5938,7 +5909,8 @@
"Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
"Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
"Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts src/main/daemon/sessions/testing/session-shell-recovery.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host-concurrent-create.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/history/restoration/testing/daemon-restore-scrollback-depth.test.ts src/main/daemon/history/restoration/testing/terminal-checkpoint-serializer.test.ts src/main/providers/agent-foreground-process.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/terminal/layout/mobile-presence-lock.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts --reporter=dot\",\n \"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts --reporter=dot\",\n \"pnpm exec electron-vite build --mode e2e\",\n \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"\n ]\ntestFiles: [\n \"src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts\",\n \"src/main/daemon/sessions/testing/session-shell-recovery.test.ts\",\n \"src/main/daemon/sessions/testing/session.test.ts\",\n \"src/main/daemon/terminal-host/testing/terminal-host-concurrent-create.test.ts\",\n \"src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\n \"src/main/daemon/history/restoration/testing/daemon-restore-scrollback-depth.test.ts\",\n \"src/main/daemon/history/restoration/testing/terminal-checkpoint-serializer.test.ts\",\n \"src/main/providers/agent-foreground-process.test.ts\",\n \"src/main/runtime/construction/orca-runtime.test.ts\",\n \"src/main/runtime/terminal/layout/mobile-presence-lock.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n \"src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts\",\n \"src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts\",\n \"tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts\",\n \"tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts\"\n ]\nassertionRefs: [\n {\n \"file\": \"src/main/daemon/sessions/testing/session-shell-recovery.test.ts\",\n \"assertions\": [\n \"post-kill shell output survives into the normalized snapshot instead of the discarded alt buffer\",\n \"a snapshot taken during a split escape keeps the pending tail intact and stale proof is revoked by the completing bytes\"\n ]\n },\n {\n \"file\": \"src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts\",\n \"assertions\": [\n \"the pending tail this gate threads over the wire folds identically at every code-unit split of the combined stream, including boundaries landing inside oscEsc/stringEsc\",\n \"the split sweep runs over an alphabet carrying CAN, SUB, doubled ESC inside OSC/DCS/SOS/PM/APC, BEL, C1 ST, NUL, DEL, intermediates, CJK, astral, and lone surrogates\"\n ]\n },\n {\n \"file\": \"tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts\",\n \"assertions\": [\n \"normal exit and cleanup-free SIGKILL both restore a visible clean shell marker\",\n \"renderer logical buffer is normal and mouse tracking is disabled after host-proven recovery\",\n \"real pointer input writes no SGR mouse report to the surviving shell\",\n \"an unrelated pane remains live\"\n ]\n }\n ]",
- "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged."
+ "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
+ "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed."
],
"demotionRule": "Keep experimental or demote if missing ownership proof changes incumbent behavior, a live TUI loses mouse/focus modes, foreground inspection enters ordinary output/reveal paths, or the focused Electron journey flakes without an identified product or harness fault."
},
@@ -5960,35 +5932,32 @@
"providers": ["local", "local-daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local-daemon"],
- "coverageNotes": "Audit1925 (sources1922/1923): Partial ownership suite loses fixed first-leaf/rootless/dangling-selection/idempotence/identity examples. Both existing active assertion aliases stay backed by exact retained active-leaf metadata pruning and idempotence across PTY/focus permutation callbacks; metadata collision and repeated-leaf challenges survive. No deleted fixed example is assigned replacement coverage. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Component unit tests cover persisted replay, rootless layouts, repeated leaf ids, metadata repair, and 12,000 nested duplicate leaves; retained store tests cover live/future pane-authority transfer and a prior detach destination. A two-launch macOS Electron journey covers a real surviving local-daemon PTY, persisted duplicate ownership, synchronized streaming output, and tab hide/reveal. Live Linux, Windows, SSH, WSL, and remote-runtime restore journeys remain gaps. The audit removed a mocked duplicate-replay wrapper suite. Its callback-count alarms are no longer covered here; retained ownership tests and historical Electron evidence do not establish equivalent wrapper coverage. The broad mirror fixture no longer supplies the duplicate-remote-PTY assertion referenced here. The terminal-mirroring fixture also lost its separate duplicate-PTY example and now retains host-finalized pending-binding composition only. Duplicate-PTY and topology fixture alarms are lost; remaining gate evidence is not replacement coverage. The test-value audit removed store duplicate/layout-only, hydration, legacy-leaf, and cross-tab layout-state examples. Their direct normalization, hydration authority, legacy compatibility, and cross-tab preservation alarms are lost. The retained store cases exercise live/future authority transfer and a prior detach destination; component and historical Electron evidence do not establish equivalent replacement coverage.",
+ "coverageNotes": "Current adopted test policy at native 6f2e: retire the sampled PTY/focus permutation callback and its assertion reference. This loses its ownership-uniqueness, rooted-focus, immutability and idempotence alarms over those combinations. Eleven direct component callbacks and the depth/store/E2E file selectors remain; no equivalent replacement or fresh execution is claimed. Previous metadata account (preserved verbatim): Audit1925 (sources1922/1923): Partial ownership suite loses fixed first-leaf/rootless/dangling-selection/idempotence/identity examples. Both existing active assertion aliases stay backed by exact retained active-leaf metadata pruning and idempotence across PTY/focus permutation callbacks; metadata collision and repeated-leaf challenges survive. No deleted fixed example is assigned replacement coverage. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Component unit tests cover persisted replay, rootless layouts, repeated leaf ids, metadata repair, and 12,000 nested duplicate leaves; retained store tests cover live/future pane-authority transfer and a prior detach destination. A two-launch macOS Electron journey covers a real surviving local-daemon PTY, persisted duplicate ownership, synchronized streaming output, and tab hide/reveal. Live Linux, Windows, SSH, WSL, and remote-runtime restore journeys remain gaps. The audit removed a mocked duplicate-replay wrapper suite. Its callback-count alarms are no longer covered here; retained ownership tests and historical Electron evidence do not establish equivalent wrapper coverage. The broad mirror fixture no longer supplies the duplicate-remote-PTY assertion referenced here. The terminal-mirroring fixture also lost its separate duplicate-PTY example and now retains host-finalized pending-binding composition only. Duplicate-PTY and topology fixture alarms are lost; remaining gate evidence is not replacement coverage. The test-value audit removed store duplicate/layout-only, hydration, legacy-leaf, and cross-tab layout-state examples. Their direct normalization, hydration authority, legacy compatibility, and cross-tab preservation alarms are lost. The retained store cases exercise live/future authority transfer and a prior detach destination; component and historical Electron evidence do not establish equivalent replacement coverage.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/11757",
"https://github.com/stablyai/orca/pull/11726"
],
"invariant": "Within one terminal tab, each PTY has at most one layout leaf, pane manager surface, and xterm renderer owner. Restore and remote mirroring must normalize duplicate ownership before replay while retaining active-leaf focus, scrollback, pane authority, agent metadata, and distinct sibling PTYs.",
- "oracle": "Audit1925 (sources1922/1923): Partial ownership suite loses fixed first-leaf/rootless/dangling-selection/idempotence/identity examples. Both existing active assertion aliases stay backed by exact retained active-leaf metadata pruning and idempotence across PTY/focus permutation callbacks; metadata collision and repeated-leaf challenges survive. No deleted fixed example is assigned replacement coverage. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Launch Orca with a real daemon PTY running a synchronized full-screen stream, close the desktop client without killing the daemon process, seed the persisted tab layout with two leaves bound to that PTY, and relaunch. Hide the restored tab behind a sibling and reveal it, then require the stream to remain visible with exactly one manager pane, one xterm DOM node, one root leaf, one PTY binding, and one unique PTY. Component contracts cover persisted replay, rootless and repeated-leaf layouts, metadata repair, and deeply nested input. Retained store contracts cover live/future authority transfer onto a retained leaf and preservation of a prior detach destination.",
+ "oracle": "Current adopted test policy at native 6f2e: retire the sampled PTY/focus permutation callback and its assertion reference. This loses its ownership-uniqueness, rooted-focus, immutability and idempotence alarms over those combinations. Eleven direct component callbacks and the depth/store/E2E file selectors remain; no equivalent replacement or fresh execution is claimed. Previous metadata account (preserved verbatim): Audit1925 (sources1922/1923): Partial ownership suite loses fixed first-leaf/rootless/dangling-selection/idempotence/identity examples. Both existing active assertion aliases stay backed by exact retained active-leaf metadata pruning and idempotence across PTY/focus permutation callbacks; metadata collision and repeated-leaf challenges survive. No deleted fixed example is assigned replacement coverage. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Launch Orca with a real daemon PTY running a synchronized full-screen stream, close the desktop client without killing the daemon process, seed the persisted tab layout with two leaves bound to that PTY, and relaunch. Hide the restored tab behind a sibling and reveal it, then require the stream to remain visible with exactly one manager pane, one xterm DOM node, one root leaf, one PTY binding, and one unique PTY. Component contracts cover persisted replay, rootless and repeated-leaf layouts, metadata repair, and deeply nested input. Retained store contracts cover live/future authority transfer onto a retained leaf and preservation of a prior detach destination.",
"commands": [
- "pnpm exec vitest run --config config/vitest.config.ts src/shared/workspace-layout/terminal-layout-pty-ownership-depth.test.ts src/renderer/src/components/terminal-pane/layout/terminal-layout-pty-ownership.test.ts src/renderer/src/store/terminals/terminal-layout-pty-ownership.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/shared/workspace-layout/terminal-topology/terminal-layout-pty-ownership-depth.test.ts src/renderer/src/components/terminal-pane/layout/terminal-layout-pty-ownership.test.ts src/renderer/src/store/terminals/terminal-layout-pty-ownership.test.ts --reporter=dot",
"pnpm exec electron-vite build --mode e2e",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
- "src/shared/workspace-layout/terminal-layout-pty-ownership-depth.test.ts",
+ "src/shared/workspace-layout/terminal-topology/terminal-layout-pty-ownership-depth.test.ts",
"src/renderer/src/components/terminal-pane/layout/terminal-layout-pty-ownership.test.ts",
"src/renderer/src/store/terminals/terminal-layout-pty-ownership.test.ts",
"tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts"
],
"assertionRefs": [
{
- "file": "src/shared/workspace-layout/terminal-layout-pty-ownership-depth.test.ts",
+ "file": "src/shared/workspace-layout/terminal-topology/terminal-layout-pty-ownership-depth.test.ts",
"assertions": ["prunes deeply nested duplicate ownership without recursive stack growth"]
},
{
"file": "src/renderer/src/components/terminal-pane/layout/terminal-layout-pty-ownership.test.ts",
- "assertions": [
- "keeps the active leaf and prunes the stale surface plus its metadata",
- "is idempotent and preserves one owner across PTY and focus permutations"
- ]
+ "assertions": ["keeps the active leaf and prunes the stale surface plus its metadata"]
},
{
"file": "src/renderer/src/store/terminals/terminal-layout-pty-ownership.test.ts",
@@ -6196,7 +6165,7 @@
"providers": ["local", "daemon", "ssh", "runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon", "ssh", "runtime"],
- "coverageNotes": "Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3323 (reconciled source audit3320) intentionally retires seven low-value renderer authority/retirement examples: retires one pane, clears resume authority, and rejects late status without harming siblings — Late status reviving a retired pane, sibling damage, or resume authority left behind.; can retire live pane authority while retaining its sleeping session — Retiring live authority accidentally dropping a retained sleeping session.; keeps a physical pane routed through chained detaches until its current owner closes — Chained detach alias routing broken after original owner closes, or alias survives final close.; forgets routing aliases for purged tabs — Purged-tab routing aliases lingering.; retires split, relay, deferred, and pending sessions for a parked tab — Split, relay, deferred or pending session omitted from teardown, sleeping-record sibling damaged, parked disposer skipped.; retires parked ownership before teardown and sweeps published state before unified close — Parked cleanup/provider teardown/state removal/sweep/unified-close ordering changes.; starts mixed provider teardown and classifies both rejection kinds after synchronous retirement — Mixed teardown failures blocking retirement, or local/runtime warning counts misclassified.. Remove the exact-pane-retirement and chained-detach assertion references because their source cases are gone. Other retained cases do not replace these alarms. Preserve all dated evidenceRuns and prior history with their original source scope; no fresh execution or historical import-closure equivalence is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1904 reduces persistence-pty-binding-reconciliation from six to four definitions, intentionally losing legacy remap-load and first-binding projection alarms. Current selector/testFile remains valid, with no selected-source assertionRef or active matching receipt. The six unchanged close/continuity receipts keep their exact original scope; no new broad gate or replacement evidence is claimed. Historical prior account (preserved verbatim): Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1674 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1630 removes low-value Git, GitHub/GitLab and IPC projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Live macOS Electron tests prove exact local PTY disappearance after parked-tab close and detached-pgid descendant death after agent close. A deterministic final-pane interleaving now proves durable tab retirement commits before externally owned PTY teardown can publish graph loss, and preserves an unrelated live canary through duplicate exit retirement. Deterministic tests also cover final-pane CLI close durability and same-incarnation handle continuity; persisted-empty restart suppression remains historical Electron evidence, alongside replacement and hard graph-loss stale fencing, preallocated-handle supersession, daemon and SSH routing, local/daemon pending-snapshot ownership across natural exit, stale-root descendant-signal suppression, graceful-to-immediate kill upgrades, duplicate-kill completion sharing, locale-stable bounded/fresh/coalesced process-table reads, deadline-safe successor scans, cycle-safe linear descendant traversal, target-only escalation indexing, 32-wide bulk teardown, source-scan timestamp identity, same-second PID ambiguity, ordinary runtime close ownership, unified-only hydration, split ownership, pane detach transfer, restart alias hydration, and late-hook suppression; live Linux, Windows, WSL, SSH, and remote-runtime process evidence remains pending. A paired macOS Electron journey (real attached-window desktop host plus a separate real paired desktop client, isolated profiles) covers the inverse authority direction for host-created terminals: a renderer graph sync must not retire a tab that `orca terminal create` made. The retained paired journey covers the incident shape the real CLI produces - a repo's FIRST host-created terminal, since src/cli/handlers/terminal.ts sends no clientMutationId. The repeated target-after-unrelated-terminal journey was retired; its separate ordering alarm is no longer provided. An earlier reading of this gate called a preceding host-created terminal and a `clientMutationId` protective; main-process instrumentation refuted that. The renderer's stale session write deleted the host tab from persistence in every variant, and only the delete's timing relative to the measured sync differed, so those rows were false negatives of a single-sync oracle. The defect was in persistence: persistPtyBinding did not raise the repo's terminal topology fence for the first host-admitted tab, leaving the renderer's pre-create tab list free to replay over it. Elapsed time and paired-client mirroring never decided anything. A windowless `orca serve` parity arm runs the identical oracle and passes on both the merge-base and the branch, confirming that topology does not exhibit the defect (the gate it turns on is window-conditioned) and that making the host binding unconditional did not regress it. All of this is macOS-local only. The reported incident occurred on a physical Windows host; we did not run against one. The claim that the mechanism is platform-independent rests on the authoritative-window gate and publication-epoch inheritance being OS-agnostic, not on Windows evidence, so no ConPTY, Windows window-lifecycle, update, or sleep behavior is covered here. The synthetic default-tabs unit suite was retired: its explicit-empty/default-tab assertions no longer supply unit evidence. This retirement supplies no new persisted-restart, runtime-routing, cross-platform, or mobile evidence; existing historical runs and counts remain historical. The test-value audit removes the isolated re-retirement-token/epoch, activity-cutoff, idle-reattach and sibling-restore examples. The cited exact retirement and chained-detach cases remain unchanged, alongside closed-tab revival fencing and alias churn bounds. Their retained evidence is not equivalent coverage for every removed permutation; historical execution evidence is unchanged. The test-value audit removed shared-owner snapshot/cold-restore reference examples, a direct absent-tab PTY-index update, caller-supplied host-owned teardown boolean/no-dispatch, and a single local-provider rejection example. It also removed hand-built detach-retention comparator examples for different runs, handles, provider identities, and handle-less rows without independent identity ingress. Their specific snapshot, missing-tab, host-decision, rejection-count, and comparator alarms are lost. Current exact authority/ordering and chained-detach cases remain retained; they do not establish equivalent coverage for the removed examples. Historical commands, counts, results, and red-green narratives remain historical. The test-value audit retires terminals-explicit-empty-hydration.test.ts in full: its direct git/folder empty-tombstone assertions and literal-flag auto-create helper check are lost. The store test never mounted the initial-terminal effect or performed a persisted restart. The audit also removes terminal-tab-retirement.test.ts pure ownership/alias/routing plan inventories and sleeping-record map assertions; its former 100-tab scan-count case was subsequently retired too; no assertion remains in that suite. These retained and historical cases do not establish equivalent tombstone, default-create, provider teardown, cross-platform, or mobile coverage. Historical commands, results, counts, and red-green narratives remain historical. The subsequent test-value audit deletes the remaining terminal-tab-retirement.test.ts suite. Its 100-tab case asserted only returned plan count and one outer scan per ownership store; it never inspected per-tab plans or provider teardown. Those direct cardinality/work-count alarms are intentionally lost. Historical executed commands, results, counts and red-green narratives remain historical; no equivalent replacement or new runtime, platform or mobile evidence is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1392: src/main/agent-hooks/server-pane-authority.test.ts reduced. Retires one duplicate-transfer no-op listener count and latest pty/timestamp callback fixture. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
+ "coverageNotes": "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed. Audit 3959 retires the whole session.test.ts driver (27 authored / 33 finite cases): startup/echo filtering, readiness input gates, ownership confirmation, detach authority, and termination retry/exit ordering alarms are intentionally lost. No equivalent replacement or fresh runtime validation is claimed. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3323 (reconciled source audit3320) intentionally retires seven low-value renderer authority/retirement examples: retires one pane, clears resume authority, and rejects late status without harming siblings — Late status reviving a retired pane, sibling damage, or resume authority left behind.; can retire live pane authority while retaining its sleeping session — Retiring live authority accidentally dropping a retained sleeping session.; keeps a physical pane routed through chained detaches until its current owner closes — Chained detach alias routing broken after original owner closes, or alias survives final close.; forgets routing aliases for purged tabs — Purged-tab routing aliases lingering.; retires split, relay, deferred, and pending sessions for a parked tab — Split, relay, deferred or pending session omitted from teardown, sleeping-record sibling damaged, parked disposer skipped.; retires parked ownership before teardown and sweeps published state before unified close — Parked cleanup/provider teardown/state removal/sweep/unified-close ordering changes.; starts mixed provider teardown and classifies both rejection kinds after synchronous retirement — Mixed teardown failures blocking retirement, or local/runtime warning counts misclassified.. Remove the exact-pane-retirement and chained-detach assertion references because their source cases are gone. Other retained cases do not replace these alarms. Preserve all dated evidenceRuns and prior history with their original source scope; no fresh execution or historical import-closure equivalence is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1904 reduces persistence-pty-binding-reconciliation from six to four definitions, intentionally losing legacy remap-load and first-binding projection alarms. Current selector/testFile remains valid, with no selected-source assertionRef or active matching receipt. The six unchanged close/continuity receipts keep their exact original scope; no new broad gate or replacement evidence is claimed. Historical prior account (preserved verbatim): Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1674 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1630 removes low-value Git, GitHub/GitLab and IPC projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Live macOS Electron tests prove exact local PTY disappearance after parked-tab close and detached-pgid descendant death after agent close. A deterministic final-pane interleaving now proves durable tab retirement commits before externally owned PTY teardown can publish graph loss, and preserves an unrelated live canary through duplicate exit retirement. Deterministic tests also cover final-pane CLI close durability and same-incarnation handle continuity; persisted-empty restart suppression remains historical Electron evidence, alongside replacement and hard graph-loss stale fencing, preallocated-handle supersession, daemon and SSH routing, local/daemon pending-snapshot ownership across natural exit, stale-root descendant-signal suppression, graceful-to-immediate kill upgrades, duplicate-kill completion sharing, locale-stable bounded/fresh/coalesced process-table reads, deadline-safe successor scans, cycle-safe linear descendant traversal, target-only escalation indexing, 32-wide bulk teardown, source-scan timestamp identity, same-second PID ambiguity, ordinary runtime close ownership, unified-only hydration, split ownership, pane detach transfer, restart alias hydration, and late-hook suppression; live Linux, Windows, WSL, SSH, and remote-runtime process evidence remains pending. A paired macOS Electron journey (real attached-window desktop host plus a separate real paired desktop client, isolated profiles) covers the inverse authority direction for host-created terminals: a renderer graph sync must not retire a tab that `orca terminal create` made. The retained paired journey covers the incident shape the real CLI produces - a repo's FIRST host-created terminal, since src/cli/handlers/terminal.ts sends no clientMutationId. The repeated target-after-unrelated-terminal journey was retired; its separate ordering alarm is no longer provided. An earlier reading of this gate called a preceding host-created terminal and a `clientMutationId` protective; main-process instrumentation refuted that. The renderer's stale session write deleted the host tab from persistence in every variant, and only the delete's timing relative to the measured sync differed, so those rows were false negatives of a single-sync oracle. The defect was in persistence: persistPtyBinding did not raise the repo's terminal topology fence for the first host-admitted tab, leaving the renderer's pre-create tab list free to replay over it. Elapsed time and paired-client mirroring never decided anything. A windowless `orca serve` parity arm runs the identical oracle and passes on both the merge-base and the branch, confirming that topology does not exhibit the defect (the gate it turns on is window-conditioned) and that making the host binding unconditional did not regress it. All of this is macOS-local only. The reported incident occurred on a physical Windows host; we did not run against one. The claim that the mechanism is platform-independent rests on the authoritative-window gate and publication-epoch inheritance being OS-agnostic, not on Windows evidence, so no ConPTY, Windows window-lifecycle, update, or sleep behavior is covered here. The synthetic default-tabs unit suite was retired: its explicit-empty/default-tab assertions no longer supply unit evidence. This retirement supplies no new persisted-restart, runtime-routing, cross-platform, or mobile evidence; existing historical runs and counts remain historical. The test-value audit removes the isolated re-retirement-token/epoch, activity-cutoff, idle-reattach and sibling-restore examples. The cited exact retirement and chained-detach cases remain unchanged, alongside closed-tab revival fencing and alias churn bounds. Their retained evidence is not equivalent coverage for every removed permutation; historical execution evidence is unchanged. The test-value audit removed shared-owner snapshot/cold-restore reference examples, a direct absent-tab PTY-index update, caller-supplied host-owned teardown boolean/no-dispatch, and a single local-provider rejection example. It also removed hand-built detach-retention comparator examples for different runs, handles, provider identities, and handle-less rows without independent identity ingress. Their specific snapshot, missing-tab, host-decision, rejection-count, and comparator alarms are lost. Current exact authority/ordering and chained-detach cases remain retained; they do not establish equivalent coverage for the removed examples. Historical commands, counts, results, and red-green narratives remain historical. The test-value audit retires terminals-explicit-empty-hydration.test.ts in full: its direct git/folder empty-tombstone assertions and literal-flag auto-create helper check are lost. The store test never mounted the initial-terminal effect or performed a persisted restart. The audit also removes terminal-tab-retirement.test.ts pure ownership/alias/routing plan inventories and sleeping-record map assertions; its former 100-tab scan-count case was subsequently retired too; no assertion remains in that suite. These retained and historical cases do not establish equivalent tombstone, default-create, provider teardown, cross-platform, or mobile coverage. Historical commands, results, counts, and red-green narratives remain historical. The subsequent test-value audit deletes the remaining terminal-tab-retirement.test.ts suite. Its 100-tab case asserted only returned plan count and one outer scan per ownership store; it never inspected per-tab plans or provider teardown. Those direct cardinality/work-count alarms are intentionally lost. Historical executed commands, results, counts and red-green narratives remain historical; no equivalent replacement or new runtime, platform or mobile evidence is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1392: src/main/agent-hooks/server-pane-authority.test.ts reduced. Retires one duplicate-transfer no-op listener count and latest pty/timestamp callback fixture. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4327",
"https://github.com/stablyai/orca/pull/14590",
@@ -6205,12 +6174,12 @@
"https://github.com/stablyai/orca/issues/14524"
],
"invariant": "Close permanently removes the owned provider session, agent descendants, persisted tab/layout authority, and resume authority even when no TerminalPane is mounted; final-pane CLI close commits durable tab retirement before PTY stop can publish graph loss, does not acknowledge before that retirement, and treats the later exit retirement as idempotent. Workspace-wide CLI close applies that same durable contract to every terminal in exactly one worktree, including pinned and persisted-only surfaces, without touching sibling-worktree PTYs or resume records. A persisted explicit-empty state prevents initial-tab fallback from repopulating the workspace after reload or restart. A handle remains valid while the same provider-attested PTY incarnation survives renderer reload or re-key, and becomes stale without adopting a replacement incarnation. A terminating id remains reserved through natural exit, duplicate callers await the same completion, and immediate teardown upgrades any graceful request without signalling a recycled PID or a descendant tree after root ownership is lost; process-table work is locale-stable, bounded, fresh for each post-start request, same-turn coalesced, and begins within the requesting caller's deadline, including bulk worktree cleanup; detach and park preserve ownership; aliases prevent a detached agent's immutable physical pane key from being retired with its former tab.",
- "oracle": "Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3323 (reconciled source audit3320) intentionally retires seven low-value renderer authority/retirement examples: retires one pane, clears resume authority, and rejects late status without harming siblings — Late status reviving a retired pane, sibling damage, or resume authority left behind.; can retire live pane authority while retaining its sleeping session — Retiring live authority accidentally dropping a retained sleeping session.; keeps a physical pane routed through chained detaches until its current owner closes — Chained detach alias routing broken after original owner closes, or alias survives final close.; forgets routing aliases for purged tabs — Purged-tab routing aliases lingering.; retires split, relay, deferred, and pending sessions for a parked tab — Split, relay, deferred or pending session omitted from teardown, sleeping-record sibling damaged, parked disposer skipped.; retires parked ownership before teardown and sweeps published state before unified close — Parked cleanup/provider teardown/state removal/sweep/unified-close ordering changes.; starts mixed provider teardown and classifies both rejection kinds after synchronous retirement — Mixed teardown failures blocking retirement, or local/runtime warning counts misclassified.. Remove the exact-pane-retirement and chained-detach assertion references because their source cases are gone. Other retained cases do not replace these alarms. Preserve all dated evidenceRuns and prior history with their original source scope; no fresh execution or historical import-closure equivalence is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1904 reduces persistence-pty-binding-reconciliation from six to four definitions, intentionally losing legacy remap-load and first-binding projection alarms. Current selector/testFile remains valid, with no selected-source assertionRef or active matching receipt. The six unchanged close/continuity receipts keep their exact original scope; no new broad gate or replacement evidence is claimed. Historical prior account (preserved verbatim): Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1674 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Capture exact tab, pane, PTY, handle, incarnation, and persisted layout identities. Final-pane terminal.close must invoke one durability-acknowledged tab retirement before exact PTY teardown; controlled PTY exit and graph removal afterward must remain idempotent, omit the target from persistence and provider inventory, and leave an unrelated canary handle live. terminal.closeAll must force-retire every pinned and unpinned target surface, clear its persisted agent-resume and incarnation records, await authoritative PTY exit, preserve a sibling worktree's tab, PTY, and resume authority, and return an unverifiable failure instead of claiming exit when the owning host does not confirm a stop. The ordinary path stays pending until the persisted row is removed and never falls back to the fire-and-forget pane event; reload/restart must keep the explicitly emptied worktree at zero terminal tabs and provider sessions. Reloading the renderer with the same tab/pane/PTY/incarnation must keep the handle readable; changing only the incarnation behind the same PTY id, losing the authoritative graph, or superseding the renderer handle with a preallocated handle must reject the old handle with terminal_handle_stale. Parked-close tests prove the exact PTY disappears; descendant/process tests keep natural exits reserved, upgrade teardown safely, bound/coalesce process-table work, and protect recycled identities.",
+ "oracle": "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed. Historical prior account (preserved verbatim): Audit3814 deliberately retires60 authored/60 finite cases:53runtime compatibility cases,4native XCTest methods and3Python clipboard methods, including the entire StableElementIndexes suite. Clipboard cuts retire the one-over-cap sample, incoming-offer destruction trace and sequential20-copy replay; actual wire, FD/pipe, startup and Xvfb/GTK boundaries remain without equivalent replacement claims. Accepted losses include narrow terminal-send payload/provider projections, legacy and direct no-op/error permutations, timing/work-count examples, private state/title/activity projections and fixture-driven readiness examples, individually enumerated below. These include real bounded production alarms consciously retired for marginal value; retained failed writes, duplicate submission, stale capture, transcript/ring and allocation fences are not equivalent replacements. No fresh native/remote/browser execution or complete transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3806 deliberately retires40 authored/40 finite runtime compatibility cases, including the terminal-side-effect-facts-part03 headless-snapshots-part02 and agent-status-and-waits-part03 fragments, plus20 scalar Swift precondition sites. Lost runtime alarms include status/title/attention projection examples, simple renderer/headless frame restoration and status waiting outcomes detailed in the accepted-loss ledger. Swift cuts retire duplicate generation-map/schema/navigation/bridge and notification-wrapper assertions; no standalone native program is deleted. These include real bounded production alarms consciously retired for marginal value. Retained races, pending writes/reflow, namespace and waiter ownership are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3798 deliberately retires21 authored/24 finite compatibility cases, including the entire SSH-worktree-lifecycle and repository-project-operations fragments. Accepted losses include navigation-only settings acknowledgement, browser session cleanup and host preservation projections, window positive/policy-state examples, terminal recovery/reload and no-incarnation remint examples, terminal listing compatibility/malformed IDs, directory browse/sort/Windows path smoke, SSH create refusal/manual lineage, recursive parent-folder creation and fork/origin/avatar/icon projections. Real bounded production alarms are consciously retired for marginal value; retained authority races, cleanup/clone ownership, pending waiters, nested-folder and scan invalidation cases are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3323 (reconciled source audit3320) intentionally retires seven low-value renderer authority/retirement examples: retires one pane, clears resume authority, and rejects late status without harming siblings — Late status reviving a retired pane, sibling damage, or resume authority left behind.; can retire live pane authority while retaining its sleeping session — Retiring live authority accidentally dropping a retained sleeping session.; keeps a physical pane routed through chained detaches until its current owner closes — Chained detach alias routing broken after original owner closes, or alias survives final close.; forgets routing aliases for purged tabs — Purged-tab routing aliases lingering.; retires split, relay, deferred, and pending sessions for a parked tab — Split, relay, deferred or pending session omitted from teardown, sleeping-record sibling damaged, parked disposer skipped.; retires parked ownership before teardown and sweeps published state before unified close — Parked cleanup/provider teardown/state removal/sweep/unified-close ordering changes.; starts mixed provider teardown and classifies both rejection kinds after synchronous retirement — Mixed teardown failures blocking retirement, or local/runtime warning counts misclassified.. Remove the exact-pane-retirement and chained-detach assertion references because their source cases are gone. Other retained cases do not replace these alarms. Preserve all dated evidenceRuns and prior history with their original source scope; no fresh execution or historical import-closure equivalence is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1904 reduces persistence-pty-binding-reconciliation from six to four definitions, intentionally losing legacy remap-load and first-binding projection alarms. Current selector/testFile remains valid, with no selected-source assertionRef or active matching receipt. The six unchanged close/continuity receipts keep their exact original scope; no new broad gate or replacement evidence is claimed. Historical prior account (preserved verbatim): Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1674 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Capture exact tab, pane, PTY, handle, incarnation, and persisted layout identities. Final-pane terminal.close must invoke one durability-acknowledged tab retirement before exact PTY teardown; controlled PTY exit and graph removal afterward must remain idempotent, omit the target from persistence and provider inventory, and leave an unrelated canary handle live. terminal.closeAll must force-retire every pinned and unpinned target surface, clear its persisted agent-resume and incarnation records, await authoritative PTY exit, preserve a sibling worktree's tab, PTY, and resume authority, and return an unverifiable failure instead of claiming exit when the owning host does not confirm a stop. The ordinary path stays pending until the persisted row is removed and never falls back to the fire-and-forget pane event; reload/restart must keep the explicitly emptied worktree at zero terminal tabs and provider sessions. Reloading the renderer with the same tab/pane/PTY/incarnation must keep the handle readable; changing only the incarnation behind the same PTY id, losing the authoritative graph, or superseding the renderer handle with a preallocated handle must reject the old handle with terminal_handle_stale. Parked-close tests prove the exact PTY disappears; descendant/process tests keep natural exits reserved, upgrade teardown safely, bound/coalesce process-table work, and protect recycled identities.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/surface/orca-runtime-terminal-close-continuity.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts",
- "pnpm dlx node@24 ./node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server/testing/authority/server-pane-authority.test.ts src/main/ipc/agent-hooks.test.ts src/main/ipc/agent-pane-authority-ownership.test.ts src/main/persistence/terminal-topology/persistence-pane-identity-migration.test.ts src/main/persistence/terminal-topology/persistence-pty-binding-reconciliation.test.ts src/renderer/src/store/slices/agent-status/agent-pane-authority.test.ts src/renderer/src/store/terminals/terminal-pane-detach-agent-identity.test.ts src/renderer/src/store/terminals/terminal-tab-retirement-store.test.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/pty/process-retirement/pty-descendant-termination.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts",
+ "pnpm dlx node@24 ./node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server/testing/authority/server-pane-authority.test.ts src/main/ipc/agent-hooks.test.ts src/main/ipc/agent-pane-authority-ownership.test.ts src/main/persistence/restoring-sessions/persistence-pane-identity-migration.test.ts src/main/persistence/loading-store/terminal-bindings/persistence-pty-binding-reconciliation.test.ts src/renderer/src/store/slices/agent-status/agent-pane-authority.test.ts src/renderer/src/store/terminals/terminal-pane-detach-agent-identity.test.ts src/renderer/src/store/terminals/terminal-tab-retirement-store.test.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/pty/process-retirement/pty-descendant-termination.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts",
"pnpm run test:e2e -- tests/e2e/terminal-tab-close-restart-persistence.spec.ts --workers=1",
"pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1",
"pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1",
@@ -6223,10 +6192,9 @@
"src/main/agent-hooks/server/testing/authority/server-pane-authority.test.ts",
"src/main/ipc/agent-hooks.test.ts",
"src/main/ipc/agent-pane-authority-ownership.test.ts",
- "src/main/persistence/terminal-topology/persistence-pane-identity-migration.test.ts",
- "src/main/persistence/terminal-topology/persistence-pty-binding-reconciliation.test.ts",
+ "src/main/persistence/restoring-sessions/persistence-pane-identity-migration.test.ts",
+ "src/main/persistence/loading-store/terminal-bindings/persistence-pty-binding-reconciliation.test.ts",
"src/main/pty/process-retirement/pty-descendant-termination.test.ts",
- "src/main/daemon/sessions/testing/session.test.ts",
"src/main/daemon/terminal-host/testing/terminal-host.test.ts",
"src/main/providers/local-pty/local-pty-provider-shutdown.test.ts",
"src/main/runtime/workspaces/removal/worktree-teardown.test.ts",
@@ -6348,6 +6316,10 @@
"Add restart/no-resurrection and repeated park-close soak coverage."
],
"knownGaps": [
+ "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed.",
+ "Audit3814 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle from a Codex ready prompt even when stale startup lines remain :: Stale MCP startup lines must not block a later Codex ready header.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle when a stale Codex prompt is followed by the ready header :: A Codex ready header following a stale resume prompt must satisfy tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for an idle Cursor lane past its dismissed trust dialog (#8210) :: Later Cursor idle banner overrides retained trust dialog.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not block a mid-run Cursor lane on its dismissed trust dialog (#8210) :: Dismissed trust dialog must not report blocked for later busy Cursor; wait times out.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not classify unrelated press-enter prompts as Codex blocked prompts :: Unidentified press-enter text must time out rather than be classified Codex blocked.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for quiet background PTY agents without OSC titles :: Quiet Codex background terminal without OSC title eventually resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: sends agent prompts as bracketed paste before submit :: Driving prompt escapes embedded paste-end ESC, writes one framed paste then CR, and counts bytes.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: settles a foreground Codex prompt when launch metadata has not arrived :: Codex inferred from foreground without launch metadata waits for composer marker/quiescence before one CR.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: gives a late Codex render marker a fresh quiescence window :: Marker arriving at7.9s re-arms fresh quiet window instead of submitting at initial cap.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: writes large agent prompt paste frames atomically before delayed submit :: A prompt larger than input chunk budget is a single paste write before delayed CR with exact byte count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects oversized terminal.send text before provider writes :: Oversized ordinary terminal.send rejects input-too-large before any provider write.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects focusing an exited background terminal session :: focusTerminal refuses terminal_exited before invoking background reveal.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: pastes the same bytes the desktop draft paste sent for the prompt :: Launch-ready prompt normalizes CR/LF and renders embedded ESC visibly identically to desktop bracketed paste.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: keeps a prompt into a running agent behind the render settle, as before :: Driving prompt remains held through7s repaint activity then submits once by9s.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reports a queued PTY focus as not navigated when its notifier disappears :: Queued PTY focus and completed active reveal report not navigated after notifier removal; no second reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: does not invoke a stale graph-leaf focus notifier after queued PTY work :: Queued graph-leaf focus must not invoke old notifier after preceding PTY reveal and notifier removal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: paginates retained terminal output with explicit limits and truncation metadata :: Preview120lines, fractional limits,50/200 pages, retained2000line truncation and future-cursor metadata stay consistent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: falls back to renderer visible screen when uncursored TUI tail is blank :: Substantial blank uncursored tail uses mounted renderer visible screen with zero scrollback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reads and shows the runtime-owned alternate-screen grid without serialization :: Actual runtime alternate-screen grid provides read/show content without renderer/provider serialization.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: classifies older provider alternate-screen snapshots from ANSI :: Older provider without alternateScreen metadata classifies ANSI alternate entry and returns Remote Vim screen.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: honors the last ANSI screen transition when older provider metadata is absent :: Last ANSI alternate exit overrides earlier entry when explicit provider mode metadata is absent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: rejects a full provider screen frame after live output advances :: Live output arriving during second full-screen capture causes screen-unavailable rather than stale full frame.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: shares one provider snapshot between concurrent read and show calls :: Concurrent read/show share one successful provider snapshot and both receive Shared TUI content.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps cursor reads provider-free on restored alternate-screen PTYs :: Restored alternate-screen cursor transcript reads never acquire provider snapshot.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: backs off after a provider snapshot failure instead of retrying for show :: Failed provider capture is cached/backed off so later show does not retry.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: falls back once to a mounted renderer when a known alternate provider fails :: A known-alternate failed provider capture falls back exactly once to newly mounted renderer.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: bounds provider visible frames for read and show responses :: Provider visible read/show use six bounded lines and300character preview.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps renderer-fallback composer drafts separate from terminal output :: Renderer fallback strips dim composer draft from terminal output and exposes draft separately.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: does not use renderer visible-screen fallback for a short blank shell tail :: Two blank shell lines must not trigger renderer screen fallback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: trims terminal tail character budget without per-line array shifts :: Tail builder trims to256KiB with correct retained suffix and no Array.shift calls.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains ANSI-only status redraws instead of appending every frame :: Repeated erase/redraw replaces preview until newline then publishes one completed cursor row.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains split multi-line ANSI footer redraw state across chunks :: CUU state across chunks retains corrected footer rows and publishes new cursor entries.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not let stale lower rows hide earlier corrected footer rows from cursor reads :: Earlier corrected footer row must not be hidden by stale lower rows in cursor reads.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: bounds completed transcript entries from a single multi-line redraw chunk :: Single redraw chunk bounds completed transcript to2000retained lines and correct oldest/next/latest cursors.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains multi-line ANSI redraws when the last footer row stays partial :: Partial final redrawn row appears in preview but cursor sees it only after newline.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not retain split ANSI controls as visible terminal preview text :: Split color/mode escapes never leak preview fragments; long split OSC title truncates at MAX_OSC_TITLE_CHARS.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains same-line redraw cursor position across split full-line erase chunks :: Full-line erase preserves column across chunks so XY follows three spaces rather than old ABC.\nsrc/main/runtime/orca-runtime-tests/conpty-stream-read.spec.ts :: fills the requested line count even when blank rows sit below the prompt :: Blank rows below a ConPTY prompt must not consume the requested nonempty-line count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: does not retain split ST-terminated string controls as preview text :: Split ST-terminated Kitty/string controls must remain excluded from preview text.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects split OSC titles before retaining terminal previews :: Split BEL OSC title must update working title/status without leaking into preview.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects ST-terminated OSC titles split before the final backslash :: ST OSC split before final backslash must update title without leaking framing.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: preserves a trailing escape after a completed OSC title :: Completed OSC followed by pending ESC must preserve the next idle-title transition.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: seeds newly synced leaves from PTY pending ANSI state :: A newly synced graph leaf inherits pending ANSI so a split color fragment cannot leak.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: bounds retained partial terminal output before preview reads :: Partial terminal state stays capped at 4000, preserves retained array identity, and preview truncation/cursor output remains correct.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: submits the mail pointer to Cursor Agent only after the paste-burst delay :: Cursor mailbox pointer Enter must wait through the paste-burst delay; this is a real input-timing alarm intentionally retired.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts :: adopts a v1.4.150-shaped agent, setup, and shell orphan as one topology transaction :: Stale incarnation refuses without topology change; three agent/setup/shell lanes adopt atomically with layout/group/revision and preserved read/input/resize; exact replay is idempotent and competing owner refuses.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: retires the exact worker when it exits after renderer reveal :: Exact worker exit after reveal retires that worker and its surface.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: re-reveals a recovered worker after the renderer graph epoch changes :: Changed renderer graph epoch invalidates reveal receipt and forces another reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: defers recovery when the renderer omits the exact reveal identity :: Missing exact reveal identity defers recovery after two attempts.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: reconciles a same-id process replacement before headless adoption :: A process replacement before headless adoption must fence off stale ownership.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retires provider resume only after authoritative inventory proves the legacy PTY exited :: Authoritative owning-host inventory overrides false local hasPty, avoids SSH scanning, retires exited provider resume/surface, adopts live workers without headless reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retries inventory and unknown liveness without revealing a ghost worker :: Inventory failure and unknown liveness must retry without ghost reveal, eventually adopt, and stop retrying.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: refuses a live reserved pane before issuing a handle or revealing it :: A requireFreshPane launch receiving a live reserved owner must reject before handle/reveal/kill, and release its claim. No equivalent replacement claimed.",
+ "Audit3806 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: skips a listener unsubscribed mid-fan-out even with mobile exclusions active :: A listener removed by an earlier listener during one fanout is not called, including with a side-effect-excluded mobile listener present.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: retains bytes emitted before a fresh daemon spawn resolves :: Bytes and title arriving before an initial zero/reset provider response survive in the serialized headless buffer with their counted sequence.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits command-finished facts with best-effort exit codes across chunk splits :: A split OSC133 D exit code becomes130 and a missing code becomes null in ordered command-finished facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits pr-link facts once per URL with batch attribution :: A split GitHub PR URL yields42 rather than4, emits42/43 once each, and carries PTY/worktree/tab attribution.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits 2031-subscribe facts across chunk splits :: Split ESC[?20 then31h emits exactly one2031-subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: restores a provisional 2031 subscribe when daemon scan authority returns :: Returning daemon scan authority with partial scan seed and pending2031 subscription restores exactly one subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers the tracked title over the renderer snapshot lastTitle :: A synthetic live Cursor title overrides stale renderer lastTitle while preserving renderer snapshot source.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers provider history over a partial headless mirror for requested snapshots :: Authoritative requested snapshots return supplied provider frame/history/seq rather than a partial headless mirror, requesting5000rows.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: tracks live alternate-screen transitions after a provider snapshot :: Provider alternateScreen true is accepted, then live1049l/1049h update isTerminalAlternateScreen false/true.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: translates reset provider snapshots without retaining the old title :: A reset provider snapshot translates new local seq into the runtime domain and replaces Old process title with New process.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits the chunk agentStatus events before its side-effect batch :: Agent status callback precedes side-effect batch callback for one coalesced OSC9999/title/bell chunk.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: still emits a throwing chunk’s facts under its own seq, not the next chunk’s :: A tracker throw still flushes first chunk title facts under its own seq, and second chunk does not inherit those facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: seeds the lazily created tracker from the daemon-snapshot title :: A lazy tracker hydrated from renderer snapshot title Codex working emits agent-idle on later Codex done.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits command-code-working facts only after the banner arms the scrape :: Unarmed Thinking text emits no facts; a Command Code0.27.3 banner then hardcoded colored spinner text emits attributed command-code-working with the submitted prompt.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits a command-code-done fact when the idle composer returns :: After hardcoded banner/working text, returned idle composer emits command-code-done with the earlier submitted prompt.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: resizes the headless mirror after an accepted desktop PTY resize :: An external accepted resize produces the resized dimensions and same status-frame lines as a separately driven reference emulator.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: replaces suffix-only headless state with the recovered renderer snapshot :: Replacing suffix-only state removes old suffix, retains renderer history plus later output/cwd, and returns the live47x40PTY grid.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: stamps SSH connection identity on runtime terminal status :: A synthetic mounted-leaf OSC9999 status after registerPty carries the supplied SSH connectionId.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: does not retain WSL context when a PTY id is reused :: After exit and same-ID new null distro context, OSC7 file://server/share/repo uses UNC server path rather than old Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: preserves immutable context while a live daemon attach is unresolved :: preparePtyExecutionContext with preserveExisting refuses a supplied Debian replacement and subsequent OSC7 keeps original Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts :: projects frame-independent live state through main buffer snapshots :: Main-buffer snapshot puts focus-report/cursor-visibility modes in frameRestoreAnsi, excludes STATIC-FRAME there and includes it in data.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts :: continues terminal agent status fanout when a callback throws :: Throwing on the first status callback does not prevent second payload delivery and logs contextual error.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: returns a title-only replay snapshot and never historical attention :: Lose replay:true/title-only fact projection despite earlierbell and unknownPTYnull. No actual delivered-history notification or reattach behavior was exercised. No equivalent replacement claimed.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects a handle rebind while a controller-less status check yields :: A handle rebound while the null-controller status continuation yields must throw terminal_handle_stale.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects confirmation evidence when the owning PTY exits :: A pending strong confirmation resolving after owning PTY exit must reject terminal_exited.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts :: keeps ordinary terminal send suffix failures on the existing not-writable contract :: Ordinary send writes text but refused CR must throw terminal_not_writable with beforeWrite twice and afterWrite once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell the execution host cannot apply instead of spawning its default :: Requested Windows shell on POSIX must refuse before spawning a default shell.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: quotes the agent startup command for the requested shell, not the host default :: Requested cmd shell must override PowerShell default quoting for agent startup command.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: keeps restored receipts outside a targeted worktree scan :: Targeted scan removes the moved-worktree receipt while preserving another worktree receipt.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: observes setup command completion without waiting for its interactive shell to exit :: Nonzero completion marker 17 resolves while interactive shell remains running.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: falls back to setup terminal exit when no completion signal is available :: Setup completion observer without token falls back to actual exit code 9.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: cancels setup completion observation when the caller aborts :: Abort rejects with the original reason and unsubscribes once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps observing after an uncertain setup terminal status :: Unknown exit waiter result must leave observation pending until completion marker arrives.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh omits a record :: Controller inventory omission disconnects the record but preserves its retained transcript.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh times out :: Hung inventory timeout leaves connected record and retained transcript intact.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle for adopted background PTY handles from the renderer title :: An adopted background handle resolves tui-idle from ready Codex renderer title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves live-leaf tui-idle from an OpenCode native title :: A live leaf resolves tui-idle from an OpenCode native title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from a Codex ready prompt preview :: A supplied Codex prompt preview resolves tui-idle without an actual agent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from an Antigravity prompt before the model line :: A supplied Antigravity prompt before model line resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell with no workspace instead of creating a default-shell tab :: Workspace-less explicit shell must reject before renderer default-tab request or spawn. This real guard/wiring alarm is deliberately retired.",
+ "Audit3798 per-case accepted losses:\nsrc/main/runtime/orca-runtime-tests/paired-settings.spec.ts :: awaits navigation-only updates from paired clients (%s) :: Updating only claudeSubagentNavigationEnabled waits for the actual controller call to the supplied pending Claude-view reconcile for both on/off values.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: drops a client page record even when its close command cannot be issued :: A removed workspace loses its runtime client-page record and headless browser projection despite close delivery_required rejection, and emits the asynchronous warning.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: leaves client-hosted pages alone when another host still owns the same worktree id :: Removing runtime:env-b metadata with local ownership leaves the local same-ID client page unchanged and issues no close command.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: marks live bindings again when reopening after a promoted window closes :: A reopened window marks its still-registered live worktree in activeWorktreeIdsOnShutdown after the first promoted window closes.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: preserves live SSH session identities when promoting a headless runtime :: Headless-to-desktop promotion records active worktree, SSH connection and remoteSessionIdsByTabId from the supplied surviving SSH PTY/session.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores a surviving renderer when its reload is cancelled :: A sole ready renderer reload cancelled under its current renderer fence returns true and becomes ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores headless authority when desktop promotion navigation is cancelled :: A cancelled desktop promotion with headless recovery returns false while headless authority remains ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: moves a desktop graph to unavailable when its reload times out :: A ready desktop graph without a headless fallback becomes unavailable at the reload deadline and retains its window/epoch.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: recovers a failed headless promotion and accepts a later renderer generation :: A promotion failure restores ready headless authority; a later valid same-window graph publishes ready desktop authority.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: clears a failed pane recovery so a later reconnect can retry :: After relay_reconnecting rejection, the pending recovery lock clears and the same pane/handle can call createTerminal a second time and return its supplied replacement.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: still preserves a CLI agent leaf when the reloaded renderer has not rebound its PTY :: An empty graph published during renderer reload preserves a preallocated live CLI PTY as one listable terminal before renderer rebind.\nsrc/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts :: keeps a no-incarnation handle across an in-graph pane remint :: Within one graph lifetime an unversioned PTY reminted onto another leaf retains its issued handle and resolves its old exit waiter after onPtyExit.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: matches explicit-id cwd PTYs when the resolved worktree cache is incomplete :: An explicit target absent from a fresh incomplete resolved cache adopts only its cwd PTY, rejects nested cwd PTY and does not rescan Git.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: ignores cwd-only controller PTYs for malformed explicit worktree IDs :: Malformed id:repo-1:: returns no terminals, does not adopt cwd-only controller PTY and avoids Git rescanning.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: refuses an SSH-backed create for mobile/runtime callers instead of creating locally :: Loss of this public unserved SSH create error-class/no-local-add/no-local-list alarm.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: records an app-selected parent workspace as a manual action :: Loss of the local runtime folder-parent manual origin, active-workspace source and explicit confidence projection alarm; no claim that SSH or cleanup coverage replaces it.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: browses runtime server directories before projects are added :: Loss of this public runtime alarm for browse availability before registration, directories-first lexical ordering and native path flavor.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: lists drive roots for a server-root browse :: Loss of the Windows public slash-root drive enumeration smoke and presence of the temporary directory drive.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations-part-02.spec.ts :: creates a missing runtime parent before creating the project directory :: Loss of this runtime createRepo recursive missing-parent/child existence and registered-path alarm.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: preserves selected project %s when a hosted parent is known :: Loss of both parent-selected and origin-selected normal fork-link projection/persisted upstream alarms plus exact single-probe count.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: links a current enterprise remote despite unavailable metadata and a retained %s :: Loss of normal current-enterprise-origin linking with stale automatic GitHub avatar or protected file image, unchanged icon assertion, and serialized project identity under unavailable metadata.",
"Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
"Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
"Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. tests/e2e/automation-terminal-launch.unit.test.ts: launches explicit Chat for %s through the common entry and keeps its actual fallback; does not apply stored Terminal extras to Chat; forwards only complete Chat-consumed values, with no Terminal startup base; refuses an expired admission without minting another launch identity; records the actual chat identity and delegates new workspace setup and provenance. tests/e2e/github-project-provider-columns.unit.test.ts: renders %s through one bounded items request on a named cloud host; preserves zero and complete counters: %j; preserves populated and legacy rows through shared sorting, grouping and cells. tests/e2e/structured-agent-session-launch-continuation.unit.test.ts: carries renderer lifetime through host intent to the real %s provider builders. tests/e2e/terminal-account-restart.unit.test.ts: replaces a tombstoned owner while its persisted pane binding has not yet been cleared; paired restart retains the old owner (host authority: %s). tests/e2e/terminal-hidden-view-parking.spec.ts: does not park excluded tabs; reproduces a static frame byte-for-byte across 25 park/reveal cycles. tests/e2e/terminal-long-table-scroll-restore.spec.ts: reproduces long markdown table artifacts after workspace switch and scroll; keeps narrow wrapped signer markdown table coherent after restore and scroll; keeps real emoji markdown table right edge clean after restore and scroll. tests/e2e/terminal-long-table-fixtures.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-paste-ownership.spec.ts: Windows multiline keyboard paste normalizes terminal newlines with one PTY owner; right-click paste sends clipboard text to the focused terminal exactly once. tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts: uses WebGL by default for ordinary terminal output when available @terminal-rendering-golden. tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. tests/e2e/workspace-board-lane-virtualization.spec.ts: mounts a window of cards for a large lane and keeps lane indexes; renders later lane indexes after the lane scrolls. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts, tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts. Unresolved local/computed edges remain explicit debt. Complete dated receipts with direct selectors or current literal graph reaching tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts are retired below as historical raw objects; their counts do not validate reduced commands. Historical retired receipt verbatim:\n{\n \"date\": \"2026-07-13\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1\",\n \"result\": \"passed\",\n \"durationSeconds\": 40.3,\n \"summary\": \"A fresh E2E build launched an isolated Electron profile, parked a live terminal, closed it through closeTab, and observed its exact PTY disappear.\"\n } Historical retired receipt verbatim:\n{\n \"date\": \"2026-07-14\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1\",\n \"result\": \"passed\",\n \"durationSeconds\": 37.7,\n \"summary\": \"A current-main integrated fresh-build run proved a detached-pgid child was alive before agent PTY kill and absent afterward on the deadline-safe, root-ownership-gated implementation.\"\n } Historical retired receipt verbatim:\n{\n \"date\": \"2026-07-15\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1\",\n \"result\": \"passed\",\n \"durationSeconds\": 78,\n \"summary\": \"The cycle-safe, target-indexed, bounded-fanout review head passed from a cold full build; the live detached-pgid descendant test body completed in 4.8 seconds.\"\n } Historical retired receipt verbatim:\n{\n \"date\": \"2026-08-14\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm run test:e2e -- tests/e2e/terminal-tab-close-restart-persistence.spec.ts --workers=1\",\n \"result\": \"passed\",\n \"durationSeconds\": 18.8,\n \"summary\": \"A fresh isolated Electron profile closed a split terminal tab through the runtime CLI and kept both renderer and runtime terminal inventories empty after restart.\"\n }",
@@ -6390,7 +6362,8 @@
"Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes. All prior notes and dated/archived evidence retain original scopes.",
"Audit3437 complete prior commands before completed-worker-retirement-resume retirement: [\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/surface/orca-runtime-terminal-close-continuity.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts\",\"pnpm dlx node@24 ./node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server/testing/authority/server-pane-authority.test.ts src/main/ipc/agent-hooks.test.ts src/main/ipc/agent-pane-authority-ownership.test.ts src/main/persistence/terminal-topology/persistence-pane-identity-migration.test.ts src/main/persistence/terminal-topology/persistence-pty-binding-reconciliation.test.ts src/renderer/src/store/slices/agent-status/agent-pane-authority.test.ts src/renderer/src/store/terminals/terminal-pane-detach-agent-identity.test.ts src/renderer/src/store/terminals/terminal-tab-retirement-store.test.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/pty/process-retirement/pty-descendant-termination.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts\",\"pnpm run test:e2e -- tests/e2e/terminal-tab-close-restart-persistence.spec.ts --workers=1\",\"pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1\",\"pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1\",\"pnpm run test:e2e -- tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts --workers=1\",\"pnpm run test:e2e -- tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts --workers=1\"]",
"Audit3437 complete prior testFiles before completed-worker-retirement-resume retirement: [\"src/main/runtime/terminal/surface/orca-runtime-terminal-close-continuity.test.ts\",\"src/main/runtime/construction/orca-runtime.test.ts\",\"src/main/agent-hooks/server/testing/authority/server-pane-authority.test.ts\",\"src/main/ipc/agent-hooks.test.ts\",\"src/main/ipc/agent-pane-authority-ownership.test.ts\",\"src/main/persistence/terminal-topology/persistence-pane-identity-migration.test.ts\",\"src/main/persistence/terminal-topology/persistence-pty-binding-reconciliation.test.ts\",\"src/main/pty/process-retirement/pty-descendant-termination.test.ts\",\"src/main/daemon/sessions/testing/session.test.ts\",\"src/main/daemon/terminal-host/testing/terminal-host.test.ts\",\"src/main/providers/local-pty/local-pty-provider-shutdown.test.ts\",\"src/main/runtime/workspaces/removal/worktree-teardown.test.ts\",\"src/renderer/src/store/slices/agent-status/agent-pane-authority.test.ts\",\"src/renderer/src/store/terminals/terminal-pane-detach-agent-identity.test.ts\",\"src/renderer/src/store/terminals/terminal-tab-retirement-store.test.ts\",\"tests/e2e/completed-worker-retirement-resume.unit.test.ts\",\"src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts\",\"tests/e2e/terminal-tab-close-restart-persistence.spec.ts\",\"tests/e2e/terminal-parked-close-retirement.spec.ts\",\"tests/e2e/agent-descendant-process-kill.spec.ts\",\"tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts\",\"tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts\"]",
- "Audit3437 complete prior assertionRefs before completed-worker-retirement-resume retirement: [{\"file\":\"src/main/runtime/terminal/surface/orca-runtime-terminal-close-continuity.test.ts\",\"assertions\":[\"final-pane terminal.close remains pending until one renderer durability acknowledgement retires the persisted tab and layout\",\"final-pane externally owned teardown commits session retirement before PTY stop, tolerates duplicate exit retirement, and preserves an unrelated live canary\",\"post-ack workspace-session loss falls back to renderer cleanup and verified PTY teardown while every pre-ack retirement error remains non-destructive\",\"renderer reload with the same provider-attested PTY incarnation preserves the exact handle\",\"same-id replacement incarnation publishes a new handle and makes the old handle deterministically stale\",\"hard graph loss and preallocated-handle supersession make the retained renderer handle deterministically stale\"]},{\"file\":\"tests/e2e/terminal-tab-close-restart-persistence.spec.ts\",\"assertions\":[\"a durability-acknowledged whole-tab close leaves zero terminal tabs and provider sessions after restart\"]},{\"file\":\"tests/e2e/completed-worker-retirement-resume.unit.test.ts\",\"assertions\":[\"explicit close revokes the exact live recovery record both before and after PTY exit removes the tab, while PTY exit alone preserves interrupted-session recovery\"]},{\"file\":\"tests/e2e/terminal-parked-close-retirement.spec.ts\",\"assertions\":[\"a long-lived exact PTY remains alive after its terminal view is parked\",\"closing the parked tab removes the exact PTY from the provider inventory and the visible tab model\"]},{\"file\":\"tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts\",\"assertions\":[\"an attached-window desktop host publishes the CLI-created terminal under the renderer publication epoch it inherits, proving the vulnerable classification path was taken rather than a headless or serve/SSH-shaped one\",\"with the target as the first host-created terminal, a renderer graph sync leaves the `terminal.create` tab in the host session inventory still naming its original daemon PTY\",\"the original fixture process answers a write through that handle with its own pid and a single READY line, so a respawned replacement cannot pass as a survivor\",\"the paired client applied that same sync and kept the tab with no replacement or resume tab appended\",\"an unrelated workspace keeps its own CLI terminal and PTY, and the client raises no direct local connection attempt or uncaught renderer error\"]},{\"file\":\"tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts\",\"assertions\":[\"a windowless serve host publishes host-created terminals under a headless epoch, never a renderer one, which is why it cannot reach the window-conditioned prune the desktop arm reproduces\",\"a later CLI dispatch leaves the earlier host-created terminal in the serve-host inventory still bound to its original PTY\",\"both original fixture processes answer writes through their own handles after the later dispatch\",\"the paired client mirrors exactly those two tabs with no replacement or resume tab appended, no direct local connection attempt, and no uncaught renderer error\"]},{\"file\":\"src/main/ipc/agent-pane-authority-ownership.test.ts\",\"assertions\":[\"pane authority transfer accepts only the canonical legacy/scoped runtime handle bound to the authoritative pane\"]},{\"file\":\"src/main/runtime/workspaces/removal/worktree-teardown.test.ts\",\"assertions\":[\"owned provider shutdowns start together so process-table snapshots can coalesce within a batch\",\"inventories above 32 sessions never exceed 32 concurrent provider shutdowns\"]},{\"file\":\"tests/e2e/agent-descendant-process-kill.spec.ts\",\"assertions\":[\"a detached-pgid descendant is alive before agent PTY kill and absent afterward\"]}]"
+ "Audit3437 complete prior assertionRefs before completed-worker-retirement-resume retirement: [{\"file\":\"src/main/runtime/terminal/surface/orca-runtime-terminal-close-continuity.test.ts\",\"assertions\":[\"final-pane terminal.close remains pending until one renderer durability acknowledgement retires the persisted tab and layout\",\"final-pane externally owned teardown commits session retirement before PTY stop, tolerates duplicate exit retirement, and preserves an unrelated live canary\",\"post-ack workspace-session loss falls back to renderer cleanup and verified PTY teardown while every pre-ack retirement error remains non-destructive\",\"renderer reload with the same provider-attested PTY incarnation preserves the exact handle\",\"same-id replacement incarnation publishes a new handle and makes the old handle deterministically stale\",\"hard graph loss and preallocated-handle supersession make the retained renderer handle deterministically stale\"]},{\"file\":\"tests/e2e/terminal-tab-close-restart-persistence.spec.ts\",\"assertions\":[\"a durability-acknowledged whole-tab close leaves zero terminal tabs and provider sessions after restart\"]},{\"file\":\"tests/e2e/completed-worker-retirement-resume.unit.test.ts\",\"assertions\":[\"explicit close revokes the exact live recovery record both before and after PTY exit removes the tab, while PTY exit alone preserves interrupted-session recovery\"]},{\"file\":\"tests/e2e/terminal-parked-close-retirement.spec.ts\",\"assertions\":[\"a long-lived exact PTY remains alive after its terminal view is parked\",\"closing the parked tab removes the exact PTY from the provider inventory and the visible tab model\"]},{\"file\":\"tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts\",\"assertions\":[\"an attached-window desktop host publishes the CLI-created terminal under the renderer publication epoch it inherits, proving the vulnerable classification path was taken rather than a headless or serve/SSH-shaped one\",\"with the target as the first host-created terminal, a renderer graph sync leaves the `terminal.create` tab in the host session inventory still naming its original daemon PTY\",\"the original fixture process answers a write through that handle with its own pid and a single READY line, so a respawned replacement cannot pass as a survivor\",\"the paired client applied that same sync and kept the tab with no replacement or resume tab appended\",\"an unrelated workspace keeps its own CLI terminal and PTY, and the client raises no direct local connection attempt or uncaught renderer error\"]},{\"file\":\"tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts\",\"assertions\":[\"a windowless serve host publishes host-created terminals under a headless epoch, never a renderer one, which is why it cannot reach the window-conditioned prune the desktop arm reproduces\",\"a later CLI dispatch leaves the earlier host-created terminal in the serve-host inventory still bound to its original PTY\",\"both original fixture processes answer writes through their own handles after the later dispatch\",\"the paired client mirrors exactly those two tabs with no replacement or resume tab appended, no direct local connection attempt, and no uncaught renderer error\"]},{\"file\":\"src/main/ipc/agent-pane-authority-ownership.test.ts\",\"assertions\":[\"pane authority transfer accepts only the canonical legacy/scoped runtime handle bound to the authoritative pane\"]},{\"file\":\"src/main/runtime/workspaces/removal/worktree-teardown.test.ts\",\"assertions\":[\"owned provider shutdowns start together so process-table snapshots can coalesce within a batch\",\"inventories above 32 sessions never exceed 32 concurrent provider shutdowns\"]},{\"file\":\"tests/e2e/agent-descendant-process-kill.spec.ts\",\"assertions\":[\"a detached-pgid descendant is alive before agent PTY kill and absent afterward\"]}]",
+ "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed."
],
"demotionRule": "Keep experimental or demote to protection none if exact PTY disappearance flakes, a sibling/detached pane is retired, late hooks can recreate closed authority, or a renderer graph sync retires a host-created tab that no explicit close retired."
},
@@ -6412,7 +6385,7 @@
"providers": ["daemon", "runtime", "ssh", "wsl"],
"coveredPlatforms": ["linux", "macos", "windows"],
"coveredProviders": ["daemon", "runtime"],
- "coverageNotes": "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2153: Reduced sources intentionally lose the forwarding smoke and retire an unrelated current selector; historical runs do not validate changed source bytes. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2020: The CLI WebSocket source retains old-protocol refusal only; its paired-open, capability, timeout and admission projection examples are removed. No daemon-generation coverage is transferred to that callback. Both independent daemon E2E receipts remain unchanged at their original commands; the reduced unit selector has no fresh result. Historical prior account (preserved verbatim): Audit1983: Delete the reasonless-close scalar suite and optional-capability socket forwarding alias. Delete the mocked close-attribution topology field-inventory suite and its aliases/selectors; preserve independent dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1957:11, 1957:35, 1957:36): The fixture-supplied repository roundtrip, isolated capability metadata readback, parser/default-timer/size-threshold/internal failure-counter examples and standalone handshake-only replay example are removed. Source11 retains real encrypted multi-client event ordering, reconnect snapshot and multiplex delivery under synthetic runtime state, and does not establish the broad handshake-to-reasonless-close refusal alias; retire that whole assertion object. Source36 capability metadata readback alias is retired. Source35 retains the actual v2 runtime-only metadata/downgrade refusal callback and captured mutating-trace fresh-nonce rejection; its mapped mobile-v2 refusal alias remains within modeled credential lookup scope. Both independent daemon E2E dated receipts remain byte-exact with their original commands and results. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Retain actual parked exit/disposal/cancel/leaf progression using injected exit and close adapters. The retained last-watcher case checks exact lifecyclePtyId, but no retained callback establishes the whole existing replacement-or-sibling-incarnation alias. Retire that broad assertion object rather than transfer partial support. Capability admission, static fields and duplicate routing examples are intentionally lost; unchanged daemon E2E receipts remain scoped to their own commands. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): The browser auth capability-advertisement case is removed in this audit; its direct encrypted-auth literal alarm is lost. Retained lifecycle evidence is not an equivalent replacement. Historical run commands and results remain historical. Recorded native Windows evidence covers the v21/v22/v23/v24/v25 named-pipe matrix. The deterministic daemon harness covers capable and legacy paired-runtime request shapes against live v25/v26 PTYs in separate worktrees, plus an unrelated control. Host/renderer tests cover old servers, missing liveness, stale publications, reused claims, split parents, explicit user intent, cross-profile isolation, remote runtime clients, SSH-provider routing, and WSL boundaries. A headed host paired to a separate live client, headless serve parity, Linux, SSH, and WSL remain explicit gaps. The audit removed private-router tests of mocked kill results and log fields. Their isolated success/failure attribution and pending-spawn tolerance alarms are no longer registered here; live lifecycle evidence does not establish equivalent log coverage. The isolated close-intent suite was removed. web-runtime-session.test.ts no longer supplies the lifecycle-close or old-server method-not-found assertions formerly referenced here. Their direct partition and RPC-shape alarms are lost; retained live daemon evidence does not establish equivalent coverage. The broad mirror fixture retains user-close suppression, refused-close reconciliation and optimistic reorder only. Its earlier reconnect/incarnation and projection examples no longer establish current daemon-generation coverage. Those narrow alarms are lost; other daemon evidence is not equivalent replacement coverage. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
+ "coverageNotes": "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed. Audit3881 intentionally removes the entire legacy E2EE channel and mobile socket-wiring test suites and the v2 additive runtime-capability refusal callback, without equivalent replacement. Those deleted suites leave current selectors and that v2 assertion alias is retired. Retained v2 replay/queue-counter cases do not establish the removed capability refusal. Reduced test bytes/selectors have no fresh execution in this static packet; independent dated daemon E2E receipts retain their complete original scope. Historical prior account (preserved verbatim): Git owner cleanup retires the mixed request-connection suite under repository test policy, including its encrypted request cancellation and cached paired-desktop authentication alarms, without equivalent replacement. Current commands and assertion references omit the retired suite; dated evidence retains its original scope and does not validate this reduced set. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2153: Reduced sources intentionally lose the forwarding smoke and retire an unrelated current selector; historical runs do not validate changed source bytes. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2020: The CLI WebSocket source retains old-protocol refusal only; its paired-open, capability, timeout and admission projection examples are removed. No daemon-generation coverage is transferred to that callback. Both independent daemon E2E receipts remain unchanged at their original commands; the reduced unit selector has no fresh result. Historical prior account (preserved verbatim): Audit1983: Delete the reasonless-close scalar suite and optional-capability socket forwarding alias. Delete the mocked close-attribution topology field-inventory suite and its aliases/selectors; preserve independent dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1957:11, 1957:35, 1957:36): The fixture-supplied repository roundtrip, isolated capability metadata readback, parser/default-timer/size-threshold/internal failure-counter examples and standalone handshake-only replay example are removed. Source11 retains real encrypted multi-client event ordering, reconnect snapshot and multiplex delivery under synthetic runtime state, and does not establish the broad handshake-to-reasonless-close refusal alias; retire that whole assertion object. Source36 capability metadata readback alias is retired. Source35 retains the actual v2 runtime-only metadata/downgrade refusal callback and captured mutating-trace fresh-nonce rejection; its mapped mobile-v2 refusal alias remains within modeled credential lookup scope. Both independent daemon E2E dated receipts remain byte-exact with their original commands and results. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Retain actual parked exit/disposal/cancel/leaf progression using injected exit and close adapters. The retained last-watcher case checks exact lifecyclePtyId, but no retained callback establishes the whole existing replacement-or-sibling-incarnation alias. Retire that broad assertion object rather than transfer partial support. Capability admission, static fields and duplicate routing examples are intentionally lost; unchanged daemon E2E receipts remain scoped to their own commands. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): The browser auth capability-advertisement case is removed in this audit; its direct encrypted-auth literal alarm is lost. Retained lifecycle evidence is not an equivalent replacement. Historical run commands and results remain historical. Recorded native Windows evidence covers the v21/v22/v23/v24/v25 named-pipe matrix. The deterministic daemon harness covers capable and legacy paired-runtime request shapes against live v25/v26 PTYs in separate worktrees, plus an unrelated control. Host/renderer tests cover old servers, missing liveness, stale publications, reused claims, split parents, explicit user intent, cross-profile isolation, remote runtime clients, SSH-provider routing, and WSL boundaries. A headed host paired to a separate live client, headless serve parity, Linux, SSH, and WSL remain explicit gaps. The audit removed private-router tests of mocked kill results and log fields. Their isolated success/failure attribution and pending-spawn tolerance alarms are no longer registered here; live lifecycle evidence does not establish equivalent log coverage. The isolated close-intent suite was removed. web-runtime-session.test.ts no longer supplies the lifecycle-close or old-server method-not-found assertions formerly referenced here. Their direct partition and RPC-shape alarms are lost; retained live daemon evidence does not establish equivalent coverage. The broad mirror fixture retains user-close suppression, refused-close reconciliation and optimistic reorder only. Its earlier reconnect/incarnation and projection examples no longer establish current daemon-generation coverage. Those narrow alarms are lost; other daemon evidence is not equivalent replacement coverage. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/9749",
"https://github.com/stablyai/orca/issues/9949",
@@ -6421,21 +6394,16 @@
"https://github.com/stablyai/orca/issues/9229"
],
"invariant": "Reconnect, replay, or lifecycle observations from a viewer that negotiated explicit close intent must never kill a live PTY. A capable reasonless close must keep and republish; a legacy paired viewer must retain current-main behavior because its intentional close and cleanup echo are wire-identical. Lifecycle close requires the exact observed publication, terminal, environment, and authoritative liveness, never signals a process, and leaves renderer-owned or partial-split retirement to its owner. Legacy daemon hello and warm reattachment remain non-destructive.",
- "oracle": "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1983: Delete the reasonless-close scalar suite and optional-capability socket forwarding alias. Delete the mocked close-attribution topology field-inventory suite and its aliases/selectors; preserve independent dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1957:11, 1957:35, 1957:36): The fixture-supplied repository roundtrip, isolated capability metadata readback, parser/default-timer/size-threshold/internal failure-counter examples and standalone handshake-only replay example are removed. Source11 retains real encrypted multi-client event ordering, reconnect snapshot and multiplex delivery under synthetic runtime state, and does not establish the broad handshake-to-reasonless-close refusal alias; retire that whole assertion object. Source36 capability metadata readback alias is retired. Source35 retains the actual v2 runtime-only metadata/downgrade refusal callback and captured mutating-trace fresh-nonce rejection; its mapped mobile-v2 refusal alias remains within modeled credential lookup scope. Both independent daemon E2E dated receipts remain byte-exact with their original commands and results. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Retain actual parked exit/disposal/cancel/leaf progression using injected exit and close adapters. The retained last-watcher case checks exact lifecyclePtyId, but no retained callback establishes the whole existing replacement-or-sibling-incarnation alias. Retire that broad assertion object rather than transfer partial support. Capability admission, static fields and duplicate routing examples are intentionally lost; unchanged daemon E2E receipts remain scoped to their own commands. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Start isolated v25 and v26 daemon generations with one capable-viewer PTY and one legacy-viewer PTY per generation in four target worktrees plus an unaddressed control PTY in a fifth worktree. Route them through the production desktop scanner, runtime, RPC dispatcher, renderer-close relay, and daemon router. First issue sequential reasonless closes from an authenticated capable connection and require refusal, snapshot republish, zero shutdown calls, exact process survival, and post-close I/O. Then issue the byte-identical requests without the negotiated capability and require current-main behavior: two ordered immediate shutdowns, session-killed events, and exact root/descendant death, while capable and control PTYs survive. An observer lists all targets before, between, and after while issuing zero closes. Unit contracts also require in-process reasonless refusal, legacy runtime/mobile compatibility, explicit user closes, encrypted client-auth advertisement, and old-server lifecycle calls never to fall back.",
+ "oracle": "Audit3881 intentionally removes the entire legacy E2EE channel and mobile socket-wiring test suites and the v2 additive runtime-capability refusal callback, without equivalent replacement. Those deleted suites leave current selectors and that v2 assertion alias is retired. Retained v2 replay/queue-counter cases do not establish the removed capability refusal. Reduced test bytes/selectors have no fresh execution in this static packet; independent dated daemon E2E receipts retain their complete original scope. Historical prior account (preserved verbatim): Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed. Historical prior account (preserved verbatim): Audit3814 deliberately retires60 authored/60 finite cases:53runtime compatibility cases,4native XCTest methods and3Python clipboard methods, including the entire StableElementIndexes suite. Clipboard cuts retire the one-over-cap sample, incoming-offer destruction trace and sequential20-copy replay; actual wire, FD/pipe, startup and Xvfb/GTK boundaries remain without equivalent replacement claims. Accepted losses include narrow terminal-send payload/provider projections, legacy and direct no-op/error permutations, timing/work-count examples, private state/title/activity projections and fixture-driven readiness examples, individually enumerated below. These include real bounded production alarms consciously retired for marginal value; retained failed writes, duplicate submission, stale capture, transcript/ring and allocation fences are not equivalent replacements. No fresh native/remote/browser execution or complete transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3806 deliberately retires40 authored/40 finite runtime compatibility cases, including the terminal-side-effect-facts-part03 headless-snapshots-part02 and agent-status-and-waits-part03 fragments, plus20 scalar Swift precondition sites. Lost runtime alarms include status/title/attention projection examples, simple renderer/headless frame restoration and status waiting outcomes detailed in the accepted-loss ledger. Swift cuts retire duplicate generation-map/schema/navigation/bridge and notification-wrapper assertions; no standalone native program is deleted. These include real bounded production alarms consciously retired for marginal value. Retained races, pending writes/reflow, namespace and waiter ownership are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3798 deliberately retires21 authored/24 finite compatibility cases, including the entire SSH-worktree-lifecycle and repository-project-operations fragments. Accepted losses include navigation-only settings acknowledgement, browser session cleanup and host preservation projections, window positive/policy-state examples, terminal recovery/reload and no-incarnation remint examples, terminal listing compatibility/malformed IDs, directory browse/sort/Windows path smoke, SSH create refusal/manual lineage, recursive parent-folder creation and fork/origin/avatar/icon projections. Real bounded production alarms are consciously retired for marginal value; retained authority races, cleanup/clone ownership, pending waiters, nested-folder and scan invalidation cases are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3774 (independent peer expansion of3773): deliberately retire7authored/13potential expanded registrations across4whole suites: standalone truncated8-byte E2EE guard; open/empty readiness null fast-path; capability parser acceptance/atomic malformed-array bounds; phone/delegated-parent/desktop/in-process creator provenance projections. These are real guard/policy alarms accepted as low marginal value, not tautologies. No equivalent replacement, authenticated-refusal, observer delivery, persisted visibility, synchronous scheduling or fresh execution is claimed. Prior dated receipts retain their exact original scopes and do not validate the changed/reduced current selector. Independent daemon E2E receipts remain scoped to their own unchanged commands. Historical prior account (preserved verbatim): Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1983: Delete the reasonless-close scalar suite and optional-capability socket forwarding alias. Delete the mocked close-attribution topology field-inventory suite and its aliases/selectors; preserve independent dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1957:11, 1957:35, 1957:36): The fixture-supplied repository roundtrip, isolated capability metadata readback, parser/default-timer/size-threshold/internal failure-counter examples and standalone handshake-only replay example are removed. Source11 retains real encrypted multi-client event ordering, reconnect snapshot and multiplex delivery under synthetic runtime state, and does not establish the broad handshake-to-reasonless-close refusal alias; retire that whole assertion object. Source36 capability metadata readback alias is retired. Source35 retains the actual v2 runtime-only metadata/downgrade refusal callback and captured mutating-trace fresh-nonce rejection; its mapped mobile-v2 refusal alias remains within modeled credential lookup scope. Both independent daemon E2E dated receipts remain byte-exact with their original commands and results. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Retain actual parked exit/disposal/cancel/leaf progression using injected exit and close adapters. The retained last-watcher case checks exact lifecyclePtyId, but no retained callback establishes the whole existing replacement-or-sibling-incarnation alias. Retire that broad assertion object rather than transfer partial support. Capability admission, static fields and duplicate routing examples are intentionally lost; unchanged daemon E2E receipts remain scoped to their own commands. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Start isolated v25 and v26 daemon generations with one capable-viewer PTY and one legacy-viewer PTY per generation in four target worktrees plus an unaddressed control PTY in a fifth worktree. Route them through the production desktop scanner, runtime, RPC dispatcher, renderer-close relay, and daemon router. First issue sequential reasonless closes from an authenticated capable connection and require refusal, snapshot republish, zero shutdown calls, exact process survival, and post-close I/O. Then issue the byte-identical requests without the negotiated capability and require current-main behavior: two ordered immediate shutdowns, session-killed events, and exact root/descendant death, while capable and control PTYs survive. An observer lists all targets before, between, and after while issuing zero closes. Unit contracts also require in-process reasonless refusal, legacy runtime/mobile compatibility, explicit user closes, encrypted client-auth advertisement, and old-server lifecycle calls never to fall back.",
"commands": [
- "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/e2ee-channel.test.ts src/main/runtime/rpc/e2ee-channel-v2.test.ts src/main/runtime/rpc/mobile-socket-wiring.test.ts src/main/runtime/rpc/runtime-client-capabilities.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/shared/remote-runtime/requests/remote-runtime-request-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/cli/runtime/websocket-transport.test.ts src/renderer/src/web/web-runtime-client.test.ts src/renderer/src/components/terminal/terminal-tab-actions.test.ts src/renderer/src/components/terminal/terminal-close-incarnation.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/mobile/e2ee/e2ee-channel-v2.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/cli/runtime/websocket-transport.test.ts src/renderer/src/web/web-runtime-client.test.ts src/renderer/src/components/terminal/terminal-tab-actions.test.ts src/renderer/src/components/terminal/terminal-close-incarnation.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts",
"pnpm exec playwright test tests/e2e/daemon-generation-reconnect-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"pnpm exec playwright test tests/e2e/daemon-generation-legacy-close-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/main/runtime/construction/orca-runtime.test.ts",
-
- "src/main/runtime/rpc/e2ee-channel.test.ts",
- "src/main/runtime/rpc/e2ee-channel-v2.test.ts",
- "src/main/runtime/rpc/mobile-socket-wiring.test.ts",
- "src/main/runtime/rpc/runtime-client-capabilities.test.ts",
+ "src/main/runtime/rpc/mobile/e2ee/e2ee-channel-v2.test.ts",
"src/shared/remote-runtime/remote-runtime-client.test.ts",
- "src/shared/remote-runtime/requests/remote-runtime-request-connection.test.ts",
"src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts",
"src/cli/runtime/websocket-transport.test.ts",
"src/renderer/src/web/web-runtime-client.test.ts",
@@ -6464,27 +6432,11 @@
"shutdown-dispose-failed drops named-pipe authority within the deadline and exact fixture cleanup leaves no process tree"
]
},
- {
- "file": "src/main/runtime/rpc/e2ee-channel-v2.test.ts",
- "assertions": ["mobile E2EE v2 continues to reject additive runtime capability metadata"]
- },
- {
- "file": "src/main/runtime/rpc/runtime-client-capabilities.test.ts",
- "assertions": [
- "the authenticated capability parser accepts only bounded string arrays and rejects malformed or oversized input"
- ]
- },
{
"file": "src/shared/remote-runtime/remote-runtime-client.test.ts",
"assertions": [
"one-shot and subscription runtime clients remain compatible while sending encrypted client authentication"
]
- },
- {
- "file": "src/shared/remote-runtime/requests/remote-runtime-request-connection.test.ts",
- "assertions": [
- "the cached paired-desktop request connection advertises close-intent support in encrypted authentication while reusing one socket"
- ]
}
],
"evidenceRuns": [
@@ -6531,6 +6483,10 @@
"Add live Linux SSH-relay and Windows WSL reconnect artifacts without weakening keep-on-unknown."
],
"knownGaps": [
+ "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed.",
+ "Audit3814 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle from a Codex ready prompt even when stale startup lines remain :: Stale MCP startup lines must not block a later Codex ready header.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle when a stale Codex prompt is followed by the ready header :: A Codex ready header following a stale resume prompt must satisfy tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for an idle Cursor lane past its dismissed trust dialog (#8210) :: Later Cursor idle banner overrides retained trust dialog.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not block a mid-run Cursor lane on its dismissed trust dialog (#8210) :: Dismissed trust dialog must not report blocked for later busy Cursor; wait times out.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not classify unrelated press-enter prompts as Codex blocked prompts :: Unidentified press-enter text must time out rather than be classified Codex blocked.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for quiet background PTY agents without OSC titles :: Quiet Codex background terminal without OSC title eventually resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: sends agent prompts as bracketed paste before submit :: Driving prompt escapes embedded paste-end ESC, writes one framed paste then CR, and counts bytes.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: settles a foreground Codex prompt when launch metadata has not arrived :: Codex inferred from foreground without launch metadata waits for composer marker/quiescence before one CR.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: gives a late Codex render marker a fresh quiescence window :: Marker arriving at7.9s re-arms fresh quiet window instead of submitting at initial cap.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: writes large agent prompt paste frames atomically before delayed submit :: A prompt larger than input chunk budget is a single paste write before delayed CR with exact byte count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects oversized terminal.send text before provider writes :: Oversized ordinary terminal.send rejects input-too-large before any provider write.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects focusing an exited background terminal session :: focusTerminal refuses terminal_exited before invoking background reveal.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: pastes the same bytes the desktop draft paste sent for the prompt :: Launch-ready prompt normalizes CR/LF and renders embedded ESC visibly identically to desktop bracketed paste.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: keeps a prompt into a running agent behind the render settle, as before :: Driving prompt remains held through7s repaint activity then submits once by9s.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reports a queued PTY focus as not navigated when its notifier disappears :: Queued PTY focus and completed active reveal report not navigated after notifier removal; no second reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: does not invoke a stale graph-leaf focus notifier after queued PTY work :: Queued graph-leaf focus must not invoke old notifier after preceding PTY reveal and notifier removal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: paginates retained terminal output with explicit limits and truncation metadata :: Preview120lines, fractional limits,50/200 pages, retained2000line truncation and future-cursor metadata stay consistent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: falls back to renderer visible screen when uncursored TUI tail is blank :: Substantial blank uncursored tail uses mounted renderer visible screen with zero scrollback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reads and shows the runtime-owned alternate-screen grid without serialization :: Actual runtime alternate-screen grid provides read/show content without renderer/provider serialization.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: classifies older provider alternate-screen snapshots from ANSI :: Older provider without alternateScreen metadata classifies ANSI alternate entry and returns Remote Vim screen.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: honors the last ANSI screen transition when older provider metadata is absent :: Last ANSI alternate exit overrides earlier entry when explicit provider mode metadata is absent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: rejects a full provider screen frame after live output advances :: Live output arriving during second full-screen capture causes screen-unavailable rather than stale full frame.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: shares one provider snapshot between concurrent read and show calls :: Concurrent read/show share one successful provider snapshot and both receive Shared TUI content.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps cursor reads provider-free on restored alternate-screen PTYs :: Restored alternate-screen cursor transcript reads never acquire provider snapshot.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: backs off after a provider snapshot failure instead of retrying for show :: Failed provider capture is cached/backed off so later show does not retry.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: falls back once to a mounted renderer when a known alternate provider fails :: A known-alternate failed provider capture falls back exactly once to newly mounted renderer.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: bounds provider visible frames for read and show responses :: Provider visible read/show use six bounded lines and300character preview.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps renderer-fallback composer drafts separate from terminal output :: Renderer fallback strips dim composer draft from terminal output and exposes draft separately.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: does not use renderer visible-screen fallback for a short blank shell tail :: Two blank shell lines must not trigger renderer screen fallback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: trims terminal tail character budget without per-line array shifts :: Tail builder trims to256KiB with correct retained suffix and no Array.shift calls.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains ANSI-only status redraws instead of appending every frame :: Repeated erase/redraw replaces preview until newline then publishes one completed cursor row.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains split multi-line ANSI footer redraw state across chunks :: CUU state across chunks retains corrected footer rows and publishes new cursor entries.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not let stale lower rows hide earlier corrected footer rows from cursor reads :: Earlier corrected footer row must not be hidden by stale lower rows in cursor reads.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: bounds completed transcript entries from a single multi-line redraw chunk :: Single redraw chunk bounds completed transcript to2000retained lines and correct oldest/next/latest cursors.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains multi-line ANSI redraws when the last footer row stays partial :: Partial final redrawn row appears in preview but cursor sees it only after newline.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not retain split ANSI controls as visible terminal preview text :: Split color/mode escapes never leak preview fragments; long split OSC title truncates at MAX_OSC_TITLE_CHARS.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains same-line redraw cursor position across split full-line erase chunks :: Full-line erase preserves column across chunks so XY follows three spaces rather than old ABC.\nsrc/main/runtime/orca-runtime-tests/conpty-stream-read.spec.ts :: fills the requested line count even when blank rows sit below the prompt :: Blank rows below a ConPTY prompt must not consume the requested nonempty-line count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: does not retain split ST-terminated string controls as preview text :: Split ST-terminated Kitty/string controls must remain excluded from preview text.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects split OSC titles before retaining terminal previews :: Split BEL OSC title must update working title/status without leaking into preview.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects ST-terminated OSC titles split before the final backslash :: ST OSC split before final backslash must update title without leaking framing.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: preserves a trailing escape after a completed OSC title :: Completed OSC followed by pending ESC must preserve the next idle-title transition.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: seeds newly synced leaves from PTY pending ANSI state :: A newly synced graph leaf inherits pending ANSI so a split color fragment cannot leak.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: bounds retained partial terminal output before preview reads :: Partial terminal state stays capped at 4000, preserves retained array identity, and preview truncation/cursor output remains correct.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: submits the mail pointer to Cursor Agent only after the paste-burst delay :: Cursor mailbox pointer Enter must wait through the paste-burst delay; this is a real input-timing alarm intentionally retired.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts :: adopts a v1.4.150-shaped agent, setup, and shell orphan as one topology transaction :: Stale incarnation refuses without topology change; three agent/setup/shell lanes adopt atomically with layout/group/revision and preserved read/input/resize; exact replay is idempotent and competing owner refuses.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: retires the exact worker when it exits after renderer reveal :: Exact worker exit after reveal retires that worker and its surface.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: re-reveals a recovered worker after the renderer graph epoch changes :: Changed renderer graph epoch invalidates reveal receipt and forces another reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: defers recovery when the renderer omits the exact reveal identity :: Missing exact reveal identity defers recovery after two attempts.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: reconciles a same-id process replacement before headless adoption :: A process replacement before headless adoption must fence off stale ownership.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retires provider resume only after authoritative inventory proves the legacy PTY exited :: Authoritative owning-host inventory overrides false local hasPty, avoids SSH scanning, retires exited provider resume/surface, adopts live workers without headless reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retries inventory and unknown liveness without revealing a ghost worker :: Inventory failure and unknown liveness must retry without ghost reveal, eventually adopt, and stop retrying.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: refuses a live reserved pane before issuing a handle or revealing it :: A requireFreshPane launch receiving a live reserved owner must reject before handle/reveal/kill, and release its claim. No equivalent replacement claimed.",
+ "Audit3806 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: skips a listener unsubscribed mid-fan-out even with mobile exclusions active :: A listener removed by an earlier listener during one fanout is not called, including with a side-effect-excluded mobile listener present.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: retains bytes emitted before a fresh daemon spawn resolves :: Bytes and title arriving before an initial zero/reset provider response survive in the serialized headless buffer with their counted sequence.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits command-finished facts with best-effort exit codes across chunk splits :: A split OSC133 D exit code becomes130 and a missing code becomes null in ordered command-finished facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits pr-link facts once per URL with batch attribution :: A split GitHub PR URL yields42 rather than4, emits42/43 once each, and carries PTY/worktree/tab attribution.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits 2031-subscribe facts across chunk splits :: Split ESC[?20 then31h emits exactly one2031-subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: restores a provisional 2031 subscribe when daemon scan authority returns :: Returning daemon scan authority with partial scan seed and pending2031 subscription restores exactly one subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers the tracked title over the renderer snapshot lastTitle :: A synthetic live Cursor title overrides stale renderer lastTitle while preserving renderer snapshot source.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers provider history over a partial headless mirror for requested snapshots :: Authoritative requested snapshots return supplied provider frame/history/seq rather than a partial headless mirror, requesting5000rows.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: tracks live alternate-screen transitions after a provider snapshot :: Provider alternateScreen true is accepted, then live1049l/1049h update isTerminalAlternateScreen false/true.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: translates reset provider snapshots without retaining the old title :: A reset provider snapshot translates new local seq into the runtime domain and replaces Old process title with New process.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits the chunk agentStatus events before its side-effect batch :: Agent status callback precedes side-effect batch callback for one coalesced OSC9999/title/bell chunk.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: still emits a throwing chunk’s facts under its own seq, not the next chunk’s :: A tracker throw still flushes first chunk title facts under its own seq, and second chunk does not inherit those facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: seeds the lazily created tracker from the daemon-snapshot title :: A lazy tracker hydrated from renderer snapshot title Codex working emits agent-idle on later Codex done.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits command-code-working facts only after the banner arms the scrape :: Unarmed Thinking text emits no facts; a Command Code0.27.3 banner then hardcoded colored spinner text emits attributed command-code-working with the submitted prompt.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits a command-code-done fact when the idle composer returns :: After hardcoded banner/working text, returned idle composer emits command-code-done with the earlier submitted prompt.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: resizes the headless mirror after an accepted desktop PTY resize :: An external accepted resize produces the resized dimensions and same status-frame lines as a separately driven reference emulator.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: replaces suffix-only headless state with the recovered renderer snapshot :: Replacing suffix-only state removes old suffix, retains renderer history plus later output/cwd, and returns the live47x40PTY grid.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: stamps SSH connection identity on runtime terminal status :: A synthetic mounted-leaf OSC9999 status after registerPty carries the supplied SSH connectionId.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: does not retain WSL context when a PTY id is reused :: After exit and same-ID new null distro context, OSC7 file://server/share/repo uses UNC server path rather than old Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: preserves immutable context while a live daemon attach is unresolved :: preparePtyExecutionContext with preserveExisting refuses a supplied Debian replacement and subsequent OSC7 keeps original Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts :: projects frame-independent live state through main buffer snapshots :: Main-buffer snapshot puts focus-report/cursor-visibility modes in frameRestoreAnsi, excludes STATIC-FRAME there and includes it in data.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts :: continues terminal agent status fanout when a callback throws :: Throwing on the first status callback does not prevent second payload delivery and logs contextual error.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: returns a title-only replay snapshot and never historical attention :: Lose replay:true/title-only fact projection despite earlierbell and unknownPTYnull. No actual delivered-history notification or reattach behavior was exercised. No equivalent replacement claimed.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects a handle rebind while a controller-less status check yields :: A handle rebound while the null-controller status continuation yields must throw terminal_handle_stale.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects confirmation evidence when the owning PTY exits :: A pending strong confirmation resolving after owning PTY exit must reject terminal_exited.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts :: keeps ordinary terminal send suffix failures on the existing not-writable contract :: Ordinary send writes text but refused CR must throw terminal_not_writable with beforeWrite twice and afterWrite once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell the execution host cannot apply instead of spawning its default :: Requested Windows shell on POSIX must refuse before spawning a default shell.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: quotes the agent startup command for the requested shell, not the host default :: Requested cmd shell must override PowerShell default quoting for agent startup command.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: keeps restored receipts outside a targeted worktree scan :: Targeted scan removes the moved-worktree receipt while preserving another worktree receipt.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: observes setup command completion without waiting for its interactive shell to exit :: Nonzero completion marker 17 resolves while interactive shell remains running.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: falls back to setup terminal exit when no completion signal is available :: Setup completion observer without token falls back to actual exit code 9.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: cancels setup completion observation when the caller aborts :: Abort rejects with the original reason and unsubscribes once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps observing after an uncertain setup terminal status :: Unknown exit waiter result must leave observation pending until completion marker arrives.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh omits a record :: Controller inventory omission disconnects the record but preserves its retained transcript.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh times out :: Hung inventory timeout leaves connected record and retained transcript intact.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle for adopted background PTY handles from the renderer title :: An adopted background handle resolves tui-idle from ready Codex renderer title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves live-leaf tui-idle from an OpenCode native title :: A live leaf resolves tui-idle from an OpenCode native title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from a Codex ready prompt preview :: A supplied Codex prompt preview resolves tui-idle without an actual agent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from an Antigravity prompt before the model line :: A supplied Antigravity prompt before model line resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell with no workspace instead of creating a default-shell tab :: Workspace-less explicit shell must reject before renderer default-tab request or spawn. This real guard/wiring alarm is deliberately retired.",
+ "Audit3798 per-case accepted losses:\nsrc/main/runtime/orca-runtime-tests/paired-settings.spec.ts :: awaits navigation-only updates from paired clients (%s) :: Updating only claudeSubagentNavigationEnabled waits for the actual controller call to the supplied pending Claude-view reconcile for both on/off values.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: drops a client page record even when its close command cannot be issued :: A removed workspace loses its runtime client-page record and headless browser projection despite close delivery_required rejection, and emits the asynchronous warning.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: leaves client-hosted pages alone when another host still owns the same worktree id :: Removing runtime:env-b metadata with local ownership leaves the local same-ID client page unchanged and issues no close command.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: marks live bindings again when reopening after a promoted window closes :: A reopened window marks its still-registered live worktree in activeWorktreeIdsOnShutdown after the first promoted window closes.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: preserves live SSH session identities when promoting a headless runtime :: Headless-to-desktop promotion records active worktree, SSH connection and remoteSessionIdsByTabId from the supplied surviving SSH PTY/session.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores a surviving renderer when its reload is cancelled :: A sole ready renderer reload cancelled under its current renderer fence returns true and becomes ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores headless authority when desktop promotion navigation is cancelled :: A cancelled desktop promotion with headless recovery returns false while headless authority remains ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: moves a desktop graph to unavailable when its reload times out :: A ready desktop graph without a headless fallback becomes unavailable at the reload deadline and retains its window/epoch.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: recovers a failed headless promotion and accepts a later renderer generation :: A promotion failure restores ready headless authority; a later valid same-window graph publishes ready desktop authority.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: clears a failed pane recovery so a later reconnect can retry :: After relay_reconnecting rejection, the pending recovery lock clears and the same pane/handle can call createTerminal a second time and return its supplied replacement.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: still preserves a CLI agent leaf when the reloaded renderer has not rebound its PTY :: An empty graph published during renderer reload preserves a preallocated live CLI PTY as one listable terminal before renderer rebind.\nsrc/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts :: keeps a no-incarnation handle across an in-graph pane remint :: Within one graph lifetime an unversioned PTY reminted onto another leaf retains its issued handle and resolves its old exit waiter after onPtyExit.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: matches explicit-id cwd PTYs when the resolved worktree cache is incomplete :: An explicit target absent from a fresh incomplete resolved cache adopts only its cwd PTY, rejects nested cwd PTY and does not rescan Git.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: ignores cwd-only controller PTYs for malformed explicit worktree IDs :: Malformed id:repo-1:: returns no terminals, does not adopt cwd-only controller PTY and avoids Git rescanning.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: refuses an SSH-backed create for mobile/runtime callers instead of creating locally :: Loss of this public unserved SSH create error-class/no-local-add/no-local-list alarm.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: records an app-selected parent workspace as a manual action :: Loss of the local runtime folder-parent manual origin, active-workspace source and explicit confidence projection alarm; no claim that SSH or cleanup coverage replaces it.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: browses runtime server directories before projects are added :: Loss of this public runtime alarm for browse availability before registration, directories-first lexical ordering and native path flavor.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: lists drive roots for a server-root browse :: Loss of the Windows public slash-root drive enumeration smoke and presence of the temporary directory drive.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations-part-02.spec.ts :: creates a missing runtime parent before creating the project directory :: Loss of this runtime createRepo recursive missing-parent/child existence and registered-path alarm.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: preserves selected project %s when a hosted parent is known :: Loss of both parent-selected and origin-selected normal fork-link projection/persisted upstream alarms plus exact single-probe count.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: links a current enterprise remote despite unavailable metadata and a retained %s :: Loss of normal current-enterprise-origin linking with stale automatic GitHub avatar or protected file image, unchanged icon assertion, and serialized project identity under unavailable metadata.",
"Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
"Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts. Unresolved local/computed edges remain explicit debt.",
"Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts. Unresolved local/computed edges remain explicit debt.",
@@ -6572,7 +6528,13 @@
"Audit2153 historical original commands item, preserved verbatim; retired selector is not active execution evidence: \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/server/remote-runtime-request-connection.integration.test.ts src/main/runtime/rpc/e2ee-channel.test.ts src/main/runtime/rpc/e2ee-channel-v2.test.ts src/main/runtime/rpc/mobile-socket-wiring.test.ts src/main/runtime/rpc/runtime-client-capabilities.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/shared/remote-runtime/requests/remote-runtime-request-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/cli/runtime/websocket-transport.test.ts src/renderer/src/web/web-runtime-client.test.ts src/renderer/src/components/terminal/terminal-tab-actions.test.ts src/renderer/src/components/terminal/terminal-close-incarnation.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts\"",
"Audit2153 historical original testFiles item, preserved verbatim; retired selector is not active execution evidence: \"src/main/runtime/rpc/server/remote-runtime-request-connection.integration.test.ts\"",
"Terminal/runtime defining-owner cleanup retires complete parking timer, lifecycle, mocked close/disposal and render/flip/mount work-count cases under repository test policy. The retained watcher source has only two literal-oracle coverage decisions; the retained cold-parking hook source has only the layout-PTY exemption invalidation case. Lost alarms include cooldown/measure/pin wakeups, split exit/close attribution and cancellation, watcher disposal/restart, flood timer rearm, worktree verdict damping, and destroyed-transport cold restore. No equivalent replacement coverage or execution pass for the reduced cases is claimed; prior dated receipts retain their original scope.",
- "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged."
+ "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
+ "Git owner cleanup retires the mixed request-connection suite under repository test policy, including its encrypted request cancellation and cached paired-desktop authentication alarms, without equivalent replacement. Current commands and assertion references omit the retired suite; dated evidence retains its original scope and does not validate this reduced set.",
+ "Audit3774 (independent peer expansion of3773): deliberately retire7authored/13potential expanded registrations across4whole suites: standalone truncated8-byte E2EE guard; open/empty readiness null fast-path; capability parser acceptance/atomic malformed-array bounds; phone/delegated-parent/desktop/in-process creator provenance projections. These are real guard/policy alarms accepted as low marginal value, not tautologies. No equivalent replacement, authenticated-refusal, observer delivery, persisted visibility, synchronous scheduling or fresh execution is claimed. Prior dated receipts retain their exact original scopes and do not validate the changed/reduced current selector. Independent daemon E2E receipts remain scoped to their own unchanged commands.",
+ "Audit3774 historical original active selector/assertion arrays, preserved verbatim; no replacement coverage claim.\ncommands:\n[\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/mobile/e2ee/e2ee-channel.test.ts src/main/runtime/rpc/mobile/e2ee/e2ee-channel-v2.test.ts src/main/runtime/rpc/mobile/mobile-socket-wiring.test.ts src/main/runtime/rpc/callers/runtime-client-capabilities.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/cli/runtime/websocket-transport.test.ts src/renderer/src/web/web-runtime-client.test.ts src/renderer/src/components/terminal/terminal-tab-actions.test.ts src/renderer/src/components/terminal/terminal-close-incarnation.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts\",\n \"pnpm exec playwright test tests/e2e/daemon-generation-reconnect-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n \"pnpm exec playwright test tests/e2e/daemon-generation-legacy-close-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"\n ]\ntestFiles:\n[\n \"src/main/runtime/construction/orca-runtime.test.ts\",\n \"src/main/runtime/rpc/mobile/e2ee/e2ee-channel.test.ts\",\n \"src/main/runtime/rpc/mobile/e2ee/e2ee-channel-v2.test.ts\",\n \"src/main/runtime/rpc/mobile/mobile-socket-wiring.test.ts\",\n \"src/main/runtime/rpc/callers/runtime-client-capabilities.test.ts\",\n \"src/shared/remote-runtime/remote-runtime-client.test.ts\",\n \"src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n \"src/cli/runtime/websocket-transport.test.ts\",\n \"src/renderer/src/web/web-runtime-client.test.ts\",\n \"src/renderer/src/components/terminal/terminal-tab-actions.test.ts\",\n \"src/renderer/src/components/terminal/terminal-close-incarnation.test.ts\",\n \"src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts\",\n \"tests/e2e/daemon-generation-reconnect-safety.spec.ts\",\n \"tests/e2e/daemon-generation-legacy-close-safety.spec.ts\"\n ]\nassertionRefs:\n[\n {\n \"file\": \"tests/e2e/daemon-generation-legacy-close-safety.spec.ts\",\n \"assertions\": [\n \"one identified capable viewer and one legacy viewer issue byte-identical sequential reasonless closes while a third viewer lists every target before, between, and after but issues zero closes\",\n \"capable v25/v26 PTY root/descendant incarnations in separate worktrees survive, answer post-close input, and produce zero shutdown calls and zero daemon session-killed events\",\n \"legacy v25/v26 PTY root/descendant incarnations die through ordered immediate shutdown calls with one daemon session-killed event each, matching current-main behavior\",\n \"an unaddressed fifth-worktree PTY root and descendant survive with zero kill events, excluding global fanout\",\n \"the JSON reconstruction records request order, negotiated capabilities, viewer connection, worktree/tab/PTY ids, daemon PID/protocol, call site, and exact before/after process liveness\"\n ]\n },\n {\n \"file\": \"tests/e2e/daemon-generation-reconnect-safety.spec.ts\",\n \"assertions\": [\n \"the production scanner discovers v21/v22/v23/v24/v25 from v26 and every generation accepts repeated client hellos while every exact daemon, PTY-root, and descendant incarnation remains alive\",\n \"desktop and two remote profiles repeat lifecycle closes before and after client relaunch with zero session-killed events\",\n \"shutdown-dispose-failed drops named-pipe authority within the deadline and exact fixture cleanup leaves no process tree\"\n ]\n },\n {\n \"file\": \"src/main/runtime/rpc/mobile/e2ee/e2ee-channel-v2.test.ts\",\n \"assertions\": [\"mobile E2EE v2 continues to reject additive runtime capability metadata\"]\n },\n {\n \"file\": \"src/main/runtime/rpc/callers/runtime-client-capabilities.test.ts\",\n \"assertions\": [\n \"the authenticated capability parser accepts only bounded string arrays and rejects malformed or oversized input\"\n ]\n },\n {\n \"file\": \"src/shared/remote-runtime/remote-runtime-client.test.ts\",\n \"assertions\": [\n \"one-shot and subscription runtime clients remain compatible while sending encrypted client authentication\"\n ]\n }\n ]",
+ "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed.",
+ "Audit3881 intentionally removes the entire legacy E2EE channel and mobile socket-wiring test suites and the v2 additive runtime-capability refusal callback, without equivalent replacement. Those deleted suites leave current selectors and that v2 assertion alias is retired. Retained v2 replay/queue-counter cases do not establish the removed capability refusal. Reduced test bytes/selectors have no fresh execution in this static packet; independent dated daemon E2E receipts retain their complete original scope.",
+ "Audit3881 historical original selector/assertion arrays, preserved verbatim; retired entries are not active execution evidence or replacement coverage.\ncommands:\n[\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/mobile/e2ee/e2ee-channel.test.ts src/main/runtime/rpc/mobile/e2ee/e2ee-channel-v2.test.ts src/main/runtime/rpc/mobile/mobile-socket-wiring.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/cli/runtime/websocket-transport.test.ts src/renderer/src/web/web-runtime-client.test.ts src/renderer/src/components/terminal/terminal-tab-actions.test.ts src/renderer/src/components/terminal/terminal-close-incarnation.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts\",\n \"pnpm exec playwright test tests/e2e/daemon-generation-reconnect-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n \"pnpm exec playwright test tests/e2e/daemon-generation-legacy-close-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"\n ]\ntestFiles:\n[\n \"src/main/runtime/construction/orca-runtime.test.ts\",\n \"src/main/runtime/rpc/mobile/e2ee/e2ee-channel.test.ts\",\n \"src/main/runtime/rpc/mobile/e2ee/e2ee-channel-v2.test.ts\",\n \"src/main/runtime/rpc/mobile/mobile-socket-wiring.test.ts\",\n \"src/shared/remote-runtime/remote-runtime-client.test.ts\",\n \"src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n \"src/cli/runtime/websocket-transport.test.ts\",\n \"src/renderer/src/web/web-runtime-client.test.ts\",\n \"src/renderer/src/components/terminal/terminal-tab-actions.test.ts\",\n \"src/renderer/src/components/terminal/terminal-close-incarnation.test.ts\",\n \"src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts\",\n \"tests/e2e/daemon-generation-reconnect-safety.spec.ts\",\n \"tests/e2e/daemon-generation-legacy-close-safety.spec.ts\"\n ]\nassertionRefs:\n[\n {\n \"file\": \"tests/e2e/daemon-generation-legacy-close-safety.spec.ts\",\n \"assertions\": [\n \"one identified capable viewer and one legacy viewer issue byte-identical sequential reasonless closes while a third viewer lists every target before, between, and after but issues zero closes\",\n \"capable v25/v26 PTY root/descendant incarnations in separate worktrees survive, answer post-close input, and produce zero shutdown calls and zero daemon session-killed events\",\n \"legacy v25/v26 PTY root/descendant incarnations die through ordered immediate shutdown calls with one daemon session-killed event each, matching current-main behavior\",\n \"an unaddressed fifth-worktree PTY root and descendant survive with zero kill events, excluding global fanout\",\n \"the JSON reconstruction records request order, negotiated capabilities, viewer connection, worktree/tab/PTY ids, daemon PID/protocol, call site, and exact before/after process liveness\"\n ]\n },\n {\n \"file\": \"tests/e2e/daemon-generation-reconnect-safety.spec.ts\",\n \"assertions\": [\n \"the production scanner discovers v21/v22/v23/v24/v25 from v26 and every generation accepts repeated client hellos while every exact daemon, PTY-root, and descendant incarnation remains alive\",\n \"desktop and two remote profiles repeat lifecycle closes before and after client relaunch with zero session-killed events\",\n \"shutdown-dispose-failed drops named-pipe authority within the deadline and exact fixture cleanup leaves no process tree\"\n ]\n },\n {\n \"file\": \"src/main/runtime/rpc/mobile/e2ee/e2ee-channel-v2.test.ts\",\n \"assertions\": [\"mobile E2EE v2 continues to reject additive runtime capability metadata\"]\n },\n {\n \"file\": \"src/shared/remote-runtime/remote-runtime-client.test.ts\",\n \"assertions\": [\n \"one-shot and subscription runtime clients remain compatible while sending encrypted client authentication\"\n ]\n }\n ]"
],
"demotionRule": "Keep experimental or quarantine if reconnect emits session-killed for a live canary, an exact root/descendant dies, an old server receives fallback destructive close, cleanup leaks a fixture process/pipe, or the gate flakes without a proven harness defect."
},
@@ -7078,7 +7040,7 @@
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
- "coverageNotes": "Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The Codex restart suite and exact command/testFiles/assertionRef are removed; its mock account-change/remote-pane restart alarms are intentionally lost. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3368 retires the whole host-session-launch unit source, including host-authority/create/ensure/legacy/Kimi/refusal/draft/options/prompt/cancel/kill/shared-disconnect and passive-sleep output callback alarms, without equivalent replacement. Its unit command token and test-file entry retire. Five unrelated macOS receipts remain verbatim and keep only their original scope; no fresh changed-selector/runtime/provider/process/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit3359 retires the whole create-handoff suite. Supplied disposition, late completion, close-callback and metadata-bookkeeping alarms are intentionally lost without equivalent replacement; the compound unit selector and test-file entry narrow accordingly. Five unrelated macOS receipts retain their original scope. No fresh runtime, process-deduplication, physical provider/network, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the caller-chat-target precedence over host selection example from web-session-tabs-sync-focus-intent.test.ts. The snapshot-before-RPC replay and split-sibling-first exact-leaf focus cases remain unchanged and match the existing assertion reference. Preserve current selectors, assertion references, unrelated active receipts and complete archived history. These mocked state-composition survivors provide no equivalent replacement, rendered, native, network or fresh execution proof. Audit2694 source-only review: Remove14 authored/14 expanded cases in the renderer completion wrapper family, including the complete bell/query-reply/stale-input factory, without replacement. Retain29 authored/34 expanded cases with unchanged callback bodies. Three removals are the existing pending2203 overlap and must be adopted/count-reconciled once; eleven are fresh removals. No current-source runtime or gate execution is supplied by this packet; dated evidence retains its original source scope and does not validate the reduced factory bytes. No equivalent replacement, physical provider, mixed-version, mobile, rendered UI, cross-platform, soak or measured-performance result is claimed. The existing command and testFiles selector retain tests/pty-connection-completion-and-notification.test.ts; no wrapper-specific assertionRef is removed. Historical selector results do not validate its changed reachable factories. Historical prior account (preserved verbatim): Audit2709 removes src/renderer/src/runtime/web-session-tabs-sync/inventory/remote-runtime-session-tabs-inflight.test.ts: intentionally retire waiting out an older inventory and sharing a fresh post-operation request among concurrent callers. No equivalent replacement or fresh execution is claimed. Dated receipts remain historical evidence for their unchanged selectors only; they do not validate the reduced commands or full current gate. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Delete the complete pure orphan-topology suite and its file membership; preserve the other selectors from its combined command after archiving the original command string. Lost alarms are synthetic current-layout preservation, one-anchor grafting and ambiguous-anchor appending examples. Do not transfer their ownership/topology scope to sibling suites. Preserve all5 independent historical receipts exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked agent-session suite and its prospective selector and aliases. Retire all3 whole dated changed-selector receipts, preserving their original raw objects in historical gaps without transferring counts or durations. Preserve5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial agent-operation service suite retains only concurrent retry joining with changed-fingerprint conflict. Retire its complete three-title assertion object: old-owner legacy fallback before side effects, nested SSH Pi transcript refusal and completed/ambiguous physical-commit replay fences are no longer backed. Other probe/launch option/ledger/failure/remote-inventory examples disappear as detailed below. No actual provider spawn, live SSH or physical commit proof is retained by this source. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1911: The complete provider PTY-inspection mock suite is removed: missing-provider rejection, stale-PTY renderer unverifiable mapping, preserved supplied renderer failures, and supplied transport-loss mapping alarms are intentionally lost. No actual terminal teardown, daemon error or remote transport was exercised. Only the deleted explicit source tokens, testFile and whole assertionRef are removed. Meaningful remaining source selectors/assertions and unaffected dated receipts retain their original scope. No equivalent replacement, fresh reduced-gate, native/platform/provider, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1495 intentionally deletes the orphan-owner suite: explicit owner/host predicate examples are retired; no equivalent replacement coverage or fresh result is claimed. Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts: Loses obsolete pending title process races, inspection failure suppression, explicit completion precedence and delayed remote inspection alarms. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audits1301 and1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic macOS tests cover controller claims, daemon and SSH/relay operation replay, mixed-version selection, runtime ownership, exact provisional handoff, durable terminal retirement, two independent viewer mirrors, guarded adoption of legacy live PTYs, and completion classification when either the outer remote transport or authoritative host/provider process inspection becomes unreachable. The adoption harness models v1.4.150 agent/setup/shell tabs, current-generation restart and reconnect, exact handle/incarnation/worktree/host checks, topology CAS, competing clients, split-pane/group restoration, WSL ownership, and SSH owner rejection. The secondary parity repro runs independent clients against one headless remote Orca runtime over encrypted pairing and a real daemon-backed PTY, with tokened fixture-process identity separated from unrelated Codex app-server startup probes. The automated primary topology runs an isolated headed macOS Orca desktop server plus a separate paired web client and proves viewer-local fresh/resume focus, exact legacy placement, writable PTYs, unrelated-terminal survival, and host/client cleanup. SSH coverage is provider/relay contract and fault-injection coverage only; it does not substitute for paired-server coverage. Live Windows, Linux, WSL, SSH, and physical paired-Linux hosts remain gaps. The isolated intent-owner ledger suite was removed. web-runtime-session.test.ts retains exact post-create handoff confirmation only; its previous fresh/resume presentation and publication-replay assertions are no longer current references. Those direct owner-partition, cap and RPC/focus alarms are lost; other agent-session evidence does not establish equivalence. Structured handoff and adopted-leaf focus references now point to their dedicated surviving fixtures. Mixed-version recovery retains actual old-host recovery followed by a new CLI tab; its unsupported/missing-evidence tables are removed. Orphan recovery retains in-flight adoption-conflict serialization only; previous topology/pruning and absence/adoption examples are removed. These removed projection, capability and adoption-shape alarms are lost; retained cases do not replace them. Audit1301: src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts reduced. Direct dedupe eviction/count and equal receipt-position sample loses authored alarm. No equivalent replacement coverage is claimed. Audit1308: src/renderer/src/runtime/web-session-tabs-sync-agent-handoff.test.ts removed. Exact provisional replacement and post-create exit confirmation handoff pipeline alarms disappear. No equivalent replacement coverage is claimed. Audit1313: src/main/runtime/terminal-orphan-topology.test.ts: Retain actual topology merge algorithms preserving disjoint subtrees and grafted/ambiguous shared anchors with independent expected trees. Remove duplicate leaf validator and empty/no-change passthrough examples. Lose basic validation and no-group/noop characterization; no renderer layout proof. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1342: src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
+ "coverageNotes": "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The Codex restart suite and exact command/testFiles/assertionRef are removed; its mock account-change/remote-pane restart alarms are intentionally lost. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3368 retires the whole host-session-launch unit source, including host-authority/create/ensure/legacy/Kimi/refusal/draft/options/prompt/cancel/kill/shared-disconnect and passive-sleep output callback alarms, without equivalent replacement. Its unit command token and test-file entry retire. Five unrelated macOS receipts remain verbatim and keep only their original scope; no fresh changed-selector/runtime/provider/process/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit3359 retires the whole create-handoff suite. Supplied disposition, late completion, close-callback and metadata-bookkeeping alarms are intentionally lost without equivalent replacement; the compound unit selector and test-file entry narrow accordingly. Five unrelated macOS receipts retain their original scope. No fresh runtime, process-deduplication, physical provider/network, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the caller-chat-target precedence over host selection example from web-session-tabs-sync-focus-intent.test.ts. The snapshot-before-RPC replay and split-sibling-first exact-leaf focus cases remain unchanged and match the existing assertion reference. Preserve current selectors, assertion references, unrelated active receipts and complete archived history. These mocked state-composition survivors provide no equivalent replacement, rendered, native, network or fresh execution proof. Audit2694 source-only review: Remove14 authored/14 expanded cases in the renderer completion wrapper family, including the complete bell/query-reply/stale-input factory, without replacement. Retain29 authored/34 expanded cases with unchanged callback bodies. Three removals are the existing pending2203 overlap and must be adopted/count-reconciled once; eleven are fresh removals. No current-source runtime or gate execution is supplied by this packet; dated evidence retains its original source scope and does not validate the reduced factory bytes. No equivalent replacement, physical provider, mixed-version, mobile, rendered UI, cross-platform, soak or measured-performance result is claimed. The existing command and testFiles selector retain tests/pty-connection-completion-and-notification.test.ts; no wrapper-specific assertionRef is removed. Historical selector results do not validate its changed reachable factories. Historical prior account (preserved verbatim): Audit2709 removes src/renderer/src/runtime/web-session-tabs-sync/inventory/remote-runtime-session-tabs-inflight.test.ts: intentionally retire waiting out an older inventory and sharing a fresh post-operation request among concurrent callers. No equivalent replacement or fresh execution is claimed. Dated receipts remain historical evidence for their unchanged selectors only; they do not validate the reduced commands or full current gate. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Delete the complete pure orphan-topology suite and its file membership; preserve the other selectors from its combined command after archiving the original command string. Lost alarms are synthetic current-layout preservation, one-anchor grafting and ambiguous-anchor appending examples. Do not transfer their ownership/topology scope to sibling suites. Preserve all5 independent historical receipts exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked agent-session suite and its prospective selector and aliases. Retire all3 whole dated changed-selector receipts, preserving their original raw objects in historical gaps without transferring counts or durations. Preserve5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial agent-operation service suite retains only concurrent retry joining with changed-fingerprint conflict. Retire its complete three-title assertion object: old-owner legacy fallback before side effects, nested SSH Pi transcript refusal and completed/ambiguous physical-commit replay fences are no longer backed. Other probe/launch option/ledger/failure/remote-inventory examples disappear as detailed below. No actual provider spawn, live SSH or physical commit proof is retained by this source. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1911: The complete provider PTY-inspection mock suite is removed: missing-provider rejection, stale-PTY renderer unverifiable mapping, preserved supplied renderer failures, and supplied transport-loss mapping alarms are intentionally lost. No actual terminal teardown, daemon error or remote transport was exercised. Only the deleted explicit source tokens, testFile and whole assertionRef are removed. Meaningful remaining source selectors/assertions and unaffected dated receipts retain their original scope. No equivalent replacement, fresh reduced-gate, native/platform/provider, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1495 intentionally deletes the orphan-owner suite: explicit owner/host predicate examples are retired; no equivalent replacement coverage or fresh result is claimed. Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts: Loses obsolete pending title process races, inspection failure suppression, explicit completion precedence and delayed remote inspection alarms. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audits1301 and1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic macOS tests cover controller claims, daemon and SSH/relay operation replay, mixed-version selection, runtime ownership, exact provisional handoff, durable terminal retirement, two independent viewer mirrors, guarded adoption of legacy live PTYs, and completion classification when either the outer remote transport or authoritative host/provider process inspection becomes unreachable. The adoption harness models v1.4.150 agent/setup/shell tabs, current-generation restart and reconnect, exact handle/incarnation/worktree/host checks, topology CAS, competing clients, split-pane/group restoration, WSL ownership, and SSH owner rejection. The secondary parity repro runs independent clients against one headless remote Orca runtime over encrypted pairing and a real daemon-backed PTY, with tokened fixture-process identity separated from unrelated Codex app-server startup probes. The automated primary topology runs an isolated headed macOS Orca desktop server plus a separate paired web client and proves viewer-local fresh/resume focus, exact legacy placement, writable PTYs, unrelated-terminal survival, and host/client cleanup. SSH coverage is provider/relay contract and fault-injection coverage only; it does not substitute for paired-server coverage. Live Windows, Linux, WSL, SSH, and physical paired-Linux hosts remain gaps. The isolated intent-owner ledger suite was removed. web-runtime-session.test.ts retains exact post-create handoff confirmation only; its previous fresh/resume presentation and publication-replay assertions are no longer current references. Those direct owner-partition, cap and RPC/focus alarms are lost; other agent-session evidence does not establish equivalence. Structured handoff and adopted-leaf focus references now point to their dedicated surviving fixtures. Mixed-version recovery retains actual old-host recovery followed by a new CLI tab; its unsupported/missing-evidence tables are removed. Orphan recovery retains in-flight adoption-conflict serialization only; previous topology/pruning and absence/adoption examples are removed. These removed projection, capability and adoption-shape alarms are lost; retained cases do not replace them. Audit1301: src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts reduced. Direct dedupe eviction/count and equal receipt-position sample loses authored alarm. No equivalent replacement coverage is claimed. Audit1308: src/renderer/src/runtime/web-session-tabs-sync-agent-handoff.test.ts removed. Exact provisional replacement and post-create exit confirmation handoff pipeline alarms disappear. No equivalent replacement coverage is claimed. Audit1313: src/main/runtime/terminal-orphan-topology.test.ts: Retain actual topology merge algorithms preserving disjoint subtrees and grafted/ambiguous shared anchors with independent expected trees. Remove duplicate leaf validator and empty/no-change passthrough examples. Lose basic validation and no-group/noop characterization; no renderer layout proof. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1342: src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8878",
"https://github.com/stablyai/orca/issues/9151",
@@ -7088,7 +7050,7 @@
"https://github.com/stablyai/orca/pull/10193"
],
"invariant": "For every claim-capable execution route, one provider-session identity has at most one live PTY owner and one canonical host surface across concurrent clients, retries, reconnects, and stale publications. For paired structured fresh and resume requests, the authenticated owning runtime creates in background without a renderer window; activate=true focuses the exact requested leaf only on the requesting viewer, while activate=false changes no viewer focus. A live orphan may be adopted only when the controller proves its exact handle and incarnation, its worktree and host owner match, no competing visual owner exists, and a host topology CAS wins. A viewer may classify completion only from successful host/provider inspection or explicit lifecycle evidence; transport, handle, or provider unavailability remains unknown and breaks any consecutive-idle proof. A physical exit retires that exact incarnation durably so stale client state and host restart cannot recreate it. Mixed-version routes select the unchanged legacy request before any authority side effect or execution-owner-local filesystem access.",
- "oracle": "Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The Codex restart suite and exact command/testFiles/assertionRef are removed; its mock account-change/remote-pane restart alarms are intentionally lost. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3368 retires the whole host-session-launch unit source, including host-authority/create/ensure/legacy/Kimi/refusal/draft/options/prompt/cancel/kill/shared-disconnect and passive-sleep output callback alarms, without equivalent replacement. Its unit command token and test-file entry retire. Five unrelated macOS receipts remain verbatim and keep only their original scope; no fresh changed-selector/runtime/provider/process/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit3359 retires the whole create-handoff suite. Supplied disposition, late completion, close-callback and metadata-bookkeeping alarms are intentionally lost without equivalent replacement; the compound unit selector and test-file entry narrow accordingly. Five unrelated macOS receipts retain their original scope. No fresh runtime, process-deduplication, physical provider/network, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the caller-chat-target precedence over host selection example from web-session-tabs-sync-focus-intent.test.ts. The snapshot-before-RPC replay and split-sibling-first exact-leaf focus cases remain unchanged and match the existing assertion reference. Preserve current selectors, assertion references, unrelated active receipts and complete archived history. These mocked state-composition survivors provide no equivalent replacement, rendered, native, network or fresh execution proof. Audit2694 source-only review: Remove14 authored/14 expanded cases in the renderer completion wrapper family, including the complete bell/query-reply/stale-input factory, without replacement. Retain29 authored/34 expanded cases with unchanged callback bodies. Three removals are the existing pending2203 overlap and must be adopted/count-reconciled once; eleven are fresh removals. No current-source runtime or gate execution is supplied by this packet; dated evidence retains its original source scope and does not validate the reduced factory bytes. No equivalent replacement, physical provider, mixed-version, mobile, rendered UI, cross-platform, soak or measured-performance result is claimed. The existing command and testFiles selector retain tests/pty-connection-completion-and-notification.test.ts; no wrapper-specific assertionRef is removed. Historical selector results do not validate its changed reachable factories. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Delete the complete pure orphan-topology suite and its file membership; preserve the other selectors from its combined command after archiving the original command string. Lost alarms are synthetic current-layout preservation, one-anchor grafting and ambiguous-anchor appending examples. Do not transfer their ownership/topology scope to sibling suites. Preserve all5 independent historical receipts exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked agent-session suite and its prospective selector and aliases. Retire all3 whole dated changed-selector receipts, preserving their original raw objects in historical gaps without transferring counts or durations. Preserve5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial agent-operation service suite retains only concurrent retry joining with changed-fingerprint conflict. Retire its complete three-title assertion object: old-owner legacy fallback before side effects, nested SSH Pi transcript refusal and completed/ambiguous physical-commit replay fences are no longer backed. Other probe/launch option/ledger/failure/remote-inventory examples disappear as detailed below. No actual provider spawn, live SSH or physical commit proof is retained by this source. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1911: The complete provider PTY-inspection mock suite is removed: missing-provider rejection, stale-PTY renderer unverifiable mapping, preserved supplied renderer failures, and supplied transport-loss mapping alarms are intentionally lost. No actual terminal teardown, daemon error or remote transport was exercised. Only the deleted explicit source tokens, testFile and whole assertionRef are removed. Meaningful remaining source selectors/assertions and unaffected dated receipts retain their original scope. No equivalent replacement, fresh reduced-gate, native/platform/provider, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Race independent clients and repeated operation IDs, then assert one physical spawn and one canonical PTY/surface; inject exit-before-reply, provider disconnect, conflicting claim scope, old daemon/relay capabilities, reused handles, stale incarnations, owner mismatch, and topology revision conflict; assert safe adoption or explicit failure without a second spawn or wrong-process attachment. Run fresh/resume with activate true/false against an isolated headed desktop host and a separate paired client, then against isolated headless serve: assert host presentation stays background, only the requesting viewer focuses the exact leaf, inactive calls preserve client/DOM focus, a same-version publication replay cannot lose focus intent, and sibling-first split publication cannot consume exact-leaf intent. Restore legacy split panes and groups beside a newer host-owned tab, preserving exact predecessor/new/successor order, output, input, resize, titles, tab/leaf identity, active group, and multi-client convergence. For completion, drive a known running agent through outer transport loss, authoritative provider rejection, reconnect, explicit stop, real exit status, and successful hook completion; assert unavailable evidence never dispatches completion and two fresh authoritative idle samples are required after the gap. After exact exit, assert terminal and tab listings omit the surface, a stale publication cannot restore it, restart cannot resurrect it, exact tokened fixture PIDs are dead, and unrelated tabs/processes survive until scoped cleanup.",
+ "oracle": "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed. Historical prior account (preserved verbatim): Audit3814 deliberately retires60 authored/60 finite cases:53runtime compatibility cases,4native XCTest methods and3Python clipboard methods, including the entire StableElementIndexes suite. Clipboard cuts retire the one-over-cap sample, incoming-offer destruction trace and sequential20-copy replay; actual wire, FD/pipe, startup and Xvfb/GTK boundaries remain without equivalent replacement claims. Accepted losses include narrow terminal-send payload/provider projections, legacy and direct no-op/error permutations, timing/work-count examples, private state/title/activity projections and fixture-driven readiness examples, individually enumerated below. These include real bounded production alarms consciously retired for marginal value; retained failed writes, duplicate submission, stale capture, transcript/ring and allocation fences are not equivalent replacements. No fresh native/remote/browser execution or complete transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3806 deliberately retires40 authored/40 finite runtime compatibility cases, including the terminal-side-effect-facts-part03 headless-snapshots-part02 and agent-status-and-waits-part03 fragments, plus20 scalar Swift precondition sites. Lost runtime alarms include status/title/attention projection examples, simple renderer/headless frame restoration and status waiting outcomes detailed in the accepted-loss ledger. Swift cuts retire duplicate generation-map/schema/navigation/bridge and notification-wrapper assertions; no standalone native program is deleted. These include real bounded production alarms consciously retired for marginal value. Retained races, pending writes/reflow, namespace and waiter ownership are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3798 deliberately retires21 authored/24 finite compatibility cases, including the entire SSH-worktree-lifecycle and repository-project-operations fragments. Accepted losses include navigation-only settings acknowledgement, browser session cleanup and host preservation projections, window positive/policy-state examples, terminal recovery/reload and no-incarnation remint examples, terminal listing compatibility/malformed IDs, directory browse/sort/Windows path smoke, SSH create refusal/manual lineage, recursive parent-folder creation and fork/origin/avatar/icon projections. Real bounded production alarms are consciously retired for marginal value; retained authority races, cleanup/clone ownership, pending waiters, nested-folder and scan invalidation cases are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The Codex restart suite and exact command/testFiles/assertionRef are removed; its mock account-change/remote-pane restart alarms are intentionally lost. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3368 retires the whole host-session-launch unit source, including host-authority/create/ensure/legacy/Kimi/refusal/draft/options/prompt/cancel/kill/shared-disconnect and passive-sleep output callback alarms, without equivalent replacement. Its unit command token and test-file entry retire. Five unrelated macOS receipts remain verbatim and keep only their original scope; no fresh changed-selector/runtime/provider/process/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit3359 retires the whole create-handoff suite. Supplied disposition, late completion, close-callback and metadata-bookkeeping alarms are intentionally lost without equivalent replacement; the compound unit selector and test-file entry narrow accordingly. Five unrelated macOS receipts retain their original scope. No fresh runtime, process-deduplication, physical provider/network, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the caller-chat-target precedence over host selection example from web-session-tabs-sync-focus-intent.test.ts. The snapshot-before-RPC replay and split-sibling-first exact-leaf focus cases remain unchanged and match the existing assertion reference. Preserve current selectors, assertion references, unrelated active receipts and complete archived history. These mocked state-composition survivors provide no equivalent replacement, rendered, native, network or fresh execution proof. Audit2694 source-only review: Remove14 authored/14 expanded cases in the renderer completion wrapper family, including the complete bell/query-reply/stale-input factory, without replacement. Retain29 authored/34 expanded cases with unchanged callback bodies. Three removals are the existing pending2203 overlap and must be adopted/count-reconciled once; eleven are fresh removals. No current-source runtime or gate execution is supplied by this packet; dated evidence retains its original source scope and does not validate the reduced factory bytes. No equivalent replacement, physical provider, mixed-version, mobile, rendered UI, cross-platform, soak or measured-performance result is claimed. The existing command and testFiles selector retain tests/pty-connection-completion-and-notification.test.ts; no wrapper-specific assertionRef is removed. Historical selector results do not validate its changed reachable factories. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Delete the complete pure orphan-topology suite and its file membership; preserve the other selectors from its combined command after archiving the original command string. Lost alarms are synthetic current-layout preservation, one-anchor grafting and ambiguous-anchor appending examples. Do not transfer their ownership/topology scope to sibling suites. Preserve all5 independent historical receipts exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked agent-session suite and its prospective selector and aliases. Retire all3 whole dated changed-selector receipts, preserving their original raw objects in historical gaps without transferring counts or durations. Preserve5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial agent-operation service suite retains only concurrent retry joining with changed-fingerprint conflict. Retire its complete three-title assertion object: old-owner legacy fallback before side effects, nested SSH Pi transcript refusal and completed/ambiguous physical-commit replay fences are no longer backed. Other probe/launch option/ledger/failure/remote-inventory examples disappear as detailed below. No actual provider spawn, live SSH or physical commit proof is retained by this source. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1911: The complete provider PTY-inspection mock suite is removed: missing-provider rejection, stale-PTY renderer unverifiable mapping, preserved supplied renderer failures, and supplied transport-loss mapping alarms are intentionally lost. No actual terminal teardown, daemon error or remote transport was exercised. Only the deleted explicit source tokens, testFile and whole assertionRef are removed. Meaningful remaining source selectors/assertions and unaffected dated receipts retain their original scope. No equivalent replacement, fresh reduced-gate, native/platform/provider, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Race independent clients and repeated operation IDs, then assert one physical spawn and one canonical PTY/surface; inject exit-before-reply, provider disconnect, conflicting claim scope, old daemon/relay capabilities, reused handles, stale incarnations, owner mismatch, and topology revision conflict; assert safe adoption or explicit failure without a second spawn or wrong-process attachment. Run fresh/resume with activate true/false against an isolated headed desktop host and a separate paired client, then against isolated headless serve: assert host presentation stays background, only the requesting viewer focuses the exact leaf, inactive calls preserve client/DOM focus, a same-version publication replay cannot lose focus intent, and sibling-first split publication cannot consume exact-leaf intent. Restore legacy split panes and groups beside a newer host-owned tab, preserving exact predecessor/new/successor order, output, input, resize, titles, tab/leaf identity, active group, and multi-client convergence. For completion, drive a known running agent through outer transport loss, authoritative provider rejection, reconnect, explicit stop, real exit status, and successful hook completion; assert unavailable evidence never dispatches completion and two fresh authoritative idle samples are required after the gap. After exact exit, assert terminal and tab listings omit the surface, a stale publication cannot restore it, restart cannot resurrect it, exact tokened fixture PIDs are dead, and unrelated tabs/processes survive until scoped cleanup.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/runtime/session-construction/agent-session/orca-runtime-agent-session-operation.test.ts src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts",
@@ -7285,6 +7247,10 @@
"Add live SSH/WSL provider evidence before claiming full provider coverage; Docker SSH proves only the SSH provider/relay path."
],
"knownGaps": [
+ "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed.",
+ "Audit3814 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle from a Codex ready prompt even when stale startup lines remain :: Stale MCP startup lines must not block a later Codex ready header.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle when a stale Codex prompt is followed by the ready header :: A Codex ready header following a stale resume prompt must satisfy tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for an idle Cursor lane past its dismissed trust dialog (#8210) :: Later Cursor idle banner overrides retained trust dialog.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not block a mid-run Cursor lane on its dismissed trust dialog (#8210) :: Dismissed trust dialog must not report blocked for later busy Cursor; wait times out.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not classify unrelated press-enter prompts as Codex blocked prompts :: Unidentified press-enter text must time out rather than be classified Codex blocked.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for quiet background PTY agents without OSC titles :: Quiet Codex background terminal without OSC title eventually resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: sends agent prompts as bracketed paste before submit :: Driving prompt escapes embedded paste-end ESC, writes one framed paste then CR, and counts bytes.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: settles a foreground Codex prompt when launch metadata has not arrived :: Codex inferred from foreground without launch metadata waits for composer marker/quiescence before one CR.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: gives a late Codex render marker a fresh quiescence window :: Marker arriving at7.9s re-arms fresh quiet window instead of submitting at initial cap.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: writes large agent prompt paste frames atomically before delayed submit :: A prompt larger than input chunk budget is a single paste write before delayed CR with exact byte count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects oversized terminal.send text before provider writes :: Oversized ordinary terminal.send rejects input-too-large before any provider write.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects focusing an exited background terminal session :: focusTerminal refuses terminal_exited before invoking background reveal.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: pastes the same bytes the desktop draft paste sent for the prompt :: Launch-ready prompt normalizes CR/LF and renders embedded ESC visibly identically to desktop bracketed paste.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: keeps a prompt into a running agent behind the render settle, as before :: Driving prompt remains held through7s repaint activity then submits once by9s.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reports a queued PTY focus as not navigated when its notifier disappears :: Queued PTY focus and completed active reveal report not navigated after notifier removal; no second reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: does not invoke a stale graph-leaf focus notifier after queued PTY work :: Queued graph-leaf focus must not invoke old notifier after preceding PTY reveal and notifier removal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: paginates retained terminal output with explicit limits and truncation metadata :: Preview120lines, fractional limits,50/200 pages, retained2000line truncation and future-cursor metadata stay consistent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: falls back to renderer visible screen when uncursored TUI tail is blank :: Substantial blank uncursored tail uses mounted renderer visible screen with zero scrollback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reads and shows the runtime-owned alternate-screen grid without serialization :: Actual runtime alternate-screen grid provides read/show content without renderer/provider serialization.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: classifies older provider alternate-screen snapshots from ANSI :: Older provider without alternateScreen metadata classifies ANSI alternate entry and returns Remote Vim screen.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: honors the last ANSI screen transition when older provider metadata is absent :: Last ANSI alternate exit overrides earlier entry when explicit provider mode metadata is absent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: rejects a full provider screen frame after live output advances :: Live output arriving during second full-screen capture causes screen-unavailable rather than stale full frame.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: shares one provider snapshot between concurrent read and show calls :: Concurrent read/show share one successful provider snapshot and both receive Shared TUI content.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps cursor reads provider-free on restored alternate-screen PTYs :: Restored alternate-screen cursor transcript reads never acquire provider snapshot.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: backs off after a provider snapshot failure instead of retrying for show :: Failed provider capture is cached/backed off so later show does not retry.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: falls back once to a mounted renderer when a known alternate provider fails :: A known-alternate failed provider capture falls back exactly once to newly mounted renderer.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: bounds provider visible frames for read and show responses :: Provider visible read/show use six bounded lines and300character preview.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps renderer-fallback composer drafts separate from terminal output :: Renderer fallback strips dim composer draft from terminal output and exposes draft separately.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: does not use renderer visible-screen fallback for a short blank shell tail :: Two blank shell lines must not trigger renderer screen fallback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: trims terminal tail character budget without per-line array shifts :: Tail builder trims to256KiB with correct retained suffix and no Array.shift calls.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains ANSI-only status redraws instead of appending every frame :: Repeated erase/redraw replaces preview until newline then publishes one completed cursor row.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains split multi-line ANSI footer redraw state across chunks :: CUU state across chunks retains corrected footer rows and publishes new cursor entries.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not let stale lower rows hide earlier corrected footer rows from cursor reads :: Earlier corrected footer row must not be hidden by stale lower rows in cursor reads.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: bounds completed transcript entries from a single multi-line redraw chunk :: Single redraw chunk bounds completed transcript to2000retained lines and correct oldest/next/latest cursors.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains multi-line ANSI redraws when the last footer row stays partial :: Partial final redrawn row appears in preview but cursor sees it only after newline.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not retain split ANSI controls as visible terminal preview text :: Split color/mode escapes never leak preview fragments; long split OSC title truncates at MAX_OSC_TITLE_CHARS.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains same-line redraw cursor position across split full-line erase chunks :: Full-line erase preserves column across chunks so XY follows three spaces rather than old ABC.\nsrc/main/runtime/orca-runtime-tests/conpty-stream-read.spec.ts :: fills the requested line count even when blank rows sit below the prompt :: Blank rows below a ConPTY prompt must not consume the requested nonempty-line count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: does not retain split ST-terminated string controls as preview text :: Split ST-terminated Kitty/string controls must remain excluded from preview text.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects split OSC titles before retaining terminal previews :: Split BEL OSC title must update working title/status without leaking into preview.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects ST-terminated OSC titles split before the final backslash :: ST OSC split before final backslash must update title without leaking framing.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: preserves a trailing escape after a completed OSC title :: Completed OSC followed by pending ESC must preserve the next idle-title transition.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: seeds newly synced leaves from PTY pending ANSI state :: A newly synced graph leaf inherits pending ANSI so a split color fragment cannot leak.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: bounds retained partial terminal output before preview reads :: Partial terminal state stays capped at 4000, preserves retained array identity, and preview truncation/cursor output remains correct.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: submits the mail pointer to Cursor Agent only after the paste-burst delay :: Cursor mailbox pointer Enter must wait through the paste-burst delay; this is a real input-timing alarm intentionally retired.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts :: adopts a v1.4.150-shaped agent, setup, and shell orphan as one topology transaction :: Stale incarnation refuses without topology change; three agent/setup/shell lanes adopt atomically with layout/group/revision and preserved read/input/resize; exact replay is idempotent and competing owner refuses.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: retires the exact worker when it exits after renderer reveal :: Exact worker exit after reveal retires that worker and its surface.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: re-reveals a recovered worker after the renderer graph epoch changes :: Changed renderer graph epoch invalidates reveal receipt and forces another reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: defers recovery when the renderer omits the exact reveal identity :: Missing exact reveal identity defers recovery after two attempts.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: reconciles a same-id process replacement before headless adoption :: A process replacement before headless adoption must fence off stale ownership.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retires provider resume only after authoritative inventory proves the legacy PTY exited :: Authoritative owning-host inventory overrides false local hasPty, avoids SSH scanning, retires exited provider resume/surface, adopts live workers without headless reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retries inventory and unknown liveness without revealing a ghost worker :: Inventory failure and unknown liveness must retry without ghost reveal, eventually adopt, and stop retrying.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: refuses a live reserved pane before issuing a handle or revealing it :: A requireFreshPane launch receiving a live reserved owner must reject before handle/reveal/kill, and release its claim. No equivalent replacement claimed.",
+ "Audit3806 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: skips a listener unsubscribed mid-fan-out even with mobile exclusions active :: A listener removed by an earlier listener during one fanout is not called, including with a side-effect-excluded mobile listener present.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: retains bytes emitted before a fresh daemon spawn resolves :: Bytes and title arriving before an initial zero/reset provider response survive in the serialized headless buffer with their counted sequence.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits command-finished facts with best-effort exit codes across chunk splits :: A split OSC133 D exit code becomes130 and a missing code becomes null in ordered command-finished facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits pr-link facts once per URL with batch attribution :: A split GitHub PR URL yields42 rather than4, emits42/43 once each, and carries PTY/worktree/tab attribution.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits 2031-subscribe facts across chunk splits :: Split ESC[?20 then31h emits exactly one2031-subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: restores a provisional 2031 subscribe when daemon scan authority returns :: Returning daemon scan authority with partial scan seed and pending2031 subscription restores exactly one subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers the tracked title over the renderer snapshot lastTitle :: A synthetic live Cursor title overrides stale renderer lastTitle while preserving renderer snapshot source.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers provider history over a partial headless mirror for requested snapshots :: Authoritative requested snapshots return supplied provider frame/history/seq rather than a partial headless mirror, requesting5000rows.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: tracks live alternate-screen transitions after a provider snapshot :: Provider alternateScreen true is accepted, then live1049l/1049h update isTerminalAlternateScreen false/true.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: translates reset provider snapshots without retaining the old title :: A reset provider snapshot translates new local seq into the runtime domain and replaces Old process title with New process.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits the chunk agentStatus events before its side-effect batch :: Agent status callback precedes side-effect batch callback for one coalesced OSC9999/title/bell chunk.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: still emits a throwing chunk’s facts under its own seq, not the next chunk’s :: A tracker throw still flushes first chunk title facts under its own seq, and second chunk does not inherit those facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: seeds the lazily created tracker from the daemon-snapshot title :: A lazy tracker hydrated from renderer snapshot title Codex working emits agent-idle on later Codex done.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits command-code-working facts only after the banner arms the scrape :: Unarmed Thinking text emits no facts; a Command Code0.27.3 banner then hardcoded colored spinner text emits attributed command-code-working with the submitted prompt.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits a command-code-done fact when the idle composer returns :: After hardcoded banner/working text, returned idle composer emits command-code-done with the earlier submitted prompt.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: resizes the headless mirror after an accepted desktop PTY resize :: An external accepted resize produces the resized dimensions and same status-frame lines as a separately driven reference emulator.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: replaces suffix-only headless state with the recovered renderer snapshot :: Replacing suffix-only state removes old suffix, retains renderer history plus later output/cwd, and returns the live47x40PTY grid.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: stamps SSH connection identity on runtime terminal status :: A synthetic mounted-leaf OSC9999 status after registerPty carries the supplied SSH connectionId.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: does not retain WSL context when a PTY id is reused :: After exit and same-ID new null distro context, OSC7 file://server/share/repo uses UNC server path rather than old Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: preserves immutable context while a live daemon attach is unresolved :: preparePtyExecutionContext with preserveExisting refuses a supplied Debian replacement and subsequent OSC7 keeps original Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts :: projects frame-independent live state through main buffer snapshots :: Main-buffer snapshot puts focus-report/cursor-visibility modes in frameRestoreAnsi, excludes STATIC-FRAME there and includes it in data.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts :: continues terminal agent status fanout when a callback throws :: Throwing on the first status callback does not prevent second payload delivery and logs contextual error.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: returns a title-only replay snapshot and never historical attention :: Lose replay:true/title-only fact projection despite earlierbell and unknownPTYnull. No actual delivered-history notification or reattach behavior was exercised. No equivalent replacement claimed.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects a handle rebind while a controller-less status check yields :: A handle rebound while the null-controller status continuation yields must throw terminal_handle_stale.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects confirmation evidence when the owning PTY exits :: A pending strong confirmation resolving after owning PTY exit must reject terminal_exited.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts :: keeps ordinary terminal send suffix failures on the existing not-writable contract :: Ordinary send writes text but refused CR must throw terminal_not_writable with beforeWrite twice and afterWrite once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell the execution host cannot apply instead of spawning its default :: Requested Windows shell on POSIX must refuse before spawning a default shell.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: quotes the agent startup command for the requested shell, not the host default :: Requested cmd shell must override PowerShell default quoting for agent startup command.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: keeps restored receipts outside a targeted worktree scan :: Targeted scan removes the moved-worktree receipt while preserving another worktree receipt.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: observes setup command completion without waiting for its interactive shell to exit :: Nonzero completion marker 17 resolves while interactive shell remains running.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: falls back to setup terminal exit when no completion signal is available :: Setup completion observer without token falls back to actual exit code 9.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: cancels setup completion observation when the caller aborts :: Abort rejects with the original reason and unsubscribes once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps observing after an uncertain setup terminal status :: Unknown exit waiter result must leave observation pending until completion marker arrives.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh omits a record :: Controller inventory omission disconnects the record but preserves its retained transcript.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh times out :: Hung inventory timeout leaves connected record and retained transcript intact.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle for adopted background PTY handles from the renderer title :: An adopted background handle resolves tui-idle from ready Codex renderer title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves live-leaf tui-idle from an OpenCode native title :: A live leaf resolves tui-idle from an OpenCode native title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from a Codex ready prompt preview :: A supplied Codex prompt preview resolves tui-idle without an actual agent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from an Antigravity prompt before the model line :: A supplied Antigravity prompt before model line resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell with no workspace instead of creating a default-shell tab :: Workspace-less explicit shell must reject before renderer default-tab request or spawn. This real guard/wiring alarm is deliberately retired.",
+ "Audit3798 per-case accepted losses:\nsrc/main/runtime/orca-runtime-tests/paired-settings.spec.ts :: awaits navigation-only updates from paired clients (%s) :: Updating only claudeSubagentNavigationEnabled waits for the actual controller call to the supplied pending Claude-view reconcile for both on/off values.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: drops a client page record even when its close command cannot be issued :: A removed workspace loses its runtime client-page record and headless browser projection despite close delivery_required rejection, and emits the asynchronous warning.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: leaves client-hosted pages alone when another host still owns the same worktree id :: Removing runtime:env-b metadata with local ownership leaves the local same-ID client page unchanged and issues no close command.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: marks live bindings again when reopening after a promoted window closes :: A reopened window marks its still-registered live worktree in activeWorktreeIdsOnShutdown after the first promoted window closes.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: preserves live SSH session identities when promoting a headless runtime :: Headless-to-desktop promotion records active worktree, SSH connection and remoteSessionIdsByTabId from the supplied surviving SSH PTY/session.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores a surviving renderer when its reload is cancelled :: A sole ready renderer reload cancelled under its current renderer fence returns true and becomes ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores headless authority when desktop promotion navigation is cancelled :: A cancelled desktop promotion with headless recovery returns false while headless authority remains ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: moves a desktop graph to unavailable when its reload times out :: A ready desktop graph without a headless fallback becomes unavailable at the reload deadline and retains its window/epoch.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: recovers a failed headless promotion and accepts a later renderer generation :: A promotion failure restores ready headless authority; a later valid same-window graph publishes ready desktop authority.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: clears a failed pane recovery so a later reconnect can retry :: After relay_reconnecting rejection, the pending recovery lock clears and the same pane/handle can call createTerminal a second time and return its supplied replacement.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: still preserves a CLI agent leaf when the reloaded renderer has not rebound its PTY :: An empty graph published during renderer reload preserves a preallocated live CLI PTY as one listable terminal before renderer rebind.\nsrc/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts :: keeps a no-incarnation handle across an in-graph pane remint :: Within one graph lifetime an unversioned PTY reminted onto another leaf retains its issued handle and resolves its old exit waiter after onPtyExit.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: matches explicit-id cwd PTYs when the resolved worktree cache is incomplete :: An explicit target absent from a fresh incomplete resolved cache adopts only its cwd PTY, rejects nested cwd PTY and does not rescan Git.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: ignores cwd-only controller PTYs for malformed explicit worktree IDs :: Malformed id:repo-1:: returns no terminals, does not adopt cwd-only controller PTY and avoids Git rescanning.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: refuses an SSH-backed create for mobile/runtime callers instead of creating locally :: Loss of this public unserved SSH create error-class/no-local-add/no-local-list alarm.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: records an app-selected parent workspace as a manual action :: Loss of the local runtime folder-parent manual origin, active-workspace source and explicit confidence projection alarm; no claim that SSH or cleanup coverage replaces it.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: browses runtime server directories before projects are added :: Loss of this public runtime alarm for browse availability before registration, directories-first lexical ordering and native path flavor.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: lists drive roots for a server-root browse :: Loss of the Windows public slash-root drive enumeration smoke and presence of the temporary directory drive.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations-part-02.spec.ts :: creates a missing runtime parent before creating the project directory :: Loss of this runtime createRepo recursive missing-parent/child existence and registered-path alarm.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: preserves selected project %s when a hosted parent is known :: Loss of both parent-selected and origin-selected normal fork-link projection/persisted upstream alarms plus exact single-probe count.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: links a current enterprise remote despite unavailable metadata and a retained %s :: Loss of normal current-enterprise-origin linking with stale automatic GitHub avatar or protected file image, unchanged icon assertion, and serialized project identity under unavailable metadata.",
"Audit2694 intentional coverage losses (source-only, no replacement): src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-command-finished-interrupt-arbitration.spec.ts: 'drops the command-finished status when pending interrupt inference is rejected': Loses the standalone rejected-inference-to-drop alarm; the delayed-write rows remain but are not equivalent to this immediate rejection example. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-bell-query-reply-and-stale-input.spec.ts: 'forwards raw onData after a bell as a query reply': Loses raw onData forwarding after the manually raised bell, including its hibernation-counter expectations. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-bell-query-reply-and-stale-input.spec.ts: 'blocks onData on a stale codex pane': The real isCodexPaneStale guard executes, and removing it would allow the typed a to reach transport. Intentionally loses this genuine stale-account typing refusal alarm. No retained query-reply test is claimed equivalent. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'omits byte-parser callbacks from the local transport options': Loses local main-authority callback omission and lifecycle callback presence checks. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'keeps byte-parser callbacks on remote-runtime transports': Loses remote-runtime parser callback preservation and factory-argument alarm, including this compatibility boundary; no mixed-version execution is covered. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'consumes pty:sideEffect facts with the live-path policy after spawn': Loses title/bell fact routing and exact 250ms delayed fake notification example. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'schedules the completion notification for genuine working→idle facts': Loses positive main-fact working-to-idle scheduling alarm. Retained stale/race cases do not replace this positive example. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'drops the agent status from a command-finished fact like the byte path did': Loses command-finished fact-to-drop routing and removeAgentStatus noncall alarm. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'routes pr-link facts to the worktree PR observer': Loses PR-link fact forwarding, worktree/tab/PTY arguments alarm; retained raw-byte nonconsumption is not equivalent. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'seeds and settles Command Code status from command-code facts': Real Command Code seed/settle policy runs. Loses positive seed, prompt payload, and 1499+1ms completion boundary alarm; retained newer-working cancellation is not equivalent. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'does not byte-scan Command Code output — facts are the only consumer': Loses Command Code-specific no-byte-parser alarm. Retained PR/OSC raw-byte exclusion does not cover this parser. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-notification-settings-gating.spec.ts: 'shares one raw store subscriber for agent-complete notification settings across panes': Actual shared subscribe/unsubscribe runs. Loses shared single-subscription and final-pane unsubscribe lifetime alarm, with no replacement claimed. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-task-complete-dispatch.spec.ts: 'dispatches agent-task-complete for generic Codex spinner titles after process identity is confirmed': Real coordinator evidence path runs over fake process answers. Loses positive generic-title/confirmed-Codex completion and inspectProcess-argument alarm. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-task-complete-dispatch.spec.ts: 'normalizes Pi-compatible remote titles to authoritative OMP launch identity': Real owner-compatible normalization runs. Loses Pi-to-OMP title/status normalization, active tab label, OSC observation, and retained launch-identity example; no real remote transport or equivalent replacement. Wrapper cleanup removes only the deleted bell factory import and its registration-only describe block; no additional authored removal credit. Audit2694 source-only review: Remove14 authored/14 expanded cases in the renderer completion wrapper family, including the complete bell/query-reply/stale-input factory, without replacement. Retain29 authored/34 expanded cases with unchanged callback bodies. Three removals are the existing pending2203 overlap and must be adopted/count-reconciled once; eleven are fresh removals. No current-source runtime or gate execution is supplied by this packet; dated evidence retains its original source scope and does not validate the reduced factory bytes. No equivalent replacement, physical provider, mixed-version, mobile, rendered UI, cross-platform, soak or measured-performance result is claimed. The existing command and testFiles selector retain tests/pty-connection-completion-and-notification.test.ts; no wrapper-specific assertionRef is removed. Historical selector results do not validate its changed reachable factories.",
"Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
"Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts. Unresolved local/computed edges remain explicit debt.",
@@ -7350,7 +7316,8 @@
"Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The Codex restart suite and exact command/testFiles/assertionRef are removed; its mock account-change/remote-pane restart alarms are intentionally lost. Earlier notes and dated/archived evidence retain original scopes.",
"Complete prior commands before exact deleted selectors were pruned: [\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/runtime/session-construction/agent-session/orca-runtime-agent-session-operation.test.ts src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts\",\"pnpm run build:cli && pnpm run build:electron-vite && node config/scripts/diagnostics/remote-agent-authority/remote-agent-session-authority-repro.mjs\",\"node --check config/scripts/development/remote-session-cleanup/remote-agent-session-process-cleanup.mjs && node config/scripts/diagnostics/remote-agent-authority/remote-agent-session-authority-repro.mjs\",\"pnpm exec electron-vite build --mode e2e\",\"VITE_EXPOSE_STORE=true pnpm run build:web\",\"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/remote-agent-session-focus-authority.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\"Manual headed paired-server journey: isolated Orca desktop host + separate paired web client + real Codex process + 20-second WebSocket fault + reconnect + explicit stop\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts --maxWorkers=1\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/providers/routing/testing/daemon-pty-router.test.ts src/main/daemon/providers/routing/testing/degraded-daemon-pty-provider.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/runtime/construction/orca-runtime.test.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion/agent-completion-coordinator-process-cadence.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/providers/routing/testing/daemon-pty-router.test.ts src/main/daemon/providers/routing/testing/degraded-daemon-pty-provider.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion/agent-completion-coordinator-process-cadence.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-completion-and-notification.test.ts src/renderer/src/lib/agent-session/accounts/codex/codex-session-restart.test.ts\"]",
"Complete prior testFiles before exact deleted selectors were pruned: [\"src/main/daemon/terminal-host/testing/terminal-host.test.ts\",\"src/main/daemon/providers/routing/testing/daemon-pty-router.test.ts\",\"src/main/daemon/providers/routing/testing/degraded-daemon-pty-provider.test.ts\",\"src/main/runtime/construction/orca-runtime.test.ts\",\"tests/e2e/remote-agent-completion-authority.unit.test.ts\",\"src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts\",\"src/renderer/src/components/terminal-pane/agent-completion/agent-completion-coordinator-process-cadence.test.ts\",\"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-completion-and-notification.test.ts\",\"src/renderer/src/lib/agent-session/accounts/codex/codex-session-restart.test.ts\",\"src/shared/claimed-agent-pty-owner.test.ts\",\"src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\"src/main/runtime/session-construction/agent-session/orca-runtime-agent-session-operation.test.ts\",\"src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts\",\"src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts\",\"tests/e2e/remote-agent-session-focus-authority.spec.ts\",\"config/scripts/diagnostics/remote-agent-authority/remote-agent-session-authority-repro.mjs\",\"config/scripts/development/remote-session-cleanup/remote-agent-session-process-cleanup.mjs\",\"tests/e2e/remote-terminal-tab-retirement.unit.test.ts\",\"src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts\",\"src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts\",\"src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\"]",
- "Complete prior assertionRefs before exact deleted selectors were pruned: [{\"file\":\"src/main/daemon/providers/routing/testing/degraded-daemon-pty-provider.test.ts\",\"assertions\":[\"completion inspection rejects an unmapped session instead of borrowing the local fallback\"]},{\"file\":\"tests/e2e/remote-agent-completion-authority.unit.test.ts\",\"assertions\":[\"transport loss remains unknown through reconnect and cannot dispatch completion\",\"returned unavailability or a thrown transport failure interrupts consecutive-idle proof and requires two fresh authoritative idle samples\",\"explicit stop, real exit status, and genuine successful completion remain distinct\"]},{\"file\":\"src/renderer/src/lib/agent-session/accounts/codex/codex-session-restart.test.ts\",\"assertions\":[\"one unreachable pane cannot suppress restart notices for another authoritatively confirmed Codex pane\"]},{\"file\":\"src/shared/claimed-agent-pty-owner.test.ts\",\"assertions\":[\"concurrent exact claims spawn once and later callers adopt the canonical owner\",\"same identity in another worktree conflicts and cannot be found as the current scope's owner\",\"generation-guarded exit and authoritative reconciliation cannot retire a replacement owner\"]},{\"file\":\"src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts\",\"assertions\":[\"independent runtime clients converge on one canonical live agent-session owner\",\"retries and concurrent requests cannot create a second physical PTY\"]},{\"file\":\"src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts\",\"assertions\":[\"an exact PTY exit retires host membership and stale topology cannot recreate the surface\",\"incarnation fencing prevents an old delayed exit from retiring a replacement PTY\"]},{\"file\":\"tests/e2e/remote-agent-session-focus-authority.spec.ts\",\"assertions\":[\"headed desktop host remains unfocused while the paired requester alone follows active fresh/resume sessions and inactive rows preserve exact client/DOM focus\",\"legacy afterTabId placement is exact in authoritative, mirrored, and rendered order with a pre-existing successor\",\"host PTY inventory plus writable agent/unrelated shell markers prove liveness, unrelated survival, and exact terminal/tab/PTY/process cleanup\"]},{\"file\":\"config/scripts/diagnostics/remote-agent-authority/remote-agent-session-authority-repro.mjs\",\"assertions\":[\"headless focused fresh/resume requests create background host surfaces without a renderer window\",\"dropped committed responses replay the same operation identity without another tokened agent spawn\",\"exact terminal/tab/process identity survives retries and stale-write rejection, then retires without restart resurrection while unrelated shells survive until scoped cleanup\"]},{\"file\":\"config/scripts/development/remote-session-cleanup/remote-agent-session-process-cleanup.mjs\",\"assertions\":[\"isolated daemon roots and captured descendants are verified dead before profile PID records are removed\"]},{\"file\":\"tests/e2e/remote-terminal-tab-retirement.unit.test.ts\",\"assertions\":[\"a durable host exit removes the terminal from two independent viewer mirrors instead of publishing a handle-less phantom\",\"one exact exit produces one same-epoch higher-version host publication and one durable persistence flush\",\"same-epoch stale publications cannot resurrect the retired surface after reconnect\"]},{\"file\":\"src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\",\"assertions\":[\"replays a snapshot that beat the RPC response and focuses the exact adopted leaf\",\"retains exact-leaf focus intent when a split sibling publishes first\"]},{\"file\":\"src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts\",\"assertions\":[\"mirrors a new CLI tab after old-host recovery when $name\"]},{\"file\":\"src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts\",\"assertions\":[\"serializes a newer convergence snapshot after an in-flight adoption conflict\"]}]"
+ "Complete prior assertionRefs before exact deleted selectors were pruned: [{\"file\":\"src/main/daemon/providers/routing/testing/degraded-daemon-pty-provider.test.ts\",\"assertions\":[\"completion inspection rejects an unmapped session instead of borrowing the local fallback\"]},{\"file\":\"tests/e2e/remote-agent-completion-authority.unit.test.ts\",\"assertions\":[\"transport loss remains unknown through reconnect and cannot dispatch completion\",\"returned unavailability or a thrown transport failure interrupts consecutive-idle proof and requires two fresh authoritative idle samples\",\"explicit stop, real exit status, and genuine successful completion remain distinct\"]},{\"file\":\"src/renderer/src/lib/agent-session/accounts/codex/codex-session-restart.test.ts\",\"assertions\":[\"one unreachable pane cannot suppress restart notices for another authoritatively confirmed Codex pane\"]},{\"file\":\"src/shared/claimed-agent-pty-owner.test.ts\",\"assertions\":[\"concurrent exact claims spawn once and later callers adopt the canonical owner\",\"same identity in another worktree conflicts and cannot be found as the current scope's owner\",\"generation-guarded exit and authoritative reconciliation cannot retire a replacement owner\"]},{\"file\":\"src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts\",\"assertions\":[\"independent runtime clients converge on one canonical live agent-session owner\",\"retries and concurrent requests cannot create a second physical PTY\"]},{\"file\":\"src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts\",\"assertions\":[\"an exact PTY exit retires host membership and stale topology cannot recreate the surface\",\"incarnation fencing prevents an old delayed exit from retiring a replacement PTY\"]},{\"file\":\"tests/e2e/remote-agent-session-focus-authority.spec.ts\",\"assertions\":[\"headed desktop host remains unfocused while the paired requester alone follows active fresh/resume sessions and inactive rows preserve exact client/DOM focus\",\"legacy afterTabId placement is exact in authoritative, mirrored, and rendered order with a pre-existing successor\",\"host PTY inventory plus writable agent/unrelated shell markers prove liveness, unrelated survival, and exact terminal/tab/PTY/process cleanup\"]},{\"file\":\"config/scripts/diagnostics/remote-agent-authority/remote-agent-session-authority-repro.mjs\",\"assertions\":[\"headless focused fresh/resume requests create background host surfaces without a renderer window\",\"dropped committed responses replay the same operation identity without another tokened agent spawn\",\"exact terminal/tab/process identity survives retries and stale-write rejection, then retires without restart resurrection while unrelated shells survive until scoped cleanup\"]},{\"file\":\"config/scripts/development/remote-session-cleanup/remote-agent-session-process-cleanup.mjs\",\"assertions\":[\"isolated daemon roots and captured descendants are verified dead before profile PID records are removed\"]},{\"file\":\"tests/e2e/remote-terminal-tab-retirement.unit.test.ts\",\"assertions\":[\"a durable host exit removes the terminal from two independent viewer mirrors instead of publishing a handle-less phantom\",\"one exact exit produces one same-epoch higher-version host publication and one durable persistence flush\",\"same-epoch stale publications cannot resurrect the retired surface after reconnect\"]},{\"file\":\"src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\",\"assertions\":[\"replays a snapshot that beat the RPC response and focuses the exact adopted leaf\",\"retains exact-leaf focus intent when a split sibling publishes first\"]},{\"file\":\"src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts\",\"assertions\":[\"mirrors a new CLI tab after old-host recovery when $name\"]},{\"file\":\"src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts\",\"assertions\":[\"serializes a newer convergence snapshot after an in-flight adoption conflict\"]}]",
+ "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed."
],
"demotionRule": "Keep experimental or demote if the focused gate flakes without a product or harness bug, if a retry can physically spawn twice, if a stale exit/publication can replace or resurrect a terminal, or if mixed-version fallback occurs after an authority side effect."
},
@@ -8249,13 +8216,13 @@
"providers": ["paired-runtime", "ssh"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
- "coverageNotes": "Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. The decorative fanout suite retains only real OSC9999 ingestion through runtime/title heartbeat/viewer past the stale boundary, preserving stateStartedAt and clearing expired prompt metadata. Spinner volume/zero-work inventories, Pi/Grok frame tables, rich-status and foreground-reset examples are retired. Existing receipts for separate paired-terminal sources retain their original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3342 removes three supplied activation/inventory fallback and same-handle retry examples; their fallback/retry alarms are intentionally lost without equivalent replacement. The exact mounted-HUB pending old-stream-end versus replacement-snapshot registration and its assertion remain. Unrelated dated macOS receipts retain only their original scope; no fresh runtime, provider, performance, mobile, mixed-version or cross-platform validation is claimed. NEXT46 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts, src/renderer/src/runtime/hosted-terminals/streams/remote-runtime-terminal-stall-recovery.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence. Historical prior account (preserved verbatim): Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: restarts only the stream whose renderer delivery credit never settles — An unreturned renderer delivery credit stalls only its stream, leaving healthy sibling/shared transport alive. Fake-clock deadline plus real multiplexer unsubscribe isolates recovery ownership.; probes then restarts a stream when an entered command receives no frames — Entered command produces no output; actual multiplexer must probe then close only its stalled stream after probe timeout. Distinct response liveness from parser credit.; establishes a probe baseline before recovering an unsequenced stream — 142-line manual five-probe baseline/regression sequence derives request IDs from encoded mock traffic and checks repeated no-close/close choreography. Oversized algorithm/state-machine example; no actual renderer/host command or recovery delivery. Retires unsequenced/unchanged/regressed baseline classification alarms.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3318 reduces remote-runtime-pty-transport-unpublished-host-graph.test.ts, retiring its direct published-empty-graph omission-to-pane-exit alarm. The unchanged bounded unpublished-frame/pushed-recovery and stale-handle park/manual-retry cases are narrower, not equivalent replacements. Both complete three-case Linux receipts dated 2026-11-04 are archived as historical, including source heads; they do not validate this reduced selector. Remaining fourteen active receipts are macOS only. No fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. The direct side-effect-facts selector retains six cases: replay exclusion, live sequence handling, stale disposer ownership, one handoff drain, drain-before-snapshot, and stale replacement-snapshot refusal. Successful current-entry snapshot application is not witnessed by the retained snapshot case. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2162: Reduced inventory-authority source intentionally loses the examples recorded in knownGaps; historical execution is not validation of changed bytes. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Remove SSH/absent-inventory attach refusal, later-subscriber retry, no-view adoption/takeback, provider-tail/unknown-read projections, failed-keystroke retry and simpler loss reattach examples. Keep the existing-subscriber inventory-ready retry alias only at its retained callback, plus retained held-input cancellation/replacement and overlapping attach/loss fences. The inventory driver also loses the whole empty-worktree-publication registration and folder-host/unverifiable scalar examples. Retire the entire dated10-case attach receipt; retain16 independent receipts only in their original scopes. No retained-memory or real-daemon measurement follows from supplied provider inventories. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove initial-snapshot sequence-domain, limited-tail/truncation and unknown-output-sequence aliases whose callbacks are removed. The source retains partial-chunk replay and requested-snapshot retry/admission at supplied snapshot/data seams, not equivalent replacement or measured retained-memory proof. Preserve the existing stream/pending-wait capacity aliases only to their retained owning multiplex callbacks with supplied PTY resolutions. Removing the sibling-PTY heartbeat dedup work-count sample does not establish a new decorative fanout budget; the unrelated-PTY cancellation fence survives. Preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove the reasonless-close selector and narrow census aliases to actual retained runtime and injected-inventory callbacks. The removed synthetic census-dedup and isolated pre-boundary timing cases receive no replacement credit; preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Delete the synthetic watcher-synchronization and partial-reconciliation suites. Retire all affected host-fact, capability-owner, activation-residue and retention-cap aliases because the remaining callbacks do not establish those full claims. Keep exact local hook/timer, byte-stream side effects, exit/disposal, scroll-intent cleanup and deterministic local rank/TTL progression callbacks within their mocked-host scope. No physical paired-host retention, resource budget or equivalent replacement evidence is assigned. The generic broad test command remains a runnable discovery command, never a dated execution receipt. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete hook-agent-status projection suite and its two behavioral assertion aliases. Supplied stored hook/title/resume/staleness/rename/question/generation/PTY-retirement/snapshot-version projections are intentionally lost. The separate osc-status-scan gate mentions this source only in existing historical notes and receives no mutation. No measured hidden-output retention, CPU/RSS or resource budget result is claimed by the deleted source or this audit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Module ownership cleanup retires the modeled cold-park private watcher/render/work-count suites under the current test policy. Their assertions are no longer active evidence. Retained lifecycle tests and headed/headless journeys do not establish equivalent coverage for those removed harness alarms. Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. deletes src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx: Loses modeled React oscillation alarm; real pane/watchers are not exercised. deletes src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts: Loses delayed credit until parsing, malformed frame/unknown stream handling, discarded transformed output recovery and failed ACK rearm alarms. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1412 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): This audit removes the browser response-after-manual-disconnect example. Its distinct in-flight response fencing alarm is lost; retained queued-call disconnect tests are not an equivalent replacement. Historical commands and results remain historical. Deterministic headed macOS runs launch an isolated Orca desktop server and a separate paired web client. A byte-identical headless run uses an isolated `orca serve` host. Both create six real paired host PTYs with bounded high-output scrollback, prove sustained output while all six client xterms are warm-mounted but hidden causes zero renderer scheduler work, then drive 180 timed real-PTY spinner frames through a second production `session.tabs.subscribeAll` transport and the real Zustand store. Each worktree must publish and apply only its exact initial-working and final-idle titles. Both topologies ordinary-park five xterms without enabling the lossy retention budget, assert bounded cells/heap/timer lag, then restore the bounded authoritative tail exactly once on the original PTY including output produced while parked and continued input/output. The headed oracle additionally keeps every remote target workspace and terminal unmounted in the host renderer before and after client recovery. Production-parity React contracts reproduce and remove the independent cold-park watcher/title feedback loop, including memo-cache discard, StrictMode cleanup replay, detached split-PTY replacement, and the zero-park fast path. A deterministic cross-boundary contract drives 24 real PTY trackers in distinct worktrees through 2,880 decorative spinner and bare-native redraw chunks and counts host publications, serialized bytes, renderer apply calls, and store mutations while preserving exact per-PTY raw chunks and per-worktree semantic transitions. Fake-clock continuation beyond the 30-minute stale boundary requires one deduplicated refresh per worktree every 15 minutes, globally spaced by at least 50 ms, with every mirrored working status still fresh. Exact-identical Pi plus rotating normalized Pi/Grok frames renew coarse working/permission state; rich prompt/tool/question fields retain their original 30-minute lease, and `stateStartedAt`/acknowledgement identity remain stable across title/hook source swaps. A separate headed desktop-client journey relaunches the host main process while retaining the daemon and a daemon-backgrounded PTY, then requires first-observation foreground sync and continued input/output on the same PTY. Unit coverage keeps layout versions out of snapshot output high-waters when a restored snapshot has no output sequence and retries an existing subscriber only after authoritative provider inventory proves the retained PTY exists. Separate headed/headless ACK-starvation tests recover one stalled stream without replacing its PTY. A headed output-drop oracle proves a successful snapshot probe cannot certify a stale live stream when the authoritative PTY sequence advanced beyond the client high-water. Unit coverage requires an unsequenced client to establish a first-probe baseline, remain attached at the same sequence, and recover only after a later probe advances. A capability-disabled run proves legacy hosts retain the prior lossy limit/TTL fallback. Unit tests cover exact-owner capability routing, raw-stream release, singleton side-effect facts with timed handoff cleanup, 64 simultaneous synthetic-title sources with zero decorative client events after convergence, per-client late-subscribe recovery, semantic bell/title transitions, local animation-frame preservation, legacy no-output-pause delivery gating with exact snapshot restore, provider-authoritative snapshots, 128 active streams plus retry after a 129th-stream capacity rejection, capacity-pressure backoff, full split-leaf remint reconciliation, truncation, and manual-disconnect queue fencing. Linux, Windows, live SSH, and production-scale paired hosts remain gaps. The audit removed the E2E parking override/debug-handle suite. Override exposure guards, delay/retention independence, TTL filtering and debug-handle forwarding alarms are lost. Retained real parking journeys do not establish equivalent test-harness configuration coverage. The test-value audit removes separate responsive-stream, intervening-control-frame and capacity-error classification examples. Retained multiplexer checks use fake clocks and captured transport callbacks; their per-stream isolation, deadline and probe-baseline assertions do not prove an actual host restart or equivalent replacement coverage. Historical run commands and results remain historical. The test-value audit removes the standalone retained/live metadata projection and additive-preference negative example from runtime-client-events.test.ts. Its remaining case checks partial-authority event admission through a captured callback; it does not establish full-pair projection, actual peer delivery or equivalent replacement coverage. Historical commands and results remain historical. The isolated accepted-handle-events observer suite is removed. Its runtime/worktree/pane membership, once-only delivery and listener-release ledger alarms are lost. Live hidden-retention evidence does not establish equivalent observer coverage. Audit1292: The entire host-session mirror empty-inventory settle suite is removed. Live-unpublished versus genuinely-empty hydration, same-ID revision response/in-flight fencing and cleared-tracking pending-probe invalidation alarms are lost. The singleton store and inventories were mocked; no real host census or resume delivery or equivalent replacement coverage is claimed. Audit1302: src/main/runtime/session-tabs-inventory-publication.test.ts: Keep actual runtime public inventory authority across renderer epochs/resync, fallback, aborts and invalid graph publishers. Remove copied nonempty publication, private scan counters/collector and known-host replacement, fake refresh that performs the restoration itself, environment capability flag, and private resume-store characterization whose fixture supplies reservation/rollback ordering. Lose isolated refresh/churn/receiver/capability and copied-payload wiring alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1346 removes the entire private-state-injected session-tabs rich-status boundary suite. Its stale task/question, neutral-title preservation, owner-change and provider-generation alarms are intentionally lost. Retained real terminal journeys do not establish equivalent replacement coverage. The prior mixed 42-contract execution receipt is historical and must not validate the reduced current selector; fresh validation remains required. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts reduced. Retire standalone reconcile set output and positive untouchedFreshSpawn/workspaceOwner copying alarms; no native watcher execution claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts reduced. Loses FIFO fairness/spacing, semantic bypass/cancellation, delayed-boundary scheduling and teardown timer-cleanup alarms. Retained fixed emission cases do not replace those outcomes. No equivalent replacement coverage is claimed.",
+ "coverageNotes": "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed. Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed. Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. The decorative fanout suite retains only real OSC9999 ingestion through runtime/title heartbeat/viewer past the stale boundary, preserving stateStartedAt and clearing expired prompt metadata. Spinner volume/zero-work inventories, Pi/Grok frame tables, rich-status and foreground-reset examples are retired. Existing receipts for separate paired-terminal sources retain their original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3342 removes three supplied activation/inventory fallback and same-handle retry examples; their fallback/retry alarms are intentionally lost without equivalent replacement. The exact mounted-HUB pending old-stream-end versus replacement-snapshot registration and its assertion remain. Unrelated dated macOS receipts retain only their original scope; no fresh runtime, provider, performance, mobile, mixed-version or cross-platform validation is claimed. NEXT46 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts, src/renderer/src/runtime/hosted-terminals/streams/remote-runtime-terminal-stall-recovery.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence. Historical prior account (preserved verbatim): Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: restarts only the stream whose renderer delivery credit never settles — An unreturned renderer delivery credit stalls only its stream, leaving healthy sibling/shared transport alive. Fake-clock deadline plus real multiplexer unsubscribe isolates recovery ownership.; probes then restarts a stream when an entered command receives no frames — Entered command produces no output; actual multiplexer must probe then close only its stalled stream after probe timeout. Distinct response liveness from parser credit.; establishes a probe baseline before recovering an unsequenced stream — 142-line manual five-probe baseline/regression sequence derives request IDs from encoded mock traffic and checks repeated no-close/close choreography. Oversized algorithm/state-machine example; no actual renderer/host command or recovery delivery. Retires unsequenced/unchanged/regressed baseline classification alarms.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3318 reduces remote-runtime-pty-transport-unpublished-host-graph.test.ts, retiring its direct published-empty-graph omission-to-pane-exit alarm. The unchanged bounded unpublished-frame/pushed-recovery and stale-handle park/manual-retry cases are narrower, not equivalent replacements. Both complete three-case Linux receipts dated 2026-11-04 are archived as historical, including source heads; they do not validate this reduced selector. Remaining fourteen active receipts are macOS only. No fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. The direct side-effect-facts selector retains six cases: replay exclusion, live sequence handling, stale disposer ownership, one handoff drain, drain-before-snapshot, and stale replacement-snapshot refusal. Successful current-entry snapshot application is not witnessed by the retained snapshot case. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2162: Reduced inventory-authority source intentionally loses the examples recorded in knownGaps; historical execution is not validation of changed bytes. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Remove SSH/absent-inventory attach refusal, later-subscriber retry, no-view adoption/takeback, provider-tail/unknown-read projections, failed-keystroke retry and simpler loss reattach examples. Keep the existing-subscriber inventory-ready retry alias only at its retained callback, plus retained held-input cancellation/replacement and overlapping attach/loss fences. The inventory driver also loses the whole empty-worktree-publication registration and folder-host/unverifiable scalar examples. Retire the entire dated10-case attach receipt; retain16 independent receipts only in their original scopes. No retained-memory or real-daemon measurement follows from supplied provider inventories. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove initial-snapshot sequence-domain, limited-tail/truncation and unknown-output-sequence aliases whose callbacks are removed. The source retains partial-chunk replay and requested-snapshot retry/admission at supplied snapshot/data seams, not equivalent replacement or measured retained-memory proof. Preserve the existing stream/pending-wait capacity aliases only to their retained owning multiplex callbacks with supplied PTY resolutions. Removing the sibling-PTY heartbeat dedup work-count sample does not establish a new decorative fanout budget; the unrelated-PTY cancellation fence survives. Preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove the reasonless-close selector and narrow census aliases to actual retained runtime and injected-inventory callbacks. The removed synthetic census-dedup and isolated pre-boundary timing cases receive no replacement credit; preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Delete the synthetic watcher-synchronization and partial-reconciliation suites. Retire all affected host-fact, capability-owner, activation-residue and retention-cap aliases because the remaining callbacks do not establish those full claims. Keep exact local hook/timer, byte-stream side effects, exit/disposal, scroll-intent cleanup and deterministic local rank/TTL progression callbacks within their mocked-host scope. No physical paired-host retention, resource budget or equivalent replacement evidence is assigned. The generic broad test command remains a runnable discovery command, never a dated execution receipt. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete hook-agent-status projection suite and its two behavioral assertion aliases. Supplied stored hook/title/resume/staleness/rename/question/generation/PTY-retirement/snapshot-version projections are intentionally lost. The separate osc-status-scan gate mentions this source only in existing historical notes and receives no mutation. No measured hidden-output retention, CPU/RSS or resource budget result is claimed by the deleted source or this audit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Module ownership cleanup retires the modeled cold-park private watcher/render/work-count suites under the current test policy. Their assertions are no longer active evidence. Retained lifecycle tests and headed/headless journeys do not establish equivalent coverage for those removed harness alarms. Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. deletes src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx: Loses modeled React oscillation alarm; real pane/watchers are not exercised. deletes src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts: Loses delayed credit until parsing, malformed frame/unknown stream handling, discarded transformed output recovery and failed ACK rearm alarms. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1412 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): This audit removes the browser response-after-manual-disconnect example. Its distinct in-flight response fencing alarm is lost; retained queued-call disconnect tests are not an equivalent replacement. Historical commands and results remain historical. Deterministic headed macOS runs launch an isolated Orca desktop server and a separate paired web client. A byte-identical headless run uses an isolated `orca serve` host. Both create six real paired host PTYs with bounded high-output scrollback, prove sustained output while all six client xterms are warm-mounted but hidden causes zero renderer scheduler work, then drive 180 timed real-PTY spinner frames through a second production `session.tabs.subscribeAll` transport and the real Zustand store. Each worktree must publish and apply only its exact initial-working and final-idle titles. Both topologies ordinary-park five xterms without enabling the lossy retention budget, assert bounded cells/heap/timer lag, then restore the bounded authoritative tail exactly once on the original PTY including output produced while parked and continued input/output. The headed oracle additionally keeps every remote target workspace and terminal unmounted in the host renderer before and after client recovery. Production-parity React contracts reproduce and remove the independent cold-park watcher/title feedback loop, including memo-cache discard, StrictMode cleanup replay, detached split-PTY replacement, and the zero-park fast path. A deterministic cross-boundary contract drives 24 real PTY trackers in distinct worktrees through 2,880 decorative spinner and bare-native redraw chunks and counts host publications, serialized bytes, renderer apply calls, and store mutations while preserving exact per-PTY raw chunks and per-worktree semantic transitions. Fake-clock continuation beyond the 30-minute stale boundary requires one deduplicated refresh per worktree every 15 minutes, globally spaced by at least 50 ms, with every mirrored working status still fresh. Exact-identical Pi plus rotating normalized Pi/Grok frames renew coarse working/permission state; rich prompt/tool/question fields retain their original 30-minute lease, and `stateStartedAt`/acknowledgement identity remain stable across title/hook source swaps. A separate headed desktop-client journey relaunches the host main process while retaining the daemon and a daemon-backgrounded PTY, then requires first-observation foreground sync and continued input/output on the same PTY. Unit coverage keeps layout versions out of snapshot output high-waters when a restored snapshot has no output sequence and retries an existing subscriber only after authoritative provider inventory proves the retained PTY exists. Separate headed/headless ACK-starvation tests recover one stalled stream without replacing its PTY. A headed output-drop oracle proves a successful snapshot probe cannot certify a stale live stream when the authoritative PTY sequence advanced beyond the client high-water. Unit coverage requires an unsequenced client to establish a first-probe baseline, remain attached at the same sequence, and recover only after a later probe advances. A capability-disabled run proves legacy hosts retain the prior lossy limit/TTL fallback. Unit tests cover exact-owner capability routing, raw-stream release, singleton side-effect facts with timed handoff cleanup, 64 simultaneous synthetic-title sources with zero decorative client events after convergence, per-client late-subscribe recovery, semantic bell/title transitions, local animation-frame preservation, legacy no-output-pause delivery gating with exact snapshot restore, provider-authoritative snapshots, 128 active streams plus retry after a 129th-stream capacity rejection, capacity-pressure backoff, full split-leaf remint reconciliation, truncation, and manual-disconnect queue fencing. Linux, Windows, live SSH, and production-scale paired hosts remain gaps. The audit removed the E2E parking override/debug-handle suite. Override exposure guards, delay/retention independence, TTL filtering and debug-handle forwarding alarms are lost. Retained real parking journeys do not establish equivalent test-harness configuration coverage. The test-value audit removes separate responsive-stream, intervening-control-frame and capacity-error classification examples. Retained multiplexer checks use fake clocks and captured transport callbacks; their per-stream isolation, deadline and probe-baseline assertions do not prove an actual host restart or equivalent replacement coverage. Historical run commands and results remain historical. The test-value audit removes the standalone retained/live metadata projection and additive-preference negative example from runtime-client-events.test.ts. Its remaining case checks partial-authority event admission through a captured callback; it does not establish full-pair projection, actual peer delivery or equivalent replacement coverage. Historical commands and results remain historical. The isolated accepted-handle-events observer suite is removed. Its runtime/worktree/pane membership, once-only delivery and listener-release ledger alarms are lost. Live hidden-retention evidence does not establish equivalent observer coverage. Audit1292: The entire host-session mirror empty-inventory settle suite is removed. Live-unpublished versus genuinely-empty hydration, same-ID revision response/in-flight fencing and cleared-tracking pending-probe invalidation alarms are lost. The singleton store and inventories were mocked; no real host census or resume delivery or equivalent replacement coverage is claimed. Audit1302: src/main/runtime/session-tabs-inventory-publication.test.ts: Keep actual runtime public inventory authority across renderer epochs/resync, fallback, aborts and invalid graph publishers. Remove copied nonempty publication, private scan counters/collector and known-host replacement, fake refresh that performs the restoration itself, environment capability flag, and private resume-store characterization whose fixture supplies reservation/rollback ordering. Lose isolated refresh/churn/receiver/capability and copied-payload wiring alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1346 removes the entire private-state-injected session-tabs rich-status boundary suite. Its stale task/question, neutral-title preservation, owner-change and provider-generation alarms are intentionally lost. Retained real terminal journeys do not establish equivalent replacement coverage. The prior mixed 42-contract execution receipt is historical and must not validate the reduced current selector; fresh validation remains required. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts reduced. Retire standalone reconcile set output and positive untouchedFreshSpawn/workspaceOwner copying alarms; no native watcher execution claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts reduced. Loses FIFO fairness/spacing, semantic bypass/cancellation, delayed-boundary scheduling and teardown timer-cleanup alarms. Retained fixed emission cases do not replace those outcomes. No equivalent replacement coverage is claimed.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8652",
"https://github.com/stablyai/orca/pull/10625"
],
"invariant": "A host advertising terminal.paired-parking.v1 keeps the PTY and bounded authoritative history alive while an ordinary hidden-view park destroys the client xterm and releases its raw per-PTY stream. Reveal must restore up to the requested 5,000 rows, parked-time side effects/output, the same PTY identity, and continued input/output. Parked watcher synchronization compares parking semantics rather than fresh object identity, owns setup and cleanup across StrictMode replay, reconciles real PTY/layout changes, and performs no terminal-state scan when nothing is parked. After a host main-process relaunch, unknown local delivery-sync state must not be treated as proof that a surviving daemon PTY is already foregrounded. An empty headed session-tab inventory is authoritative only after the current renderer graph generation publishes a complete inventory and every execution host answers the PTY census; unpublished, resync-pending, transport-failed, and partially scoped inventories remain unverifiable, while genuinely authoritative empty and non-empty inventories settle and a scope-less legacy empty keeps its pre-authority best-effort settle so outdated hosts retain agent auto-resume. The unpublished-empty regression must keep the resume dispatch parked with exactly one daemon process/writer; restoring unconditional empty hydration must release one dispatch and create two live writers. If subscription precedes provider readiness, authoritative inventory must reconsider that existing subscriber without spawning, resizing, or changing reconnect state. A snapshot without an output high-water must keep it unknown rather than borrowing a layout version that can suppress newer live output. Hosts without the capability must gate hidden raw output before xterm scheduling and repaint from the authoritative snapshot on reveal while retaining the existing limit/TTL force-parking fallback. After the first semantic title state, decorative spinner frequency must add zero paired client-event frames and zero full session-tabs work between status-freshness leases regardless of hidden worktree count. Continuous working or permission evidence may refresh each affected worktree once per 15 minutes through one globally spaced FIFO so current and legacy viewers do not decay before 30 minutes; sibling PTYs share that worktree refresh, while local title animation, raw output, and semantic title, status, bell, completion, and query facts remain intact. A paired terminal stream whose delivery credits stop progressing must replace only that stream; command silence first probes authoritative state and replaces the stream if the probe times out or proves the PTY advanced beyond the client's delivered output sequence. When no comparable delivery high-water exists, the first sequenced probe establishes a baseline and only later advancement proves staleness. A same-sequence snapshot remains valid proof of a responsive silent command. A successful status probe may replace a pre-ready shared-control socket without rejecting or duplicating calls already waiting for that transport. Manual disconnect must retain pairing while preventing queued or passive calls and subscriptions from recreating transport until explicit Connect. A paired pane reconnecting to a relaunched host that has not yet published its window graph (an unpublished frame, bare or client-projected) must stay in recovery rather than retire, and the host's first published snapshot carrying the surface must reattach it; a published frame lacking the surface still retires it. The placeholder is only ever sent before the host's graph first publishes; afterwards a worktree with no tabs gets a real empty answer, pushed once to any client that asked during startup, so a paired client opening a never-opened host worktree still gets its first terminal.",
- "oracle": "Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. The decorative fanout suite retains only real OSC9999 ingestion through runtime/title heartbeat/viewer past the stale boundary, preserving stateStartedAt and clearing expired prompt metadata. Spinner volume/zero-work inventories, Pi/Grok frame tables, rich-status and foreground-reset examples are retired. Existing receipts for separate paired-terminal sources retain their original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3342 removes three supplied activation/inventory fallback and same-handle retry examples; their fallback/retry alarms are intentionally lost without equivalent replacement. The exact mounted-HUB pending old-stream-end versus replacement-snapshot registration and its assertion remain. Unrelated dated macOS receipts retain only their original scope; no fresh runtime, provider, performance, mobile, mixed-version or cross-platform validation is claimed. Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: restarts only the stream whose renderer delivery credit never settles — An unreturned renderer delivery credit stalls only its stream, leaving healthy sibling/shared transport alive. Fake-clock deadline plus real multiplexer unsubscribe isolates recovery ownership.; probes then restarts a stream when an entered command receives no frames — Entered command produces no output; actual multiplexer must probe then close only its stalled stream after probe timeout. Distinct response liveness from parser credit.; establishes a probe baseline before recovering an unsequenced stream — 142-line manual five-probe baseline/regression sequence derives request IDs from encoded mock traffic and checks repeated no-close/close choreography. Oversized algorithm/state-machine example; no actual renderer/host command or recovery delivery. Retires unsequenced/unchanged/regressed baseline classification alarms.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3318 reduces remote-runtime-pty-transport-unpublished-host-graph.test.ts, retiring its direct published-empty-graph omission-to-pane-exit alarm. The unchanged bounded unpublished-frame/pushed-recovery and stale-handle park/manual-retry cases are narrower, not equivalent replacements. Both complete three-case Linux receipts dated 2026-11-04 are archived as historical, including source heads; they do not validate this reduced selector. Remaining fourteen active receipts are macOS only. No fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. The direct side-effect-facts selector retains six cases: replay exclusion, live sequence handling, stale disposer ownership, one handoff drain, drain-before-snapshot, and stale replacement-snapshot refusal. Successful current-entry snapshot application is not witnessed by the retained snapshot case. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Remove SSH/absent-inventory attach refusal, later-subscriber retry, no-view adoption/takeback, provider-tail/unknown-read projections, failed-keystroke retry and simpler loss reattach examples. Keep the existing-subscriber inventory-ready retry alias only at its retained callback, plus retained held-input cancellation/replacement and overlapping attach/loss fences. The inventory driver also loses the whole empty-worktree-publication registration and folder-host/unverifiable scalar examples. Retire the entire dated10-case attach receipt; retain16 independent receipts only in their original scopes. No retained-memory or real-daemon measurement follows from supplied provider inventories. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove initial-snapshot sequence-domain, limited-tail/truncation and unknown-output-sequence aliases whose callbacks are removed. The source retains partial-chunk replay and requested-snapshot retry/admission at supplied snapshot/data seams, not equivalent replacement or measured retained-memory proof. Preserve the existing stream/pending-wait capacity aliases only to their retained owning multiplex callbacks with supplied PTY resolutions. Removing the sibling-PTY heartbeat dedup work-count sample does not establish a new decorative fanout budget; the unrelated-PTY cancellation fence survives. Preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove the reasonless-close selector and narrow census aliases to actual retained runtime and injected-inventory callbacks. The removed synthetic census-dedup and isolated pre-boundary timing cases receive no replacement credit; preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Delete the synthetic watcher-synchronization and partial-reconciliation suites. Retire all affected host-fact, capability-owner, activation-residue and retention-cap aliases because the remaining callbacks do not establish those full claims. Keep exact local hook/timer, byte-stream side effects, exit/disposal, scroll-intent cleanup and deterministic local rank/TTL progression callbacks within their mocked-host scope. No physical paired-host retention, resource budget or equivalent replacement evidence is assigned. The generic broad test command remains a runnable discovery command, never a dated execution receipt. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete hook-agent-status projection suite and its two behavioral assertion aliases. Supplied stored hook/title/resume/staleness/rename/question/generation/PTY-retirement/snapshot-version projections are intentionally lost. The separate osc-status-scan gate mentions this source only in existing historical notes and receives no mutation. No measured hidden-output retention, CPU/RSS or resource budget result is claimed by the deleted source or this audit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Run one byte-identical six-terminal oracle against an isolated headed desktop host and an isolated headless `orca serve` host. Stage at least 1,000,000 xterm cells, hide all six warm managers, emit an initial working title followed by 30 timed real-PTY spinner frames and a final idle title per worktree, and observe a second real session-tabs subscription plus the production renderer store. Require exactly two transport envelopes and two title mutations per worktree, no decorative title crossing either boundary, and positive decoded-envelope bytes. Enable ordinary parking with the lossy retention budget disabled, require exactly one mounted manager and five parked tabs, at most 45% retained cells, no more than 16 MiB heap growth, and under 500 ms timer drift. In headed mode, require the host renderer to remain on its original workspace with zero target terminal managers mounted throughout client park, reveal, and live I/O. While a tab is parked, require authoritative terminal.read to observe new PTY output; reveal it and require the original PTY, a marker within the requested 5,000-row history, the parked marker, and post-reveal input/output. Drive 24 real PTY title trackers in distinct worktrees through 40 decorative spinner frames each, then 40 spinner frames alternating with Cursor's bare native identity redraw, using fake clocks. Require all 2,880 raw chunks exactly and zero host session-tabs publications, serialized bytes, renderer apply calls, and renderer store mutations. Continue decorative evidence beyond 30 minutes, require exactly one refresh per worktree per 15-minute lease through a FIFO spaced by at least 50 ms, and require all 24 viewer statuses to remain working and fresh; then require one exact semantic idle transition and one visible-output chunk per PTY. Require ordinary and interior-Braille title changes to publish. Drive 64 host PTYs through ten 80 ms synthetic title frames, require zero paired client events after the first frame per PTY while all 640 local frames remain observable, attach a late client and require one current frame per PTY, then require semantic bell and idle transitions on both clients. Reconstruct a legacy subscribed stream with no outputPause capability, hide a chatty pane, require no hidden xterm writes, reveal it, and require one authoritative snapshot plus continued live output. Drop and acknowledge output only for one original paired-client stream, prove the fixture process consumed input while the host model advanced and the client stayed stale, then require the command snapshot probe to replace that stream, repaint exact fixture output, preserve authoritative PTY identity and target-tab cardinality, and resume live I/O. For a client without a delivered sequence, require the first numeric probe to establish a baseline without replacement, a same-sequence probe to remain attached, and a later advanced probe to replace only that stream. Withhold the first encrypted shared-control ready frame, start one RPC, trigger a status-probe refresh, and require two connections, one host delivery, successful response, and zero retained request bytes. Admit 128 active streams, reject the 129th as retryable, release one stream, then require the retry to attach and publish a snapshot without multiplying retained subscribers. Disable terminal.paired-parking.v1 and require the same oracle to fail before parking, while the legacy limit-one fallback separately passes. Also preserve truncated first paint, ACK-starved same-PTY recovery, responsive silent-command snapshot probes, dead-stream probe timeout recovery, and queued manual-disconnect fencing.",
+ "oracle": "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed. Historical prior account (preserved verbatim): Audit3814 deliberately retires60 authored/60 finite cases:53runtime compatibility cases,4native XCTest methods and3Python clipboard methods, including the entire StableElementIndexes suite. Clipboard cuts retire the one-over-cap sample, incoming-offer destruction trace and sequential20-copy replay; actual wire, FD/pipe, startup and Xvfb/GTK boundaries remain without equivalent replacement claims. Accepted losses include narrow terminal-send payload/provider projections, legacy and direct no-op/error permutations, timing/work-count examples, private state/title/activity projections and fixture-driven readiness examples, individually enumerated below. These include real bounded production alarms consciously retired for marginal value; retained failed writes, duplicate submission, stale capture, transcript/ring and allocation fences are not equivalent replacements. No fresh native/remote/browser execution or complete transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3806 deliberately retires40 authored/40 finite runtime compatibility cases, including the terminal-side-effect-facts-part03 headless-snapshots-part02 and agent-status-and-waits-part03 fragments, plus20 scalar Swift precondition sites. Lost runtime alarms include status/title/attention projection examples, simple renderer/headless frame restoration and status waiting outcomes detailed in the accepted-loss ledger. Swift cuts retire duplicate generation-map/schema/navigation/bridge and notification-wrapper assertions; no standalone native program is deleted. These include real bounded production alarms consciously retired for marginal value. Retained races, pending writes/reflow, namespace and waiter ownership are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3798 deliberately retires21 authored/24 finite compatibility cases, including the entire SSH-worktree-lifecycle and repository-project-operations fragments. Accepted losses include navigation-only settings acknowledgement, browser session cleanup and host preservation projections, window positive/policy-state examples, terminal recovery/reload and no-incarnation remint examples, terminal listing compatibility/malformed IDs, directory browse/sort/Windows path smoke, SSH create refusal/manual lineage, recursive parent-folder creation and fork/origin/avatar/icon projections. Real bounded production alarms are consciously retired for marginal value; retained authority races, cleanup/clone ownership, pending waiters, nested-folder and scan invalidation cases are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed. Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. The decorative fanout suite retains only real OSC9999 ingestion through runtime/title heartbeat/viewer past the stale boundary, preserving stateStartedAt and clearing expired prompt metadata. Spinner volume/zero-work inventories, Pi/Grok frame tables, rich-status and foreground-reset examples are retired. Existing receipts for separate paired-terminal sources retain their original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3342 removes three supplied activation/inventory fallback and same-handle retry examples; their fallback/retry alarms are intentionally lost without equivalent replacement. The exact mounted-HUB pending old-stream-end versus replacement-snapshot registration and its assertion remain. Unrelated dated macOS receipts retain only their original scope; no fresh runtime, provider, performance, mobile, mixed-version or cross-platform validation is claimed. Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: restarts only the stream whose renderer delivery credit never settles — An unreturned renderer delivery credit stalls only its stream, leaving healthy sibling/shared transport alive. Fake-clock deadline plus real multiplexer unsubscribe isolates recovery ownership.; probes then restarts a stream when an entered command receives no frames — Entered command produces no output; actual multiplexer must probe then close only its stalled stream after probe timeout. Distinct response liveness from parser credit.; establishes a probe baseline before recovering an unsequenced stream — 142-line manual five-probe baseline/regression sequence derives request IDs from encoded mock traffic and checks repeated no-close/close choreography. Oversized algorithm/state-machine example; no actual renderer/host command or recovery delivery. Retires unsequenced/unchanged/regressed baseline classification alarms.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3318 reduces remote-runtime-pty-transport-unpublished-host-graph.test.ts, retiring its direct published-empty-graph omission-to-pane-exit alarm. The unchanged bounded unpublished-frame/pushed-recovery and stale-handle park/manual-retry cases are narrower, not equivalent replacements. Both complete three-case Linux receipts dated 2026-11-04 are archived as historical, including source heads; they do not validate this reduced selector. Remaining fourteen active receipts are macOS only. No fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. The direct side-effect-facts selector retains six cases: replay exclusion, live sequence handling, stale disposer ownership, one handoff drain, drain-before-snapshot, and stale replacement-snapshot refusal. Successful current-entry snapshot application is not witnessed by the retained snapshot case. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Remove SSH/absent-inventory attach refusal, later-subscriber retry, no-view adoption/takeback, provider-tail/unknown-read projections, failed-keystroke retry and simpler loss reattach examples. Keep the existing-subscriber inventory-ready retry alias only at its retained callback, plus retained held-input cancellation/replacement and overlapping attach/loss fences. The inventory driver also loses the whole empty-worktree-publication registration and folder-host/unverifiable scalar examples. Retire the entire dated10-case attach receipt; retain16 independent receipts only in their original scopes. No retained-memory or real-daemon measurement follows from supplied provider inventories. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove initial-snapshot sequence-domain, limited-tail/truncation and unknown-output-sequence aliases whose callbacks are removed. The source retains partial-chunk replay and requested-snapshot retry/admission at supplied snapshot/data seams, not equivalent replacement or measured retained-memory proof. Preserve the existing stream/pending-wait capacity aliases only to their retained owning multiplex callbacks with supplied PTY resolutions. Removing the sibling-PTY heartbeat dedup work-count sample does not establish a new decorative fanout budget; the unrelated-PTY cancellation fence survives. Preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove the reasonless-close selector and narrow census aliases to actual retained runtime and injected-inventory callbacks. The removed synthetic census-dedup and isolated pre-boundary timing cases receive no replacement credit; preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Delete the synthetic watcher-synchronization and partial-reconciliation suites. Retire all affected host-fact, capability-owner, activation-residue and retention-cap aliases because the remaining callbacks do not establish those full claims. Keep exact local hook/timer, byte-stream side effects, exit/disposal, scroll-intent cleanup and deterministic local rank/TTL progression callbacks within their mocked-host scope. No physical paired-host retention, resource budget or equivalent replacement evidence is assigned. The generic broad test command remains a runnable discovery command, never a dated execution receipt. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete hook-agent-status projection suite and its two behavioral assertion aliases. Supplied stored hook/title/resume/staleness/rename/question/generation/PTY-retirement/snapshot-version projections are intentionally lost. The separate osc-status-scan gate mentions this source only in existing historical notes and receives no mutation. No measured hidden-output retention, CPU/RSS or resource budget result is claimed by the deleted source or this audit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Run one byte-identical six-terminal oracle against an isolated headed desktop host and an isolated headless `orca serve` host. Stage at least 1,000,000 xterm cells, hide all six warm managers, emit an initial working title followed by 30 timed real-PTY spinner frames and a final idle title per worktree, and observe a second real session-tabs subscription plus the production renderer store. Require exactly two transport envelopes and two title mutations per worktree, no decorative title crossing either boundary, and positive decoded-envelope bytes. Enable ordinary parking with the lossy retention budget disabled, require exactly one mounted manager and five parked tabs, at most 45% retained cells, no more than 16 MiB heap growth, and under 500 ms timer drift. In headed mode, require the host renderer to remain on its original workspace with zero target terminal managers mounted throughout client park, reveal, and live I/O. While a tab is parked, require authoritative terminal.read to observe new PTY output; reveal it and require the original PTY, a marker within the requested 5,000-row history, the parked marker, and post-reveal input/output. Drive 24 real PTY title trackers in distinct worktrees through 40 decorative spinner frames each, then 40 spinner frames alternating with Cursor's bare native identity redraw, using fake clocks. Require all 2,880 raw chunks exactly and zero host session-tabs publications, serialized bytes, renderer apply calls, and renderer store mutations. Continue decorative evidence beyond 30 minutes, require exactly one refresh per worktree per 15-minute lease through a FIFO spaced by at least 50 ms, and require all 24 viewer statuses to remain working and fresh; then require one exact semantic idle transition and one visible-output chunk per PTY. Require ordinary and interior-Braille title changes to publish. Drive 64 host PTYs through ten 80 ms synthetic title frames, require zero paired client events after the first frame per PTY while all 640 local frames remain observable, attach a late client and require one current frame per PTY, then require semantic bell and idle transitions on both clients. Reconstruct a legacy subscribed stream with no outputPause capability, hide a chatty pane, require no hidden xterm writes, reveal it, and require one authoritative snapshot plus continued live output. Drop and acknowledge output only for one original paired-client stream, prove the fixture process consumed input while the host model advanced and the client stayed stale, then require the command snapshot probe to replace that stream, repaint exact fixture output, preserve authoritative PTY identity and target-tab cardinality, and resume live I/O. For a client without a delivered sequence, require the first numeric probe to establish a baseline without replacement, a same-sequence probe to remain attached, and a later advanced probe to replace only that stream. Withhold the first encrypted shared-control ready frame, start one RPC, trigger a status-probe refresh, and require two connections, one host delivery, successful response, and zero retained request bytes. Admit 128 active streams, reject the 129th as retryable, release one stream, then require the retry to attach and publish a snapshot without multiplying retained subscribers. Disable terminal.paired-parking.v1 and require the same oracle to fail before parking, while the legacy limit-one fallback separately passes. Also preserve truncated first paint, ACK-starved same-PTY recovery, responsive silent-command snapshot probes, dead-stream probe timeout recovery, and queued manual-disconnect fencing.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts",
"ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
@@ -8263,7 +8230,7 @@
"ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-client-first-terminal-unopened-host-worktree.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-lifecycle/publication/mobile-session-tabs-agent-status-heartbeat.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts --maxWorkers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts --maxWorkers=1",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport/output/terminal-side-effect-facts-handler.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/terminal/terminal-multiplex-initial-snapshot-buffering.test.ts src/main/runtime/rpc/terminal/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal/terminal-subscribe-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport/output/terminal-side-effect-facts-handler.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts src/main/daemon/terminal-host/testing/terminal-host-agent-session.test.ts tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts --maxWorkers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts",
@@ -8287,10 +8254,9 @@
"src/main/runtime/construction/orca-runtime.test.ts",
"src/renderer/src/web/web-preload-api-runtime-environment.test.ts",
"src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts",
- "src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts",
- "src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts",
- "src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts",
- "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
+ "src/main/runtime/rpc/terminal/terminal-multiplex-initial-snapshot-buffering.test.ts",
+ "src/main/runtime/rpc/terminal/terminal-multiplex-pty-wait-capacity.test.ts",
+ "src/main/runtime/rpc/terminal/terminal-subscribe-buffer.test.ts",
"src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts",
"src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts",
"src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts",
@@ -8409,7 +8375,7 @@
]
},
{
- "file": "src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts",
+ "file": "src/main/runtime/rpc/terminal/terminal-multiplex-pty-wait-capacity.test.ts",
"assertions": [
"admits 128 active streams, rejects the 129th, and reuses released capacity",
"reserves PTY wait capacity independently from active streams"
@@ -8596,6 +8562,12 @@
"Keep the budget-off control, exact manager count, final bounded-tail flood marker, parked-time output, and post-reveal PTY input in both topology runs."
],
"knownGaps": [
+ "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed.",
+ "Audit3814 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle from a Codex ready prompt even when stale startup lines remain :: Stale MCP startup lines must not block a later Codex ready header.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle when a stale Codex prompt is followed by the ready header :: A Codex ready header following a stale resume prompt must satisfy tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for an idle Cursor lane past its dismissed trust dialog (#8210) :: Later Cursor idle banner overrides retained trust dialog.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not block a mid-run Cursor lane on its dismissed trust dialog (#8210) :: Dismissed trust dialog must not report blocked for later busy Cursor; wait times out.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not classify unrelated press-enter prompts as Codex blocked prompts :: Unidentified press-enter text must time out rather than be classified Codex blocked.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for quiet background PTY agents without OSC titles :: Quiet Codex background terminal without OSC title eventually resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: sends agent prompts as bracketed paste before submit :: Driving prompt escapes embedded paste-end ESC, writes one framed paste then CR, and counts bytes.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: settles a foreground Codex prompt when launch metadata has not arrived :: Codex inferred from foreground without launch metadata waits for composer marker/quiescence before one CR.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: gives a late Codex render marker a fresh quiescence window :: Marker arriving at7.9s re-arms fresh quiet window instead of submitting at initial cap.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: writes large agent prompt paste frames atomically before delayed submit :: A prompt larger than input chunk budget is a single paste write before delayed CR with exact byte count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects oversized terminal.send text before provider writes :: Oversized ordinary terminal.send rejects input-too-large before any provider write.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects focusing an exited background terminal session :: focusTerminal refuses terminal_exited before invoking background reveal.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: pastes the same bytes the desktop draft paste sent for the prompt :: Launch-ready prompt normalizes CR/LF and renders embedded ESC visibly identically to desktop bracketed paste.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: keeps a prompt into a running agent behind the render settle, as before :: Driving prompt remains held through7s repaint activity then submits once by9s.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reports a queued PTY focus as not navigated when its notifier disappears :: Queued PTY focus and completed active reveal report not navigated after notifier removal; no second reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: does not invoke a stale graph-leaf focus notifier after queued PTY work :: Queued graph-leaf focus must not invoke old notifier after preceding PTY reveal and notifier removal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: paginates retained terminal output with explicit limits and truncation metadata :: Preview120lines, fractional limits,50/200 pages, retained2000line truncation and future-cursor metadata stay consistent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: falls back to renderer visible screen when uncursored TUI tail is blank :: Substantial blank uncursored tail uses mounted renderer visible screen with zero scrollback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reads and shows the runtime-owned alternate-screen grid without serialization :: Actual runtime alternate-screen grid provides read/show content without renderer/provider serialization.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: classifies older provider alternate-screen snapshots from ANSI :: Older provider without alternateScreen metadata classifies ANSI alternate entry and returns Remote Vim screen.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: honors the last ANSI screen transition when older provider metadata is absent :: Last ANSI alternate exit overrides earlier entry when explicit provider mode metadata is absent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: rejects a full provider screen frame after live output advances :: Live output arriving during second full-screen capture causes screen-unavailable rather than stale full frame.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: shares one provider snapshot between concurrent read and show calls :: Concurrent read/show share one successful provider snapshot and both receive Shared TUI content.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps cursor reads provider-free on restored alternate-screen PTYs :: Restored alternate-screen cursor transcript reads never acquire provider snapshot.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: backs off after a provider snapshot failure instead of retrying for show :: Failed provider capture is cached/backed off so later show does not retry.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: falls back once to a mounted renderer when a known alternate provider fails :: A known-alternate failed provider capture falls back exactly once to newly mounted renderer.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: bounds provider visible frames for read and show responses :: Provider visible read/show use six bounded lines and300character preview.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps renderer-fallback composer drafts separate from terminal output :: Renderer fallback strips dim composer draft from terminal output and exposes draft separately.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: does not use renderer visible-screen fallback for a short blank shell tail :: Two blank shell lines must not trigger renderer screen fallback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: trims terminal tail character budget without per-line array shifts :: Tail builder trims to256KiB with correct retained suffix and no Array.shift calls.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains ANSI-only status redraws instead of appending every frame :: Repeated erase/redraw replaces preview until newline then publishes one completed cursor row.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains split multi-line ANSI footer redraw state across chunks :: CUU state across chunks retains corrected footer rows and publishes new cursor entries.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not let stale lower rows hide earlier corrected footer rows from cursor reads :: Earlier corrected footer row must not be hidden by stale lower rows in cursor reads.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: bounds completed transcript entries from a single multi-line redraw chunk :: Single redraw chunk bounds completed transcript to2000retained lines and correct oldest/next/latest cursors.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains multi-line ANSI redraws when the last footer row stays partial :: Partial final redrawn row appears in preview but cursor sees it only after newline.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not retain split ANSI controls as visible terminal preview text :: Split color/mode escapes never leak preview fragments; long split OSC title truncates at MAX_OSC_TITLE_CHARS.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains same-line redraw cursor position across split full-line erase chunks :: Full-line erase preserves column across chunks so XY follows three spaces rather than old ABC.\nsrc/main/runtime/orca-runtime-tests/conpty-stream-read.spec.ts :: fills the requested line count even when blank rows sit below the prompt :: Blank rows below a ConPTY prompt must not consume the requested nonempty-line count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: does not retain split ST-terminated string controls as preview text :: Split ST-terminated Kitty/string controls must remain excluded from preview text.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects split OSC titles before retaining terminal previews :: Split BEL OSC title must update working title/status without leaking into preview.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects ST-terminated OSC titles split before the final backslash :: ST OSC split before final backslash must update title without leaking framing.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: preserves a trailing escape after a completed OSC title :: Completed OSC followed by pending ESC must preserve the next idle-title transition.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: seeds newly synced leaves from PTY pending ANSI state :: A newly synced graph leaf inherits pending ANSI so a split color fragment cannot leak.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: bounds retained partial terminal output before preview reads :: Partial terminal state stays capped at 4000, preserves retained array identity, and preview truncation/cursor output remains correct.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: submits the mail pointer to Cursor Agent only after the paste-burst delay :: Cursor mailbox pointer Enter must wait through the paste-burst delay; this is a real input-timing alarm intentionally retired.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts :: adopts a v1.4.150-shaped agent, setup, and shell orphan as one topology transaction :: Stale incarnation refuses without topology change; three agent/setup/shell lanes adopt atomically with layout/group/revision and preserved read/input/resize; exact replay is idempotent and competing owner refuses.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: retires the exact worker when it exits after renderer reveal :: Exact worker exit after reveal retires that worker and its surface.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: re-reveals a recovered worker after the renderer graph epoch changes :: Changed renderer graph epoch invalidates reveal receipt and forces another reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: defers recovery when the renderer omits the exact reveal identity :: Missing exact reveal identity defers recovery after two attempts.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: reconciles a same-id process replacement before headless adoption :: A process replacement before headless adoption must fence off stale ownership.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retires provider resume only after authoritative inventory proves the legacy PTY exited :: Authoritative owning-host inventory overrides false local hasPty, avoids SSH scanning, retires exited provider resume/surface, adopts live workers without headless reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retries inventory and unknown liveness without revealing a ghost worker :: Inventory failure and unknown liveness must retry without ghost reveal, eventually adopt, and stop retrying.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: refuses a live reserved pane before issuing a handle or revealing it :: A requireFreshPane launch receiving a live reserved owner must reject before handle/reveal/kill, and release its claim. No equivalent replacement claimed.",
+ "Audit3806 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: skips a listener unsubscribed mid-fan-out even with mobile exclusions active :: A listener removed by an earlier listener during one fanout is not called, including with a side-effect-excluded mobile listener present.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: retains bytes emitted before a fresh daemon spawn resolves :: Bytes and title arriving before an initial zero/reset provider response survive in the serialized headless buffer with their counted sequence.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits command-finished facts with best-effort exit codes across chunk splits :: A split OSC133 D exit code becomes130 and a missing code becomes null in ordered command-finished facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits pr-link facts once per URL with batch attribution :: A split GitHub PR URL yields42 rather than4, emits42/43 once each, and carries PTY/worktree/tab attribution.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits 2031-subscribe facts across chunk splits :: Split ESC[?20 then31h emits exactly one2031-subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: restores a provisional 2031 subscribe when daemon scan authority returns :: Returning daemon scan authority with partial scan seed and pending2031 subscription restores exactly one subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers the tracked title over the renderer snapshot lastTitle :: A synthetic live Cursor title overrides stale renderer lastTitle while preserving renderer snapshot source.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers provider history over a partial headless mirror for requested snapshots :: Authoritative requested snapshots return supplied provider frame/history/seq rather than a partial headless mirror, requesting5000rows.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: tracks live alternate-screen transitions after a provider snapshot :: Provider alternateScreen true is accepted, then live1049l/1049h update isTerminalAlternateScreen false/true.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: translates reset provider snapshots without retaining the old title :: A reset provider snapshot translates new local seq into the runtime domain and replaces Old process title with New process.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits the chunk agentStatus events before its side-effect batch :: Agent status callback precedes side-effect batch callback for one coalesced OSC9999/title/bell chunk.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: still emits a throwing chunk’s facts under its own seq, not the next chunk’s :: A tracker throw still flushes first chunk title facts under its own seq, and second chunk does not inherit those facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: seeds the lazily created tracker from the daemon-snapshot title :: A lazy tracker hydrated from renderer snapshot title Codex working emits agent-idle on later Codex done.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits command-code-working facts only after the banner arms the scrape :: Unarmed Thinking text emits no facts; a Command Code0.27.3 banner then hardcoded colored spinner text emits attributed command-code-working with the submitted prompt.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits a command-code-done fact when the idle composer returns :: After hardcoded banner/working text, returned idle composer emits command-code-done with the earlier submitted prompt.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: resizes the headless mirror after an accepted desktop PTY resize :: An external accepted resize produces the resized dimensions and same status-frame lines as a separately driven reference emulator.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: replaces suffix-only headless state with the recovered renderer snapshot :: Replacing suffix-only state removes old suffix, retains renderer history plus later output/cwd, and returns the live47x40PTY grid.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: stamps SSH connection identity on runtime terminal status :: A synthetic mounted-leaf OSC9999 status after registerPty carries the supplied SSH connectionId.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: does not retain WSL context when a PTY id is reused :: After exit and same-ID new null distro context, OSC7 file://server/share/repo uses UNC server path rather than old Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: preserves immutable context while a live daemon attach is unresolved :: preparePtyExecutionContext with preserveExisting refuses a supplied Debian replacement and subsequent OSC7 keeps original Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts :: projects frame-independent live state through main buffer snapshots :: Main-buffer snapshot puts focus-report/cursor-visibility modes in frameRestoreAnsi, excludes STATIC-FRAME there and includes it in data.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts :: continues terminal agent status fanout when a callback throws :: Throwing on the first status callback does not prevent second payload delivery and logs contextual error.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: returns a title-only replay snapshot and never historical attention :: Lose replay:true/title-only fact projection despite earlierbell and unknownPTYnull. No actual delivered-history notification or reattach behavior was exercised. No equivalent replacement claimed.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects a handle rebind while a controller-less status check yields :: A handle rebound while the null-controller status continuation yields must throw terminal_handle_stale.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects confirmation evidence when the owning PTY exits :: A pending strong confirmation resolving after owning PTY exit must reject terminal_exited.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts :: keeps ordinary terminal send suffix failures on the existing not-writable contract :: Ordinary send writes text but refused CR must throw terminal_not_writable with beforeWrite twice and afterWrite once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell the execution host cannot apply instead of spawning its default :: Requested Windows shell on POSIX must refuse before spawning a default shell.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: quotes the agent startup command for the requested shell, not the host default :: Requested cmd shell must override PowerShell default quoting for agent startup command.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: keeps restored receipts outside a targeted worktree scan :: Targeted scan removes the moved-worktree receipt while preserving another worktree receipt.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: observes setup command completion without waiting for its interactive shell to exit :: Nonzero completion marker 17 resolves while interactive shell remains running.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: falls back to setup terminal exit when no completion signal is available :: Setup completion observer without token falls back to actual exit code 9.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: cancels setup completion observation when the caller aborts :: Abort rejects with the original reason and unsubscribes once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps observing after an uncertain setup terminal status :: Unknown exit waiter result must leave observation pending until completion marker arrives.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh omits a record :: Controller inventory omission disconnects the record but preserves its retained transcript.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh times out :: Hung inventory timeout leaves connected record and retained transcript intact.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle for adopted background PTY handles from the renderer title :: An adopted background handle resolves tui-idle from ready Codex renderer title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves live-leaf tui-idle from an OpenCode native title :: A live leaf resolves tui-idle from an OpenCode native title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from a Codex ready prompt preview :: A supplied Codex prompt preview resolves tui-idle without an actual agent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from an Antigravity prompt before the model line :: A supplied Antigravity prompt before model line resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell with no workspace instead of creating a default-shell tab :: Workspace-less explicit shell must reject before renderer default-tab request or spawn. This real guard/wiring alarm is deliberately retired.",
+ "Audit3798 per-case accepted losses:\nsrc/main/runtime/orca-runtime-tests/paired-settings.spec.ts :: awaits navigation-only updates from paired clients (%s) :: Updating only claudeSubagentNavigationEnabled waits for the actual controller call to the supplied pending Claude-view reconcile for both on/off values.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: drops a client page record even when its close command cannot be issued :: A removed workspace loses its runtime client-page record and headless browser projection despite close delivery_required rejection, and emits the asynchronous warning.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: leaves client-hosted pages alone when another host still owns the same worktree id :: Removing runtime:env-b metadata with local ownership leaves the local same-ID client page unchanged and issues no close command.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: marks live bindings again when reopening after a promoted window closes :: A reopened window marks its still-registered live worktree in activeWorktreeIdsOnShutdown after the first promoted window closes.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: preserves live SSH session identities when promoting a headless runtime :: Headless-to-desktop promotion records active worktree, SSH connection and remoteSessionIdsByTabId from the supplied surviving SSH PTY/session.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores a surviving renderer when its reload is cancelled :: A sole ready renderer reload cancelled under its current renderer fence returns true and becomes ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores headless authority when desktop promotion navigation is cancelled :: A cancelled desktop promotion with headless recovery returns false while headless authority remains ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: moves a desktop graph to unavailable when its reload times out :: A ready desktop graph without a headless fallback becomes unavailable at the reload deadline and retains its window/epoch.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: recovers a failed headless promotion and accepts a later renderer generation :: A promotion failure restores ready headless authority; a later valid same-window graph publishes ready desktop authority.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: clears a failed pane recovery so a later reconnect can retry :: After relay_reconnecting rejection, the pending recovery lock clears and the same pane/handle can call createTerminal a second time and return its supplied replacement.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: still preserves a CLI agent leaf when the reloaded renderer has not rebound its PTY :: An empty graph published during renderer reload preserves a preallocated live CLI PTY as one listable terminal before renderer rebind.\nsrc/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts :: keeps a no-incarnation handle across an in-graph pane remint :: Within one graph lifetime an unversioned PTY reminted onto another leaf retains its issued handle and resolves its old exit waiter after onPtyExit.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: matches explicit-id cwd PTYs when the resolved worktree cache is incomplete :: An explicit target absent from a fresh incomplete resolved cache adopts only its cwd PTY, rejects nested cwd PTY and does not rescan Git.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: ignores cwd-only controller PTYs for malformed explicit worktree IDs :: Malformed id:repo-1:: returns no terminals, does not adopt cwd-only controller PTY and avoids Git rescanning.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: refuses an SSH-backed create for mobile/runtime callers instead of creating locally :: Loss of this public unserved SSH create error-class/no-local-add/no-local-list alarm.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: records an app-selected parent workspace as a manual action :: Loss of the local runtime folder-parent manual origin, active-workspace source and explicit confidence projection alarm; no claim that SSH or cleanup coverage replaces it.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: browses runtime server directories before projects are added :: Loss of this public runtime alarm for browse availability before registration, directories-first lexical ordering and native path flavor.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: lists drive roots for a server-root browse :: Loss of the Windows public slash-root drive enumeration smoke and presence of the temporary directory drive.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations-part-02.spec.ts :: creates a missing runtime parent before creating the project directory :: Loss of this runtime createRepo recursive missing-parent/child existence and registered-path alarm.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: preserves selected project %s when a hosted parent is known :: Loss of both parent-selected and origin-selected normal fork-link projection/persisted upstream alarms plus exact single-probe count.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: links a current enterprise remote despite unavailable metadata and a retained %s :: Loss of normal current-enterprise-origin linking with stale automatic GitHub avatar or protected file image, unchanged icon assertion, and serialized project identity under unavailable metadata.",
+ "Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed.",
+ "Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions.",
"NEXT65 current scope qualification: The NEXT65 knownGaps entries below govern the changed selectors and qualify any broader coverage implication in this gate’s unchanged oracle/coverageNotes narratives. Those narratives and preserved dated evidenceRuns retain their historical text and original exact execution scopes only; no fresh execution, transferred pass or equivalent replacement coverage is claimed. Upstream case removals remain upstream; original NEXT65 proposal descriptions grant no duplicate retirement credit.",
"NEXT65 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-watcher-reconciliation.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence.",
"NEXT65 historical original active selector fields (verbatim JSON values; not current coverage):\ncommands: [\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts\",\n \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts\",\n \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-client-first-terminal-unopened-host-worktree.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-lifecycle/publication/mobile-session-tabs-agent-status-heartbeat.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts --maxWorkers=1\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts --maxWorkers=1\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport/output/terminal-side-effect-facts-handler.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-watcher-reconciliation.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts src/main/daemon/terminal-host/testing/terminal-host-agent-session.test.ts tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts --maxWorkers=1\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n \"ORCA_E2E_FORWARD_APP_LOGS=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=10 --max-failures=1\",\n \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_DISABLE_PAIRED_TERMINAL_PARKING=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"ORCA_E2E_WEB_CLIENT=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-parked-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\"\n ]\ntestFiles: [\n \"src/main/runtime/session-lifecycle/publication/mobile-session-tabs-agent-status-heartbeat.test.ts\",\n \"tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts\",\n \"src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts\",\n \"src/main/runtime/construction/orca-runtime.test.ts\",\n \"src/renderer/src/web/web-preload-api-runtime-environment.test.ts\",\n \"src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts\",\n \"src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts\",\n \"src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts\",\n \"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts\",\n \"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts\",\n \"src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n \"src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts\",\n \"src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts\",\n \"src/main/daemon/terminal-host/testing/terminal-host-agent-session.test.ts\",\n \"tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-transport/output/terminal-side-effect-facts-handler.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts\",\n \"src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts\",\n \"src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts\",\n \"src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts\",\n \"src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-watcher-reconciliation.test.ts\",\n \"src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts\",\n \"src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n \"tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts\",\n \"tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts\",\n \"tests/e2e/paired-remote-terminal-stall-recovery.spec.ts\",\n \"tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts\",\n \"tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts\",\n \"tests/e2e/paired-remote-terminal-retention-memory.spec.ts\",\n \"tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts\",\n \"tests/e2e/terminal-parked-memory.spec.ts\",\n \"tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts\",\n \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts\",\n \"tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts\",\n \"src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts\",\n \"tests/e2e/paired-client-first-terminal-unopened-host-worktree.spec.ts\"\n ]\nassertionRefs: [\n {\n \"file\": \"tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts\",\n \"assertions\": [\n \"2,880 decorative spinner and bare-native real-PTY OSC chunks publish zero session-tabs snapshots or serialized bytes after semantic convergence\",\n \"the viewer performs zero snapshot applies and zero store mutations during decorative activity\",\n \"after 30 minutes, one globally spaced refresh per worktree keeps every mirrored working status fresh\",\n \"exact Pi and rotating normalized Pi/Grok frames renew explicit and fallback status without changing stateStartedAt or acknowledgement semantics\",\n \"matching title evidence renews retained OSC hook status without resetting stateStartedAt, then drops unverifiable prompt metadata after the hook row expires\",\n \"renderer-authored rich status keeps its original lease, then renews only coarse title-confirmed state and provider identity\",\n \"ordinary-shell title transitions replace working stateStartedAt with the completion transition time\",\n \"decorative heartbeats remain blocked until unknown foreground ownership resolves, then resume at the bounded interval\",\n \"tracked terminal state reset clears delayed foreground ownership markers\",\n \"raw chunks, semantic idle transitions, and visible output remain exact\"\n ]\n },\n {\n \"file\": \"src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n \"assertions\": [\"retries an existing subscriber when provider inventory becomes ready\"]\n },\n {\n \"file\": \"src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts\",\n \"assertions\": [\n \"creation and removal at the census release edge are subsumed once, and a delayed pre-boundary change is not replayed\",\n \"post-boundary creation and removal replay after the initial snapshot in sequence order\",\n \"create/remove/recreate transitions are preserved without collapse\",\n \"a post-boundary projected-state change is delivered without a new snapshot revision\",\n \"an older coalesced callback cannot overwrite a newer immediate change\",\n \"initialization churn publishes only the latest projected state and repeated structural overflow fails after bounded recollection\",\n \"disconnect aborts the census and removes the real runtime listener\"\n ]\n },\n {\n \"file\": \"tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts\",\n \"assertions\": [\n \"unpublished empty inventory keeps resume dispatch at zero with the original daemon session, process id, and writer as the sole live writer\",\n \"an authoritative empty inventory settles the mirror and releases exactly one resume dispatch with zero liveness probes\",\n \"re-enabling unconditional empty hydration makes the identical oracle red with one resume dispatch, two session ids, two process ids, and two writer calls\"\n ]\n },\n {\n \"file\": \"tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts\",\n \"assertions\": [\n \"preserves daemon PID and target PTY identity across the paired host relaunch\",\n \"foregrounds the daemon-backgrounded target on its first post-relaunch remote observation\",\n \"delivers target and post-relaunch control terminal input and live output\"\n ]\n },\n {\n \"file\": \"tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts\",\n \"assertions\": [\"replaces a stale paired stream when the PTY snapshot advanced\"]\n },\n {\n \"file\": \"tests/e2e/paired-remote-terminal-stall-recovery.spec.ts\",\n \"assertions\": [\n \"restarts one ACK-starved paired terminal stream without replacing its PTY\"\n ]\n },\n {\n \"file\": \"tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts\",\n \"assertions\": [\"recovers an ACK-starved stream from an isolated headless Orca host\"]\n },\n {\n \"file\": \"tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts\",\n \"assertions\": [\n \"a nonempty lossy initial snapshot paints exactly once on a paired client\",\n \"the authoritative host cursor advances and live output resumes exactly once\"\n ]\n },\n {\n \"file\": \"tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts\",\n \"assertions\": [\n \"paints a paired remote terminal when only its retained text tail overflowed\",\n \"legacy paired hosts retain the lossy hidden-manager budget fallback\"\n ]\n },\n {\n \"file\": \"tests/e2e/paired-remote-terminal-retention-memory.spec.ts\",\n \"assertions\": [\n \"ordinary-parks paired terminals and restores authoritative host scrollback\",\n \"warm-mounted hidden paired streams schedule zero renderer output work under sustained host output\",\n \"six hidden real PTYs publish and apply only exact working and idle title transitions across paired transport\",\n \"client recovery completes while every target terminal remains unmounted in the host renderer\"\n ]\n },\n {\n \"file\": \"tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts\",\n \"assertions\": [\n \"ordinary-parks paired terminals against an isolated headless Orca host\",\n \"cold-activates only visible paired terminals against an isolated headless host\",\n \"the headless host bounds real-PTY decorative title transport and production store application\",\n \"the headless host shares the zero-hidden-renderer-work and exact-restoration contract\"\n ]\n },\n {\n \"file\": \"tests/e2e/terminal-parked-memory.spec.ts\",\n \"assertions\": [\n \"releases un-parkable hidden worktree buffers only once the retention budget engages\"\n ]\n },\n {\n \"file\": \"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts\",\n \"assertions\": [\n \"admits 128 active streams, rejects the 129th, and reuses released capacity\",\n \"reserves PTY wait capacity independently from active streams\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n \"assertions\": [\n \"pauses capable paired output while hidden and restores exactly on reveal\",\n \"locally gates hidden paired output when a legacy host cannot pause it\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts\",\n \"assertions\": [\n \"keeps a mounted HUB mirror alive when the old stream ends before the replacement snapshot\"\n ]\n },\n {\n \"file\": \"src/renderer/src/web/web-preload-api-runtime-environment.test.ts\",\n \"assertions\": [\n \"keeps pairing while manual disconnect fences passive reconnects\",\n \"returns a disconnect envelope when a queued active runtime call disconnects\",\n \"returns a disconnect envelope when a queued selected environment call disconnects\"\n ]\n }\n ]",
@@ -8712,7 +8684,8 @@
"Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts\",\n \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts\",\n \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-client-first-terminal-unopened-host-worktree.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-lifecycle/publication/mobile-session-tabs-agent-status-heartbeat.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts --maxWorkers=1\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts --maxWorkers=1\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport/output/terminal-side-effect-facts-handler.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts src/main/daemon/terminal-host/testing/terminal-host-agent-session.test.ts tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts --maxWorkers=1\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n \"ORCA_E2E_FORWARD_APP_LOGS=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=10 --max-failures=1\",\n \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_DISABLE_PAIRED_TERMINAL_PARKING=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"ORCA_E2E_WEB_CLIENT=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-parked-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\"\n ]\ntestFiles: [\n \"src/main/runtime/session-lifecycle/publication/mobile-session-tabs-agent-status-heartbeat.test.ts\",\n \"tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts\",\n \"src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts\",\n \"src/main/runtime/construction/orca-runtime.test.ts\",\n \"src/renderer/src/web/web-preload-api-runtime-environment.test.ts\",\n \"src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts\",\n \"src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts\",\n \"src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts\",\n \"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts\",\n \"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts\",\n \"src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n \"src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts\",\n \"src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts\",\n \"src/main/daemon/terminal-host/testing/terminal-host-agent-session.test.ts\",\n \"tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-transport/output/terminal-side-effect-facts-handler.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts\",\n \"src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts\",\n \"src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts\",\n \"src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts\",\n \"src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts\",\n \"src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n \"tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts\",\n \"tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts\",\n \"tests/e2e/paired-remote-terminal-stall-recovery.spec.ts\",\n \"tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts\",\n \"tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts\",\n \"tests/e2e/paired-remote-terminal-retention-memory.spec.ts\",\n \"tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts\",\n \"tests/e2e/terminal-parked-memory.spec.ts\",\n \"tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts\",\n \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts\",\n \"tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts\",\n \"src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts\",\n \"tests/e2e/paired-client-first-terminal-unopened-host-worktree.spec.ts\"\n ]\nassertionRefs: [\n {\n \"file\": \"tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts\",\n \"assertions\": [\n \"2,880 decorative spinner and bare-native real-PTY OSC chunks publish zero session-tabs snapshots or serialized bytes after semantic convergence\",\n \"the viewer performs zero snapshot applies and zero store mutations during decorative activity\",\n \"after 30 minutes, one globally spaced refresh per worktree keeps every mirrored working status fresh\",\n \"exact Pi and rotating normalized Pi/Grok frames renew explicit and fallback status without changing stateStartedAt or acknowledgement semantics\",\n \"matching title evidence renews retained OSC hook status without resetting stateStartedAt, then drops unverifiable prompt metadata after the hook row expires\",\n \"renderer-authored rich status keeps its original lease, then renews only coarse title-confirmed state and provider identity\",\n \"ordinary-shell title transitions replace working stateStartedAt with the completion transition time\",\n \"decorative heartbeats remain blocked until unknown foreground ownership resolves, then resume at the bounded interval\",\n \"tracked terminal state reset clears delayed foreground ownership markers\",\n \"raw chunks, semantic idle transitions, and visible output remain exact\"\n ]\n },\n {\n \"file\": \"src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n \"assertions\": [\"retries an existing subscriber when provider inventory becomes ready\"]\n },\n {\n \"file\": \"src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts\",\n \"assertions\": [\n \"creation and removal at the census release edge are subsumed once, and a delayed pre-boundary change is not replayed\",\n \"post-boundary creation and removal replay after the initial snapshot in sequence order\",\n \"create/remove/recreate transitions are preserved without collapse\",\n \"a post-boundary projected-state change is delivered without a new snapshot revision\",\n \"an older coalesced callback cannot overwrite a newer immediate change\",\n \"initialization churn publishes only the latest projected state and repeated structural overflow fails after bounded recollection\",\n \"disconnect aborts the census and removes the real runtime listener\"\n ]\n },\n {\n \"file\": \"tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts\",\n \"assertions\": [\n \"unpublished empty inventory keeps resume dispatch at zero with the original daemon session, process id, and writer as the sole live writer\",\n \"an authoritative empty inventory settles the mirror and releases exactly one resume dispatch with zero liveness probes\",\n \"re-enabling unconditional empty hydration makes the identical oracle red with one resume dispatch, two session ids, two process ids, and two writer calls\"\n ]\n },\n {\n \"file\": \"tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts\",\n \"assertions\": [\n \"preserves daemon PID and target PTY identity across the paired host relaunch\",\n \"foregrounds the daemon-backgrounded target on its first post-relaunch remote observation\",\n \"delivers target and post-relaunch control terminal input and live output\"\n ]\n },\n {\n \"file\": \"tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts\",\n \"assertions\": [\"replaces a stale paired stream when the PTY snapshot advanced\"]\n },\n {\n \"file\": \"tests/e2e/paired-remote-terminal-stall-recovery.spec.ts\",\n \"assertions\": [\n \"restarts one ACK-starved paired terminal stream without replacing its PTY\"\n ]\n },\n {\n \"file\": \"tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts\",\n \"assertions\": [\"recovers an ACK-starved stream from an isolated headless Orca host\"]\n },\n {\n \"file\": \"tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts\",\n \"assertions\": [\n \"a nonempty lossy initial snapshot paints exactly once on a paired client\",\n \"the authoritative host cursor advances and live output resumes exactly once\"\n ]\n },\n {\n \"file\": \"tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts\",\n \"assertions\": [\n \"paints a paired remote terminal when only its retained text tail overflowed\",\n \"legacy paired hosts retain the lossy hidden-manager budget fallback\"\n ]\n },\n {\n \"file\": \"tests/e2e/paired-remote-terminal-retention-memory.spec.ts\",\n \"assertions\": [\n \"ordinary-parks paired terminals and restores authoritative host scrollback\",\n \"warm-mounted hidden paired streams schedule zero renderer output work under sustained host output\",\n \"six hidden real PTYs publish and apply only exact working and idle title transitions across paired transport\",\n \"client recovery completes while every target terminal remains unmounted in the host renderer\"\n ]\n },\n {\n \"file\": \"tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts\",\n \"assertions\": [\n \"ordinary-parks paired terminals against an isolated headless Orca host\",\n \"cold-activates only visible paired terminals against an isolated headless host\",\n \"the headless host bounds real-PTY decorative title transport and production store application\",\n \"the headless host shares the zero-hidden-renderer-work and exact-restoration contract\"\n ]\n },\n {\n \"file\": \"tests/e2e/terminal-parked-memory.spec.ts\",\n \"assertions\": [\n \"releases un-parkable hidden worktree buffers only once the retention budget engages\"\n ]\n },\n {\n \"file\": \"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts\",\n \"assertions\": [\n \"admits 128 active streams, rejects the 129th, and reuses released capacity\",\n \"reserves PTY wait capacity independently from active streams\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n \"assertions\": [\n \"pauses capable paired output while hidden and restores exactly on reveal\",\n \"locally gates hidden paired output when a legacy host cannot pause it\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts\",\n \"assertions\": [\n \"keeps a mounted HUB mirror alive when the old stream ends before the replacement snapshot\"\n ]\n },\n {\n \"file\": \"src/renderer/src/web/web-preload-api-runtime-environment.test.ts\",\n \"assertions\": [\n \"keeps pairing while manual disconnect fences passive reconnects\",\n \"returns a disconnect envelope when a queued active runtime call disconnects\",\n \"returns a disconnect envelope when a queued selected environment call disconnects\"\n ]\n }\n ]",
"Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
"Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. The decorative fanout suite retains only real OSC9999 ingestion through runtime/title heartbeat/viewer past the stale boundary, preserving stateStartedAt and clearing expired prompt metadata. Spinner volume/zero-work inventories, Pi/Grok frame tables, rich-status and foreground-reset examples are retired. Existing receipts for separate paired-terminal sources retain their original scopes. All prior notes and complete dated receipts retain their original scopes.",
- "Audit3446 archived original assertionRef after source reduction; historical scope only, raw original object follows:\n{\n \"file\": \"tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts\",\n \"assertions\": [\n \"2,880 decorative spinner and bare-native real-PTY OSC chunks publish zero session-tabs snapshots or serialized bytes after semantic convergence\",\n \"the viewer performs zero snapshot applies and zero store mutations during decorative activity\",\n \"after 30 minutes, one globally spaced refresh per worktree keeps every mirrored working status fresh\",\n \"exact Pi and rotating normalized Pi/Grok frames renew explicit and fallback status without changing stateStartedAt or acknowledgement semantics\",\n \"matching title evidence renews retained OSC hook status without resetting stateStartedAt, then drops unverifiable prompt metadata after the hook row expires\",\n \"renderer-authored rich status keeps its original lease, then renews only coarse title-confirmed state and provider identity\",\n \"ordinary-shell title transitions replace working stateStartedAt with the completion transition time\",\n \"decorative heartbeats remain blocked until unknown foreground ownership resolves, then resume at the bounded interval\",\n \"tracked terminal state reset clears delayed foreground ownership markers\",\n \"raw chunks, semantic idle transitions, and visible output remain exact\"\n ]\n }"
+ "Audit3446 archived original assertionRef after source reduction; historical scope only, raw original object follows:\n{\n \"file\": \"tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts\",\n \"assertions\": [\n \"2,880 decorative spinner and bare-native real-PTY OSC chunks publish zero session-tabs snapshots or serialized bytes after semantic convergence\",\n \"the viewer performs zero snapshot applies and zero store mutations during decorative activity\",\n \"after 30 minutes, one globally spaced refresh per worktree keeps every mirrored working status fresh\",\n \"exact Pi and rotating normalized Pi/Grok frames renew explicit and fallback status without changing stateStartedAt or acknowledgement semantics\",\n \"matching title evidence renews retained OSC hook status without resetting stateStartedAt, then drops unverifiable prompt metadata after the hook row expires\",\n \"renderer-authored rich status keeps its original lease, then renews only coarse title-confirmed state and provider identity\",\n \"ordinary-shell title transitions replace working stateStartedAt with the completion transition time\",\n \"decorative heartbeats remain blocked until unknown foreground ownership resolves, then resume at the bounded interval\",\n \"tracked terminal state reset clears delayed foreground ownership markers\",\n \"raw chunks, semantic idle transitions, and visible output remain exact\"\n ]\n }",
+ "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed."
],
"demotionRule": "Keep experimental or demote to protection none if decorative title frequency changes paired client-event or session-tabs publication volume after convergence, a semantic fact is dropped, paired first paint is blank, passive work reconnects after manual disconnect, a capable hidden paired manager survives ordinary parking, a legacy hidden pane schedules raw xterm output or bypasses its fallback, reveal loses requested bounded history or live PTY identity, retained buffer cells do not fall, or either headed/headless scenario flakes."
},
@@ -8876,7 +8849,7 @@
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
- "coverageNotes": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Module layout SSH policy: Retire the multiplexer private-clock saturation registration, the writer saturation transition-count registration and the changed-source dated writer/backpressure receipt. Retained byte delivery, lane order, fairness, settlement and cancellation cases are unvalidated by that historical receipt. No equivalent replacement, new execution, measured performance, live SSH/WSL or cross-platform proof is claimed. The unchanged WSL protocol receipt retains only its original command scope. Historical prior account (preserved verbatim): Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/ssh/ssh-multiplexer-transport-writer.test.ts: reports saturated epochs and their drain boundary exactly once. src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/main/ssh/ssh-multiplexer-transport-writer.test.ts remains historical and is not a passing result for the reduced current command. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete tail-wait memo suite: its sole current authored callback checks supplied fromTail/blocked field values. Retire all three broader memoization/equivalence/eviction assertion aliases; they are not backed by retained source callbacks. No scan-work budget, sustained output, physical terminal or resource measurement is assigned to this removed test. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1674 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Local macOS evidence covers main-process pending-output and projection-admission caps, saturated-tail wait detection, direct-SSH source retention/accounting, always-on V1 negotiation with legacy peer fallback, exact provider-generation pause ownership, renderer exit/data ordering, decoder input bounds, bounded reconnect scheduling, and WSL stdio transport settlement through deterministic unit contracts. A joined main/runtime oracle exercises renderer-sourced headed semantics and headless-model snapshot semantics without launching a live paired server. Separately, a macOS-hosted Docker OpenSSH run exercises only the deployed Linux relay and direct SSH provider with an exact 256 KiB source-credit plateau, concurrent PTY typing, fixed-size filesystem frames, Git churn, and owner-lease reconnect. Neither deterministic topology labels nor Docker SSH constitute live headed desktop, headless orca serve, or physical WSL evidence; local/daemon, prior-version daemons, Windows named pipes/ConPTY, folder workspaces, and mixed-version clients also remain uncovered. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
+ "coverageNotes": "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed. Audit3788 retires10 authored/11 expanded cases across six changed drivers, including the entire screencast pending-frame-retry and usage-source-cache-streaming suites. Deliberate losses are false-refused last-frame retry/once-only delivery, ordinary stable-pane reattachment, cleared-chat Dispatch completion, terminal-declared chat-caller refusal, at-rest worker liveness projection, nested depth/cap policy, small unsigned6/sealed7 plain-format and verified-bit examples, generic malformed-ISIZE footer refusal examples, and synthetic10k/100k chunk-size/work-count budgets in gzip and general cache I/O. These include real state/disk/RPC outcomes consciously retired for marginal value; retained E2EE-backlog, receipt/custody/uncertain-ack, integrity/migration and staging-cleanup cases are not equivalent replacements. The footer test did not prove early rejection or bounded allocation; staging cleanup did not seed unrelated files. No replacement or fresh native/remote/performance execution is claimed. Earlier raw selectors and dated receipts remain historical. Audit3779 retires17 authored/17 expanded registrations across six changed drivers, including the entire shared-Codex-home and prompt-telemetry suites. Accepted losses are shared-home wrapper noninterference/opt-out preservation, mocked metric count/provenance filters, SSH activity labeling/clearing and handover idle timing, VM ownership/capability/status projections and asleep-worktree refusal, a link-only external conversation replay sample, and two narrow input-credit noninterference/expiry examples. Retain the direct exact-tab/single-use input-credit case. These bounded real disk/state/routing alarms are intentionally retired for marginal value without equivalent replacement or fresh execution claims; earlier receipts remain historical. Audit3772 retires18 authored/27 expanded cases, including whole Codex service opt-out, RPC capability-parser, creator-provenance, short-ciphertext and readiness-null suites. Accepted losses include service ledger/symlink/mode cleanup, user TOML substring preservation, old-hash cleanup, description pass-through, malformed-file/pending-hash examples, coordinator write/probe counts, capability array bounds, positive creator projections, early short-payload refusal and readiness helper null shape. Two redundant Codex exit-cause rows are also retired; Pi shares their direct-idle path only in this empty-output immediate-exit fixture, and future agent-config drift coverage is lost. Real bounded filesystem/parser/runtime alarms are deliberately retired for marginal value; no equivalent replacements or fresh execution are claimed. Earlier receipts retain their historical scope. Audits3754/3755 intentionally remove9 authored/9 finite registrations: the entire one-case usage-source-cache-streaming.test.ts driver and8 cases from the surviving computer-action-validation.test.ts driver. This gate retains an unfiltered root Vitest command; UNIT_INCLUDE admits both source paths. Accepted losses are the real encoder output chunk-size/work-count alarm on repetitive10k/100k ownership payloads through a mocked durable sink, plus CLI diagnostic precedence, fractional window-id rejection, action-call-site window-target exclusivity, plain-text click-count recovery copy, incomplete click/drag targeting, mouse/modifier/direction allowlist samples and inline/stdin text exclusivity. These CLI cases exercise real argument/handler validation before mocked runtime calls; they are deliberately retired for marginal value, not declared tautologies. Retained cache I/O and CLI cases are not equivalent replacements for these alarms. Existing historical raw receipts remain unchanged and do not validate the deleted or reduced drivers. No fresh execution claim is made. Audits3758/3763 intentionally remove9 authored/11 finite registrations from6 changed drivers, including the entire pane-title-notification, window-linear-notices and worktree-card-lifecycle-effects suites. This gate retains an unfiltered root Vitest command admitting these paths. Accepted losses are same-account linked-row success-notice fanout, sidebar-switch channel forwarding, Linear-only notification forwarding/non-terminal-consumer selection/closed-window detach, destroyed-window refusal and first-send-failure suspension through the pane-title adapter, the100-card synthetic focus/poll absence sample, stored-source local folder badge refresh, unobserved-row badge refusal, and immediate reposChanged lineage invalidation. These exercise real owners with controlled ports; they are retired for marginal value, without equivalent replacement claims. The no-badge-work fixture does not seed its title-promised collection-only cache. Preserved historical receipts do not validate deleted or reduced drivers; no fresh execution is claimed. Audit3759 retires the entire one-case Tailwind compiler/scanner smoke. Accept loss of the direct CSS production/test/spec source-exclusion and rescan alarm; no replacement or current execution is claimed. Audit3752 independently approves audit3749: retire five authored/five finite watcher-process registrations, retaining18 raw-exact registrations. Accept loss of healthy shared-pool joint recovery, last-pending-failure idle retirement/respawn, late VITEST fallback release, missing-entry fail-closed selection and independent-supervisor fuse locality alarms. These are real bounded host-policy alarms intentionally retired for low marginal value; no equivalent replacement is asserted. Remaining driver selections exercise controlled FakeChild supervisor lifecycle, cancellation, physical-exit fencing, recovery and fuse behavior. This source review supplies no fresh native/process/platform/remote/SSH execution; historical receipts retain original source and selector scopes. Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered root Vitest command. Current UNIT_INCLUDE admits the partial push-service, metadata-dialog and two config/scripts browser drivers:10 authored/16 finite removals. Accepted losses: actual retry30s/60s progression and register bucket/refill wiring, explicit seven-day lease arithmetic (its notification lacked seq/epoch and never reached send), equal-name edit latch/save payload, real image/font/meta-refresh/form/popup browser refusal controls, and broad rich-markdown bridge/command/edit-select smoke. Actual production state, callback routing and browser enforcement run in these cases; these alarms are deliberately retired on marginal value. All drivers and selectors survive. Existing unrelated receipts remain historical evidence for their unchanged selectors, not proof of the reduced cases. Audit3732 removes 2 authored/3 finite registrations from two partial suites: nominal custom/Kimi local naming success and deferred context usage row presentation. Real losses: custom/Kimi successful extraction through conversation-name sanitization and agentLabel composition; separate ordered counted/deferred lists and exact percentage/token formatting. No replacement or equivalent coverage claimed. Retain 11 authored/13 finite raw-exact registrations for bounded naming instruction/refusal/cancellation, menu dismissal focus ownership and hover/composer Escape/timer cleanup. Source-only bounded value review, no runtime/CI/native/remote/mobile/folder workspace or global completion credit. Previous account (preserved verbatim): Audit3733 removes2authored/2finite terminal input checks: fixed custom-cap error/secret fixture and three-emoji cap5refusal whose6UTF16units already trip length fast guard (no UTF8-dependent boundary). Accept exact non-disclosure/oversized-refusal alarm losses; no replacement/equivalence claim. Retain13/13scalar/pending input, OSC state and cron DST/cadence outcomes after bounded material reads. Source-only zero runtime/novelty credit; original historical reasons preserved. Previous account (preserved verbatim): Audit3729 removes1authored/3finite by deleting whole CLI runtime pairing advisory-close suite. Accept losing post-real-close injected EIO preservation of native/script/unreadable pairing, env identity/preservation and exact close/release assertions; no actual failed-close leak or replacement coverage claimed. Two retained URL grammar/identity suites11authored16finite raw unchanged. Bounded source/owner/caller value review, zero novelty/runtime credit; other seven3724deferred closures remain. Historical receipts preserve original limits. Previous account (preserved verbatim): Audit3724 removes3authored/3finite checks by deleting two whole suites: TUI clear burst-size singleton and terminal-file-URL target two-case wrapper suite. Deliberate losses: derived widest burst<64byte alarm, UNC authority+line-column anchor composition, and malformed-percent null refusal. Real production algorithms execute in those tests; no mocked-output tautology, equivalent replacement, actual Claude/file-navigation delivery or universal safety-irrelevance claim. TUI58byte bound and URI examples have low marginal value as standalone suites. Actual1262/1264/1742KEEP superseded explicitly. Remaining14drivers83authored136finite raw unchanged. Bounded source-only review; ten closures deferred, four bounded keep judgments repeated with zero new semantic-frontier credit. No runtime/CI/native/remote/mobile/folder/global completion claim; historical receipts retain original scope. Previous account (preserved verbatim): Audit3723 removes 4 authored/4 finite registrations in two whole suites: keybinding cache freeze/token spellings and host-dependent Orca command name examples. Real losses include returned-object freeze, repeated Mod+P key, Space/PageDown/NumpadSubtract mapping, unknown/empty/prototype-token rejection, and headless Linux versus Windows-server/WSL command choice. No equivalent or replacement coverage claimed. Retain 12 authored/21 finite raw-exact registrations exercising generated scaffold validation, artifact failures, shipped editor/hook/worker/panel tests, actual generated typing compilation, independent CLI root routing and intent-name precedence. Source-only bounded audit; no runtime, CI, native, remote, mobile, folder workspace or global completion credit. Previous account (preserved verbatim): Audit3720 removes17authored/23finite checks: whole main catalog-date adapter2 and shared date-helper7, seven renderer nominal ranking/cap/no-date/composition cases, and one browser registration expanding to seven forced-container/DOM-child boundary cases. Deliberate real losses: community oldest-date UTC forwarding, official/undated omission, date sorting/window/invalid/future/skew/clamp and default/override cap; nominal ranking/cap and combined Featured/Newly-added outputs; real CSS459/460,719/720,1055/1056breakpoint, five-card partial-row and720px two-card first-row alarms. Browser cases really measure rendered geometry but force width/remove DOM children; no fake-pixel or tautology rationale. No replacement/equivalent coverage claimed. Retain14authored/19finite raw-exact registrations across4drivers: adversarial featured category/order/tie and installability, date order/window selection, actual PluginManager failure/escaping/duplicate-card suppression, real browser viewport/odd-count geometry/phone catalog visibility, syntax ingress/depth/include/printability and68dlong-bracket auto-close fill-in. No tests/browser/native/UI/provider/remote/mobile/folder/CI/global execution or completion credit. Previous account (preserved verbatim): Audit3717 removes6 authored/6finite checks in two whole thin-adapter/presentation suites. Deliberate real losses: ordinary recipe repository-URL withholding and provisioned-root credential scrubbing/forwarding; repository label lockstep suffix expansion, host-scoped map identity/collision grouping, Windows crosshost paths and WSL distro suffixes. Actual provision options, label/sort consumers and host/scrubber delegates inspected; no replacement/equivalence claim. Retain40 authored/84finite registrations raw exact in14 drivers with bounded owner/context review. Prior KEEP superseded for removed suites; no runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous account (preserved verbatim): Audit3714 removes8 authored/39finite checks: whole CLI selector-recovery, task display-text and ANSI grammar suites plus two name joiner/blank tables. Deliberate real losses: selector flag/value/identity and mutation recovery merge/serialization; exact task suffix, transcript fallback, input immutability, cache reuse and edited blocks; independent failed-escape/resumption and OSC/DCS/BEL/ST/C1/nested/unfinished stripping outputs; meaningful-language joiner preservation and invisible/blank-name rejection. These are real bounded alarms, removed as narrow supplied-error examples, helper/token inventories and repeated internal-work fixtures. Prior2936,1195/1196,1214/1215 and1082 KEEP superseded; no replacement or equivalent coverage claimed. Keep9authored/9finite raw-exact registrations in5surviving drivers: screenshot export/failure filesystem behavior, CLI local tree query, event-local reply provenance, vault role-sensitive content and four hostile/UTF16/dangling/tag-name regressions. No native/UI/provider/remote/mobile/folder/runtime/CI/global completion credit. Previous account (preserved verbatim): Audit3711 retires2authored/4finite cases by deleting whole clipboard-image-temp-file signature-to-name inventory (HEIC/TIFF/unrecognised bytes) and workspace-last-active switch-on supplied visit/reason singleton, plus its now-orphan test fixture. This intentionally loses real generated-filename suffix/extensionless alarms and real newer-visit archived7day versus inactive30day filtering/older-visit identity alarms. Filesystem writing and production reason pruning really execute; no equivalent replacement or universal absence of safety relevance is claimed. The clipboard test does not inspect written bytes, native delivery or decode; the visit test supplies candidate/timestamps and does not exercise persisted visit routing or actual removal.20authored/20finite cases remain unchanged across4bounded Git/sidecar/removal drivers. No new runner/test/module evaluation or runtime result; historical notes and receipts remain historical. Previous account (preserved verbatim): Audit3707 removes10 authored/11finite checks: three whole renderer adapter/assembled-stage suites and two native projection cases. Deliberate losses: plugin URL/ref/default-version/local-path and unsafe credential refusal forwarding; real Task hook/store A→B→A late-save/list/count fences, owner disappearance, legacy-host convergence, query/history/eviction and same-ID host history; native child append ordered-ID/replacement and compound fallback/order/optimistic-admission/child-turn/duplicate/shrink/revision alarms. These are real bounded alarms; removal follows thin adapter, manually assembled Task pipeline and repetitive fixture value judgment, with no replacement or equivalent coverage claim. Prior1179/1182,1220/1221 and1885 KEEP superseded as applicable. Keep36 authored/38finite registrations raw exact across13 surviving drivers. No runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous account (preserved verbatim): Audit3706 removes7authored/7potential cases from3renderer sources: whole usage-label3case and130000-distinct-day usage-overview singleton suites, plus3SSH grouping/ordinary-range examples. Retain11authored/11potential cases across6drivers in this bounded selection; no equivalent replacement or fresh runtime result. Existing bare root-unit commands admit this selection statically; prior command/receipt strings remain historical. Audit3706 intentionally retires first/second-order usage-group label collision alarms; equal50%-weekly bucket versus derived-weekly selection identity and Gemini wk label alarm;130000distinct-day aggregation no-spread-crash/max/intensity alarm; legacy absent-source SSH grouping and ordinary reverse-select/selected-target deselect range alarms. Actual label ambiguity and pathological-input crash are accepted losses. Distinct-day fixture spans~356years; no hard producer/date bound is claimed. Retained filtered-anchor/grouped-order guards do not replace removed deselection/reverse-range/legacy-group coverage. No native SSH, mounted renderer, live provider, remote/folder/mobile end-to-end or current runtime pass was obtained. Previous account (preserved verbatim): Audit3699 removes4 authored/4finite checks, including one whole xterm copy-policy suite and one root/group CLI help case. Deliberate losses: direct copy-chord admission for platform, selection, Kitty mode, defaultPrevented, logical/physical key and key phase; command-group disclosure and group help routing including claude-teams early return without RuntimeClient construction. These are real bounded policy/wiring alarms; no replacement or equivalent coverage claimed. Retain14 authored/19finite raw-exact registrations across6 drivers: unsafe CLI refusal, Claude model event carry and disk reconstruction/OSC-first case, attachment ownership/upload lifetime and mixed BMP file-reference/PNG-chip delivery, actual SQLite authority/admission/mutation, and Electron geometry/hit-testing. No runtime, CI, native-key delivery, external provider, mobile, remote, folder or global completion credit. Previous account (preserved verbatim): Audit3692 removes5 authored/5finite marginal Codex checks: unrelated login URL without notice; ordinary per-account launch resource/config materialization; no-retained-pane skip; preservation of a previously owed full scan through actual preparation and pending-marker update (no actual history scan/settlement); ordinary later-config refresh. Accept these exact branch/wiring alarms as deliberate losses without replacement. Retain32 authored/34finite raw callbacks/registrations/table bytes exact across14suites, including credential/admission refusal, grace/reset readiness, filesystem ownership, commit-dependent queue state, streaming/host trust, path canonicalization and private-state preservation. All14whole suites challenged without keeper quota; no whole deletion warranted on current concrete signals. No runtime/CI/native WSL/remote/mobile/folder/global completion credit Previous account (preserved verbatim): Audit3691 removes two complete runtime-home routing singleton suites (2 authored/2 finite): catalog wrapper mirror login-copy and passive transcript-lookup filesystem noncreation. Exact accepted losses are recorded in knownGaps; no replacement or equivalent coverage claimed. Audit3691: no dedicated alarm remains in the deleted sources for post-launch system login import through prepareHostCodexHomeForReadOnlyAppServer, or for repeated missing-transcript lookups leaving removed Codex account/runtime directories absent and userData entries unchanged. Ownership-marker read avoidance was never independently measured. No real catalog probe, provider, native Windows or crash was validated by those fixtures. Previous account (preserved verbatim): Audit3686 current Claude profile/account review removes5 authored/5 finite cases: whole structured-auth diagnostic-label suite3 and Windows-only command suite1 whose advertised cache alarm is ineffective because cache lifetime is per invocation; remove duplicate setup namespace-link refusal1 at wrapper layer. All5 exact historical KEEP are consciously superseded. Retain49 authored/50 finite unchanged, including filesystem privacy/recovery, route identity and concurrency, built worker/helper, legacy WSL alias compatibility and sign-in handoff. These are deliberate coverage losses without replacement. No runtime/CI/native WSL/macOS Keychain, remote/mobile/folder or global completion credit. Explicit accepted real losses: unknown-account host fallback and mixed-version/WSL-only structured auth diagnostic labels; Windows-only sentinel ENOENT-to-friendly-error translation plus fresh-call successful dispatch smoke; setup catch-to-refused wrapper and no-write outcome for a namespace symlink. The command case does not discriminate removal of its per-invocation noncache guard; it still supplies the error-translation alarm, which is intentionally retired. No replacement/equivalence promise. Previous account (preserved verbatim): Audit3680 removes eleven authored/eleven finite unit cases across four files, including entire launch setup row projection, structured legacy-model metadata, and legacy classifier suites. Accept loss of exact row partition/start selection, Codex supersession/default/unknown and Claude alias/suffix folding examples, other-agent exemption, getter/cache read budgets, same-array per-agent cache isolation, replaced-catalog metadata, and tracked-only model exclusion from structured and PTY legacy inventories. These are real narrow policy/metadata alarms intentionally retired without equivalent replacements. Retain real menu collapse/reopen in dropdown/select, AI picker cancel/accept and stale-effort filing, IME carry/gesture/frame transitions, and typed-flip versus held-dispatch fencing. No production or shared fixtures change. No dead timing entry exists for the three deleted drivers; retained timing keys stay unchanged. Static source-value review only; no project import, test runner, native/app execution or runtime validation established. Earlier receipts retain historical scope. Previous account (preserved verbatim): Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit. Previous account (preserved verbatim): Audit3672 renewed by3676 removes four authored/four finite cases from federation-output.test.ts: nominal show/read routing and terminal-fallback projection; initial archive-table SELECT failure returning retained/no-close; simulated old-peer read/fleet/refusal and method inventory; and absent archive-release capability refusing release. These actual compatibility/guard alarms are intentionally lost without equivalent replacement; the dropped-table case never reaches capture or commit. Current selected frontier9 becomes5: retain actual temporary transcript parsing/path omission, current no-transcript release/unavailable-output/restart/replay regression, and three home deadline/stop nonmutation cases. Prior held-capture case was already removed upstream and receives no new removal credit; prior redacted snapshot archive behavior was rewritten upstream and is not claimed retained here. The surviving driver timing entry stays. Static review/private composition only; no actual peer/network/native/platform or fresh runtime validation. Previous account (preserved verbatim): Audit3671 removes14 authored/32 finite root-unit cases, including the whole WSL move-handler refusal suite, WSL preload object-presence suite and internal gate spelling truth table. Also retire the weak withheld-command non-array shape assertion, static serve-only Add/capability/mock-remove example, grammar scope equality and basic configuration/payload schema roundtrips. Genuine wrong-window/malformed-request/gate-before-work, exact gate spellings/platform/argv precedence, static serve-only routing, declaration mismatch and empty grammar/pair admission alarms are consciously lost without replacement; prior KEEP decisions are reconsidered. Seven unchanged authored/finite root-unit cases retain real image/provider/line budgets, live policy transition/capability broadcast, grammar resource/reference traversal and strict-versus-tolerant literal salvage. Source-value evidence only; no runner/compiler/build/app/native/provider/remote/mobile/folder validation or historical fault claim. Independently remove one authored/finite Playwright closed-gate app-boot inventory: accept loss of real renderer/preload/main refusal composition, saved-host row and Add/Move hiding/Remove visibility alarms. Keep the unchanged scripted-move rendered dialog lifecycle/reload case. It runs no real WSL migration, host connection, file copy or automation restoration. No selector or Playwright participation cleanup is required because the spec remains. Previous account (preserved verbatim): Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence. Audit3634: Remove five authored/five finite cases, including the complete structured chat terminal-refusal, terminal-plus-agent worker-start validation, and canonical Git common-directory parser suites. Also remove the gh free-text -R argument projection case. Consciously supersede prior KEEP decisions and accept chat-versus-stale redirect classification, real RPC refusal-before-SQLite-Dispatch, old-Git echoed-option relative-path parsing, WSL execution-space resolution, and free-text preservation/bare-repo qualification alarms. These are genuine narrow alarms, intentionally retired without equivalent replacements. Retain real Git stdin/EOF delivery, bound-account host admission, naming environment/account precedence, upload iterator cancellation and remote path confinement. Shared fixtures and production code remain. Remove only the dead canonical-repo-key timing entry. Static source-value evidence only; all prior evidence retains historical scope. Audit3636: Remove the entire maintenance opportunity internal-count driver (one authored/two finite cases), the mocked remote worker start-card argument case (one/one), and the follow-up heading mapping table (one/two). Root-unit discovery loses three authored/five finite cases. Independently remove four Python native screenshot methods/five statically enumerated subTest scenarios: grim argv/stub payload, failure-code mapping, X11 mocked capture payload, and capability flags. The Python lane is verify:computer-native and is not root Vitest. Accept loss of exact native command/projection and exception/capability alarms, ready-only card publication arguments/agent forwarding, and serialized follow-up heading mapping; no equivalent replacement is claimed. Retain actual ownership/mail/queue/reopen transitions, remote lost-response fencing and first-result settlement, filesystem/maintenance admission and successor progress, wrong-region screenshot refusal and Sway geometry. The whole-deleted new driver has no timing key; this component requires no timing cleanup. No production changes. Static source-value review only; no project import, runner, app, native desktop or runtime validation established. All prior evidence retains historical scope. Audit3629 removes two singleton parser suites: WSL Claude plugin metadata out-of-range index rejection and Git checkout unlink-warning path extraction. Their real range-refusal and quoted-path extraction alarms are intentionally lost without replacement; no WSL execution, checkout recovery or equivalent remaining coverage is claimed. Audit3630 removes the sole orphan automation availability test (1 authored/1 finite). Its real policy kind, orphan precondition, delete/toggle enablement and run/edit refusal alarms are intentionally lost. The test did not dispatch an action, enforce a server generation fence or observe a remote mutation. No equivalent replacement, actual renderer/transport execution or new platform/provider evidence is claimed. Previous account (preserved verbatim): Audit3628: remove the entire one-authored/one-finite RepositoryRemoveProjectSection happy-dom suite. Accept losing the local zero-to-one-terminal stale-count revalidation alarm: first confirmation defers the removal callback and second confirmation invokes it after the count snapshot updates. The test never asserts updated warning text/count, actual terminal creation or removal/PTY teardown, host/scope routing, cancellation or folder/mobile behavior. No equivalent replacement or end-to-end warning-before-teardown proof asserted. Static evidence only; historical receipts retain original scope. Audit3624: Remove one authored/five finite positive Gemini identity table from the Claude/Gemini title collision driver. The real normalization, legacy label and explicit title evidence owners execute, so ordinary Gemini marker/name/wrapper recognition and normalized-label composition alarms are consciously retired without equivalent replacement; these five supplied title-to-literal identity examples have low marginal value. Preserve the six-row Claude task-text collision oracle, whose unrelated CLI mentions must not rebrand or destructively normalize titles. The other audited drivers preserve real permission-mode session transitions, prompt secret/fence/bounds defenses, JSON-to-Ask option/preview preservation, and optional GitLab failure summary/trace composition. Root-unit discovery loses one authored/five finite cases; no whole driver or timing key is removed. No actual terminal stream, UI routing, application/native or runtime execution established; all prior evidence retains historical scope. Audit3618: Remove three authored/three finite browser reload cases, including the complete renderer reload-actions suite. Agent bridge fake did-fail-load plus permanently supplied manager error projects description/code into a rejection. Renderer seeded empty metadata projects a saved URL into plain webview src; its earlier not-ready case projects a live-id/throwing fake reload into absence of a loading patch. Real queue/wait/error/cache/classifier/hook code executes, but these narrow supplied-state and exception-to-callback wirings have low marginal value; no rerender, lifecycle, actual cache generation/retirement or guest commit is asserted. Explicitly supersede audit1822 not-ready KEEP and preliminary3617 cross-module retain opinion, accepting offline-reload failure reporting, empty guest to saved URL routing, native-reload bypass and premature-loading/stranded-state alarms without replacement. Retain distinct main cancellation queue progression and absent queued side-effect dispatch. Root-unit discovery loses three/three. No Electron guest, network failure, restored navigation/commit, app/native focus or runtime execution established; earlier evidence retains its historical scope. Audit3614: Remove thirty-one authored/thirty-nine finite potential cases across CLI format and argument drivers, including three whole suites: search-result/status sanitation sites, Linear issue/list/warning sanitation sites, and quote-stripped JSON diagnostic secret non-echo. Those real formatter/guard transformations execute on supplied strings; intentionally retire their field-specific CSI/OSC/C1/newline/bell and diagnostic secrecy alarms as low-value caller/output inventories, without replacement. Also retire twenty-one search registrations/twenty-four finite cases covering minimal positional request/default omission, exhaustive all-flags request projection, nominal named query/index routes, repeated syntax/agent examples, enum/agent/path-count/timestamp/numeric/cursor admission examples, unknown/browser flag examples and postcommand last-wins projections; retire one parser sentinel-only case. Keep actual ambiguity, conflicting index request, precommand/crosscommand scoping, variadic reference parsing and missing-repeatable-value controls, without claiming equivalent coverage. Root-unit discovery loses all twenty-nine/thirty-seven. No CLI/RPC/terminal/PowerShell/host/schema/runtime execution is established by this source-only audit; earlier evidence retains its historical scope. Audit3613: remove six authored/six finite callbacks, including whole reviewer-display oversize-input and explorer-root record-filter suites, plus plugin family-emoji/invisible-only-name and pool legacy-name/urgent-countdown samples. Accept losing oversized-input empty-result/no-split, malformed-record/prototype-sensitive-key/nonstring filtering, exact ZWJ family preservation, invisible-only name refusal, no-group old-host full-name preservation, and80/79/null-reset countdown composition alarms. No equivalent replacement asserted. Retained strict/runtime sanitization, SVG parser, mobile focus recovery and collision/tie cases have different scopes. Static evidence only; historical receipts retain original scope. Audit3609: Remove the complete pnpm CLI invocation literal-selection suite (eleven authored/nineteen finite potential cases), with no replacement claimed. Root-unit discovery loses JavaScript-versus-native command selection, npm/npx executable rejection, Windows cmd/bat casing and shell selection, non-Windows cmd behavior, native PNPM_HOME flat/bin preference, explicit-path priority, relative-home rejection, missing-native fallback and non-Windows home-probe refusal alarms. The suite called the real resolver with independently expected objects, but exercised no pnpm/node/cmd process, installed native executable or real filesystem probe. Earlier KEEP decisions are consciously superseded by accepting these narrow branch and probe-inventory alarms as low value. Real symlink entry, Git signing isolation, Bun filesystem/Node child normalization and compiler scheduling/continuation tests remain distinct tests, not equivalent coverage. No runner, compiler, app, platform or remote execution was performed in this source-only audit. Earlier evidence retains its historical scope. Audit3608: remove five authored/five finite callbacks, including whole owner-slug and remote favicon URL suites and two repository-label projections. Lose five owner acceptance samples, eleven negative owner samples plus nonstring refusal, six host-local icon refusal samples, legacy-SSH same-path label-map cardinality, and explicit runtime ownership over stale legacy metadata at label level. These are accepted narrow grammar/presentation alarms with no equivalent replacement claimed. Retained binary parser, React recovery and label grouping/platform cases do not replace these losses. Static evidence only; historical receipts retain their original scope. Audit3606 adopts the enhanced3604/3605 icon cuts: nine authored/nine finite cases removed, including the whole tray-attention-icon suite. Retires the no-encoder oversized-upload null sample, missing-ID/request-order sample, encoder-null PNG-prefix fallback, SVG/404 rejection samples, transparent amber-dot placement and half-alpha white-tint sample, exact small fetched-byte passthrough, host-qualified image-key inventory and constant-encoder large-upload projection. These specific admission, formatting and bitmap alarms are intentionally lost without equivalent replacements. Retained queue/cache, bounded fetch and Dock lifecycle checks do not establish actual raster decoding, native image conversion or rendered appearance. Historical receipts below are preserved evidence for earlier test sets, not fresh validation of this reduced selection. Audit3601 scope: remove the whole custom-sound happy-path IPC suite and one custom-label/multiline notification formatting example (2 authored/2 finite). Intentionally lose configured .ogg selection, exact byte/MIME success wiring, successful dispatch for the formatting fixture, custom-label whitespace/title normalization and assistant-body whitespace/180-character-cap alarms. Retain prompt-exclusion, persisted qualified dismissal/restart, theme ownership/restore and Ghostty precedence/collision cases; none replaces the retired sound/formatting alarms. No actual playback, native delivery, phone/network, cross-platform or new runtime evidence is claimed; historical execution keeps its original scope. Audit3598: Remove seven authored/nine finite literal-table potential test registrations across workflow routing, Claude cold-start and real-zsh preexec drivers. Root-unit discovery loses six authored/six finite: three test-local workflow parser fixtures, the five-positive/three-negative explicit command-paint route inventory, a boot-banner-before-composer sample and an already-painted bare-title positive sample. The separately selected shell_contracts live-shell driver loses one authored/three finite raw-capture paint-only cases across three hook configurations; its real-wrapper launch-order, four rechunkings (twelve finite) and runtime-wait replay remain, without claiming equivalent replacement. Intentionally lose those parser, exact routing-list, banner, post-paint subscription and native-read-boundary paint alarms. Retained workflow/UNIT_EXCLUDE/classifier cross-source routing checks and readiness-race-to-writer timing are distinct bounded alarms. No runner, real shell, PTY, app, native focus, remote delivery, cross-platform execution or full-feature correctness is established by this source-only audit. Earlier evidence retains its historical scope. Audit3597 scope: remove two renderer-hang-capture examples (2 authored/2 finite): an invalid repeated-token oversized reducer fixture and a shorter unanswered-request fixture. Intentionally lose the direct truncated flag/sanitized frame fixture and request-pending status/zero-sample alarms. Retain window-death/stale-result exclusion, generation reconciliation, and baseline-publication cancellation lifecycles; they are not equivalent bound, redaction or pending-status replacements. Historical execution retains its original source scope; no new runtime evidence is claimed. Audit3591: Retire the whole one-case background journal-producer attribution suite and the fabricated malformed-details-block case (two authored/two finite cases). Intentionally lose the fixed own-task versus output/foreign-task attribution examples across flat/message row shapes, missing-root classification, and direct unbalanced/detailsish fabricated-block rejection alarms. Retained parser sibling/depth and editor navigation tests do not replace these alarms. No equivalent replacement or fresh runtime, transport, persistence, native focus or rendered UI validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3592: Retire the whole three-case shared agent smart-key resolver suite, explicitly superseding its Audit3238/3237 keep decisions. Intentionally lose literal permission-versus-question classification, longest-question digit selection, Codex async-question opener/digit/Enter/skip mapping, and unsupported-agent/state/prompt refusal examples. These were real parser/selection and literal-byte alarms; they did not exercise terminal delivery or timing. No equivalent replacement or fresh runtime, native TUI, mobile, remote or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3587/3588: Retire six authored/fourteen finite cases, including the whole WSL stopped-notice and connecting-status selector suites. Intentionally lose direct WSL retry connection field/target/ready-epoch/null-guard examples, connecting/reconnecting distro and absent-state selector samples, and stopped/connecting notice text/button/data-attribute examples. Retained host-ready retry and content-loader/reload lifecycles do not replace these alarms. No equivalent replacement or fresh runtime, native WSL, remote, rendered UI or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed. Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions. Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Module layout SSH policy: Retire the multiplexer private-clock saturation registration, the writer saturation transition-count registration and the changed-source dated writer/backpressure receipt. Retained byte delivery, lane order, fairness, settlement and cancellation cases are unvalidated by that historical receipt. No equivalent replacement, new execution, measured performance, live SSH/WSL or cross-platform proof is claimed. The unchanged WSL protocol receipt retains only its original command scope. Historical prior account (preserved verbatim): Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/ssh/ssh-multiplexer-transport-writer.test.ts: reports saturated epochs and their drain boundary exactly once. src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/main/ssh/ssh-multiplexer-transport-writer.test.ts remains historical and is not a passing result for the reduced current command. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete tail-wait memo suite: its sole current authored callback checks supplied fromTail/blocked field values. Retire all three broader memoization/equivalence/eviction assertion aliases; they are not backed by retained source callbacks. No scan-work budget, sustained output, physical terminal or resource measurement is assigned to this removed test. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1674 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Local macOS evidence covers main-process pending-output and projection-admission caps, saturated-tail wait detection, direct-SSH source retention/accounting, always-on V1 negotiation with legacy peer fallback, exact provider-generation pause ownership, renderer exit/data ordering, decoder input bounds, bounded reconnect scheduling, and WSL stdio transport settlement through deterministic unit contracts. A joined main/runtime oracle exercises renderer-sourced headed semantics and headless-model snapshot semantics without launching a live paired server. Separately, a macOS-hosted Docker OpenSSH run exercises only the deployed Linux relay and direct SSH provider with an exact 256 KiB source-credit plateau, concurrent PTY typing, fixed-size filesystem frames, Git churn, and owner-lease reconnect. Neither deterministic topology labels nor Docker SSH constitute live headed desktop, headless orca serve, or physical WSL evidence; local/daemon, prior-version daemons, Windows named pipes/ConPTY, folder workspaces, and mixed-version clients also remain uncovered. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6836",
"https://github.com/stablyai/orca/pull/6858",
@@ -8884,7 +8857,7 @@
"https://github.com/stablyai/orca/pull/7054"
],
"invariant": "High-volume terminal output must stay bounded across daemon socket writes, SSH relay writer/decoder/source retention/reconnect, main model and projection admission, runtime metadata, detectors, and tail checks, main-to-renderer in-flight bytes, renderer scheduler queues, and hidden-output restore without starving focused input. Every new SSH session offers V1 and every same-build relay supports it; legacy delivery is reachable only when capability negotiation proves the peer cannot use V1. Negotiated SSH spans remain exact and contiguous through activation, exit, cancellation, recovery, desktop projection, and required remote replacement; provisional activation data cannot project, reconnect may release it only into the exact attempt's private recovery quarantine after contract validation, and exit seals that quarantine against later same-token frames until ordered admission or exact cancellation proof. Reconnect checkpoint capture freezes exact provider-generation/PTy admission, cancels queued old work, and waits for the running raw completion before exposing its accepted checkpoint; timeout or failure detaches only that PTy's old model, makes the checkpoint unavailable, and releases the bounded fence without closing the shared provider, while the same failure outside an active exact migration remains generation-fatal and overlapping reconnects preserve any earlier outstanding fence. Pending renderer projection IDs are capped and compacted across split remainders, exit preparation owns its renderer fence through finalization, exit-time cancellation transfers published projections before proof commit, generation close fences late proof while draining exact projection waiters, closed-generation identity compacts without weakening stale rejection, canceled source-delivery retirement retains at most one ordered token per PTY, and pause/resume targets only the exact provider generation. Additional subscribers cannot stall the owner, while the required legacy primary retains backpressure.",
- "oracle": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Module layout SSH policy: Retire the multiplexer private-clock saturation registration, the writer saturation transition-count registration and the changed-source dated writer/backpressure receipt. Retained byte delivery, lane order, fairness, settlement and cancellation cases are unvalidated by that historical receipt. No equivalent replacement, new execution, measured performance, live SSH/WSL or cross-platform proof is claimed. The unchanged WSL protocol receipt retains only its original command scope. Historical prior account (preserved verbatim): Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/ssh/ssh-multiplexer-transport-writer.test.ts: reports saturated epochs and their drain boundary exactly once. src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/main/ssh/ssh-multiplexer-transport-writer.test.ts remains historical and is not a passing result for the reduced current command. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete tail-wait memo suite: its sole current authored callback checks supplied fromTail/blocked field values. Retire all three broader memoization/equivalence/eviction assertion aliases; they are not backed by retained source callbacks. No scan-work budget, sustained output, physical terminal or resource measurement is assigned to this removed test. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1674 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The current executable slice injects main-process renderer backlog pressure, then asserts ordinary terminal-wait detection without a joined-tail allocation and with full prompt-family continuity, per-PTY and total pending-output caps, a 1,024-ID projection cap with split-remainder compaction, preserved sequenced-tail metadata, active-pending protection ahead of background trimming, exact provider-generation pause ownership, renderer exit/data ordering, and ACK-gated in-flight bounds. The negotiation seam proves every initial connection and reconnect offers V1, the same-build relay advertises V1 without launch flags, old clients remain token-free, and method-not-found peers fall back without installing source ACK publication. The joined source-intake/multiplex oracle blocks renderer or headless serialization, admits one snapshot-covered span and one trailing span, requires replacement reservation only after the authoritative sequence is known, advances upstream ACK eligibility exactly to the covered boundary after SnapshotEnd, and delivers then ACKs the trailing span through the ordinary live path without cancellation. Source-range ledger and multiplex seams additionally require cumulative byte ACK 40 then 100 for one 100-byte frame to release exact byte credit without early source settlement, admit a contiguous higher-generation recovered token while the prior token remains unsettled, and reject stale stream or source generations without releasing in-flight byte credit. Replacement reservation rolls back every earlier span on a later failure, commit requires the exact frozen transfer states, and an authoritatively reclaimed covered span rejects commit without local trim authority while rollback removes the reservation idempotently. The exit-deadline oracle publishes a source-backed desktop projection, advances a fake clock to cancellation, and requires one projection transfer, proof commit, preparation, and final exit with no provider close, retained obligation, duplicate finalization, or process-lifetime cancellation tombstone; a second controlled proof remains pending across generation close and must never publish final exit, while both paths release the renderer preparation lease exactly once. The model-migration oracle accepts span A, blocks span B's raw emulator completion, begins disconnect migration, and proves no checkpoint or reconnect attach can remain at A; releasing B advances the exact checkpoint to B and projects B once. Its fake-clock arm reaches the 10-second deadline, requires checkpoint-unavailable, one exact model reset, zero retained admission charge and timers, and no effect from late raw settlement. Its two-PTY failure arm rejects one running raw callback under an active exact migration and requires one checkpoint-unavailable result, one model reset, zero provider closes, retained sibling checkpoint and transport liveness, zero charges and timers, and an unaffected other generation; a non-migrating sibling oracle still requires generation close. The intake additionally closes 2,048 sequential provider generations into one exact range, rejects stale events across that range, and preserves an out-of-order live gap until its own close. Direct-SSH contracts additionally prove activation-response settlement before the first source frame, claim-gated projection under same-decoder-turn response/data delivery, exact early-ACK reservation through send settlement or same-token retry, recovery completion visible before lease-held frames transfers those frames only into the private quarantine and admits no output until exact checkpoint-to-recoveryEnd coverage, invalid-checkpoint restore retention through response settlement followed by fresh-token retry and one live source frame, isolated saturated-subscriber eviction with healthy owner liveness, preserved legacy-primary backpressure, one-write ownership across write(false)/drain, control selection ahead of queued ordinary PTY input with FIFO lanes and bounded fairness, liveness rebasing, failed-exit retention through late ACK or exact recovery, response-settlement cancellation authority, token-scoped exit cancellation, exact checkpoint-to-recoveryEnd continuity, stale-owner one-shot retry, no physical PTY teardown on recovery failure, exact provider-generation closure and once-only cleanup when recovery cancellation publication or proof rejects, 16 MiB-plus-1 MiB decoder caps, charged per-PTY/session retention budgets, and eight-wide isolated reattach. The live Electron perf oracle adds hidden-output floods, renderer scheduler queue depth, dropped-output-zero normal scenarios, and active key latency budgets before promotion.",
+ "oracle": "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed. Historical prior account (preserved verbatim): Audit3814 deliberately retires60 authored/60 finite cases:53runtime compatibility cases,4native XCTest methods and3Python clipboard methods, including the entire StableElementIndexes suite. Clipboard cuts retire the one-over-cap sample, incoming-offer destruction trace and sequential20-copy replay; actual wire, FD/pipe, startup and Xvfb/GTK boundaries remain without equivalent replacement claims. Accepted losses include narrow terminal-send payload/provider projections, legacy and direct no-op/error permutations, timing/work-count examples, private state/title/activity projections and fixture-driven readiness examples, individually enumerated below. These include real bounded production alarms consciously retired for marginal value; retained failed writes, duplicate submission, stale capture, transcript/ring and allocation fences are not equivalent replacements. No fresh native/remote/browser execution or complete transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3806 deliberately retires40 authored/40 finite runtime compatibility cases, including the terminal-side-effect-facts-part03 headless-snapshots-part02 and agent-status-and-waits-part03 fragments, plus20 scalar Swift precondition sites. Lost runtime alarms include status/title/attention projection examples, simple renderer/headless frame restoration and status waiting outcomes detailed in the accepted-loss ledger. Swift cuts retire duplicate generation-map/schema/navigation/bridge and notification-wrapper assertions; no standalone native program is deleted. These include real bounded production alarms consciously retired for marginal value. Retained races, pending writes/reflow, namespace and waiter ownership are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3798 deliberately retires21 authored/24 finite compatibility cases, including the entire SSH-worktree-lifecycle and repository-project-operations fragments. Accepted losses include navigation-only settings acknowledgement, browser session cleanup and host preservation projections, window positive/policy-state examples, terminal recovery/reload and no-incarnation remint examples, terminal listing compatibility/malformed IDs, directory browse/sort/Windows path smoke, SSH create refusal/manual lineage, recursive parent-folder creation and fork/origin/avatar/icon projections. Real bounded production alarms are consciously retired for marginal value; retained authority races, cleanup/clone ownership, pending waiters, nested-folder and scan invalidation cases are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3788 retires10 authored/11 expanded cases across six changed drivers, including the entire screencast pending-frame-retry and usage-source-cache-streaming suites. Deliberate losses are false-refused last-frame retry/once-only delivery, ordinary stable-pane reattachment, cleared-chat Dispatch completion, terminal-declared chat-caller refusal, at-rest worker liveness projection, nested depth/cap policy, small unsigned6/sealed7 plain-format and verified-bit examples, generic malformed-ISIZE footer refusal examples, and synthetic10k/100k chunk-size/work-count budgets in gzip and general cache I/O. These include real state/disk/RPC outcomes consciously retired for marginal value; retained E2EE-backlog, receipt/custody/uncertain-ack, integrity/migration and staging-cleanup cases are not equivalent replacements. The footer test did not prove early rejection or bounded allocation; staging cleanup did not seed unrelated files. No replacement or fresh native/remote/performance execution is claimed. Earlier raw selectors and dated receipts remain historical. Audit3779 retires17 authored/17 expanded registrations across six changed drivers, including the entire shared-Codex-home and prompt-telemetry suites. Accepted losses are shared-home wrapper noninterference/opt-out preservation, mocked metric count/provenance filters, SSH activity labeling/clearing and handover idle timing, VM ownership/capability/status projections and asleep-worktree refusal, a link-only external conversation replay sample, and two narrow input-credit noninterference/expiry examples. Retain the direct exact-tab/single-use input-credit case. These bounded real disk/state/routing alarms are intentionally retired for marginal value without equivalent replacement or fresh execution claims; earlier receipts remain historical. Audit3772 retires18 authored/27 expanded cases, including whole Codex service opt-out, RPC capability-parser, creator-provenance, short-ciphertext and readiness-null suites. Accepted losses include service ledger/symlink/mode cleanup, user TOML substring preservation, old-hash cleanup, description pass-through, malformed-file/pending-hash examples, coordinator write/probe counts, capability array bounds, positive creator projections, early short-payload refusal and readiness helper null shape. Two redundant Codex exit-cause rows are also retired; Pi shares their direct-idle path only in this empty-output immediate-exit fixture, and future agent-config drift coverage is lost. Real bounded filesystem/parser/runtime alarms are deliberately retired for marginal value; no equivalent replacements or fresh execution are claimed. Earlier receipts retain their historical scope. Audits3754/3755 intentionally remove9 authored/9 finite registrations: the entire one-case usage-source-cache-streaming.test.ts driver and8 cases from the surviving computer-action-validation.test.ts driver. This gate retains an unfiltered root Vitest command; UNIT_INCLUDE admits both source paths. Accepted losses are the real encoder output chunk-size/work-count alarm on repetitive10k/100k ownership payloads through a mocked durable sink, plus CLI diagnostic precedence, fractional window-id rejection, action-call-site window-target exclusivity, plain-text click-count recovery copy, incomplete click/drag targeting, mouse/modifier/direction allowlist samples and inline/stdin text exclusivity. These CLI cases exercise real argument/handler validation before mocked runtime calls; they are deliberately retired for marginal value, not declared tautologies. Retained cache I/O and CLI cases are not equivalent replacements for these alarms. Existing historical raw receipts remain unchanged and do not validate the deleted or reduced drivers. No fresh execution claim is made. Audits3758/3763 intentionally remove9 authored/11 finite registrations from6 changed drivers, including the entire pane-title-notification, window-linear-notices and worktree-card-lifecycle-effects suites. This gate retains an unfiltered root Vitest command admitting these paths. Accepted losses are same-account linked-row success-notice fanout, sidebar-switch channel forwarding, Linear-only notification forwarding/non-terminal-consumer selection/closed-window detach, destroyed-window refusal and first-send-failure suspension through the pane-title adapter, the100-card synthetic focus/poll absence sample, stored-source local folder badge refresh, unobserved-row badge refusal, and immediate reposChanged lineage invalidation. These exercise real owners with controlled ports; they are retired for marginal value, without equivalent replacement claims. The no-badge-work fixture does not seed its title-promised collection-only cache. Preserved historical receipts do not validate deleted or reduced drivers; no fresh execution is claimed. Audit3759 retires the entire one-case Tailwind compiler/scanner smoke. Accept loss of the direct CSS production/test/spec source-exclusion and rescan alarm; no replacement or current execution is claimed. Audit3752 independently approves audit3749: retire five authored/five finite watcher-process registrations, retaining18 raw-exact registrations. Accept loss of healthy shared-pool joint recovery, last-pending-failure idle retirement/respawn, late VITEST fallback release, missing-entry fail-closed selection and independent-supervisor fuse locality alarms. These are real bounded host-policy alarms intentionally retired for low marginal value; no equivalent replacement is asserted. Remaining driver selections exercise controlled FakeChild supervisor lifecycle, cancellation, physical-exit fencing, recovery and fuse behavior. This source review supplies no fresh native/process/platform/remote/SSH execution; historical receipts retain original source and selector scopes. Previous oracle (preserved verbatim): Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered root Vitest command. Current UNIT_INCLUDE admits the partial push-service, metadata-dialog and two config/scripts browser drivers:10 authored/16 finite removals. Accepted losses: actual retry30s/60s progression and register bucket/refill wiring, explicit seven-day lease arithmetic (its notification lacked seq/epoch and never reached send), equal-name edit latch/save payload, real image/font/meta-refresh/form/popup browser refusal controls, and broad rich-markdown bridge/command/edit-select smoke. Actual production state, callback routing and browser enforcement run in these cases; these alarms are deliberately retired on marginal value. All drivers and selectors survive. Existing unrelated receipts remain historical evidence for their unchanged selectors, not proof of the reduced cases. Audit3732 removes 2 authored/3 finite registrations from two partial suites: nominal custom/Kimi local naming success and deferred context usage row presentation. Real losses: custom/Kimi successful extraction through conversation-name sanitization and agentLabel composition; separate ordered counted/deferred lists and exact percentage/token formatting. No replacement or equivalent coverage claimed. Retain 11 authored/13 finite raw-exact registrations for bounded naming instruction/refusal/cancellation, menu dismissal focus ownership and hover/composer Escape/timer cleanup. Source-only bounded value review, no runtime/CI/native/remote/mobile/folder workspace or global completion credit. Previous oracle (preserved verbatim): Audit3733 removes2authored/2finite terminal input checks: fixed custom-cap error/secret fixture and three-emoji cap5refusal whose6UTF16units already trip length fast guard (no UTF8-dependent boundary). Accept exact non-disclosure/oversized-refusal alarm losses; no replacement/equivalence claim. Retain13/13scalar/pending input, OSC state and cron DST/cadence outcomes after bounded material reads. Source-only zero runtime/novelty credit; original historical reasons preserved. Previous oracle (preserved verbatim): Audit3729 removes1authored/3finite by deleting whole CLI runtime pairing advisory-close suite. Accept losing post-real-close injected EIO preservation of native/script/unreadable pairing, env identity/preservation and exact close/release assertions; no actual failed-close leak or replacement coverage claimed. Two retained URL grammar/identity suites11authored16finite raw unchanged. Bounded source/owner/caller value review, zero novelty/runtime credit; other seven3724deferred closures remain. Historical receipts preserve original limits. Previous oracle (preserved verbatim): Audit3724 removes3authored/3finite checks by deleting two whole suites: TUI clear burst-size singleton and terminal-file-URL target two-case wrapper suite. Deliberate losses: derived widest burst<64byte alarm, UNC authority+line-column anchor composition, and malformed-percent null refusal. Real production algorithms execute in those tests; no mocked-output tautology, equivalent replacement, actual Claude/file-navigation delivery or universal safety-irrelevance claim. TUI58byte bound and URI examples have low marginal value as standalone suites. Actual1262/1264/1742KEEP superseded explicitly. Remaining14drivers83authored136finite raw unchanged. Bounded source-only review; ten closures deferred, four bounded keep judgments repeated with zero new semantic-frontier credit. No runtime/CI/native/remote/mobile/folder/global completion claim; historical receipts retain original scope. Previous oracle (preserved verbatim): Audit3723 removes 4 authored/4 finite registrations in two whole suites: keybinding cache freeze/token spellings and host-dependent Orca command name examples. Real losses include returned-object freeze, repeated Mod+P key, Space/PageDown/NumpadSubtract mapping, unknown/empty/prototype-token rejection, and headless Linux versus Windows-server/WSL command choice. No equivalent or replacement coverage claimed. Retain 12 authored/21 finite raw-exact registrations exercising generated scaffold validation, artifact failures, shipped editor/hook/worker/panel tests, actual generated typing compilation, independent CLI root routing and intent-name precedence. Source-only bounded audit; no runtime, CI, native, remote, mobile, folder workspace or global completion credit. Previous oracle (preserved verbatim): Audit3720 removes17authored/23finite checks: whole main catalog-date adapter2 and shared date-helper7, seven renderer nominal ranking/cap/no-date/composition cases, and one browser registration expanding to seven forced-container/DOM-child boundary cases. Deliberate real losses: community oldest-date UTC forwarding, official/undated omission, date sorting/window/invalid/future/skew/clamp and default/override cap; nominal ranking/cap and combined Featured/Newly-added outputs; real CSS459/460,719/720,1055/1056breakpoint, five-card partial-row and720px two-card first-row alarms. Browser cases really measure rendered geometry but force width/remove DOM children; no fake-pixel or tautology rationale. No replacement/equivalent coverage claimed. Retain14authored/19finite raw-exact registrations across4drivers: adversarial featured category/order/tie and installability, date order/window selection, actual PluginManager failure/escaping/duplicate-card suppression, real browser viewport/odd-count geometry/phone catalog visibility, syntax ingress/depth/include/printability and68dlong-bracket auto-close fill-in. No tests/browser/native/UI/provider/remote/mobile/folder/CI/global execution or completion credit. Previous oracle (preserved verbatim): Audit3717 removes6 authored/6finite checks in two whole thin-adapter/presentation suites. Deliberate real losses: ordinary recipe repository-URL withholding and provisioned-root credential scrubbing/forwarding; repository label lockstep suffix expansion, host-scoped map identity/collision grouping, Windows crosshost paths and WSL distro suffixes. Actual provision options, label/sort consumers and host/scrubber delegates inspected; no replacement/equivalence claim. Retain40 authored/84finite registrations raw exact in14 drivers with bounded owner/context review. Prior KEEP superseded for removed suites; no runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous oracle (preserved verbatim): Audit3714 removes8 authored/39finite checks: whole CLI selector-recovery, task display-text and ANSI grammar suites plus two name joiner/blank tables. Deliberate real losses: selector flag/value/identity and mutation recovery merge/serialization; exact task suffix, transcript fallback, input immutability, cache reuse and edited blocks; independent failed-escape/resumption and OSC/DCS/BEL/ST/C1/nested/unfinished stripping outputs; meaningful-language joiner preservation and invisible/blank-name rejection. These are real bounded alarms, removed as narrow supplied-error examples, helper/token inventories and repeated internal-work fixtures. Prior2936,1195/1196,1214/1215 and1082 KEEP superseded; no replacement or equivalent coverage claimed. Keep9authored/9finite raw-exact registrations in5surviving drivers: screenshot export/failure filesystem behavior, CLI local tree query, event-local reply provenance, vault role-sensitive content and four hostile/UTF16/dangling/tag-name regressions. No native/UI/provider/remote/mobile/folder/runtime/CI/global completion credit. Previous oracle (preserved verbatim): Audit3711 retires2authored/4finite cases by deleting whole clipboard-image-temp-file signature-to-name inventory (HEIC/TIFF/unrecognised bytes) and workspace-last-active switch-on supplied visit/reason singleton, plus its now-orphan test fixture. This intentionally loses real generated-filename suffix/extensionless alarms and real newer-visit archived7day versus inactive30day filtering/older-visit identity alarms. Filesystem writing and production reason pruning really execute; no equivalent replacement or universal absence of safety relevance is claimed. The clipboard test does not inspect written bytes, native delivery or decode; the visit test supplies candidate/timestamps and does not exercise persisted visit routing or actual removal.20authored/20finite cases remain unchanged across4bounded Git/sidecar/removal drivers. No new runner/test/module evaluation or runtime result; historical notes and receipts remain historical. Previous oracle (preserved verbatim): Audit3707 removes10 authored/11finite checks: three whole renderer adapter/assembled-stage suites and two native projection cases. Deliberate losses: plugin URL/ref/default-version/local-path and unsafe credential refusal forwarding; real Task hook/store A→B→A late-save/list/count fences, owner disappearance, legacy-host convergence, query/history/eviction and same-ID host history; native child append ordered-ID/replacement and compound fallback/order/optimistic-admission/child-turn/duplicate/shrink/revision alarms. These are real bounded alarms; removal follows thin adapter, manually assembled Task pipeline and repetitive fixture value judgment, with no replacement or equivalent coverage claim. Prior1179/1182,1220/1221 and1885 KEEP superseded as applicable. Keep36 authored/38finite registrations raw exact across13 surviving drivers. No runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous oracle (preserved verbatim): Audit3706 removes7authored/7potential cases from3renderer sources: whole usage-label3case and130000-distinct-day usage-overview singleton suites, plus3SSH grouping/ordinary-range examples. Retain11authored/11potential cases across6drivers in this bounded selection; no equivalent replacement or fresh runtime result. Existing bare root-unit commands admit this selection statically; prior command/receipt strings remain historical. Audit3706 intentionally retires first/second-order usage-group label collision alarms; equal50%-weekly bucket versus derived-weekly selection identity and Gemini wk label alarm;130000distinct-day aggregation no-spread-crash/max/intensity alarm; legacy absent-source SSH grouping and ordinary reverse-select/selected-target deselect range alarms. Actual label ambiguity and pathological-input crash are accepted losses. Distinct-day fixture spans~356years; no hard producer/date bound is claimed. Retained filtered-anchor/grouped-order guards do not replace removed deselection/reverse-range/legacy-group coverage. No native SSH, mounted renderer, live provider, remote/folder/mobile end-to-end or current runtime pass was obtained. Previous oracle (preserved verbatim): Audit3699 removes4 authored/4finite checks, including one whole xterm copy-policy suite and one root/group CLI help case. Deliberate losses: direct copy-chord admission for platform, selection, Kitty mode, defaultPrevented, logical/physical key and key phase; command-group disclosure and group help routing including claude-teams early return without RuntimeClient construction. These are real bounded policy/wiring alarms; no replacement or equivalent coverage claimed. Retain14 authored/19finite raw-exact registrations across6 drivers: unsafe CLI refusal, Claude model event carry and disk reconstruction/OSC-first case, attachment ownership/upload lifetime and mixed BMP file-reference/PNG-chip delivery, actual SQLite authority/admission/mutation, and Electron geometry/hit-testing. No runtime, CI, native-key delivery, external provider, mobile, remote, folder or global completion credit. Previous oracle (preserved verbatim): Audit3692 removes5 authored/5finite marginal Codex checks: unrelated login URL without notice; ordinary per-account launch resource/config materialization; no-retained-pane skip; preservation of a previously owed full scan through actual preparation and pending-marker update (no actual history scan/settlement); ordinary later-config refresh. Accept these exact branch/wiring alarms as deliberate losses without replacement. Retain32 authored/34finite raw callbacks/registrations/table bytes exact across14suites, including credential/admission refusal, grace/reset readiness, filesystem ownership, commit-dependent queue state, streaming/host trust, path canonicalization and private-state preservation. All14whole suites challenged without keeper quota; no whole deletion warranted on current concrete signals. No runtime/CI/native WSL/remote/mobile/folder/global completion credit Previous oracle (preserved verbatim): Audit3691 removes two complete runtime-home routing singleton suites (2 authored/2 finite): catalog wrapper mirror login-copy and passive transcript-lookup filesystem noncreation. Exact accepted losses are recorded in knownGaps; no replacement or equivalent coverage claimed. Audit3691: no dedicated alarm remains in the deleted sources for post-launch system login import through prepareHostCodexHomeForReadOnlyAppServer, or for repeated missing-transcript lookups leaving removed Codex account/runtime directories absent and userData entries unchanged. Ownership-marker read avoidance was never independently measured. No real catalog probe, provider, native Windows or crash was validated by those fixtures. Previous oracle (preserved verbatim): Audit3686 current Claude profile/account review removes5 authored/5 finite cases: whole structured-auth diagnostic-label suite3 and Windows-only command suite1 whose advertised cache alarm is ineffective because cache lifetime is per invocation; remove duplicate setup namespace-link refusal1 at wrapper layer. All5 exact historical KEEP are consciously superseded. Retain49 authored/50 finite unchanged, including filesystem privacy/recovery, route identity and concurrency, built worker/helper, legacy WSL alias compatibility and sign-in handoff. These are deliberate coverage losses without replacement. No runtime/CI/native WSL/macOS Keychain, remote/mobile/folder or global completion credit. Explicit accepted real losses: unknown-account host fallback and mixed-version/WSL-only structured auth diagnostic labels; Windows-only sentinel ENOENT-to-friendly-error translation plus fresh-call successful dispatch smoke; setup catch-to-refused wrapper and no-write outcome for a namespace symlink. The command case does not discriminate removal of its per-invocation noncache guard; it still supplies the error-translation alarm, which is intentionally retired. No replacement/equivalence promise. Previous oracle (preserved verbatim): Audit3680 removes eleven authored/eleven finite unit cases across four files, including entire launch setup row projection, structured legacy-model metadata, and legacy classifier suites. Accept loss of exact row partition/start selection, Codex supersession/default/unknown and Claude alias/suffix folding examples, other-agent exemption, getter/cache read budgets, same-array per-agent cache isolation, replaced-catalog metadata, and tracked-only model exclusion from structured and PTY legacy inventories. These are real narrow policy/metadata alarms intentionally retired without equivalent replacements. Retain real menu collapse/reopen in dropdown/select, AI picker cancel/accept and stale-effort filing, IME carry/gesture/frame transitions, and typed-flip versus held-dispatch fencing. No production or shared fixtures change. No dead timing entry exists for the three deleted drivers; retained timing keys stay unchanged. Static source-value review only; no project import, test runner, native/app execution or runtime validation established. Earlier receipts retain historical scope. Previous oracle (preserved verbatim): Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit. Previous oracle (preserved verbatim): Audit3672 renewed by3676 removes four authored/four finite cases from federation-output.test.ts: nominal show/read routing and terminal-fallback projection; initial archive-table SELECT failure returning retained/no-close; simulated old-peer read/fleet/refusal and method inventory; and absent archive-release capability refusing release. These actual compatibility/guard alarms are intentionally lost without equivalent replacement; the dropped-table case never reaches capture or commit. Current selected frontier9 becomes5: retain actual temporary transcript parsing/path omission, current no-transcript release/unavailable-output/restart/replay regression, and three home deadline/stop nonmutation cases. Prior held-capture case was already removed upstream and receives no new removal credit; prior redacted snapshot archive behavior was rewritten upstream and is not claimed retained here. The surviving driver timing entry stays. Static review/private composition only; no actual peer/network/native/platform or fresh runtime validation. Previous oracle (preserved verbatim): Audit3671 removes14 authored/32 finite root-unit cases, including the whole WSL move-handler refusal suite, WSL preload object-presence suite and internal gate spelling truth table. Also retire the weak withheld-command non-array shape assertion, static serve-only Add/capability/mock-remove example, grammar scope equality and basic configuration/payload schema roundtrips. Genuine wrong-window/malformed-request/gate-before-work, exact gate spellings/platform/argv precedence, static serve-only routing, declaration mismatch and empty grammar/pair admission alarms are consciously lost without replacement; prior KEEP decisions are reconsidered. Seven unchanged authored/finite root-unit cases retain real image/provider/line budgets, live policy transition/capability broadcast, grammar resource/reference traversal and strict-versus-tolerant literal salvage. Source-value evidence only; no runner/compiler/build/app/native/provider/remote/mobile/folder validation or historical fault claim. Previous oracle (preserved verbatim): Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence. Audit3634: Remove five authored/five finite cases, including the complete structured chat terminal-refusal, terminal-plus-agent worker-start validation, and canonical Git common-directory parser suites. Also remove the gh free-text -R argument projection case. Consciously supersede prior KEEP decisions and accept chat-versus-stale redirect classification, real RPC refusal-before-SQLite-Dispatch, old-Git echoed-option relative-path parsing, WSL execution-space resolution, and free-text preservation/bare-repo qualification alarms. These are genuine narrow alarms, intentionally retired without equivalent replacements. Retain real Git stdin/EOF delivery, bound-account host admission, naming environment/account precedence, upload iterator cancellation and remote path confinement. Shared fixtures and production code remain. Remove only the dead canonical-repo-key timing entry. Static source-value evidence only; all prior evidence retains historical scope. Audit3636: Remove the entire maintenance opportunity internal-count driver (one authored/two finite cases), the mocked remote worker start-card argument case (one/one), and the follow-up heading mapping table (one/two). Root-unit discovery loses three authored/five finite cases. Independently remove four Python native screenshot methods/five statically enumerated subTest scenarios: grim argv/stub payload, failure-code mapping, X11 mocked capture payload, and capability flags. The Python lane is verify:computer-native and is not root Vitest. Accept loss of exact native command/projection and exception/capability alarms, ready-only card publication arguments/agent forwarding, and serialized follow-up heading mapping; no equivalent replacement is claimed. Retain actual ownership/mail/queue/reopen transitions, remote lost-response fencing and first-result settlement, filesystem/maintenance admission and successor progress, wrong-region screenshot refusal and Sway geometry. The whole-deleted new driver has no timing key; this component requires no timing cleanup. No production changes. Static source-value review only; no project import, runner, app, native desktop or runtime validation established. All prior evidence retains historical scope. Audit3629 removes two singleton parser suites: WSL Claude plugin metadata out-of-range index rejection and Git checkout unlink-warning path extraction. Their real range-refusal and quoted-path extraction alarms are intentionally lost without replacement; no WSL execution, checkout recovery or equivalent remaining coverage is claimed. Audit3630 removes the sole orphan automation availability test (1 authored/1 finite). Its real policy kind, orphan precondition, delete/toggle enablement and run/edit refusal alarms are intentionally lost. The test did not dispatch an action, enforce a server generation fence or observe a remote mutation. No equivalent replacement, actual renderer/transport execution or new platform/provider evidence is claimed. Previous account (preserved verbatim): Audit3628: remove the entire one-authored/one-finite RepositoryRemoveProjectSection happy-dom suite. Accept losing the local zero-to-one-terminal stale-count revalidation alarm: first confirmation defers the removal callback and second confirmation invokes it after the count snapshot updates. The test never asserts updated warning text/count, actual terminal creation or removal/PTY teardown, host/scope routing, cancellation or folder/mobile behavior. No equivalent replacement or end-to-end warning-before-teardown proof asserted. Static evidence only; historical receipts retain original scope. Audit3624: Remove one authored/five finite positive Gemini identity table from the Claude/Gemini title collision driver. The real normalization, legacy label and explicit title evidence owners execute, so ordinary Gemini marker/name/wrapper recognition and normalized-label composition alarms are consciously retired without equivalent replacement; these five supplied title-to-literal identity examples have low marginal value. Preserve the six-row Claude task-text collision oracle, whose unrelated CLI mentions must not rebrand or destructively normalize titles. The other audited drivers preserve real permission-mode session transitions, prompt secret/fence/bounds defenses, JSON-to-Ask option/preview preservation, and optional GitLab failure summary/trace composition. Root-unit discovery loses one authored/five finite cases; no whole driver or timing key is removed. No actual terminal stream, UI routing, application/native or runtime execution established; all prior evidence retains historical scope. Audit3618: Remove three authored/three finite browser reload cases, including the complete renderer reload-actions suite. Agent bridge fake did-fail-load plus permanently supplied manager error projects description/code into a rejection. Renderer seeded empty metadata projects a saved URL into plain webview src; its earlier not-ready case projects a live-id/throwing fake reload into absence of a loading patch. Real queue/wait/error/cache/classifier/hook code executes, but these narrow supplied-state and exception-to-callback wirings have low marginal value; no rerender, lifecycle, actual cache generation/retirement or guest commit is asserted. Explicitly supersede audit1822 not-ready KEEP and preliminary3617 cross-module retain opinion, accepting offline-reload failure reporting, empty guest to saved URL routing, native-reload bypass and premature-loading/stranded-state alarms without replacement. Retain distinct main cancellation queue progression and absent queued side-effect dispatch. Root-unit discovery loses three/three. No Electron guest, network failure, restored navigation/commit, app/native focus or runtime execution established; earlier evidence retains its historical scope. Audit3614: Remove thirty-one authored/thirty-nine finite potential cases across CLI format and argument drivers, including three whole suites: search-result/status sanitation sites, Linear issue/list/warning sanitation sites, and quote-stripped JSON diagnostic secret non-echo. Those real formatter/guard transformations execute on supplied strings; intentionally retire their field-specific CSI/OSC/C1/newline/bell and diagnostic secrecy alarms as low-value caller/output inventories, without replacement. Also retire twenty-one search registrations/twenty-four finite cases covering minimal positional request/default omission, exhaustive all-flags request projection, nominal named query/index routes, repeated syntax/agent examples, enum/agent/path-count/timestamp/numeric/cursor admission examples, unknown/browser flag examples and postcommand last-wins projections; retire one parser sentinel-only case. Keep actual ambiguity, conflicting index request, precommand/crosscommand scoping, variadic reference parsing and missing-repeatable-value controls, without claiming equivalent coverage. Root-unit discovery loses all twenty-nine/thirty-seven. No CLI/RPC/terminal/PowerShell/host/schema/runtime execution is established by this source-only audit; earlier evidence retains its historical scope. Audit3613: remove six authored/six finite callbacks, including whole reviewer-display oversize-input and explorer-root record-filter suites, plus plugin family-emoji/invisible-only-name and pool legacy-name/urgent-countdown samples. Accept losing oversized-input empty-result/no-split, malformed-record/prototype-sensitive-key/nonstring filtering, exact ZWJ family preservation, invisible-only name refusal, no-group old-host full-name preservation, and80/79/null-reset countdown composition alarms. No equivalent replacement asserted. Retained strict/runtime sanitization, SVG parser, mobile focus recovery and collision/tie cases have different scopes. Static evidence only; historical receipts retain original scope. Audit3609: Remove the complete pnpm CLI invocation literal-selection suite (eleven authored/nineteen finite potential cases), with no replacement claimed. Root-unit discovery loses JavaScript-versus-native command selection, npm/npx executable rejection, Windows cmd/bat casing and shell selection, non-Windows cmd behavior, native PNPM_HOME flat/bin preference, explicit-path priority, relative-home rejection, missing-native fallback and non-Windows home-probe refusal alarms. The suite called the real resolver with independently expected objects, but exercised no pnpm/node/cmd process, installed native executable or real filesystem probe. Earlier KEEP decisions are consciously superseded by accepting these narrow branch and probe-inventory alarms as low value. Real symlink entry, Git signing isolation, Bun filesystem/Node child normalization and compiler scheduling/continuation tests remain distinct tests, not equivalent coverage. No runner, compiler, app, platform or remote execution was performed in this source-only audit. Earlier evidence retains its historical scope. Audit3608: remove five authored/five finite callbacks, including whole owner-slug and remote favicon URL suites and two repository-label projections. Lose five owner acceptance samples, eleven negative owner samples plus nonstring refusal, six host-local icon refusal samples, legacy-SSH same-path label-map cardinality, and explicit runtime ownership over stale legacy metadata at label level. These are accepted narrow grammar/presentation alarms with no equivalent replacement claimed. Retained binary parser, React recovery and label grouping/platform cases do not replace these losses. Static evidence only; historical receipts retain their original scope. Audit3606 adopts the enhanced3604/3605 icon cuts: nine authored/nine finite cases removed, including the whole tray-attention-icon suite. Retires the no-encoder oversized-upload null sample, missing-ID/request-order sample, encoder-null PNG-prefix fallback, SVG/404 rejection samples, transparent amber-dot placement and half-alpha white-tint sample, exact small fetched-byte passthrough, host-qualified image-key inventory and constant-encoder large-upload projection. These specific admission, formatting and bitmap alarms are intentionally lost without equivalent replacements. Retained queue/cache, bounded fetch and Dock lifecycle checks do not establish actual raster decoding, native image conversion or rendered appearance. Historical receipts below are preserved evidence for earlier test sets, not fresh validation of this reduced selection. Audit3601 scope: remove the whole custom-sound happy-path IPC suite and one custom-label/multiline notification formatting example (2 authored/2 finite). Intentionally lose configured .ogg selection, exact byte/MIME success wiring, successful dispatch for the formatting fixture, custom-label whitespace/title normalization and assistant-body whitespace/180-character-cap alarms. Retain prompt-exclusion, persisted qualified dismissal/restart, theme ownership/restore and Ghostty precedence/collision cases; none replaces the retired sound/formatting alarms. No actual playback, native delivery, phone/network, cross-platform or new runtime evidence is claimed; historical execution keeps its original scope. Audit3598: Remove seven authored/nine finite literal-table potential test registrations across workflow routing, Claude cold-start and real-zsh preexec drivers. Root-unit discovery loses six authored/six finite: three test-local workflow parser fixtures, the five-positive/three-negative explicit command-paint route inventory, a boot-banner-before-composer sample and an already-painted bare-title positive sample. The separately selected shell_contracts live-shell driver loses one authored/three finite raw-capture paint-only cases across three hook configurations; its real-wrapper launch-order, four rechunkings (twelve finite) and runtime-wait replay remain, without claiming equivalent replacement. Intentionally lose those parser, exact routing-list, banner, post-paint subscription and native-read-boundary paint alarms. Retained workflow/UNIT_EXCLUDE/classifier cross-source routing checks and readiness-race-to-writer timing are distinct bounded alarms. No runner, real shell, PTY, app, native focus, remote delivery, cross-platform execution or full-feature correctness is established by this source-only audit. Earlier evidence retains its historical scope. Audit3597 scope: remove two renderer-hang-capture examples (2 authored/2 finite): an invalid repeated-token oversized reducer fixture and a shorter unanswered-request fixture. Intentionally lose the direct truncated flag/sanitized frame fixture and request-pending status/zero-sample alarms. Retain window-death/stale-result exclusion, generation reconciliation, and baseline-publication cancellation lifecycles; they are not equivalent bound, redaction or pending-status replacements. Historical execution retains its original source scope; no new runtime evidence is claimed. Audit3591: Retire the whole one-case background journal-producer attribution suite and the fabricated malformed-details-block case (two authored/two finite cases). Intentionally lose the fixed own-task versus output/foreign-task attribution examples across flat/message row shapes, missing-root classification, and direct unbalanced/detailsish fabricated-block rejection alarms. Retained parser sibling/depth and editor navigation tests do not replace these alarms. No equivalent replacement or fresh runtime, transport, persistence, native focus or rendered UI validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3592: Retire the whole three-case shared agent smart-key resolver suite, explicitly superseding its Audit3238/3237 keep decisions. Intentionally lose literal permission-versus-question classification, longest-question digit selection, Codex async-question opener/digit/Enter/skip mapping, and unsupported-agent/state/prompt refusal examples. These were real parser/selection and literal-byte alarms; they did not exercise terminal delivery or timing. No equivalent replacement or fresh runtime, native TUI, mobile, remote or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3587/3588: Retire six authored/fourteen finite cases, including the whole WSL stopped-notice and connecting-status selector suites. Intentionally lose direct WSL retry connection field/target/ready-epoch/null-guard examples, connecting/reconnecting distro and absent-state selector samples, and stopped/connecting notice text/button/data-attribute examples. Retained host-ready retry and content-loader/reload lifecycles do not replace these alarms. No equivalent replacement or fresh runtime, native WSL, remote, rendered UI or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed. Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions. Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Module layout SSH policy: Retire the multiplexer private-clock saturation registration, the writer saturation transition-count registration and the changed-source dated writer/backpressure receipt. Retained byte delivery, lane order, fairness, settlement and cancellation cases are unvalidated by that historical receipt. No equivalent replacement, new execution, measured performance, live SSH/WSL or cross-platform proof is claimed. The unchanged WSL protocol receipt retains only its original command scope. Historical prior account (preserved verbatim): Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/ssh/ssh-multiplexer-transport-writer.test.ts: reports saturated epochs and their drain boundary exactly once. src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/main/ssh/ssh-multiplexer-transport-writer.test.ts remains historical and is not a passing result for the reduced current command. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete tail-wait memo suite: its sole current authored callback checks supplied fromTail/blocked field values. Retire all three broader memoization/equivalence/eviction assertion aliases; they are not backed by retained source callbacks. No scan-work budget, sustained output, physical terminal or resource measurement is assigned to this removed test. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1674 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The current executable slice injects main-process renderer backlog pressure, then asserts ordinary terminal-wait detection without a joined-tail allocation and with full prompt-family continuity, per-PTY and total pending-output caps, a 1,024-ID projection cap with split-remainder compaction, preserved sequenced-tail metadata, active-pending protection ahead of background trimming, exact provider-generation pause ownership, renderer exit/data ordering, and ACK-gated in-flight bounds. The negotiation seam proves every initial connection and reconnect offers V1, the same-build relay advertises V1 without launch flags, old clients remain token-free, and method-not-found peers fall back without installing source ACK publication. The joined source-intake/multiplex oracle blocks renderer or headless serialization, admits one snapshot-covered span and one trailing span, requires replacement reservation only after the authoritative sequence is known, advances upstream ACK eligibility exactly to the covered boundary after SnapshotEnd, and delivers then ACKs the trailing span through the ordinary live path without cancellation. Source-range ledger and multiplex seams additionally require cumulative byte ACK 40 then 100 for one 100-byte frame to release exact byte credit without early source settlement, admit a contiguous higher-generation recovered token while the prior token remains unsettled, and reject stale stream or source generations without releasing in-flight byte credit. Replacement reservation rolls back every earlier span on a later failure, commit requires the exact frozen transfer states, and an authoritatively reclaimed covered span rejects commit without local trim authority while rollback removes the reservation idempotently. The exit-deadline oracle publishes a source-backed desktop projection, advances a fake clock to cancellation, and requires one projection transfer, proof commit, preparation, and final exit with no provider close, retained obligation, duplicate finalization, or process-lifetime cancellation tombstone; a second controlled proof remains pending across generation close and must never publish final exit, while both paths release the renderer preparation lease exactly once. The model-migration oracle accepts span A, blocks span B's raw emulator completion, begins disconnect migration, and proves no checkpoint or reconnect attach can remain at A; releasing B advances the exact checkpoint to B and projects B once. Its fake-clock arm reaches the 10-second deadline, requires checkpoint-unavailable, one exact model reset, zero retained admission charge and timers, and no effect from late raw settlement. Its two-PTY failure arm rejects one running raw callback under an active exact migration and requires one checkpoint-unavailable result, one model reset, zero provider closes, retained sibling checkpoint and transport liveness, zero charges and timers, and an unaffected other generation; a non-migrating sibling oracle still requires generation close. The intake additionally closes 2,048 sequential provider generations into one exact range, rejects stale events across that range, and preserves an out-of-order live gap until its own close. Direct-SSH contracts additionally prove activation-response settlement before the first source frame, claim-gated projection under same-decoder-turn response/data delivery, exact early-ACK reservation through send settlement or same-token retry, recovery completion visible before lease-held frames transfers those frames only into the private quarantine and admits no output until exact checkpoint-to-recoveryEnd coverage, invalid-checkpoint restore retention through response settlement followed by fresh-token retry and one live source frame, isolated saturated-subscriber eviction with healthy owner liveness, preserved legacy-primary backpressure, one-write ownership across write(false)/drain, control selection ahead of queued ordinary PTY input with FIFO lanes and bounded fairness, liveness rebasing, failed-exit retention through late ACK or exact recovery, response-settlement cancellation authority, token-scoped exit cancellation, exact checkpoint-to-recoveryEnd continuity, stale-owner one-shot retry, no physical PTY teardown on recovery failure, exact provider-generation closure and once-only cleanup when recovery cancellation publication or proof rejects, 16 MiB-plus-1 MiB decoder caps, charged per-PTY/session retention budgets, and eight-wide isolated reattach. The live Electron perf oracle adds hidden-output floods, renderer scheduler queue depth, dropped-output-zero normal scenarios, and active key latency budgets before promotion.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts",
@@ -8983,6 +8956,49 @@
"Keep stress variants non-blocking until stable runtime history exists."
],
"knownGaps": [
+ "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed.",
+ "Audit3814 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle from a Codex ready prompt even when stale startup lines remain :: Stale MCP startup lines must not block a later Codex ready header.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle when a stale Codex prompt is followed by the ready header :: A Codex ready header following a stale resume prompt must satisfy tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for an idle Cursor lane past its dismissed trust dialog (#8210) :: Later Cursor idle banner overrides retained trust dialog.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not block a mid-run Cursor lane on its dismissed trust dialog (#8210) :: Dismissed trust dialog must not report blocked for later busy Cursor; wait times out.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not classify unrelated press-enter prompts as Codex blocked prompts :: Unidentified press-enter text must time out rather than be classified Codex blocked.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for quiet background PTY agents without OSC titles :: Quiet Codex background terminal without OSC title eventually resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: sends agent prompts as bracketed paste before submit :: Driving prompt escapes embedded paste-end ESC, writes one framed paste then CR, and counts bytes.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: settles a foreground Codex prompt when launch metadata has not arrived :: Codex inferred from foreground without launch metadata waits for composer marker/quiescence before one CR.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: gives a late Codex render marker a fresh quiescence window :: Marker arriving at7.9s re-arms fresh quiet window instead of submitting at initial cap.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: writes large agent prompt paste frames atomically before delayed submit :: A prompt larger than input chunk budget is a single paste write before delayed CR with exact byte count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects oversized terminal.send text before provider writes :: Oversized ordinary terminal.send rejects input-too-large before any provider write.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects focusing an exited background terminal session :: focusTerminal refuses terminal_exited before invoking background reveal.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: pastes the same bytes the desktop draft paste sent for the prompt :: Launch-ready prompt normalizes CR/LF and renders embedded ESC visibly identically to desktop bracketed paste.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: keeps a prompt into a running agent behind the render settle, as before :: Driving prompt remains held through7s repaint activity then submits once by9s.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reports a queued PTY focus as not navigated when its notifier disappears :: Queued PTY focus and completed active reveal report not navigated after notifier removal; no second reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: does not invoke a stale graph-leaf focus notifier after queued PTY work :: Queued graph-leaf focus must not invoke old notifier after preceding PTY reveal and notifier removal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: paginates retained terminal output with explicit limits and truncation metadata :: Preview120lines, fractional limits,50/200 pages, retained2000line truncation and future-cursor metadata stay consistent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: falls back to renderer visible screen when uncursored TUI tail is blank :: Substantial blank uncursored tail uses mounted renderer visible screen with zero scrollback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reads and shows the runtime-owned alternate-screen grid without serialization :: Actual runtime alternate-screen grid provides read/show content without renderer/provider serialization.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: classifies older provider alternate-screen snapshots from ANSI :: Older provider without alternateScreen metadata classifies ANSI alternate entry and returns Remote Vim screen.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: honors the last ANSI screen transition when older provider metadata is absent :: Last ANSI alternate exit overrides earlier entry when explicit provider mode metadata is absent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: rejects a full provider screen frame after live output advances :: Live output arriving during second full-screen capture causes screen-unavailable rather than stale full frame.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: shares one provider snapshot between concurrent read and show calls :: Concurrent read/show share one successful provider snapshot and both receive Shared TUI content.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps cursor reads provider-free on restored alternate-screen PTYs :: Restored alternate-screen cursor transcript reads never acquire provider snapshot.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: backs off after a provider snapshot failure instead of retrying for show :: Failed provider capture is cached/backed off so later show does not retry.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: falls back once to a mounted renderer when a known alternate provider fails :: A known-alternate failed provider capture falls back exactly once to newly mounted renderer.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: bounds provider visible frames for read and show responses :: Provider visible read/show use six bounded lines and300character preview.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps renderer-fallback composer drafts separate from terminal output :: Renderer fallback strips dim composer draft from terminal output and exposes draft separately.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: does not use renderer visible-screen fallback for a short blank shell tail :: Two blank shell lines must not trigger renderer screen fallback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: trims terminal tail character budget without per-line array shifts :: Tail builder trims to256KiB with correct retained suffix and no Array.shift calls.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains ANSI-only status redraws instead of appending every frame :: Repeated erase/redraw replaces preview until newline then publishes one completed cursor row.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains split multi-line ANSI footer redraw state across chunks :: CUU state across chunks retains corrected footer rows and publishes new cursor entries.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not let stale lower rows hide earlier corrected footer rows from cursor reads :: Earlier corrected footer row must not be hidden by stale lower rows in cursor reads.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: bounds completed transcript entries from a single multi-line redraw chunk :: Single redraw chunk bounds completed transcript to2000retained lines and correct oldest/next/latest cursors.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains multi-line ANSI redraws when the last footer row stays partial :: Partial final redrawn row appears in preview but cursor sees it only after newline.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not retain split ANSI controls as visible terminal preview text :: Split color/mode escapes never leak preview fragments; long split OSC title truncates at MAX_OSC_TITLE_CHARS.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains same-line redraw cursor position across split full-line erase chunks :: Full-line erase preserves column across chunks so XY follows three spaces rather than old ABC.\nsrc/main/runtime/orca-runtime-tests/conpty-stream-read.spec.ts :: fills the requested line count even when blank rows sit below the prompt :: Blank rows below a ConPTY prompt must not consume the requested nonempty-line count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: does not retain split ST-terminated string controls as preview text :: Split ST-terminated Kitty/string controls must remain excluded from preview text.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects split OSC titles before retaining terminal previews :: Split BEL OSC title must update working title/status without leaking into preview.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects ST-terminated OSC titles split before the final backslash :: ST OSC split before final backslash must update title without leaking framing.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: preserves a trailing escape after a completed OSC title :: Completed OSC followed by pending ESC must preserve the next idle-title transition.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: seeds newly synced leaves from PTY pending ANSI state :: A newly synced graph leaf inherits pending ANSI so a split color fragment cannot leak.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: bounds retained partial terminal output before preview reads :: Partial terminal state stays capped at 4000, preserves retained array identity, and preview truncation/cursor output remains correct.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: submits the mail pointer to Cursor Agent only after the paste-burst delay :: Cursor mailbox pointer Enter must wait through the paste-burst delay; this is a real input-timing alarm intentionally retired.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts :: adopts a v1.4.150-shaped agent, setup, and shell orphan as one topology transaction :: Stale incarnation refuses without topology change; three agent/setup/shell lanes adopt atomically with layout/group/revision and preserved read/input/resize; exact replay is idempotent and competing owner refuses.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: retires the exact worker when it exits after renderer reveal :: Exact worker exit after reveal retires that worker and its surface.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: re-reveals a recovered worker after the renderer graph epoch changes :: Changed renderer graph epoch invalidates reveal receipt and forces another reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: defers recovery when the renderer omits the exact reveal identity :: Missing exact reveal identity defers recovery after two attempts.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: reconciles a same-id process replacement before headless adoption :: A process replacement before headless adoption must fence off stale ownership.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retires provider resume only after authoritative inventory proves the legacy PTY exited :: Authoritative owning-host inventory overrides false local hasPty, avoids SSH scanning, retires exited provider resume/surface, adopts live workers without headless reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retries inventory and unknown liveness without revealing a ghost worker :: Inventory failure and unknown liveness must retry without ghost reveal, eventually adopt, and stop retrying.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: refuses a live reserved pane before issuing a handle or revealing it :: A requireFreshPane launch receiving a live reserved owner must reject before handle/reveal/kill, and release its claim. No equivalent replacement claimed.",
+ "Audit3806 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: skips a listener unsubscribed mid-fan-out even with mobile exclusions active :: A listener removed by an earlier listener during one fanout is not called, including with a side-effect-excluded mobile listener present.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: retains bytes emitted before a fresh daemon spawn resolves :: Bytes and title arriving before an initial zero/reset provider response survive in the serialized headless buffer with their counted sequence.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits command-finished facts with best-effort exit codes across chunk splits :: A split OSC133 D exit code becomes130 and a missing code becomes null in ordered command-finished facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits pr-link facts once per URL with batch attribution :: A split GitHub PR URL yields42 rather than4, emits42/43 once each, and carries PTY/worktree/tab attribution.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits 2031-subscribe facts across chunk splits :: Split ESC[?20 then31h emits exactly one2031-subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: restores a provisional 2031 subscribe when daemon scan authority returns :: Returning daemon scan authority with partial scan seed and pending2031 subscription restores exactly one subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers the tracked title over the renderer snapshot lastTitle :: A synthetic live Cursor title overrides stale renderer lastTitle while preserving renderer snapshot source.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers provider history over a partial headless mirror for requested snapshots :: Authoritative requested snapshots return supplied provider frame/history/seq rather than a partial headless mirror, requesting5000rows.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: tracks live alternate-screen transitions after a provider snapshot :: Provider alternateScreen true is accepted, then live1049l/1049h update isTerminalAlternateScreen false/true.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: translates reset provider snapshots without retaining the old title :: A reset provider snapshot translates new local seq into the runtime domain and replaces Old process title with New process.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits the chunk agentStatus events before its side-effect batch :: Agent status callback precedes side-effect batch callback for one coalesced OSC9999/title/bell chunk.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: still emits a throwing chunk’s facts under its own seq, not the next chunk’s :: A tracker throw still flushes first chunk title facts under its own seq, and second chunk does not inherit those facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: seeds the lazily created tracker from the daemon-snapshot title :: A lazy tracker hydrated from renderer snapshot title Codex working emits agent-idle on later Codex done.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits command-code-working facts only after the banner arms the scrape :: Unarmed Thinking text emits no facts; a Command Code0.27.3 banner then hardcoded colored spinner text emits attributed command-code-working with the submitted prompt.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits a command-code-done fact when the idle composer returns :: After hardcoded banner/working text, returned idle composer emits command-code-done with the earlier submitted prompt.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: resizes the headless mirror after an accepted desktop PTY resize :: An external accepted resize produces the resized dimensions and same status-frame lines as a separately driven reference emulator.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: replaces suffix-only headless state with the recovered renderer snapshot :: Replacing suffix-only state removes old suffix, retains renderer history plus later output/cwd, and returns the live47x40PTY grid.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: stamps SSH connection identity on runtime terminal status :: A synthetic mounted-leaf OSC9999 status after registerPty carries the supplied SSH connectionId.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: does not retain WSL context when a PTY id is reused :: After exit and same-ID new null distro context, OSC7 file://server/share/repo uses UNC server path rather than old Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: preserves immutable context while a live daemon attach is unresolved :: preparePtyExecutionContext with preserveExisting refuses a supplied Debian replacement and subsequent OSC7 keeps original Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts :: projects frame-independent live state through main buffer snapshots :: Main-buffer snapshot puts focus-report/cursor-visibility modes in frameRestoreAnsi, excludes STATIC-FRAME there and includes it in data.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts :: continues terminal agent status fanout when a callback throws :: Throwing on the first status callback does not prevent second payload delivery and logs contextual error.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: returns a title-only replay snapshot and never historical attention :: Lose replay:true/title-only fact projection despite earlierbell and unknownPTYnull. No actual delivered-history notification or reattach behavior was exercised. No equivalent replacement claimed.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects a handle rebind while a controller-less status check yields :: A handle rebound while the null-controller status continuation yields must throw terminal_handle_stale.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects confirmation evidence when the owning PTY exits :: A pending strong confirmation resolving after owning PTY exit must reject terminal_exited.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts :: keeps ordinary terminal send suffix failures on the existing not-writable contract :: Ordinary send writes text but refused CR must throw terminal_not_writable with beforeWrite twice and afterWrite once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell the execution host cannot apply instead of spawning its default :: Requested Windows shell on POSIX must refuse before spawning a default shell.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: quotes the agent startup command for the requested shell, not the host default :: Requested cmd shell must override PowerShell default quoting for agent startup command.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: keeps restored receipts outside a targeted worktree scan :: Targeted scan removes the moved-worktree receipt while preserving another worktree receipt.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: observes setup command completion without waiting for its interactive shell to exit :: Nonzero completion marker 17 resolves while interactive shell remains running.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: falls back to setup terminal exit when no completion signal is available :: Setup completion observer without token falls back to actual exit code 9.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: cancels setup completion observation when the caller aborts :: Abort rejects with the original reason and unsubscribes once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps observing after an uncertain setup terminal status :: Unknown exit waiter result must leave observation pending until completion marker arrives.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh omits a record :: Controller inventory omission disconnects the record but preserves its retained transcript.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh times out :: Hung inventory timeout leaves connected record and retained transcript intact.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle for adopted background PTY handles from the renderer title :: An adopted background handle resolves tui-idle from ready Codex renderer title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves live-leaf tui-idle from an OpenCode native title :: A live leaf resolves tui-idle from an OpenCode native title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from a Codex ready prompt preview :: A supplied Codex prompt preview resolves tui-idle without an actual agent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from an Antigravity prompt before the model line :: A supplied Antigravity prompt before model line resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell with no workspace instead of creating a default-shell tab :: Workspace-less explicit shell must reject before renderer default-tab request or spawn. This real guard/wiring alarm is deliberately retired.",
+ "Audit3798 per-case accepted losses:\nsrc/main/runtime/orca-runtime-tests/paired-settings.spec.ts :: awaits navigation-only updates from paired clients (%s) :: Updating only claudeSubagentNavigationEnabled waits for the actual controller call to the supplied pending Claude-view reconcile for both on/off values.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: drops a client page record even when its close command cannot be issued :: A removed workspace loses its runtime client-page record and headless browser projection despite close delivery_required rejection, and emits the asynchronous warning.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: leaves client-hosted pages alone when another host still owns the same worktree id :: Removing runtime:env-b metadata with local ownership leaves the local same-ID client page unchanged and issues no close command.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: marks live bindings again when reopening after a promoted window closes :: A reopened window marks its still-registered live worktree in activeWorktreeIdsOnShutdown after the first promoted window closes.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: preserves live SSH session identities when promoting a headless runtime :: Headless-to-desktop promotion records active worktree, SSH connection and remoteSessionIdsByTabId from the supplied surviving SSH PTY/session.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores a surviving renderer when its reload is cancelled :: A sole ready renderer reload cancelled under its current renderer fence returns true and becomes ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores headless authority when desktop promotion navigation is cancelled :: A cancelled desktop promotion with headless recovery returns false while headless authority remains ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: moves a desktop graph to unavailable when its reload times out :: A ready desktop graph without a headless fallback becomes unavailable at the reload deadline and retains its window/epoch.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: recovers a failed headless promotion and accepts a later renderer generation :: A promotion failure restores ready headless authority; a later valid same-window graph publishes ready desktop authority.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: clears a failed pane recovery so a later reconnect can retry :: After relay_reconnecting rejection, the pending recovery lock clears and the same pane/handle can call createTerminal a second time and return its supplied replacement.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: still preserves a CLI agent leaf when the reloaded renderer has not rebound its PTY :: An empty graph published during renderer reload preserves a preallocated live CLI PTY as one listable terminal before renderer rebind.\nsrc/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts :: keeps a no-incarnation handle across an in-graph pane remint :: Within one graph lifetime an unversioned PTY reminted onto another leaf retains its issued handle and resolves its old exit waiter after onPtyExit.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: matches explicit-id cwd PTYs when the resolved worktree cache is incomplete :: An explicit target absent from a fresh incomplete resolved cache adopts only its cwd PTY, rejects nested cwd PTY and does not rescan Git.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: ignores cwd-only controller PTYs for malformed explicit worktree IDs :: Malformed id:repo-1:: returns no terminals, does not adopt cwd-only controller PTY and avoids Git rescanning.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: refuses an SSH-backed create for mobile/runtime callers instead of creating locally :: Loss of this public unserved SSH create error-class/no-local-add/no-local-list alarm.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: records an app-selected parent workspace as a manual action :: Loss of the local runtime folder-parent manual origin, active-workspace source and explicit confidence projection alarm; no claim that SSH or cleanup coverage replaces it.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: browses runtime server directories before projects are added :: Loss of this public runtime alarm for browse availability before registration, directories-first lexical ordering and native path flavor.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: lists drive roots for a server-root browse :: Loss of the Windows public slash-root drive enumeration smoke and presence of the temporary directory drive.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations-part-02.spec.ts :: creates a missing runtime parent before creating the project directory :: Loss of this runtime createRepo recursive missing-parent/child existence and registered-path alarm.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: preserves selected project %s when a hosted parent is known :: Loss of both parent-selected and origin-selected normal fork-link projection/persisted upstream alarms plus exact single-probe count.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: links a current enterprise remote despite unavailable metadata and a retained %s :: Loss of normal current-enterprise-origin linking with stale automatic GitHub avatar or protected file image, unchanged icon assertion, and serialized project identity under unavailable metadata.",
+ "Audit3788 retires10 authored/11 expanded cases across six changed drivers, including the entire screencast pending-frame-retry and usage-source-cache-streaming suites. Deliberate losses are false-refused last-frame retry/once-only delivery, ordinary stable-pane reattachment, cleared-chat Dispatch completion, terminal-declared chat-caller refusal, at-rest worker liveness projection, nested depth/cap policy, small unsigned6/sealed7 plain-format and verified-bit examples, generic malformed-ISIZE footer refusal examples, and synthetic10k/100k chunk-size/work-count budgets in gzip and general cache I/O. These include real state/disk/RPC outcomes consciously retired for marginal value; retained E2EE-backlog, receipt/custody/uncertain-ack, integrity/migration and staging-cleanup cases are not equivalent replacements. The footer test did not prove early rejection or bounded allocation; staging cleanup did not seed unrelated files. No replacement or fresh native/remote/performance execution is claimed. Earlier raw selectors and dated receipts remain historical.",
+ "Audit3779 retires17 authored/17 expanded registrations across six changed drivers, including the entire shared-Codex-home and prompt-telemetry suites. Accepted losses are shared-home wrapper noninterference/opt-out preservation, mocked metric count/provenance filters, SSH activity labeling/clearing and handover idle timing, VM ownership/capability/status projections and asleep-worktree refusal, a link-only external conversation replay sample, and two narrow input-credit noninterference/expiry examples. Retain the direct exact-tab/single-use input-credit case. These bounded real disk/state/routing alarms are intentionally retired for marginal value without equivalent replacement or fresh execution claims; earlier receipts remain historical.",
+ "Audit3772 retires18 authored/27 expanded cases, including whole Codex service opt-out, RPC capability-parser, creator-provenance, short-ciphertext and readiness-null suites. Accepted losses include service ledger/symlink/mode cleanup, user TOML substring preservation, old-hash cleanup, description pass-through, malformed-file/pending-hash examples, coordinator write/probe counts, capability array bounds, positive creator projections, early short-payload refusal and readiness helper null shape. Two redundant Codex exit-cause rows are also retired; Pi shares their direct-idle path only in this empty-output immediate-exit fixture, and future agent-config drift coverage is lost. Real bounded filesystem/parser/runtime alarms are deliberately retired for marginal value; no equivalent replacements or fresh execution are claimed. Earlier receipts retain their historical scope.",
+ "Audits3754/3755 intentionally remove9 authored/9 finite registrations: the entire one-case usage-source-cache-streaming.test.ts driver and8 cases from the surviving computer-action-validation.test.ts driver. This gate retains an unfiltered root Vitest command; UNIT_INCLUDE admits both source paths. Accepted losses are the real encoder output chunk-size/work-count alarm on repetitive10k/100k ownership payloads through a mocked durable sink, plus CLI diagnostic precedence, fractional window-id rejection, action-call-site window-target exclusivity, plain-text click-count recovery copy, incomplete click/drag targeting, mouse/modifier/direction allowlist samples and inline/stdin text exclusivity. These CLI cases exercise real argument/handler validation before mocked runtime calls; they are deliberately retired for marginal value, not declared tautologies. Retained cache I/O and CLI cases are not equivalent replacements for these alarms. Existing historical raw receipts remain unchanged and do not validate the deleted or reduced drivers. No fresh execution claim is made. Audits3758/3763 intentionally remove9 authored/11 finite registrations from6 changed drivers, including the entire pane-title-notification, window-linear-notices and worktree-card-lifecycle-effects suites. This gate retains an unfiltered root Vitest command admitting these paths. Accepted losses are same-account linked-row success-notice fanout, sidebar-switch channel forwarding, Linear-only notification forwarding/non-terminal-consumer selection/closed-window detach, destroyed-window refusal and first-send-failure suspension through the pane-title adapter, the100-card synthetic focus/poll absence sample, stored-source local folder badge refresh, unobserved-row badge refusal, and immediate reposChanged lineage invalidation. These exercise real owners with controlled ports; they are retired for marginal value, without equivalent replacement claims. The no-badge-work fixture does not seed its title-promised collection-only cache. Preserved historical receipts do not validate deleted or reduced drivers; no fresh execution is claimed. Audit3759 retires the entire one-case Tailwind compiler/scanner smoke. Accept loss of the direct CSS production/test/spec source-exclusion and rescan alarm; no replacement or current execution is claimed.",
+ "Audit3752 independently approves audit3749: retire five authored/five finite watcher-process registrations, retaining18 raw-exact registrations. Accept loss of healthy shared-pool joint recovery, last-pending-failure idle retirement/respawn, late VITEST fallback release, missing-entry fail-closed selection and independent-supervisor fuse locality alarms. These are real bounded host-policy alarms intentionally retired for low marginal value; no equivalent replacement is asserted. Remaining driver selections exercise controlled FakeChild supervisor lifecycle, cancellation, physical-exit fencing, recovery and fuse behavior. This source review supplies no fresh native/process/platform/remote/SSH execution; historical receipts retain original source and selector scopes.",
+ "Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered root Vitest command. Current UNIT_INCLUDE admits the partial push-service, metadata-dialog and two config/scripts browser drivers:10 authored/16 finite removals. Accepted losses: actual retry30s/60s progression and register bucket/refill wiring, explicit seven-day lease arithmetic (its notification lacked seq/epoch and never reached send), equal-name edit latch/save payload, real image/font/meta-refresh/form/popup browser refusal controls, and broad rich-markdown bridge/command/edit-select smoke. Actual production state, callback routing and browser enforcement run in these cases; these alarms are deliberately retired on marginal value. All drivers and selectors survive. Existing unrelated receipts remain historical evidence for their unchanged selectors, not proof of the reduced cases.",
+ "Audit3732 removes 2 authored/3 finite registrations from two partial suites: nominal custom/Kimi local naming success and deferred context usage row presentation. Real losses: custom/Kimi successful extraction through conversation-name sanitization and agentLabel composition; separate ordered counted/deferred lists and exact percentage/token formatting. No replacement or equivalent coverage claimed. Retain 11 authored/13 finite raw-exact registrations for bounded naming instruction/refusal/cancellation, menu dismissal focus ownership and hover/composer Escape/timer cleanup. Source-only bounded value review, no runtime/CI/native/remote/mobile/folder workspace or global completion credit.",
+ "Audit3733 removes2authored/2finite terminal input checks: fixed custom-cap error/secret fixture and three-emoji cap5refusal whose6UTF16units already trip length fast guard (no UTF8-dependent boundary). Accept exact non-disclosure/oversized-refusal alarm losses; no replacement/equivalence claim. Retain13/13scalar/pending input, OSC state and cron DST/cadence outcomes after bounded material reads. Source-only zero runtime/novelty credit; original historical reasons preserved.",
+ "Audit3729 removes1authored/3finite by deleting whole CLI runtime pairing advisory-close suite. Accept losing post-real-close injected EIO preservation of native/script/unreadable pairing, env identity/preservation and exact close/release assertions; no actual failed-close leak or replacement coverage claimed. Two retained URL grammar/identity suites11authored16finite raw unchanged. Bounded source/owner/caller value review, zero novelty/runtime credit; other seven3724deferred closures remain. Historical receipts preserve original limits.",
+ "Audit3724 removes3authored/3finite checks by deleting two whole suites: TUI clear burst-size singleton and terminal-file-URL target two-case wrapper suite. Deliberate losses: derived widest burst<64byte alarm, UNC authority+line-column anchor composition, and malformed-percent null refusal. Real production algorithms execute in those tests; no mocked-output tautology, equivalent replacement, actual Claude/file-navigation delivery or universal safety-irrelevance claim. TUI58byte bound and URI examples have low marginal value as standalone suites. Actual1262/1264/1742KEEP superseded explicitly. Remaining14drivers83authored136finite raw unchanged. Bounded source-only review; ten closures deferred, four bounded keep judgments repeated with zero new semantic-frontier credit. No runtime/CI/native/remote/mobile/folder/global completion claim; historical receipts retain original scope.",
+ "Audit3723 removes 4 authored/4 finite registrations in two whole suites: keybinding cache freeze/token spellings and host-dependent Orca command name examples. Real losses include returned-object freeze, repeated Mod+P key, Space/PageDown/NumpadSubtract mapping, unknown/empty/prototype-token rejection, and headless Linux versus Windows-server/WSL command choice. No equivalent or replacement coverage claimed. Retain 12 authored/21 finite raw-exact registrations exercising generated scaffold validation, artifact failures, shipped editor/hook/worker/panel tests, actual generated typing compilation, independent CLI root routing and intent-name precedence. Source-only bounded audit; no runtime, CI, native, remote, mobile, folder workspace or global completion credit.",
+ "Audit3720 removes17authored/23finite checks: whole main catalog-date adapter2 and shared date-helper7, seven renderer nominal ranking/cap/no-date/composition cases, and one browser registration expanding to seven forced-container/DOM-child boundary cases. Deliberate real losses: community oldest-date UTC forwarding, official/undated omission, date sorting/window/invalid/future/skew/clamp and default/override cap; nominal ranking/cap and combined Featured/Newly-added outputs; real CSS459/460,719/720,1055/1056breakpoint, five-card partial-row and720px two-card first-row alarms. Browser cases really measure rendered geometry but force width/remove DOM children; no fake-pixel or tautology rationale. No replacement/equivalent coverage claimed. Retain14authored/19finite raw-exact registrations across4drivers: adversarial featured category/order/tie and installability, date order/window selection, actual PluginManager failure/escaping/duplicate-card suppression, real browser viewport/odd-count geometry/phone catalog visibility, syntax ingress/depth/include/printability and68dlong-bracket auto-close fill-in. No tests/browser/native/UI/provider/remote/mobile/folder/CI/global execution or completion credit.",
+ "Audit3717 removes6 authored/6finite checks in two whole thin-adapter/presentation suites. Deliberate real losses: ordinary recipe repository-URL withholding and provisioned-root credential scrubbing/forwarding; repository label lockstep suffix expansion, host-scoped map identity/collision grouping, Windows crosshost paths and WSL distro suffixes. Actual provision options, label/sort consumers and host/scrubber delegates inspected; no replacement/equivalence claim. Retain40 authored/84finite registrations raw exact in14 drivers with bounded owner/context review. Prior KEEP superseded for removed suites; no runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit.",
+ "Audit3714 removes8 authored/39finite checks: whole CLI selector-recovery, task display-text and ANSI grammar suites plus two name joiner/blank tables. Deliberate real losses: selector flag/value/identity and mutation recovery merge/serialization; exact task suffix, transcript fallback, input immutability, cache reuse and edited blocks; independent failed-escape/resumption and OSC/DCS/BEL/ST/C1/nested/unfinished stripping outputs; meaningful-language joiner preservation and invisible/blank-name rejection. These are real bounded alarms, removed as narrow supplied-error examples, helper/token inventories and repeated internal-work fixtures. Prior2936,1195/1196,1214/1215 and1082 KEEP superseded; no replacement or equivalent coverage claimed. Keep9authored/9finite raw-exact registrations in5surviving drivers: screenshot export/failure filesystem behavior, CLI local tree query, event-local reply provenance, vault role-sensitive content and four hostile/UTF16/dangling/tag-name regressions. No native/UI/provider/remote/mobile/folder/runtime/CI/global completion credit.",
+ "Audit3711 retires2authored/4finite cases by deleting whole clipboard-image-temp-file signature-to-name inventory (HEIC/TIFF/unrecognised bytes) and workspace-last-active switch-on supplied visit/reason singleton, plus its now-orphan test fixture. This intentionally loses real generated-filename suffix/extensionless alarms and real newer-visit archived7day versus inactive30day filtering/older-visit identity alarms. Filesystem writing and production reason pruning really execute; no equivalent replacement or universal absence of safety relevance is claimed. The clipboard test does not inspect written bytes, native delivery or decode; the visit test supplies candidate/timestamps and does not exercise persisted visit routing or actual removal.20authored/20finite cases remain unchanged across4bounded Git/sidecar/removal drivers. No new runner/test/module evaluation or runtime result; historical notes and receipts remain historical.",
+ "Audit3707 removes10 authored/11finite checks: three whole renderer adapter/assembled-stage suites and two native projection cases. Deliberate losses: plugin URL/ref/default-version/local-path and unsafe credential refusal forwarding; real Task hook/store A→B→A late-save/list/count fences, owner disappearance, legacy-host convergence, query/history/eviction and same-ID host history; native child append ordered-ID/replacement and compound fallback/order/optimistic-admission/child-turn/duplicate/shrink/revision alarms. These are real bounded alarms; removal follows thin adapter, manually assembled Task pipeline and repetitive fixture value judgment, with no replacement or equivalent coverage claim. Prior1179/1182,1220/1221 and1885 KEEP superseded as applicable. Keep36 authored/38finite registrations raw exact across13 surviving drivers. No runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit.",
+ "Audit3706 removes7authored/7potential cases from3renderer sources: whole usage-label3case and130000-distinct-day usage-overview singleton suites, plus3SSH grouping/ordinary-range examples. Retain11authored/11potential cases across6drivers in this bounded selection; no equivalent replacement or fresh runtime result. Existing bare root-unit commands admit this selection statically; prior command/receipt strings remain historical. Audit3706 intentionally retires first/second-order usage-group label collision alarms; equal50%-weekly bucket versus derived-weekly selection identity and Gemini wk label alarm;130000distinct-day aggregation no-spread-crash/max/intensity alarm; legacy absent-source SSH grouping and ordinary reverse-select/selected-target deselect range alarms. Actual label ambiguity and pathological-input crash are accepted losses. Distinct-day fixture spans~356years; no hard producer/date bound is claimed. Retained filtered-anchor/grouped-order guards do not replace removed deselection/reverse-range/legacy-group coverage. No native SSH, mounted renderer, live provider, remote/folder/mobile end-to-end or current runtime pass was obtained.",
+ "Audit3699 removes4 authored/4finite checks, including one whole xterm copy-policy suite and one root/group CLI help case. Deliberate losses: direct copy-chord admission for platform, selection, Kitty mode, defaultPrevented, logical/physical key and key phase; command-group disclosure and group help routing including claude-teams early return without RuntimeClient construction. These are real bounded policy/wiring alarms; no replacement or equivalent coverage claimed. Retain14 authored/19finite raw-exact registrations across6 drivers: unsafe CLI refusal, Claude model event carry and disk reconstruction/OSC-first case, attachment ownership/upload lifetime and mixed BMP file-reference/PNG-chip delivery, actual SQLite authority/admission/mutation, and Electron geometry/hit-testing. No runtime, CI, native-key delivery, external provider, mobile, remote, folder or global completion credit.",
+ "Audit3692 removes5 authored/5finite marginal Codex checks: unrelated login URL without notice; ordinary per-account launch resource/config materialization; no-retained-pane skip; preservation of a previously owed full scan through actual preparation and pending-marker update (no actual history scan/settlement); ordinary later-config refresh. Accept these exact branch/wiring alarms as deliberate losses without replacement. Retain32 authored/34finite raw callbacks/registrations/table bytes exact across14suites, including credential/admission refusal, grace/reset readiness, filesystem ownership, commit-dependent queue state, streaming/host trust, path canonicalization and private-state preservation. All14whole suites challenged without keeper quota; no whole deletion warranted on current concrete signals. No runtime/CI/native WSL/remote/mobile/folder/global completion credit",
+ "Audit3691 removes two complete runtime-home routing singleton suites (2 authored/2 finite): catalog wrapper mirror login-copy and passive transcript-lookup filesystem noncreation. Exact accepted losses are recorded in knownGaps; no replacement or equivalent coverage claimed. Audit3691: no dedicated alarm remains in the deleted sources for post-launch system login import through prepareHostCodexHomeForReadOnlyAppServer, or for repeated missing-transcript lookups leaving removed Codex account/runtime directories absent and userData entries unchanged. Ownership-marker read avoidance was never independently measured. No real catalog probe, provider, native Windows or crash was validated by those fixtures.",
+ "Audit3686 current Claude profile/account review removes5 authored/5 finite cases: whole structured-auth diagnostic-label suite3 and Windows-only command suite1 whose advertised cache alarm is ineffective because cache lifetime is per invocation; remove duplicate setup namespace-link refusal1 at wrapper layer. All5 exact historical KEEP are consciously superseded. Retain49 authored/50 finite unchanged, including filesystem privacy/recovery, route identity and concurrency, built worker/helper, legacy WSL alias compatibility and sign-in handoff. These are deliberate coverage losses without replacement. No runtime/CI/native WSL/macOS Keychain, remote/mobile/folder or global completion credit. Explicit accepted real losses: unknown-account host fallback and mixed-version/WSL-only structured auth diagnostic labels; Windows-only sentinel ENOENT-to-friendly-error translation plus fresh-call successful dispatch smoke; setup catch-to-refused wrapper and no-write outcome for a namespace symlink. The command case does not discriminate removal of its per-invocation noncache guard; it still supplies the error-translation alarm, which is intentionally retired. No replacement/equivalence promise.",
+ "Audit3680 removes eleven authored/eleven finite unit cases across four files, including entire launch setup row projection, structured legacy-model metadata, and legacy classifier suites. Accept loss of exact row partition/start selection, Codex supersession/default/unknown and Claude alias/suffix folding examples, other-agent exemption, getter/cache read budgets, same-array per-agent cache isolation, replaced-catalog metadata, and tracked-only model exclusion from structured and PTY legacy inventories. These are real narrow policy/metadata alarms intentionally retired without equivalent replacements. Retain real menu collapse/reopen in dropdown/select, AI picker cancel/accept and stale-effort filing, IME carry/gesture/frame transitions, and typed-flip versus held-dispatch fencing. No production or shared fixtures change. No dead timing entry exists for the three deleted drivers; retained timing keys stay unchanged. Static source-value review only; no project import, test runner, native/app execution or runtime validation established. Earlier receipts retain historical scope.",
+ "Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit.",
+ "Audit3672 renewed by3676 removes four authored/four finite cases from federation-output.test.ts: nominal show/read routing and terminal-fallback projection; initial archive-table SELECT failure returning retained/no-close; simulated old-peer read/fleet/refusal and method inventory; and absent archive-release capability refusing release. These actual compatibility/guard alarms are intentionally lost without equivalent replacement; the dropped-table case never reaches capture or commit. Current selected frontier9 becomes5: retain actual temporary transcript parsing/path omission, current no-transcript release/unavailable-output/restart/replay regression, and three home deadline/stop nonmutation cases. Prior held-capture case was already removed upstream and receives no new removal credit; prior redacted snapshot archive behavior was rewritten upstream and is not claimed retained here. The surviving driver timing entry stays. Static review/private composition only; no actual peer/network/native/platform or fresh runtime validation.",
+ "Audit3671 removes14 authored/32 finite root-unit cases, including the whole WSL move-handler refusal suite, WSL preload object-presence suite and internal gate spelling truth table. Also retire the weak withheld-command non-array shape assertion, static serve-only Add/capability/mock-remove example, grammar scope equality and basic configuration/payload schema roundtrips. Genuine wrong-window/malformed-request/gate-before-work, exact gate spellings/platform/argv precedence, static serve-only routing, declaration mismatch and empty grammar/pair admission alarms are consciously lost without replacement; prior KEEP decisions are reconsidered. Seven unchanged authored/finite root-unit cases retain real image/provider/line budgets, live policy transition/capability broadcast, grammar resource/reference traversal and strict-versus-tolerant literal salvage. Source-value evidence only; no runner/compiler/build/app/native/provider/remote/mobile/folder validation or historical fault claim. Independently remove one authored/finite Playwright closed-gate app-boot inventory: accept loss of real renderer/preload/main refusal composition, saved-host row and Add/Move hiding/Remove visibility alarms. Keep the unchanged scripted-move rendered dialog lifecycle/reload case. It runs no real WSL migration, host connection, file copy or automation restoration. No selector or Playwright participation cleanup is required because the spec remains.",
+ "Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence.",
+ "Audit3634: Remove five authored/five finite cases, including the complete structured chat terminal-refusal, terminal-plus-agent worker-start validation, and canonical Git common-directory parser suites. Also remove the gh free-text -R argument projection case. Consciously supersede prior KEEP decisions and accept chat-versus-stale redirect classification, real RPC refusal-before-SQLite-Dispatch, old-Git echoed-option relative-path parsing, WSL execution-space resolution, and free-text preservation/bare-repo qualification alarms. These are genuine narrow alarms, intentionally retired without equivalent replacements. Retain real Git stdin/EOF delivery, bound-account host admission, naming environment/account precedence, upload iterator cancellation and remote path confinement. Shared fixtures and production code remain. Remove only the dead canonical-repo-key timing entry. Static source-value evidence only; all prior evidence retains historical scope.",
+ "Audit3636: Remove the entire maintenance opportunity internal-count driver (one authored/two finite cases), the mocked remote worker start-card argument case (one/one), and the follow-up heading mapping table (one/two). Root-unit discovery loses three authored/five finite cases. Independently remove four Python native screenshot methods/five statically enumerated subTest scenarios: grim argv/stub payload, failure-code mapping, X11 mocked capture payload, and capability flags. The Python lane is verify:computer-native and is not root Vitest. Accept loss of exact native command/projection and exception/capability alarms, ready-only card publication arguments/agent forwarding, and serialized follow-up heading mapping; no equivalent replacement is claimed. Retain actual ownership/mail/queue/reopen transitions, remote lost-response fencing and first-result settlement, filesystem/maintenance admission and successor progress, wrong-region screenshot refusal and Sway geometry. The whole-deleted new driver has no timing key; this component requires no timing cleanup. No production changes. Static source-value review only; no project import, runner, app, native desktop or runtime validation established. All prior evidence retains historical scope.",
+ "Audit3630 removed orphan delete/toggle capability/precondition and run/edit refusal assertions. Real dispatch, mutation fencing, mixed-version and host outcomes are not established by this removal or by a substitute test.",
+ "Audit3624: Remove one authored/five finite positive Gemini identity table from the Claude/Gemini title collision driver. The real normalization, legacy label and explicit title evidence owners execute, so ordinary Gemini marker/name/wrapper recognition and normalized-label composition alarms are consciously retired without equivalent replacement; these five supplied title-to-literal identity examples have low marginal value. Preserve the six-row Claude task-text collision oracle, whose unrelated CLI mentions must not rebrand or destructively normalize titles. The other audited drivers preserve real permission-mode session transitions, prompt secret/fence/bounds defenses, JSON-to-Ask option/preview preservation, and optional GitLab failure summary/trace composition. Root-unit discovery loses one authored/five finite cases; no whole driver or timing key is removed. No actual terminal stream, UI routing, application/native or runtime execution established; all prior evidence retains historical scope.",
+ "Audit3618: Remove three authored/three finite browser reload cases, including the complete renderer reload-actions suite. Agent bridge fake did-fail-load plus permanently supplied manager error projects description/code into a rejection. Renderer seeded empty metadata projects a saved URL into plain webview src; its earlier not-ready case projects a live-id/throwing fake reload into absence of a loading patch. Real queue/wait/error/cache/classifier/hook code executes, but these narrow supplied-state and exception-to-callback wirings have low marginal value; no rerender, lifecycle, actual cache generation/retirement or guest commit is asserted. Explicitly supersede audit1822 not-ready KEEP and preliminary3617 cross-module retain opinion, accepting offline-reload failure reporting, empty guest to saved URL routing, native-reload bypass and premature-loading/stranded-state alarms without replacement. Retain distinct main cancellation queue progression and absent queued side-effect dispatch. Root-unit discovery loses three/three. No Electron guest, network failure, restored navigation/commit, app/native focus or runtime execution established; earlier evidence retains its historical scope.",
+ "Audit3614: Remove thirty-one authored/thirty-nine finite potential cases across CLI format and argument drivers, including three whole suites: search-result/status sanitation sites, Linear issue/list/warning sanitation sites, and quote-stripped JSON diagnostic secret non-echo. Those real formatter/guard transformations execute on supplied strings; intentionally retire their field-specific CSI/OSC/C1/newline/bell and diagnostic secrecy alarms as low-value caller/output inventories, without replacement. Also retire twenty-one search registrations/twenty-four finite cases covering minimal positional request/default omission, exhaustive all-flags request projection, nominal named query/index routes, repeated syntax/agent examples, enum/agent/path-count/timestamp/numeric/cursor admission examples, unknown/browser flag examples and postcommand last-wins projections; retire one parser sentinel-only case. Keep actual ambiguity, conflicting index request, precommand/crosscommand scoping, variadic reference parsing and missing-repeatable-value controls, without claiming equivalent coverage. Root-unit discovery loses all twenty-nine/thirty-seven. No CLI/RPC/terminal/PowerShell/host/schema/runtime execution is established by this source-only audit; earlier evidence retains its historical scope.",
+ "Audit3609: Remove the complete pnpm CLI invocation literal-selection suite (eleven authored/nineteen finite potential cases), with no replacement claimed. Root-unit discovery loses JavaScript-versus-native command selection, npm/npx executable rejection, Windows cmd/bat casing and shell selection, non-Windows cmd behavior, native PNPM_HOME flat/bin preference, explicit-path priority, relative-home rejection, missing-native fallback and non-Windows home-probe refusal alarms. The suite called the real resolver with independently expected objects, but exercised no pnpm/node/cmd process, installed native executable or real filesystem probe. Earlier KEEP decisions are consciously superseded by accepting these narrow branch and probe-inventory alarms as low value. Real symlink entry, Git signing isolation, Bun filesystem/Node child normalization and compiler scheduling/continuation tests remain distinct tests, not equivalent coverage. No runner, compiler, app, platform or remote execution was performed in this source-only audit. Earlier evidence retains its historical scope.",
+ "Audit3598: Remove seven authored/nine finite literal-table potential test registrations across workflow routing, Claude cold-start and real-zsh preexec drivers. Root-unit discovery loses six authored/six finite: three test-local workflow parser fixtures, the five-positive/three-negative explicit command-paint route inventory, a boot-banner-before-composer sample and an already-painted bare-title positive sample. The separately selected shell_contracts live-shell driver loses one authored/three finite raw-capture paint-only cases across three hook configurations; its real-wrapper launch-order, four rechunkings (twelve finite) and runtime-wait replay remain, without claiming equivalent replacement. Intentionally lose those parser, exact routing-list, banner, post-paint subscription and native-read-boundary paint alarms. Retained workflow/UNIT_EXCLUDE/classifier cross-source routing checks and readiness-race-to-writer timing are distinct bounded alarms. No runner, real shell, PTY, app, native focus, remote delivery, cross-platform execution or full-feature correctness is established by this source-only audit. Earlier evidence retains its historical scope.",
+ "Audit3591: Retire the whole one-case background journal-producer attribution suite and the fabricated malformed-details-block case (two authored/two finite cases). Intentionally lose the fixed own-task versus output/foreign-task attribution examples across flat/message row shapes, missing-root classification, and direct unbalanced/detailsish fabricated-block rejection alarms. Retained parser sibling/depth and editor navigation tests do not replace these alarms. No equivalent replacement or fresh runtime, transport, persistence, native focus or rendered UI validation is claimed. Earlier dated text and evidence retain their historical scopes.",
+ "Audit3592: Retire the whole three-case shared agent smart-key resolver suite, explicitly superseding its Audit3238/3237 keep decisions. Intentionally lose literal permission-versus-question classification, longest-question digit selection, Codex async-question opener/digit/Enter/skip mapping, and unsupported-agent/state/prompt refusal examples. These were real parser/selection and literal-byte alarms; they did not exercise terminal delivery or timing. No equivalent replacement or fresh runtime, native TUI, mobile, remote or performance validation is claimed. Earlier dated text and evidence retain their historical scopes.",
+ "Audit3587/3588: Retire six authored/fourteen finite cases, including the whole WSL stopped-notice and connecting-status selector suites. Intentionally lose direct WSL retry connection field/target/ready-epoch/null-guard examples, connecting/reconnecting distro and absent-state selector samples, and stopped/connecting notice text/button/data-attribute examples. Retained host-ready retry and content-loader/reload lifecycles do not replace these alarms. No equivalent replacement or fresh runtime, native WSL, remote, rendered UI or performance validation is claimed. Earlier dated text and evidence retain their historical scopes.",
+ "Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed.",
+ "Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions.",
"Launch direct-owner cleanup current scope: This gate’s unfiltered unit command now selects a suite reduced by 82 whole registrations / 159 potential table examples in 10 whole test Programs, including 8 registrations / 15 examples from five once-registered create-message factory closures. Lost alarms include frozen first-message/options and legacy-host fallback; distinct actions and redelivery; uncertain/refused/reloaded input custody, Retry and late proof; rich prompt/attachment upload Stop/close and handback; ordinary draft/editor/IME/StrictMode lifetime and accepted topology; provisional fallback tab placement/group/pin/order and rich worktree handoff. Four whole consent/resume-identity cases remain in two Programs; they do not replace these alarms. This entry governs current reduced-unit scope and qualifies any broader implication of unchanged oracle/coverageNotes history. Entire dated evidenceRuns, original commands/currentCommand values, counts/results and existing history retain their original scopes only; no fresh execution, transferred pass, replacement equivalence or prior upstream-removal credit is claimed.",
"Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
"Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/ssh/ssh-channel-multiplexer.test.ts: sends a JSON-RPC request and resolves on response; assigns unique request IDs; sends notifications without expecting a response; dispatches incoming notifications to handler; sends one keepalive frame per cadence tick; drives keepalive sends AND dead-link detection from a single interval; resolves false immediately on a disposed mux; throws on request after dispose; reports isDisposed correctly; clears registered handlers on dispose; does not retain handlers registered after dispose. src/main/persistence/worktree-sort-order-write.test.ts: re-ranks every writable row when a blocked row sits in the requested order. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts: continues skill management after startup recovery fails. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts: uses bounded ownership lookup for direct arrivals while the agent cannot take input; wakes a bound Run waiter when same-Run direct mail arrives; keeps an unowned detached-recipient message in its direct mailbox; uses primary-key lookups for bounded routing updates. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts: remove only literal registration import/call pairs import './orchestration-mailbox-pointer-cli-command.spec'; no additional authored credit. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts: renders the %s CLI command in a mailbox pointer. src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts: sizes a slow high-latency link near twice its bandwidth-delay product; never paces a LAN, even when its client parses slowly; never paces a fast link; returns to legacy windows when the path RTT jumps. src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts: steps down the row ladder when history is over the byte budget; tries the larger first row count, then the usual ladder within the same byte budget. src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts: returns unknown when route inspection fails or emits malformed data; does not inspect routes outside Windows. src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts: is refused to a paired %s client; reports a failed widening instead of advertising an unreachable address. src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts: reports exited only when the owning runtime completes the exit waiter; reports unverifiable when the runtime cannot observe the exit waiter; reports unverifiable when a disconnected PTY resolves with unknown liveness. src/main/runtime/session-graph/headless-runtime-graph.spec.ts: lets a session tab inventory settle on a host no renderer publishes for. src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts: remove only literal registration import/call pairs import { registerHeadlessRuntimeGraphTests } from './headless-runtime-graph.spec', registerHeadlessRuntimeGraphTests(); no additional authored credit. src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts: bumps the stored snapshot version only when the title changes. src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts: keeps the healthy aggregate verification and delayed physical exit behavior; uses a stamped exit for the incarnation that was actually being closed. src/main/runtime/terminal/identity/terminal-identity-probe.test.ts: answers live for a structured worker without touching the PTY graph; answers live for a PTY handle the runtime still holds; runs the full leaf check for a handle with no live PTY; answers not-live for a stale handle; propagates \"could not look\" rather than reporting it as a dead handle. src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts: names the tab in main’s layout through terminal.rename; takes a window-style layout.apply close as already stopped, so the terminal runs on. src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts: retains no lifecycle generation after a spawn/exit cycle. src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts: reads a freshly spawned terminal as used once a user opens its tab, not on a probe; keeps the open mark on the process a user open starts. src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts: from a desktop window that mounts both panes; from a server with no window. src/main/runtime/terminal/surface/workspace-layout-projection.test.ts: carries views for a partition that holds none yet. src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts: releases a signalled exit-waiter when the signal aborts. src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts: selects a local hook status for a local pane. src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts: keeps the footer and the bare caret on screen mid-turn; %s: the screen alone reads ready during %s. src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts: uses per-launch arguments and preserves launch telemetry; attributes a startup agent whose caller named no surface as unknown; launches %s bare for an absent or blank prompt; attributes a %s draft launch named %s as %s; merges an automation's extras over the host defaults; threads worktree-create extras into the startup build; returns an enabled requested agent without detecting; returns the default when nothing was requested; detects instead of using the default when the requested agent is disabled; starts no agent when the default is blank; detects an enabled agent on this host when nothing usable was named; starts no agent when detection finds none. src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts: pastes and submits through composer readiness, never typing raw input; types the follow-up on WSL or SSH-to-Windows once the agent is in front, as before; cleans up the deadline when the composer was already captured; a draft that is not submitted is pasted on the box cursor, as before; takes the box after the grace when the row never comes, whatever repaints; takes the box at the deadline when the grace would outlast the budget; lets a dialog on screen veto a grace; refuses the deadline inside a pending grace while a shell is in front; takes the box at the deadline inside a pending grace with the agent in front; takes the box at the deadline after a refused grace once the agent is in front. src/main/skills/skill-install-transaction.test.ts: installs, previews unchanged bytes, and updates a clean receipt-owned skill; preserves the old version after a %s filesystem failure. src/main/speech/model-manager-download-resume.test.ts: requests the remaining bytes when a clean range response ends before the file total; bounds a server that advances by pathologically tiny segments forever. src/main/ssh/config/ssh-config-parser.test.ts: parses a basic host block; parses multiple host blocks; skips wildcard-only Host entries; skips Host entries with only pattern characters; parses IdentityFile with ~ expansion; parses Windows-style IdentityFile with ~ expansion; parses quoted scalar values like OpenSSH; parses equals-form scalar directives; parses IdentityAgent with ~ expansion; parses IdentitiesOnly; parses GSSAPIAuthentication; keeps the first GSSAPIAuthentication value like OpenSSH; parses ProxyCommand, ProxyUseFdpass, and ProxyJump; ignores comments and blank lines; handles case-insensitive keywords; stops current block on Match directive; returns empty array for empty input; creates one parsed host per concrete alias on a multi-pattern Host line; applies identity agent settings to every concrete alias on a multi-pattern Host line; defaults port to 22 for invalid port values; converts hosts to SshTarget objects; uses host alias as hostname when HostName is missing; skips hosts that are already imported; defaults username to empty string when not specified; carries through identityFile, identityAgent, identitiesOnly, proxyCommand, and jumpHost; carries through gssapiAuthentication; imports duplicate aliases only once and keeps the first concrete host; maps hosts for the picker and flags aliases already in Orca; de-dupes aliases and defaults missing fields; parses hostname, user, port from ssh -G output; collects multiple identity files; parses forwardagent yes; defaults port to 22 when missing; returns empty hostname when missing; returns undefined user when missing; handles empty output; skips lines without spaces; parses proxycommand and filters \"none\"; parses proxyusefdpass yes; parses proxyjump and filters \"none\"; handles ~ expansion in identity file paths; handles Windows-style ~ expansion in identity file paths; parses identityagent with ~ expansion; preserves identityagent none so auth can disable agent fallback; parses identitiesonly yes; parses gssapiauthentication; parses controlmaster options and filters controlpath none. src/main/ssh/config/ssh-known-hosts-source.test.ts: splits the space-separated list ssh -G prints on one line; expands ~ in a reported path; keeps a double-quoted path containing spaces whole; falls back to the default files when ssh -G reported nothing; drops an explicit none without falling back to the defaults; splits both known_hosts lists on one line each; reads StrictHostKeyChecking, including accept-new; reads HostKeyAlias and prefers it for the lookup; reads the non-default port; reports that the lookup came from an alias, so the port is not appended; reports no alias when the dialed host is used; unions the entries of every file; skips a path that is a directory; returns nothing when no file can be read; reports nothing unreadable when every file parses; does not count an empty file as unreadable; prefers HostKeyAlias over the resolved hostname; uses the dialed host, because a resolved hostname can just echo the label; still prefers an explicit HostKeyAlias over the dialed host; falls back to the dialed host when nothing was resolved; is rejoined when the split fragments resolve to nothing; leaves a single unresolvable path alone rather than inventing one; expands the __PROGRAMDATA__ token rather than passing it through as a path; does not rewrite a path that merely BEGINS with the token characters; keeps a drive-letter path with mixed separators intact; splits a spaced Windows home into the fragments the rejoin has to put back. src/main/ssh/config/ssh-known-hosts.test.ts: reads the algorithm from the blob rather than trusting the line; rejects %s; refuses a malformed blob: %s; uses the bare host on the default port; tries the bracketed form first and falls back to bare off-port; matches an exact line; matches case-insensitively; reports a changed key of the same type; reports unknown for %s; matches any host in a comma list; matches the bracketed form on its port; does not apply a bracketed entry to the default port; falls back to a bare line when off-port; never reports a change from the fallback pass; matches a bare literal on the default port; matches a bracketed literal on its port; reports a change for a literal; handles %s; still reports a change for a different key on a revoked host; skips a line carrying an unrecognised marker; does not report a change when only another key type is on file; matches within the same type; accepts CRLF terminators; skips blanks, comments and surrounding whitespace; accepts a hit regardless of which file holds it (%s); never brackets the alias, whatever the port; still brackets an ordinary host on a non-default port; matches a bare alias entry on a non-default port; still accepts the unmodified key field; accepts a hashed entry whose salt is a full SHA1 digest; still accepts the unmutated ssh-keygen -H vector; falls back to the bare host line on a non-default port, as ssh did; refuses a key type it has not seen for a host it knows, as ssh did. src/main/ssh/connection/ssh-connect-config.test.ts: returns undefined when no default keys exist; returns the first existing key file; probes regular and FIDO2 keys in stable default order; keeps a regular default ahead of a malformed FIDO2 default; uses target host/port/username; falls back to resolved config when target fields are empty; keeps imported endpoint fields as the fallback when ssh -G is unavailable; sets readyTimeout to CONNECT_TIMEOUT_MS; sets keepaliveInterval to 15s; enables keyboard-interactive auth so MFA challenges can be answered; uses agent auth when no explicit key and SSH_AUTH_SOCK is set; enables agent forwarding when OpenSSH config requests it and an agent is available; does not enable agent forwarding without a usable agent; resolves IdentityAgent SSH_AUTH_SOCK from the environment; uses the Windows OpenSSH agent pipe when no environment socket is available on Windows; wraps agent auth with IdentityFile filtering when IdentitiesOnly is enabled; applies a manual target IdentitiesOnly setting when ssh -G reports it off; includes unencrypted target.identityFile auth when an agent is available; defers encrypted target.identityFile auth when an agent is available; uses keyFile auth when target.identityFile is set and no agent is available; includes unencrypted resolved identityFile auth when an agent is available; defers a default-path resolved identityFile to the no-agent retry; offers the keyboard-interactive challenge when the agent defers no key; provides fallback key when no agent is available; can force private key inclusion for the post-agent fallback path; falls back to resolved proxyCommand; returns structured jump-host config for target.jumpHost; returns structured jump-host config for resolved proxyJump; returns undefined when no proxy is configured. src/main/ssh/connection/ssh-connection-auth-fallback.test.ts: resolves OpenSSH config using configHost when present; tries ssh-agent before reading an explicit private key; falls back to direct private key auth when agent auth fails; falls back to direct private key auth after too many agent authentication failures; answers bounded keyboard-interactive challenges such as Duo 2FA. src/main/ssh/connection/ssh-connection-store.test.ts: lists picker suppression aliases without consulting re-adoption tombstones; getTarget delegates to store; addTarget generates an id and persists; saves the CLI control switch as given, with no consent stamp; addTarget stamps source as manual by default; addTarget preserves an explicitly provided source; inserts a new config host stamped as ssh-config; asks the parser for all hosts — reconciliation happens in the store; updates an existing config-sourced target when the port changed; refreshes gssapiAuthentication on sync; never overwrites a manual target that owns the alias; does not rewrite an unchanged config-sourced target; returns empty array when nothing changed; tombstones a deleted config-sourced host so re-import skips it; suppresses a deleted manual target from config discovery; re-adding a deleted host reclaims its alias so sync stops suppressing it; editing a target reclaims its alias from the deleted set; records a tombstone when removing any user-facing target; re-adopts orphaned repos when the same host is re-added. src/main/ssh/connection/ssh-connection.test.ts: transitions to connected on successful connect; captures the negotiated SSH server key fingerprint; allows concurrent exec commands for ssh2 transport; removes startup listeners after ssh2 connect succeeds; scopes lifecycle events and pending handshake timers to one mock client; enables TCP_NODELAY on the new ssh2 client after a reconnect cycle; transitions through connecting → connected states; reports error state on connection failure; disconnect cleans up and sets state to disconnected; getTarget returns a copy of the target; getState returns a copy of the state; throws when connecting a disposed connection. src/main/ssh/orcad-migration-stuck-host-profiles.test.ts: never leaves a running terminal behind; is offered only when leaving saved state behind would clear the refusal. src/main/ssh/orcad-runtime-maintenance.test.ts: keeps a connect from retrying a build an explicit Update also failed; offers Force when Update was refused by policy; forwards anew after an activation, since the new slot may bind another port; passes a refusal through and leaves the server linked; forwards anew once a serving slot is restored, which may have bound another port. src/main/ssh/port-forwarding/ssh-port-forward.test.ts: reports the port the OS bound when an ssh2 forward asks for port 0; adds an ssh2 port forward and returns entry; adds a system SSH port forward when no ssh2 client is available; reports the port a system SSH forward resolved when asked for port 0; passes resolved OpenSSH config to system SSH port forwards; disposes a system SSH tunnel when removing the forward; lists forwards filtered by connectionId; removes a forward by id; awaits forward close when removing a forward for user actions; returns null when removing nonexistent forward; removes all forwards for a connection; dispose removes all forwards; stores label in the entry; preserves the existing id when updating a forward succeeds. src/main/ssh/system-transport/system-ssh-forward-process.test.ts: spawns exactly the argv the orphan matcher is given, LogLevel=INFO included; runs port forwards unmultiplexed even when ssh_config disables muxing; preserves manual target port and identity options in the forwarded ssh command; does not spawn ssh when the requested local forward port is already in use; spawns ssh after the requested local forward port preflight succeeds; resolves startup after the grace period when ssh keeps running; sends SIGTERM then SIGKILL when the process does not exit; does not resolve stop until the process exits. src/main/ssh/system-transport/system-ssh-loopback-route.test.ts: dials the held forward ahead of the alias so OpenSSH keeps these over ssh_config; drops a manual target's own port and proxies, which would fight the route; never routes a forward, whose argv must stay stable for orphan recovery; %s → %s; opens the forward over the real proxy, then proves a login over the route; lands the forward on the sshd and known_hosts name the direct route resolved; holds the forward with server-alive probes; never lets the background forward or probe ask for credentials; starts no forward when admission refuses the route; stops the forward when sshd refuses logins over it; stops the whole forward process tree on Windows, once; reports a forward that already exited before anyone listened for it. src/main/startup/browser-process-user-agent-ordering.test.ts: explains admission refusal before a desktop launch exits; explains an orcad holding the profile instead of exiting silently; does not acquire profile admission for a duplicate launch; executes after the dev app name and before later preflight work; exits and releases admission after pending profile move recovery fails; keeps Linux background startup failures console-only and immediate; keeps Linux serve startup failures console-only and immediate. src/main/startup/quit/quit-path-durable-write-blocking.test.ts: store.flushAsync() issues no synchronous fs syscalls; store.flushAsync() also moves the active-view and github-cache sidecars off the thread; stats.flushAsync() issues no synchronous fs syscalls; Grok session cleanup issues no synchronous fs syscalls; stats.flushAsync() closes out live agents before it returns, not when its write lands; a stalled mount leaves the event loop live instead of parking it; store.flushAsync() is one idempotent final barrier; store.flushAsync() resolves instead of throwing when the profile mount rejects writes. src/main/stats/agent-session-transition-recorder.test.ts: counts a hook-only agent that never writes an agent-shaped terminal title; never opens a session from a replayed or disk-restored working status; still closes a live session when the terminating status arrives as a replay; counts one session per turn across repeated working/done cycles; closes an open session when its pane is torn down; bounds the mirror and closes what it evicts; stops the session when the main agent settles and only a watch loop holds the row working; keeps the session open while a subagent outlives the main agent, and closes it when the child settles; dates the stop by the evidence when a shell outlives the last subagent; opens a new session dated by the observation when the main agent resumes after monitoring; never dates a reopen before the close a fact-less OSC repaint caused; dates the first live row after a restored one by the evidence, not the restored clock; treats an unchanged answer as a snapshot, never a transition; opens only on a live working edge; closes only a session it opened. src/main/text-generation/commit-message-text-generation-model-discovery.test.ts: returns static catalog models without spawning for static agents; discovers dynamic models through the agent CLI; discovers dynamic models through the configured agent command override; falls back to static models when dynamic discovery returns no parseable models; falls back to the first discovered non-Pi model when its static default is unavailable. src/main/text-generation/pull-request-context.test.ts: does not fetch unrelated fork remotes before generating PR context; bounds exact remote-ref probe concurrency for a large remote list; reports no branch change because PR context preparation is read-only; keeps a remote-qualified base when the selected base includes the remote. src/main/text-generation/source-control-local-process.test.ts: asks the supervisor to stop and leaves its group to it; signals nothing once the supervisor has exited; stops an agent that ignores its stdin end through its supervisor. src/main/updater/linux-package/linux-package-update-recovery.test.ts: retains the downloaded package with the digest from the event metadata; requires a string downloaded path; accepts an uppercase extension; requires a non-empty string version; matches an absolute file URL by basename; accepts duplicate entries that agree on the digest; refuses an entry with a missing or non-string digest; refuses a digest that is not base64 at all; refuses a malformed percent-encoded URL; refuses a missing or non-array file list; tolerates a non-object event; replaces the retained artifact with a newer download; keeps the retained artifact when a new download has no usable digest; keeps the retained artifact when an unrelated download event arrives; clears the retained artifact; preserves the artifact across a recheck of the same version; clears the artifact when another version takes over; preserves the artifact for an unknown or empty version; is a no-op without a retained artifact; returns the built command and package file name for a verified package; reports missing without a retained artifact; propagates a package-manager discovery failure; rejects a well-formed digest that belongs to another file; never hashes a package that a malformed digest failed to arm; rejects a path outside the cache root; rejects the cache root itself; rejects a package in the updater directory itself; rejects a pending directory that is a symlink out of the cache; performs one hash pass for concurrent requests; revalidates once the in-flight pass settles; does not reuse an in-flight pass for a different artifact; starts a fresh proof when the same package is captured again; returns the verified package path; returns missing without a retained artifact. src/main/updater/releases/updater-prerelease-feed-readiness.test.ts: accepts a GitHub %s asset redirect as ready; reports a GitHub asset request error as unavailable; reports not-ready with a verified last-good tag when the newest assets are unavailable; does not classify a non-positive tag limit as feed unavailability; reproduces the v1.4.142 publishing incident as not-ready; reports transport failures as unavailable instead of not-ready; treats an explicit asset 404 as not-ready when another asset is unavailable; accepts absolute manifest asset URLs without rewriting them to release asset paths; returns not-ready with an older ready update as last-good while newest is publishing. src/main/updater/releases/updater-release-builds.test.ts: lists hourly builds from the dedicated repo, newest first; lists daily builds from the dedicated repo, newest first; separates stable from rc in the shared main repo; skips drafts and unparseable tags; keeps a composed release title and drops one that repeats the tag; hides builds that published no artifact for this platform; returns an empty list when no build has this platform artifact; keeps mac builds visible on macOS regardless of the Windows leg; resolves the platform installer download url; leaves the installer url null when the release published no installer; tolerates a release whose assets are missing or malformed; sends the local gh token as a bearer header when one is available; sends no authorization header when gh has no token; retries unauthenticated once when GitHub rejects the token; does not retry a 401 that was already unauthenticated; falls back to the per-IP bucket when the token is rate limited and tells the gh breaker; reports a secondary limit carrying retry-after without retrying or tripping the breaker; records a primary limit in the token scope %s; keeps %s authenticated when only %s is blocked; skips the token while its scope %s is blocked; surfaces a rate limit with its reset time and a sign-in hint when unauthenticated; omits the sign-in hint when the rate-limited request was authenticated; treats 429 as a rate limit; reports a 403 without rate-limit headers as a plain HTTP error; reports a missing hourly repo distinctly; is null when GitHub sent no reset; prefers retry-after over the primary reset epoch; falls back to the primary reset epoch when there is no retry-after; reads retry-after as seconds; reads retry-after as an HTTP date; pins an hourly tag at the hourly repo download path; pins a daily tag at the daily repo download path; pins a stable tag at the main repo download path; rejects a tag that is not a version. src/main/updater/updater.build-channel-selection.test.ts: uses the display label in the unsupported-platform %s pinned-build error; still pins %s from an unsigned Windows dev build; restores ordinary release checks after local build selection fails; opts into the RC channel when checkForUpdatesFromMenu is called with includePrerelease; pins the generic feed to a perf-tagged prerelease when requested; surfaces no-update feedback when no newer perf-tagged prerelease exists; keeps prerelease publishing-window misses on the generic retry path; leaves the feed URL alone for a normal user-initiated check. src/main/updater/updater.check-preflight.test.ts: ignores a stale update-not-available event after a new check starts preflight; deduplicates repeated manual checks while the immediate checking status is active. src/main/updater/updater.prerelease-fallback.test.ts: retries a prerelease check once against the previous feed tag when the manifest is missing; surfaces a promise-only prerelease fallback failure after the primary error event. src/main/updater/updater.publishing-window-feed.test.ts: repins the generic feed to the newest RC tag for a prerelease user; repins the generic feed to a newer stable tag for a prerelease user; pins a stable fallback when Atom has no newer prerelease; uses last-good concrete feed when a user-initiated check lands during publishing; can offer an older fully published update while the newest release is publishing; keeps background publishing-window fallback on the short retry cadence. src/main/updater/updater.quit-and-install.test.ts: surfaces an accepted retry before electron-updater emits download progress; defers quitAndInstall and runs its launcher within the launch PATH scope; runs pre-quit cleanup before local PTY cleanup during update install; keeps optional pre-quit cleanup fail-and-continue behavior by default; ignores duplicate quitAndInstall requests while the shared delay is pending; arms the forced-exit watchdog once the install commits; disarms the forced-exit watchdog when sync install error recovery keeps the app open. src/main/window/createMainWindow-markdown-editor-focus.test.ts: ignores traffic light sync IPC on non-macOS; still intercepts Cmd+Shift+B and Cmd+Alt+B when the markdown editor is focused; coerces non-boolean setMarkdownEditorFocused payloads to false; opens a table-aware context menu synchronously without a renderer query; builds the plain edit menu for the one right-click the renderer marks as plain text. src/main/window/createMainWindow-renderer-crash-recovery.test.ts: notifies the caller when the renderer process is gone; passes the renderer webContents id through crash recording and recovery callbacks; forwards expected renderer teardowns so the recorder can diagnose suppression; reloads the app shell after an unexpected renderer process loss; does not reload after renderer loss when recovery is disabled; stops auto-reloading after a rapid renderer crash loop trips the breaker. src/main/window/dashboard-popout-window.test.ts: updates the title after language initialization and unsubscribes when closed; lets its preload expose saved WSL hosts in serve-only, and passes nothing otherwise; creates a native-frame window with the shared preload and no webview surface; shows the window on ready-to-show; loads the prod file entry; loads the dev server URL when in dev; focuses the existing window instead of creating a second one; trusts only the live popout webContents; restores a minimized window when re-requested; restores valid persisted bounds; discards off-screen persisted bounds and falls back to defaults; persists bounds on resize after the debounce, guarding near-minimum sizes; keeps saving bounds after a vetoed quit and freezes them only on an allowed quit; closeDashboardPopout closes an open window; applies the persisted app zoom level on dom-ready; follows app zoom changes while open and unsubscribes on close; zoomDashboardPopoutIfFocused steps the popout zoom only while focused; handles the zoom-in chord via before-input-event and ignores other keys; handles mouse-wheel zoom requests outside before-input-event; respects zoom keybinding overrides for keyboard and mouse-wheel paths. src/main/window/dropped-path-preparation.test.ts: opens and stores each unique source once as drop size grows tenfold; passes ordinary paths without copying for %s; preserves ordinary successes and copied successes when another file fails; serializes copy requests from different owners; reports all lost paths without a shared reason when their failures differ. src/main/window/main-window-updater-deferred-setup.test.ts: releases all 64 completed fallback handles without repeating initialization; keeps setup after ready-to-show and releases its fallback afterward; preserves the 15-second fallback when first paint never arrives; preserves destroyed-window guard reads before and at the fallback deadline; keeps the exact %s error and releases its completed fallback; keeps the exact fallback %s error without retrying initialization; preserves pending manual setup after failed ready registration; keeps setup options, live store reads, nudge writes and required quit flush. src/main/worker-threads/worker-thread-request-queue.test.ts: posts one request at a time and in the order it was dispatched; fires a posted call at its own deadline; stops respawning and fails the rest of the queue once deaths hit the cap; clears the death count when a fresh burst starts from full idle. src/main/workspace-hooks/hooks-setup-runner-script.test.ts: builds Windows runners for newline-heavy scripts without line-array splitting; builds POSIX runners without regex-wide CRLF normalization; writes POSIX setup runners for shebang-declared scripts on native Windows paths; keeps batch setup scripts on cmd.exe when the terminal is Git Bash; hands a Git Bash pane a launch command MSYS cannot rewrite for a cmd runner; replays interpreter flags declared on the shebang line; preserves cmd.exe setup runner semantics for configured cmd users; keeps POSIX runner behavior on POSIX platforms; waits when either local or project policy requires completed setup; marks setup-runner terminals for the always-on credential guard; maps git-bash to POSIX setup launch metadata on Windows; falls back to the cmd runner when the git-bash setting has no installed Git Bash; keeps the cmd runner for a non-Git bash such as Cygwin; keeps the cmd runner for a bare bash whose flavor cannot be resolved; uses the POSIX runner for a bare bash that resolves to Git Bash; uses the POSIX runner for an extension-less Git Bash path; preserves the existing cmd runner for PowerShell terminals; preserves cmd setup compatibility when a Windows-host project has a WSL shell setting; classifies an installed explicit Git Bash executable as a POSIX runner; falls back to the cmd runner when the explicit Git Bash path no longer exists. src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts: schedules remote identity enrichment without blocking the caller; probes a drive project whose runtime is WSL %s; sweeps a local repo: %s; probes an SSH row that carries only executionHostId on its own host; keeps same-path rows on two different SSH hosts from sharing one backoff; coalesces concurrent probes for the same repo location; caches no-identity probes briefly so list calls do not retry every time; does not rewrite the no-remote marker on a later retry; resolves a settled no-remote repo once it gains a remote; does not re-probe a resolved identity before the refresh window elapses; re-probes a resolved identity after the refresh window elapses; bounds re-probes per sweep so a large repo list drains gradually; forgets a removed repo location so its deadline cannot outlive the repo; keeps a surviving repo backoff when a sibling repo is removed; probes again when the same location is re-added after its probe was retired; coalesces concurrent sweeps instead of running one pass per list call. src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts: preserves create priority through claim probes on %s; starts the checkout only once the async workspace root resolves; still deduplicates when both callers await the same pending root lookup; namespaces native Windows preparation directories for long paths; deduplicates preparation for the same repo, base, runtime, and workspace root; does not spend a divergence walk when the base matches exactly; claims when the two sides spell the same ref differently; evicts a repo's own stale preparation before another repo's; still discards armed checkouts when the project runtime needs repair; routes preparation and finalization through the selected WSL runtime; retries stale cleanup after a transient listing failure; does not discard a detached worktree with caller-controlled preparation metadata; does not re-arm after an isolated create; re-arms a preparation once creates arrive in a burst; holds the re-arm checkout until the create runs the deferred thunk; starts one explicit prefetch after the create completes; does not re-arm when finalization failed; reports a pending create while a stale-cleanup scan is running. src/main/workspaces/removal/local-worktree-removal-recovery.test.ts: recovers Git for Windows partial filesystem deletion failures; finishes a clean non-force deletion after Git leaves a Windows directory behind; recovers localized Windows failures after Git already removed the registration; does not recover unrelated localized failures while Git still owns the row; finishes a macOS deletion Git deregistered before failing with Directory not empty; leaves an orphaned checkout to the orphan cleanup instead of deleting it; prunes and strictly verifies on the selected WSL host without deleting files or branches. src/main/workspaces/removal/worktree-removal-safety.test.ts: rejects deleting a worktree that contains another registered worktree; rejects POSIX home directories even when host homedir has a different path shape; refuses a home the host reported even when no path rule recognises it; refuses the Windows host's home directory from a POSIX client; refuses the Windows host's home directory even when the host reported nothing. src/main/wsl/discovery/distro-catalog.test.ts: retries asynchronous discovery after a transient wsl.exe failure; retries synchronous discovery after a transient wsl.exe failure; retries asynchronous discovery after wsl.exe reports no distros yet; retries synchronous discovery after wsl.exe reports no distros yet; bounds the wsl.exe spawn rate while no distros are installed; bounds the asynchronous spawn rate while no distros are installed; still caches a non-empty distro list for the process lifetime; re-probes a docker-desktop-only machine once a user distro can appear; backs off while the list keeps coming back empty; backs off after repeated distro-list failures; caps the empty-list backoff at five minutes; keeps reporting an empty result after it goes stale; keeps reporting a known distro list indefinitely; bounds cached homes while retaining the most recently used distros; still lists distros, and an excluded distro home probe fails like any other probe; gives the async home probe time for a cold boot instead of killing it at 5 s; retries availability after a probe timeout instead of latching false; bounds the probe rate while the failure window is open; caches a successful probe for the process lifetime; names an explicit spawn directory, so no deleted cwd can read as ENOENT; shares one wsl.exe spawn between concurrent probes; keeps reporting the last observed answer after it goes stale; holds a definitive failure far longer than a timeout when %s; backs off after repeated probe failures; re-probes a seeded retryable failure once its window lapses; re-probes availability once a distro list succeeds after %s; does not drop an availability failure for an empty distro list; keeps reporting unavailable off Windows without probing. src/main/wsl/discovery/wsl-distro-holder.test.ts: runs a busybox-safe loop through --exec and names the distro; spawns a detached-style holder, records it, and waits for the distro to run; a holder exiting with code 1 notes its distro may have stopped (E9); rejects a pid whose command line is not our holder for that distro; cleans up stale and corrupt records; keeps a holder and its record when release cannot verify it; reports unverifiable when the command line is unreadable even with a matching pid; release kills a verified holder and removes its record; release never kills a pid that is no longer our holder; reports a spawned holder exit so liveness can re-check. src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts: skips 9p shares that are not drvfs, and malformed lines. src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts: plans the update on the census the running orcad reports, not an unknown one; forwards force to the update planner; does not serve the incumbent past a refusal that is not a wait; does not re-activate the build this host rolled back from; labels the launch with the build the adoption found serving, not the stale record; defers while another run holds the host fence; lets an explicit force deploy past both skips; names a newer host refusal apart from a rolled-back one, so only Force is offered; updates an older host as before, without asking to adopt it; never asks the incumbent when it already runs this build. src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts: keeps a completed listing usable when the host rejects the wait parameter. src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts: delivers to chat-default users in all targeting while holding out not-switched users. src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts: completes the row on a pick, even when the command is already typed; ignores a pick of the row while side chats are unavailable. src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts: explains a too-large refusal that arrives through the IPC error prefix. src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts: keeps the question with the caller and says once that it never went; tells the user to check the side chat when delivery is unconfirmed; reports a delivered question as sent, silently. src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts: decides each of %i tool-only turns once per layout, and nothing without a listener. src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx: places a side chat whose question was %s: %o. src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts: calls back once for %s; stops watching once unsubscribed. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts: records a mode 2031 subscribe from the raw chunk boundary without answering. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts: routes terminal input through deferPtyInput so the host can withhold it; forwards terminal input directly when the host supplies no deferPtyInput. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts: forwards onBell to pane attention and notification policy; hands the bell to the attention module with its pane even when pane attention is off. src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts: repaints from the main-owned snapshot when main drops pending output at the cap. src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts: retries a fresh-spawn native follow reset when renderer dimensions return. src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts: requests a tab remount for an unbound spawn; leaves recovery to a remote transport that armed its own retry; requests a remount when the transport reports no recovery of its own; settles the spawn as failed before requesting a remount; prefers the restored leaf id when reporting the anomaly; falls back to the pane leaf id when no restored leaf exists. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionDeferredInputForwardingTests } from '../input/pty-connection-deferred-input-forwarding.spec', registerPtyConnectionDeferredInputForwardingTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts: structural support changed only; no new authored removal credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionFreshNativeFollowResetTests } from '../output/pty-connection-fresh-native-follow-reset.spec', registerPtyConnectionFreshNativeFollowResetTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionTerminalBellAttentionTests } from '../notifications/pty-connection-terminal-bell-attention.spec', registerPtyConnectionTerminalBellAttentionTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts: registers interest on the first sidecar and releases on the last unsubscribe; releases sidecar interest only once for repeated unsubscribes; does not let an eager pre-mount buffer defeat hidden delivery gating; keeps eager buffers outside delivery interest when the PTY exits before mount; lets a sidecar exclusively own interest while an eager buffer overlaps. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts: blackholed delivery reproduces the wedge: no handler dispatch, no ACK ever. src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts: sends preferences to the execution host and attaches only to its returned PTY; preserves one operation ID across a lost reply and reconnect; preserves ordinary raw startup and captured-session attachment. src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts: sums registered gauges and drops disposed ones; ignores a repeated dispose instead of dropping another gauge; stops tracking new gauges past the cap so a missed dispose cannot grow it; tracks a live output processor queue through enqueue, drain, and dispose; excludes cleared consumed entries from retention after a bounded drain. src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts: says nothing once the pane is closed. src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts: refreshes after each scheduled atlas reset; falls back to a timeout when animation frames are unavailable; continues recovery when a manager throws after scheduling. src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts: tracks a remounted quiet title source even when the stale owner unregisters later; preserves the renderer-parsed output sequence in the response; preserves a pending escape tail for snapshot replay; routes a host's Reset Terminal request to the pane that owns the PTY. src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts: marks panes with restored scrollback for fresh-shell viewport blanking. src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts: recovers a 0x0 spawn whose container is briefly unmeasurable then settles. src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts: removes global listeners when the last pane unregisters. src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx: keeps trust text readable on a host-owned dialog surface; applies the hostile surface to ordinary dialogs, so the case above is exercised. src/renderer/src/components/use-terminal-parking-pass.test.tsx: does not queue a render when a pass produces the same parking sets; keeps parking transitions working under StrictMode. src/renderer/src/hooks/client-workspace-view-report.test.ts: reports an away user’s screen with no presence, and renews as soon as input returns; retries a failed send, empty or not, no sooner than a refresh. src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts: is new work in a workspace with no live terminal: its first bind moves it up in Recent. src/renderer/src/hooks/use-bundled-skill-install.test.tsx: ignores a repeated click while the install runs; retries the last requested skills on this host. src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx: adds seeds to a successful empty list but not to loading or failed results; retains seed projection after expiry and fetches fresh metadata for a new reader. src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx: retranslates the settings nav labels when the UI language changes live. src/renderer/src/lib/codex-stale-pane-account-identity.test.ts: keeps the prompt when the roster read fails and every label collapses. src/renderer/src/lib/image-blob-png.test.ts: downscales a pasted image above the pixel cap; releases its temporary URL on a decode error; releases its temporary URL when PNG encoding fails or exceeds the byte cap. src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts: names callers above the frame the write came from; restores Error.stackTraceLimit when the capture throws; stops collecting after the sample cap when captureStackTrace is unavailable; caps reported changed keys from a single wide write. src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts: applies the rendered text hard cap last and reserves the final overflow marker. src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts: keeps the runtime target identity stable across unrelated store writes. src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts: keeps creation available on old hosts and explains the missing operation; preserves landed warnings and direct collision recovery data; propagates remote discovery failure instead of a false empty page. src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts: reuses unchanged worktree tab projections when one worktree title changes; bumps only the changed worktree version when a sibling stays byte-identical. src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts: shares safe-auto fork sync cooldown attempts across store instances. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts: collapses a 193-workspace hydration to one store write; leaves the store byte-identical to the per-workspace path; re-reconciling the batched result is a no-op, as it is for the per-workspace path. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts: dedicated zero-case helper retirement; no authored test credit. src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts: persists each batch metadata update to its workspace owner. src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts: dismisses a rename error on its capable remote owner; clears pending first-agent rename when the title is updated. src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts: orders capture, guards, handlers, main's stop, commit, cleanup, and exit settlement. src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts: publishes the first terminal and root tab group atomically; publishes the first terminal and root tab group atomically, then marks it starting in main. src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts: restores daemon terminal wake hints before declaring the session ready. src/renderer/src/web/web-runtime-connection-auth-framing.test.ts: keeps legacy framing for sockets that cannot absorb a refused attempt. src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts: moves the old Windows default to Regular once and queues the notice; keeps custom weights and fresh profiles without a notice; leaves macOS and Linux profiles untouched. tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/persistence/worktree-sort-order-write.test.ts, src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts, src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts, src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts, src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts, src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts, src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts, src/main/runtime/session-graph/headless-runtime-graph.spec.ts, src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts, src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts, src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts, src/main/runtime/terminal/identity/terminal-identity-probe.test.ts, src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts, src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts, src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts, src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts, src/main/runtime/terminal/surface/workspace-layout-projection.test.ts, src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts, src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts, src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts, src/main/skills/skill-install-transaction.test.ts, src/main/speech/model-manager-download-resume.test.ts, src/main/ssh/config/ssh-config-parser.test.ts, src/main/ssh/config/ssh-known-hosts-source.test.ts, src/main/ssh/config/ssh-known-hosts.test.ts, src/main/ssh/connection/ssh-connect-config.test.ts, src/main/ssh/connection/ssh-connection-auth-fallback.test.ts, src/main/ssh/connection/ssh-connection-store.test.ts, src/main/ssh/connection/ssh-connection.test.ts, src/main/ssh/orcad-migration-stuck-host-profiles.test.ts, src/main/ssh/orcad-runtime-maintenance.test.ts, src/main/ssh/port-forwarding/ssh-port-forward.test.ts, src/main/ssh/ssh-channel-multiplexer.test.ts, src/main/ssh/system-transport/system-ssh-forward-process.test.ts, src/main/ssh/system-transport/system-ssh-loopback-route.test.ts, src/main/startup/browser-process-user-agent-ordering.test.ts, src/main/startup/quit/quit-path-durable-write-blocking.test.ts, src/main/stats/agent-session-transition-recorder.test.ts, src/main/text-generation/commit-message-text-generation-model-discovery.test.ts, src/main/text-generation/pull-request-context.test.ts, src/main/text-generation/source-control-local-process.test.ts, src/main/updater/linux-package/linux-package-update-recovery.test.ts, src/main/updater/releases/updater-prerelease-feed-readiness.test.ts, src/main/updater/releases/updater-release-builds.test.ts, src/main/updater/updater.build-channel-selection.test.ts, src/main/updater/updater.check-preflight.test.ts, src/main/updater/updater.prerelease-fallback.test.ts, src/main/updater/updater.publishing-window-feed.test.ts, src/main/updater/updater.quit-and-install.test.ts, src/main/window/createMainWindow-markdown-editor-focus.test.ts, src/main/window/createMainWindow-renderer-crash-recovery.test.ts, src/main/window/dashboard-popout-window.test.ts, src/main/window/dropped-path-preparation.test.ts, src/main/window/main-window-updater-deferred-setup.test.ts, src/main/worker-threads/worker-thread-request-queue.test.ts, src/main/workspace-hooks/hooks-setup-runner-script.test.ts, src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts, src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts, src/main/workspaces/removal/local-worktree-removal-recovery.test.ts, src/main/workspaces/removal/worktree-removal-safety.test.ts, src/main/wsl/discovery/distro-catalog.test.ts, src/main/wsl/discovery/wsl-distro-holder.test.ts, src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts, src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts, src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts, src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts, src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts, src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts, src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx, src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts, src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts, src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts, src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts, src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts, src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts, src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts, src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts, src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts, src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx, src/renderer/src/components/use-terminal-parking-pass.test.tsx, src/renderer/src/hooks/client-workspace-view-report.test.ts, src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts, src/renderer/src/hooks/use-bundled-skill-install.test.tsx, src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx, src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx, src/renderer/src/lib/codex-stale-pane-account-identity.test.ts, src/renderer/src/lib/image-blob-png.test.ts, src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts, src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts, src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts, src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts, src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts, src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts, src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts, src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts, src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts, src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts, src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts, src/renderer/src/web/web-runtime-connection-auth-framing.test.ts, src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts, tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
@@ -9073,7 +9089,15 @@
"Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
"Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. All prior notes and dated/archived evidence retain original scopes.",
"Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
- "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Earlier notes, complete dated receipts and archived gaps retain their original scopes."
+ "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
+ "Audit3597 scope: remove two renderer-hang-capture examples (2 authored/2 finite): an invalid repeated-token oversized reducer fixture and a shorter unanswered-request fixture. Intentionally lose the direct truncated flag/sanitized frame fixture and request-pending status/zero-sample alarms. Retain window-death/stale-result exclusion, generation reconciliation, and baseline-publication cancellation lifecycles; they are not equivalent bound, redaction or pending-status replacements. Historical execution retains its original source scope; no new runtime evidence is claimed.",
+ "Audit3601 scope: remove the whole custom-sound happy-path IPC suite and one custom-label/multiline notification formatting example (2 authored/2 finite). Intentionally lose configured .ogg selection, exact byte/MIME success wiring, successful dispatch for the formatting fixture, custom-label whitespace/title normalization and assistant-body whitespace/180-character-cap alarms. Retain prompt-exclusion, persisted qualified dismissal/restart, theme ownership/restore and Ghostty precedence/collision cases; none replaces the retired sound/formatting alarms. No actual playback, native delivery, phone/network, cross-platform or new runtime evidence is claimed; historical execution keeps its original scope.",
+ "Audit3606 adopts the enhanced3604/3605 icon cuts: nine authored/nine finite cases removed, including the whole tray-attention-icon suite. Retires the no-encoder oversized-upload null sample, missing-ID/request-order sample, encoder-null PNG-prefix fallback, SVG/404 rejection samples, transparent amber-dot placement and half-alpha white-tint sample, exact small fetched-byte passthrough, host-qualified image-key inventory and constant-encoder large-upload projection. These specific admission, formatting and bitmap alarms are intentionally lost without equivalent replacements. Retained queue/cache, bounded fetch and Dock lifecycle checks do not establish actual raster decoding, native image conversion or rendered appearance. Historical receipts below are preserved evidence for earlier test sets, not fresh validation of this reduced selection.",
+ "Audit3608: remove five authored/five finite callbacks, including whole owner-slug and remote favicon URL suites and two repository-label projections. Lose five owner acceptance samples, eleven negative owner samples plus nonstring refusal, six host-local icon refusal samples, legacy-SSH same-path label-map cardinality, and explicit runtime ownership over stale legacy metadata at label level. These are accepted narrow grammar/presentation alarms with no equivalent replacement claimed. Retained binary parser, React recovery and label grouping/platform cases do not replace these losses. Static evidence only; historical receipts retain their original scope.",
+ "Audit3613: remove six authored/six finite callbacks, including whole reviewer-display oversize-input and explorer-root record-filter suites, plus plugin family-emoji/invisible-only-name and pool legacy-name/urgent-countdown samples. Accept losing oversized-input empty-result/no-split, malformed-record/prototype-sensitive-key/nonstring filtering, exact ZWJ family preservation, invisible-only name refusal, no-group old-host full-name preservation, and80/79/null-reset countdown composition alarms. No equivalent replacement asserted. Retained strict/runtime sanitization, SVG parser, mobile focus recovery and collision/tie cases have different scopes. Static evidence only; historical receipts retain original scope.",
+ "Audit3628: remove the entire one-authored/one-finite RepositoryRemoveProjectSection happy-dom suite. Accept losing the local zero-to-one-terminal stale-count revalidation alarm: first confirmation defers the removal callback and second confirmation invokes it after the count snapshot updates. The test never asserts updated warning text/count, actual terminal creation or removal/PTY teardown, host/scope routing, cancellation or folder/mobile behavior. No equivalent replacement or end-to-end warning-before-teardown proof asserted. Static evidence only; historical receipts retain original scope.",
+ "Audit3629 removes two singleton parser suites: WSL Claude plugin metadata out-of-range index rejection and Git checkout unlink-warning path extraction. Their real range-refusal and quoted-path extraction alarms are intentionally lost without replacement; no WSL execution, checkout recovery or equivalent remaining coverage is claimed.",
+ "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed."
],
"demotionRule": "Cannot promote without metric artifacts and bounded-byte assertions."
},
@@ -9309,7 +9333,7 @@
"providers": ["ssh", "remote-runtime", "wsl"],
"coveredPlatforms": ["linux"],
"coveredProviders": ["ssh", "remote-runtime"],
- "coverageNotes": "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3368 narrows stream-reconnect coverage to the actual ten synthetic transport epochs retaining one PTY identity, accepting and holding detached input for exactly-once later delivery, current decoded output and per-epoch subscription release. Prior rejection wording was inaccurate. Phase/backoff/cutoff/manual reconnect and parser/OSC/pause/retained-image/fatal/latch/claim/early-close alarms are intentionally lost without equivalent replacement. The Linux multi-pane reconnect receipt remains verbatim with its original scope; no fresh live SSH/provider/PTY/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit3359 retires whole host-surface-replacement and create-handoff suites, removing their compound unit command tokens, test-file entries and assertion references. Fake polling/deadline/subscription, supplied stale-handle ownership, close and replacement examples are intentionally lost without equivalent replacement. The unrelated Linux paired multi-pane reconnect receipt stays verbatim with its original scope. No fresh SSH/provider/network/PTY recovery, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit3342 retires the complete client create-outcome identity/options/recovery suite and the malformed-or-contradictory repo-owner response matrix. Client replay identity, options, no-downgrade, quiescence/budget/manual retry, authoritative probe-error and malformed-owner refusal alarms are intentionally lost without equivalent replacement. Remaining repo-owner late catalog and old-host re-adoption boundaries do not replace them. The unrelated Linux paired-reconnect receipt stays verbatim with its original scope. Surviving selectors are unexecuted here; no fresh SSH/provider/process-deduplication, mobile, mixed-version or cross-platform validation is claimed. Audit3329 execution amendment: the reduced one-suite reconnect selector passed on Linux (1 case). Original source-review statements about no fresh execution describe the earlier static review; this new receipt validates only this one local deterministic unit case, not the complete gate or physical/runtime/rendered/provider/platform parity. Historical seven-case macOS and two-case Linux receipts remain archived verbatim. Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: keeps a sidebar row for every still-live pane after a long sleep — Whole suite: 279 lines manually replay renderer ownership registry/status writes, snapshot patch/set, six-pane fixture inventory, and sidebar selectors/builders; expected pane IDs are production-computed. Does not run sleep/wake/transport or actual sidebar entry. Retires reconnect row-preservation assembly alarm.; still retires the regular TUI surface after an explicit terminal exit — Ordinary explicit-exit callback/map cleanup is repeated in the stale/new stream lifecycle case below. Retires separate regular-TUI baseline; keeper is not equivalent process/UI proof.; asks the HUB to recover an expired SSH pane and rebinds the host identity — Expired SSH owner error must ask the owning HUB to recover, then adopt fixed replacement handle, resubscribe and report rebind; actual transport dispatch and handle state prevent wrong-client recovery.; does not recover a pane whose relay reply was an identity mismatch — Identity mismatch means a different live PTY, so actual transport must surface refusal without recover/create, keeping original identity. Prevents destructive duplicate agent recovery.; fails closed when an older HUB cannot recover an expired SSH pane — Old HUB method_not_found is scripted mock refusal/error echo with no actual skewed host; repeats generic recovery failure propagation. Retires old-host recovery fallback refusal example.; names a held recovery's stopped WSL distro in readable copy, not the raw hold code — Pins exact WSL stopped-distro error prose after mock code; translation/copy assertion with no actual held recovery behavior. Retires readable-copy alarm.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3318 reduces runtime-environment-ssh-state.test.ts, intentionally losing metadata membership-pruning/new-target-only-read and other-environment/local-bucket isolation alarms. Preserve generation/failed-full-refresh assertion and unknown-target authoritative-list reread; these narrower cases are not equivalent replacements. The unchanged active two-case Linux reconnect materialization/sidebar receipt and covered platform retain their exact scope and do not validate the reduced SSH state selector. Preserve unrelated SSH assertions, selectors and archived history. No fresh SSH discovery, provider/PTY/network, rendered, mobile, mixed-version, cross-platform or full-gate execution is claimed. Audit3315 execution amendment: the reduced two-suite reconnect selector passed on Linux (2 cases). Original source-review statements about no fresh execution describe the earlier static review; this new receipt validates only these two local deterministic unit cases, not the complete gate or physical/runtime/rendered/provider/platform parity. Historical seven-case macOS receipt remains archived verbatim. Audit 3312 retires the ordinary six-pane distinct-live-handle reconnect/resubscription alarm from paired-reconnect-multi-pane-materialization.test.ts. The unchanged parked-pane activation/rematerialization case remains narrower and is not an equivalent replacement. The complete prior seven-contract macOS receipt is archived as historical evidence; it does not validate the reduced selector. No fresh socket, PTY, sleep/wake, provider, platform, mobile, mixed-version or rendered execution is claimed. Audit3096: remove the deleted reconnect-banner selector and its two UI aliases. The reduced recovery-state selector retains only the deadline cancelling pending backoff and explicit retry owning a new epoch alias; healthy-replacement stale-schedule and independent caller-cutoff cancellation aliases retire. Other retained state cases cover reentrant retry, owner settlement and same-epoch parked revival, without replacing those removed alarms. Prior admission-selector retirement, archived July 28 receipt, unrelated selectors/claims/receipts and old gaps remain unchanged; no fresh execution is claimed. Audit3086: retire the destroyed fresh-session fallback settlement/non-destructive reattach alias and its direct selector; retain the detach/attach selector and assertion unchanged. The retained admission cases cover adopt-before-data and explicitly buffered-death admission without a new spawn, without replacing fallback retirement. July 28 evidence was already archived by audit3077; no duplicate retirement or new execution is claimed. Audit2709 removes src/renderer/src/runtime/web-session-tabs-sync/inventory/remote-runtime-session-tabs-inflight.test.ts: intentionally retire waiting out an older inventory and sharing a fresh post-operation request among concurrent callers. No equivalent replacement or fresh execution is claimed. Dated receipts remain historical evidence for their unchanged selectors only; they do not validate the reduced commands or full current gate. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/ssh/connection/ssh-connection-manager.test.ts: tears a failed startup down quietly, so its error is not replaced by a disconnect; marks a dial that never reached the host, so setup reports SSH’s reason; removes the registration when bulk teardown fails; leaves a connection whose own reconnect is asking the user alone; clears the pool entry when the closed connection is still the registered one; still reuses a connection that is already up; dials a user's connection test. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2052 (sources2049/2050/2051): Remove complete low-value restored-pane-title and pane-visibility-identity suites and their current selectors. Their supplied snapshot/title and nullable identity-comparison alarms are intentionally lost without replacement. Unrelated dated evidenceRuns remain unchanged and do not validate the reduced commands. No fresh gate execution, actual PTY/provider, rendered, remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the terminal-create idempotency forwarding suite and its prospective selector. Preserve2 unrelated receipts without claiming the lost forwarding alarm was replaced. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete complete transport-unmount and queued-initial-CWD helper suites: despite lifecycle-shaped fixtures, the unmount owner returns a Boolean PTY-id predicate, while CWD cases check nullish field selection and callback counts. Lose their detach/destroy/teardown and one-shot-CWD supplied examples. Partial queued-pane-startup loses three identical/empty/nonowner identity examples, retaining four exact one-shot/replacement ownership callbacks. No assertion object maps to these three sources, so unrelated alias objects remain byte-exact. Preserve the current81ed prior removal of pane-split-startup; stale bd948 source metadata snapshots are not replayed. No actual process/PTY startup, transport shutdown, live SSH or rendered recovery is proven by this metadata change. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Delete the sole supplied public-SSH-state spread/sanitized-error projection and its provider-authority-pair alias. Also delete the complete tiny one-shot split-startup wrapper suite: callback-visible temporary field/reset, sequential payload and thrown-sentinel reset alarms disappear. No SSH provider epoch handoff, connection, process startup or actual terminal split was performed by either deleted suite. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Historical prior account (preserved verbatim): Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1301 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic renderer coverage proves retained native and runtime SSH payloads are admitted through production routes only with valid complete authority, stale cleanup cannot unregister a replacement runtime terminal, direct SSH Git and folder panes keep their PTY bindings through disconnect and reconnect, one authority chain stops after two automatic attempts even when each timeout exceeds the rolling window, rejected acknowledgements mutate no store maps, and one shared exact attempt admits every concurrent split-pane spawn and reattach while preserving the first PTY as the tab fallback. A later sibling failure rotates the tab once, stale callbacks from the prior attempt mutate no state, split remount activity suppression is counted per leaf, primary PTY exit promotes a bound survivor or preserves an empty continuation gap for a late sibling, and primary, non-primary, or null-PTY detach preserves exact authority on both resulting tabs. Intentional pane disposal cancels its settlement timer without breaking StrictMode remount timeout ownership. A mounted remote-runtime terminal survives repeated transport partitions without changing PTY identity. A real encrypted-WebSocket oracle proves a successful reachability probe can replace a pre-ready shared-control socket without rejecting or duplicating the waiting RPC. Direct SSH coordinator tests cover immediate terminal finalization, hydration correction, damping, bounded retry, and telemetry non-interference. Client/server heartbeat tests cover timer suspension, socket generations fence stale callbacks, cold restored-terminal attachment retries, cached pixels remain unhealthy until authoritative replay, automatic retries stop after one minute, manual reconnect preserves the PTY, and pane closure releases recovery UI state. Current-transport recovery clears every error that transport surfaced without clearing or displaying a sibling pane's errors, while transport suppression, pane retention, and the rendered surface are independently bounded. Current macOS Electron journeys against an ephemeral Linux Docker SSH target cover exact-authority repo/worktree hydration, live terminal recovery after disconnect/reconnect, and eager six-terminal remount after renderer reload. A Windows remote-runtime smoke covers reachability and PTY round-trip. Multi-target live fanout, paired-close, WSL, and patched live partition journeys remain gaps. The test-value audit narrowed resolved-worktree-execution-host.test.ts to cache reuse and invalidation. Its direct hydrated-worktree, missing-folder, restored-owner, host-stamp and empty-runtime selection alarms are lost. Other routing and recovery suites do not establish equivalent selector coverage; historical run commands and results remain historical. The test-value audit removes standalone unwritten/released renderer-authority and cross-scope request-count examples. The retained synthetic mirror/store/sidebar and pending-inventory checks do not establish real PTY byte ownership, SSH reconnection or equivalent replacement coverage; historical commands and results remain historical. The test-value audit removes direct join/label ledgers, immediate failure and negative-only stale/removal/partial-authority examples, plus the standalone retained/live event projection. Retained synthetic store/hydration compositions do not establish real SSH continuity, remote authority delivery or equivalent replacement alarms. Historical commands and results remain historical. The renderer scheduling fixture retains in-flight coalescing only. Its immediate publication and negative stale-SSH-cleanup call ledgers were removed; the retained SSH recovery evidence does not replace those alarms. The accepted-handle-events observer suite is removed, including its scoped listener and settlement-release assertions. These observer alarms are lost; retained SSH/transport journeys are not equivalent replacement coverage. The test-value audit removed repeated remote-handle rotation inventories and snapshot-first pending-restart migration examples from terminal-pty-identity-replacement.test.ts, plus direct foreground metadata setter, confirmation, evidence-enum, and prefix/worktree cleanup examples. Those rotation, pending-restart, snapshot-first migration, and foreground scalar-update alarms are lost. The retained replacement case observes pane and tab identities in one subscriber publication; it does not establish equivalent migration, process-evidence, or input-routing coverage. Historical commands and results remain historical. The test-value audit narrows terminals-hydration.test.ts to a real reconnect batch with one measured store publication and hydration-seeded history consumed by a subsequent visit/Back check. Direct split-layout, runtime/folder/floating restoration, dead-leaf focus, cold/known-absent SSH deferral, title, default-tab marker, navigation initialization, and hydrationSucceeded scalar examples are removed; those specific alarms are lost. No actual target-removal transition, live SSH connection, session writer, or persisted restart is exercised by the retained cases. The old target-scoped/snapshot assertion references are retired because the current file does not contain those oracles. Other suites and historical runs do not establish equivalent replacement coverage. Audit1299 removes tests/e2e/terminal-cold-activation-deferral.spec.ts. Private-state/work-budget/assembled-fixture alarms are intentionally lost; retained suites are not equivalent replacement coverage. No new runtime/platform evidence is claimed. Audit1301: src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts reduced. Direct dedupe eviction/count and equal receipt-position sample loses authored alarm. No equivalent replacement coverage is claimed. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1342: src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts removed. Initial and event-triggered partial-authority hydration fixture alarms disappear. src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts removed. Multiline dedup/storm bounds, resource classification/collision, scoped clear/reconnect strip and1000-pane map count alarms disappear. No equivalent replacement coverage is claimed. Audit1396: src/renderer/src/components/terminal-pane/pty-connection-pending-spawn.spec.ts reduced. Lose standalone debug-state retention/log silence alarm. React StrictMode is not mounted; bindings manually simulate remount over mocked transport. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/ipc/ssh/ssh.test.ts reduced. Lose trivial missing target and mocked publication inventory. Preexisting unresolved ../ssh/ssh-port-scanner mock is recorded, not fixed. src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts reduced. Removes three no-op/work-count registrations; retains externally observed ownership consistency. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1412: src/main/ssh/ssh-provider-authority.test.ts removed. Loses real AbortController revocation/target isolation/reentrancy outcomes, recreated-target generation-floor/session rollover behavior, stale mutation refusal and settled-registration cleanup alarms. These useful alarms are deliberately lost; no equivalent cancellation coverage is claimed. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1743 removes the standalone line-height clamp/default and pane cwd fallback helper tests (5 authored cases). These trivial-helper alarms are intentionally lost, with no equivalent replacement. Only current commands/testFiles lose the deleted selectors; historical receipts and evidenceRuns remain unchanged and do not validate the reduced commands.",
+ "coverageNotes": "Audit3554 intentionally removes the whole worktrees-ssh-repo-owner-resolution suite (2 authored cases). Dedicated duplicate-exact/ambiguous-legacy owner refusal and fixed runtime-host/wrong-target/missing-authority/zero-owner/contradictory-owner status alarms are lost. The suite did not exercise an authority transition or actual SSH listing; its no-local-Git spy was also unreachable on an admitted SSH metadata-only route. Remaining suites are not equivalent replacements. Current selectors have no fresh execution from this static packet; historical receipts retain their original scope. No new SSH/provider/native/UI/mobile/mixed-version/cross-platform result is claimed. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3368 narrows stream-reconnect coverage to the actual ten synthetic transport epochs retaining one PTY identity, accepting and holding detached input for exactly-once later delivery, current decoded output and per-epoch subscription release. Prior rejection wording was inaccurate. Phase/backoff/cutoff/manual reconnect and parser/OSC/pause/retained-image/fatal/latch/claim/early-close alarms are intentionally lost without equivalent replacement. The Linux multi-pane reconnect receipt remains verbatim with its original scope; no fresh live SSH/provider/PTY/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit3359 retires whole host-surface-replacement and create-handoff suites, removing their compound unit command tokens, test-file entries and assertion references. Fake polling/deadline/subscription, supplied stale-handle ownership, close and replacement examples are intentionally lost without equivalent replacement. The unrelated Linux paired multi-pane reconnect receipt stays verbatim with its original scope. No fresh SSH/provider/network/PTY recovery, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit3342 retires the complete client create-outcome identity/options/recovery suite and the malformed-or-contradictory repo-owner response matrix. Client replay identity, options, no-downgrade, quiescence/budget/manual retry, authoritative probe-error and malformed-owner refusal alarms are intentionally lost without equivalent replacement. Remaining repo-owner late catalog and old-host re-adoption boundaries do not replace them. The unrelated Linux paired-reconnect receipt stays verbatim with its original scope. Surviving selectors are unexecuted here; no fresh SSH/provider/process-deduplication, mobile, mixed-version or cross-platform validation is claimed. Audit3329 execution amendment: the reduced one-suite reconnect selector passed on Linux (1 case). Original source-review statements about no fresh execution describe the earlier static review; this new receipt validates only this one local deterministic unit case, not the complete gate or physical/runtime/rendered/provider/platform parity. Historical seven-case macOS and two-case Linux receipts remain archived verbatim. Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: keeps a sidebar row for every still-live pane after a long sleep — Whole suite: 279 lines manually replay renderer ownership registry/status writes, snapshot patch/set, six-pane fixture inventory, and sidebar selectors/builders; expected pane IDs are production-computed. Does not run sleep/wake/transport or actual sidebar entry. Retires reconnect row-preservation assembly alarm.; still retires the regular TUI surface after an explicit terminal exit — Ordinary explicit-exit callback/map cleanup is repeated in the stale/new stream lifecycle case below. Retires separate regular-TUI baseline; keeper is not equivalent process/UI proof.; asks the HUB to recover an expired SSH pane and rebinds the host identity — Expired SSH owner error must ask the owning HUB to recover, then adopt fixed replacement handle, resubscribe and report rebind; actual transport dispatch and handle state prevent wrong-client recovery.; does not recover a pane whose relay reply was an identity mismatch — Identity mismatch means a different live PTY, so actual transport must surface refusal without recover/create, keeping original identity. Prevents destructive duplicate agent recovery.; fails closed when an older HUB cannot recover an expired SSH pane — Old HUB method_not_found is scripted mock refusal/error echo with no actual skewed host; repeats generic recovery failure propagation. Retires old-host recovery fallback refusal example.; names a held recovery's stopped WSL distro in readable copy, not the raw hold code — Pins exact WSL stopped-distro error prose after mock code; translation/copy assertion with no actual held recovery behavior. Retires readable-copy alarm.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3318 reduces runtime-environment-ssh-state.test.ts, intentionally losing metadata membership-pruning/new-target-only-read and other-environment/local-bucket isolation alarms. Preserve generation/failed-full-refresh assertion and unknown-target authoritative-list reread; these narrower cases are not equivalent replacements. The unchanged active two-case Linux reconnect materialization/sidebar receipt and covered platform retain their exact scope and do not validate the reduced SSH state selector. Preserve unrelated SSH assertions, selectors and archived history. No fresh SSH discovery, provider/PTY/network, rendered, mobile, mixed-version, cross-platform or full-gate execution is claimed. Audit3315 execution amendment: the reduced two-suite reconnect selector passed on Linux (2 cases). Original source-review statements about no fresh execution describe the earlier static review; this new receipt validates only these two local deterministic unit cases, not the complete gate or physical/runtime/rendered/provider/platform parity. Historical seven-case macOS receipt remains archived verbatim. Audit 3312 retires the ordinary six-pane distinct-live-handle reconnect/resubscription alarm from paired-reconnect-multi-pane-materialization.test.ts. The unchanged parked-pane activation/rematerialization case remains narrower and is not an equivalent replacement. The complete prior seven-contract macOS receipt is archived as historical evidence; it does not validate the reduced selector. No fresh socket, PTY, sleep/wake, provider, platform, mobile, mixed-version or rendered execution is claimed. Audit3096: remove the deleted reconnect-banner selector and its two UI aliases. The reduced recovery-state selector retains only the deadline cancelling pending backoff and explicit retry owning a new epoch alias; healthy-replacement stale-schedule and independent caller-cutoff cancellation aliases retire. Other retained state cases cover reentrant retry, owner settlement and same-epoch parked revival, without replacing those removed alarms. Prior admission-selector retirement, archived July 28 receipt, unrelated selectors/claims/receipts and old gaps remain unchanged; no fresh execution is claimed. Audit3086: retire the destroyed fresh-session fallback settlement/non-destructive reattach alias and its direct selector; retain the detach/attach selector and assertion unchanged. The retained admission cases cover adopt-before-data and explicitly buffered-death admission without a new spawn, without replacing fallback retirement. July 28 evidence was already archived by audit3077; no duplicate retirement or new execution is claimed. Audit2709 removes src/renderer/src/runtime/web-session-tabs-sync/inventory/remote-runtime-session-tabs-inflight.test.ts: intentionally retire waiting out an older inventory and sharing a fresh post-operation request among concurrent callers. No equivalent replacement or fresh execution is claimed. Dated receipts remain historical evidence for their unchanged selectors only; they do not validate the reduced commands or full current gate. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/ssh/connection/ssh-connection-manager.test.ts: tears a failed startup down quietly, so its error is not replaced by a disconnect; marks a dial that never reached the host, so setup reports SSH’s reason; removes the registration when bulk teardown fails; leaves a connection whose own reconnect is asking the user alone; clears the pool entry when the closed connection is still the registered one; still reuses a connection that is already up; dials a user's connection test. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2052 (sources2049/2050/2051): Remove complete low-value restored-pane-title and pane-visibility-identity suites and their current selectors. Their supplied snapshot/title and nullable identity-comparison alarms are intentionally lost without replacement. Unrelated dated evidenceRuns remain unchanged and do not validate the reduced commands. No fresh gate execution, actual PTY/provider, rendered, remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the terminal-create idempotency forwarding suite and its prospective selector. Preserve2 unrelated receipts without claiming the lost forwarding alarm was replaced. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete complete transport-unmount and queued-initial-CWD helper suites: despite lifecycle-shaped fixtures, the unmount owner returns a Boolean PTY-id predicate, while CWD cases check nullish field selection and callback counts. Lose their detach/destroy/teardown and one-shot-CWD supplied examples. Partial queued-pane-startup loses three identical/empty/nonowner identity examples, retaining four exact one-shot/replacement ownership callbacks. No assertion object maps to these three sources, so unrelated alias objects remain byte-exact. Preserve the current81ed prior removal of pane-split-startup; stale bd948 source metadata snapshots are not replayed. No actual process/PTY startup, transport shutdown, live SSH or rendered recovery is proven by this metadata change. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Delete the sole supplied public-SSH-state spread/sanitized-error projection and its provider-authority-pair alias. Also delete the complete tiny one-shot split-startup wrapper suite: callback-visible temporary field/reset, sequential payload and thrown-sentinel reset alarms disappear. No SSH provider epoch handoff, connection, process startup or actual terminal split was performed by either deleted suite. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Historical prior account (preserved verbatim): Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1301 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic renderer coverage proves retained native and runtime SSH payloads are admitted through production routes only with valid complete authority, stale cleanup cannot unregister a replacement runtime terminal, direct SSH Git and folder panes keep their PTY bindings through disconnect and reconnect, one authority chain stops after two automatic attempts even when each timeout exceeds the rolling window, rejected acknowledgements mutate no store maps, and one shared exact attempt admits every concurrent split-pane spawn and reattach while preserving the first PTY as the tab fallback. A later sibling failure rotates the tab once, stale callbacks from the prior attempt mutate no state, split remount activity suppression is counted per leaf, primary PTY exit promotes a bound survivor or preserves an empty continuation gap for a late sibling, and primary, non-primary, or null-PTY detach preserves exact authority on both resulting tabs. Intentional pane disposal cancels its settlement timer without breaking StrictMode remount timeout ownership. A mounted remote-runtime terminal survives repeated transport partitions without changing PTY identity. A real encrypted-WebSocket oracle proves a successful reachability probe can replace a pre-ready shared-control socket without rejecting or duplicating the waiting RPC. Direct SSH coordinator tests cover immediate terminal finalization, hydration correction, damping, bounded retry, and telemetry non-interference. Client/server heartbeat tests cover timer suspension, socket generations fence stale callbacks, cold restored-terminal attachment retries, cached pixels remain unhealthy until authoritative replay, automatic retries stop after one minute, manual reconnect preserves the PTY, and pane closure releases recovery UI state. Current-transport recovery clears every error that transport surfaced without clearing or displaying a sibling pane's errors, while transport suppression, pane retention, and the rendered surface are independently bounded. Current macOS Electron journeys against an ephemeral Linux Docker SSH target cover exact-authority repo/worktree hydration, live terminal recovery after disconnect/reconnect, and eager six-terminal remount after renderer reload. A Windows remote-runtime smoke covers reachability and PTY round-trip. Multi-target live fanout, paired-close, WSL, and patched live partition journeys remain gaps. The test-value audit narrowed resolved-worktree-execution-host.test.ts to cache reuse and invalidation. Its direct hydrated-worktree, missing-folder, restored-owner, host-stamp and empty-runtime selection alarms are lost. Other routing and recovery suites do not establish equivalent selector coverage; historical run commands and results remain historical. The test-value audit removes standalone unwritten/released renderer-authority and cross-scope request-count examples. The retained synthetic mirror/store/sidebar and pending-inventory checks do not establish real PTY byte ownership, SSH reconnection or equivalent replacement coverage; historical commands and results remain historical. The test-value audit removes direct join/label ledgers, immediate failure and negative-only stale/removal/partial-authority examples, plus the standalone retained/live event projection. Retained synthetic store/hydration compositions do not establish real SSH continuity, remote authority delivery or equivalent replacement alarms. Historical commands and results remain historical. The renderer scheduling fixture retains in-flight coalescing only. Its immediate publication and negative stale-SSH-cleanup call ledgers were removed; the retained SSH recovery evidence does not replace those alarms. The accepted-handle-events observer suite is removed, including its scoped listener and settlement-release assertions. These observer alarms are lost; retained SSH/transport journeys are not equivalent replacement coverage. The test-value audit removed repeated remote-handle rotation inventories and snapshot-first pending-restart migration examples from terminal-pty-identity-replacement.test.ts, plus direct foreground metadata setter, confirmation, evidence-enum, and prefix/worktree cleanup examples. Those rotation, pending-restart, snapshot-first migration, and foreground scalar-update alarms are lost. The retained replacement case observes pane and tab identities in one subscriber publication; it does not establish equivalent migration, process-evidence, or input-routing coverage. Historical commands and results remain historical. The test-value audit narrows terminals-hydration.test.ts to a real reconnect batch with one measured store publication and hydration-seeded history consumed by a subsequent visit/Back check. Direct split-layout, runtime/folder/floating restoration, dead-leaf focus, cold/known-absent SSH deferral, title, default-tab marker, navigation initialization, and hydrationSucceeded scalar examples are removed; those specific alarms are lost. No actual target-removal transition, live SSH connection, session writer, or persisted restart is exercised by the retained cases. The old target-scoped/snapshot assertion references are retired because the current file does not contain those oracles. Other suites and historical runs do not establish equivalent replacement coverage. Audit1299 removes tests/e2e/terminal-cold-activation-deferral.spec.ts. Private-state/work-budget/assembled-fixture alarms are intentionally lost; retained suites are not equivalent replacement coverage. No new runtime/platform evidence is claimed. Audit1301: src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts reduced. Direct dedupe eviction/count and equal receipt-position sample loses authored alarm. No equivalent replacement coverage is claimed. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1342: src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts removed. Initial and event-triggered partial-authority hydration fixture alarms disappear. src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts removed. Multiline dedup/storm bounds, resource classification/collision, scoped clear/reconnect strip and1000-pane map count alarms disappear. No equivalent replacement coverage is claimed. Audit1396: src/renderer/src/components/terminal-pane/pty-connection-pending-spawn.spec.ts reduced. Lose standalone debug-state retention/log silence alarm. React StrictMode is not mounted; bindings manually simulate remount over mocked transport. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/ipc/ssh/ssh.test.ts reduced. Lose trivial missing target and mocked publication inventory. Preexisting unresolved ../ssh/ssh-port-scanner mock is recorded, not fixed. src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts reduced. Removes three no-op/work-count registrations; retains externally observed ownership consistency. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1412: src/main/ssh/ssh-provider-authority.test.ts removed. Loses real AbortController revocation/target isolation/reentrancy outcomes, recreated-target generation-floor/session rollover behavior, stale mutation refusal and settled-registration cleanup alarms. These useful alarms are deliberately lost; no equivalent cancellation coverage is claimed. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1743 removes the standalone line-height clamp/default and pane cwd fallback helper tests (5 authored cases). These trivial-helper alarms are intentionally lost, with no equivalent replacement. Only current commands/testFiles lose the deleted selectors; historical receipts and evidenceRuns remain unchanged and do not validate the reduced commands.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-3107",
"https://github.com/stablyai/orca/pull/12664",
@@ -9329,9 +9353,9 @@
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/store/terminals/terminal-pty-identity-replacement.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/ui/workspace-navigation-history-hydration.test.ts src/renderer/src/store/repos/repos-ssh-host-reconciliation.test.ts --reporter=dot",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh/ssh.test.ts src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts src/main/ssh/connection/ssh-connection-manager.test.ts src/main/ssh/connection/ssh-connection.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh/ssh.test.ts src/main/ssh/connection/ssh-connection-manager.test.ts src/main/ssh/connection/ssh-connection.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts --reporter=dot",
"pnpm exec electron-vite build --mode e2e",
"pnpm run build:web-from-renderer",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
@@ -9350,13 +9374,11 @@
"src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts",
"src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts",
"src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts",
- "src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts",
"src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts",
"tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts",
"src/renderer/src/store/slices/ui/workspace-navigation-history-hydration.test.ts",
"src/renderer/src/store/repos/repos-ssh-host-reconciliation.test.ts",
"src/main/ipc/ssh/ssh.test.ts",
- "src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts",
"src/main/ssh/connection/ssh-connection-manager.test.ts",
"src/main/ssh/connection/ssh-connection.test.ts",
"src/preload/ssh-authority-forwarding.test.ts",
@@ -9559,7 +9581,8 @@
"Audit3359 historical original assertionRefs object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-handoff.test.ts\",\n \"assertions\": [\n \"a stale create completion cannot replace or close a newer attachment, including when two runtimes use the same raw handle\"\n ]\n }",
"Audit3368 narrows stream-reconnect coverage to the actual ten synthetic transport epochs retaining one PTY identity, accepting and holding detached input for exactly-once later delivery, current decoded output and per-epoch subscription release. Prior rejection wording was inaccurate. Phase/backoff/cutoff/manual reconnect and parser/OSC/pause/retained-image/fatal/latch/claim/early-close alarms are intentionally lost without equivalent replacement. The Linux multi-pane reconnect receipt remains verbatim with its original scope; no fresh live SSH/provider/PTY/UI/mobile/mixed-version/cross-platform evidence is claimed.",
"Audit3368 historical original assertionRefs object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts\",\n \"assertions\": [\n \"recovery exposes connecting, recovering, backoff, connected, and fatal-offline phases with fenced epochs\",\n \"ten partition cycles retain one PTY identity, reject detached input, and unsubscribe each epoch exactly once\",\n \"automatic retries stop after one minute with no fatal error, no further requests, and no stale input\",\n \"manual reconnect starts a new epoch, resubscribes the same PTY exactly once, and becomes healthy only after its snapshot\"\n ]\n }",
- "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts --reporter=dot\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/store/terminals/terminal-pty-identity-replacement.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/ui/workspace-navigation-history-hydration.test.ts src/renderer/src/store/repos/repos-ssh-host-reconciliation.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts --reporter=dot\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh/ssh.test.ts src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts src/main/ssh/connection/ssh-connection-manager.test.ts src/main/ssh/connection/ssh-connection.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts --reporter=dot\",\n \"pnpm exec electron-vite build --mode e2e\",\n \"pnpm run build:web-from-renderer\",\n \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"\n ]\ntestFiles: [\n \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts\",\n \"src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts\",\n \"src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts\",\n \"src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts\",\n \"src/renderer/src/store/terminals/terminal-pty-identity-replacement.test.ts\",\n \"src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts\",\n \"src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n \"src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts\",\n \"src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts\",\n \"src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts\",\n \"src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\",\n \"tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts\",\n \"src/renderer/src/store/slices/ui/workspace-navigation-history-hydration.test.ts\",\n \"src/renderer/src/store/repos/repos-ssh-host-reconciliation.test.ts\",\n \"src/main/ipc/ssh/ssh.test.ts\",\n \"src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts\",\n \"src/main/ssh/connection/ssh-connection-manager.test.ts\",\n \"src/main/ssh/connection/ssh-connection.test.ts\",\n \"src/preload/ssh-authority-forwarding.test.ts\",\n \"src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts\",\n \"src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts\",\n \"src/shared/ssh-retained-payload-admission.test.ts\"\n ]\nassertionRefs: [\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts\",\n \"assertions\": [\n \"a pane parked while the client slept is authoritatively activated and rematerialized without leaving any pane handle null\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts\",\n \"assertions\": [\n \"ten synthetic partition cycles retain one PTY identity, deliver each held detached input exactly once and release each epoch subscription exactly once; decoded live input/output remains current\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts\",\n \"assertions\": [\n \"the automatic-recovery deadline cancels pending backoff and a manual retry owns a new epoch\"\n ]\n },\n {\n \"file\": \"src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts\",\n \"assertions\": [\n \"a suspended client receives a fresh probe deadline after resume and post-resume activity clears it\"\n ]\n },\n {\n \"file\": \"src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\",\n \"assertions\": [\n \"one authenticated client/worktree mutation derives a stable server-owned terminal handle\",\n \"an unknown-outcome retry adopts the same provider PTY after runtime-process restart without rerunning startup\",\n \"retry inventory failure, missing same-worktree identity metadata, or ownership mismatch fails closed without spawning\",\n \"in-flight mutation coordination is bounded and releases capacity after settlement\"\n ]\n },\n {\n \"file\": \"src/main/ssh/connection/ssh-connection-manager.test.ts\",\n \"assertions\": [\n \"disconnect invalidates a pending transport attempt immediately so late rejection or resolution cannot remove the replacement\"\n ]\n },\n {\n \"file\": \"src/main/ssh/connection/ssh-connection.test.ts\",\n \"assertions\": [\n \"late ssh2 ready and startup error events after disconnect cannot resurrect or overwrite disconnected state\"\n ]\n },\n {\n \"file\": \"src/preload/ssh-authority-forwarding.test.ts\",\n \"assertions\": [\n \"full authority crosses Electron IPC without loss\",\n \"partial authority becomes unknown for bounded reconciliation and malformed full authority is dropped\",\n \"variable-form host-qualified worktree requests retain fail-closed outcomes in their return type\"\n ]\n },\n {\n \"file\": \"src/shared/ssh-retained-payload-admission.test.ts\",\n \"assertions\": [\n \"retained connection states reject partial or malformed authority\",\n \"only partial compatibility authority can normalize to unknown for bounded direct-SSH reconciliation\",\n \"shared direct SSH authority admission requires bounded identifiers and a non-negative safe generation\"\n ]\n },\n {\n \"file\": \"src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts\",\n \"assertions\": [\n \"partial runtime authority is rejected through the captured subscription callback before environment state receives it\"\n ]\n },\n {\n \"file\": \"src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts\",\n \"assertions\": [\n \"held replies from an old generation cannot replace a newer generation; failed full refresh preserves live state behind queued metadata\",\n \"an unknown target triggers an authoritative list reread\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts\",\n \"assertions\": [\n \"a StrictMode remount joins the pending spawn instead of starting a second one\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts\",\n \"assertions\": [\n \"abandoning an obsolete reattach drops its data, replay, write-unavailable, and exit handlers without killing the durable PTY\"\n ]\n }\n ]"
+ "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts --reporter=dot\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/store/terminals/terminal-pty-identity-replacement.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/ui/workspace-navigation-history-hydration.test.ts src/renderer/src/store/repos/repos-ssh-host-reconciliation.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts --reporter=dot\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh/ssh.test.ts src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts src/main/ssh/connection/ssh-connection-manager.test.ts src/main/ssh/connection/ssh-connection.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts --reporter=dot\",\n \"pnpm exec electron-vite build --mode e2e\",\n \"pnpm run build:web-from-renderer\",\n \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"\n ]\ntestFiles: [\n \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts\",\n \"src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts\",\n \"src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts\",\n \"src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts\",\n \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts\",\n \"src/renderer/src/store/terminals/terminal-pty-identity-replacement.test.ts\",\n \"src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts\",\n \"src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n \"src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts\",\n \"src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts\",\n \"src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts\",\n \"src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\",\n \"tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts\",\n \"src/renderer/src/store/slices/ui/workspace-navigation-history-hydration.test.ts\",\n \"src/renderer/src/store/repos/repos-ssh-host-reconciliation.test.ts\",\n \"src/main/ipc/ssh/ssh.test.ts\",\n \"src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts\",\n \"src/main/ssh/connection/ssh-connection-manager.test.ts\",\n \"src/main/ssh/connection/ssh-connection.test.ts\",\n \"src/preload/ssh-authority-forwarding.test.ts\",\n \"src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts\",\n \"src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts\",\n \"src/shared/ssh-retained-payload-admission.test.ts\"\n ]\nassertionRefs: [\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts\",\n \"assertions\": [\n \"a pane parked while the client slept is authoritatively activated and rematerialized without leaving any pane handle null\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts\",\n \"assertions\": [\n \"ten synthetic partition cycles retain one PTY identity, deliver each held detached input exactly once and release each epoch subscription exactly once; decoded live input/output remains current\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts\",\n \"assertions\": [\n \"the automatic-recovery deadline cancels pending backoff and a manual retry owns a new epoch\"\n ]\n },\n {\n \"file\": \"src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts\",\n \"assertions\": [\n \"a suspended client receives a fresh probe deadline after resume and post-resume activity clears it\"\n ]\n },\n {\n \"file\": \"src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\",\n \"assertions\": [\n \"one authenticated client/worktree mutation derives a stable server-owned terminal handle\",\n \"an unknown-outcome retry adopts the same provider PTY after runtime-process restart without rerunning startup\",\n \"retry inventory failure, missing same-worktree identity metadata, or ownership mismatch fails closed without spawning\",\n \"in-flight mutation coordination is bounded and releases capacity after settlement\"\n ]\n },\n {\n \"file\": \"src/main/ssh/connection/ssh-connection-manager.test.ts\",\n \"assertions\": [\n \"disconnect invalidates a pending transport attempt immediately so late rejection or resolution cannot remove the replacement\"\n ]\n },\n {\n \"file\": \"src/main/ssh/connection/ssh-connection.test.ts\",\n \"assertions\": [\n \"late ssh2 ready and startup error events after disconnect cannot resurrect or overwrite disconnected state\"\n ]\n },\n {\n \"file\": \"src/preload/ssh-authority-forwarding.test.ts\",\n \"assertions\": [\n \"full authority crosses Electron IPC without loss\",\n \"partial authority becomes unknown for bounded reconciliation and malformed full authority is dropped\",\n \"variable-form host-qualified worktree requests retain fail-closed outcomes in their return type\"\n ]\n },\n {\n \"file\": \"src/shared/ssh-retained-payload-admission.test.ts\",\n \"assertions\": [\n \"retained connection states reject partial or malformed authority\",\n \"only partial compatibility authority can normalize to unknown for bounded direct-SSH reconciliation\",\n \"shared direct SSH authority admission requires bounded identifiers and a non-negative safe generation\"\n ]\n },\n {\n \"file\": \"src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts\",\n \"assertions\": [\n \"partial runtime authority is rejected through the captured subscription callback before environment state receives it\"\n ]\n },\n {\n \"file\": \"src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts\",\n \"assertions\": [\n \"held replies from an old generation cannot replace a newer generation; failed full refresh preserves live state behind queued metadata\",\n \"an unknown target triggers an authoritative list reread\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts\",\n \"assertions\": [\n \"a StrictMode remount joins the pending spawn instead of starting a second one\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts\",\n \"assertions\": [\n \"abandoning an obsolete reattach drops its data, replay, write-unavailable, and exit handlers without killing the durable PTY\"\n ]\n }\n ]",
+ "Audit3554 intentionally removes the whole worktrees-ssh-repo-owner-resolution suite (2 authored cases). Dedicated duplicate-exact/ambiguous-legacy owner refusal and fixed runtime-host/wrong-target/missing-authority/zero-owner/contradictory-owner status alarms are lost. The suite did not exercise an authority transition or actual SSH listing; its no-local-Git spy was also unreachable on an admitted SSH metadata-only route. Remaining suites are not equivalent replacements. Current selectors have no fresh execution from this static packet; historical receipts retain their original scope. No new SSH/provider/native/UI/mobile/mixed-version/cross-platform result is claimed."
],
"demotionRule": "Cannot promote if provider failure can close panes or if the oracle is screenshot-only."
},
@@ -9761,7 +9784,7 @@
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos", "linux"],
"coveredProviders": [],
- "coverageNotes": "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked AgentTerminalPreview component suite is removed, including the snapshot-proven kitty mirror forwarding alarm. Remove its active file, command token and assertion reference; the other IME drivers are unchanged and do not replace the removed component checks. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1619 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally reduces src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts: Loses direct timestamp-formula assertion; no useful independent alarm in removed registration. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1361 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1320 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1301 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): This audit removes the browser native-keyboard fallback inventory case. Its empty-chord, absent-layout and no-op-subscription alarms are lost; retained native input evidence is not an equivalent replacement. Historical commands and results remain historical. Local macOS and containerized Linux evidence, deterministic renderer-unit coverage for the Linux/Sogou candidate-key policy including the legacy orphaned-keyup fallback, xterm preedit visibility and row-occlusion behavior, Electron/CDP preedit geometry, Electron/CDP live-PTY Sogou-style repros, and macOS renderer/main slices for Preview kitty commits and layout-native Option input. The Option slice covers complete CSI-u flag fields including lock state, repeat/release event types, authoritative committed associated text, native dead-key release suppression, functional-versus-printable numpad codes, press-pinned release identity, live keyup modifiers, pending-layout text fallback, atomic layout refresh, rapid in-focus input-source changes, stable native layout characters, and both native/web preload fallbacks. The standalone remote SnapshotStart metadata suite is removed. Its proven-zero, nonzero, absent-field and malformed-value propagation alarms are intentionally lost; retained daemon and preview consumer contracts do not establish equivalent remote projection coverage. Historical commands and results remain historical. Real Linux/Sogou OS IME automation, native Windows candidate-window placement, Windows ConPTY post-agent reset, and the CJK/Vietnamese/Arabic matrix remain registered gaps. The audit removes isolated candidate-anchor width, last-column, timer-ordering and detached-textarea examples. The retained deterministic fixtures do not observe a native candidate window or establish equivalent geometry coverage; separate Electron geometry evidence remains historical. The test-value audit removes the empty end-of-row/no-tail composition baseline from terminal-korean-midline-preedit-occlusion.spec.ts. The placeholder masking and measured row-tail occlusion registrations remain; they are not equivalent replacement coverage for the removed empty-tail alarm. No new execution or native IME evidence is claimed. Audit1301: src/renderer/src/components/terminal-pane/terminal-shortcut-option-compose.test.ts reduced. Dead-key/IME variants, Unicode/language inventories, numpad/CapsLock cases and other protocol samples lose their individual alarms. No equivalent replacement coverage is claimed. Audit1320: src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts reduced. Last-complete snapshot while layout-map/native-snapshot partial refresh settles loses its individual implementation-cache alarm. No equivalent replacement coverage is claimed. Audit1342: src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts reduced. Second Korean-layout replay, ordinary Korean/ASCII no-remap baselines and weak Option nonempty-byte alarm are dropped. No equivalent replacement coverage is claimed. Audit1361: src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts removed. Snapshot/live-proven kitty flags, replacement choice and replay idempotence in the assembled mirror. No equivalent replacement coverage is claimed. Audit1365: focused Linux unit selection passed on source head 8880357cb420c45f1b808ae545a5bc609324624d. This new result has its own exact command; historical results keep their prior scope. Intentional test losses remain recorded in knownGaps. No physical-provider, native input, rendered E2E, p95, soak or replacement-coverage claim. Audit1391: src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts reduced. Lose explicit one-read/unchanged-style work budget across 30 syllables and single-timer burst alarm. Synthetic screen bounds/terminal cursor bound retained proof to DOM anchor updates, not actual OS IME placement. src/renderer/src/components/terminal-pane/terminal-kitty-csi-u-encoding.test.ts reduced. Lose explicit PC-101 alternate omission, multi-codepoint/control associated text filtering, lock modifier integer, shifted punctuation, standalone separator and printable nonfunctional keypad fallbacks. Retained pure encoding is a wire-contract check without host input delivery. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1396: src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts reduced. Lose standalone handled Ctrl, Shift+Space, shifted non-ASCII keydown and active-composition backspace/arrow/text/Process suppression alarms. No actual IME/PTY encoding occurs. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/lib/keyboard-layout/option-as-alt-probe.test.ts removed. Intentionally loses invalidation, focus/manual refresh gating and stale/newest generation settlement outcomes, including direct stale category suppression. No equivalent replacement or default preload input-source delivery claim. src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts removed. Intentionally loses substituted sentence punctuation, shifted/backslash/multi-unit/full-width/letter input and Kitty flag/release/report encoding alarms across14 authored registrations. No equivalent replacement or real pane/browser input delivery claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
+ "coverageNotes": "Audit3699 removes the complete restored app-owned-copy xterm bypass predicate suite (3 authored/3 finite). Intentionally lose Linux/Windows Ctrl+Shift+C keydown/keyup and logical-over-physical-key pass-through, selection/Kitty-disabled/defaultPrevented refusal, and macOS Cmd+C pass-through/selection/Kitty-disabled policy alarms. No actual browser dispatch, clipboard operation, negotiated application bytes, native key delivery or PTY result was established by this driver. No equivalent replacement or fresh execution claimed. Preserve all prior dated receipts and historical accounts. Previous account (preserved verbatim): Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked AgentTerminalPreview component suite is removed, including the snapshot-proven kitty mirror forwarding alarm. Remove its active file, command token and assertion reference; the other IME drivers are unchanged and do not replace the removed component checks. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1619 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally reduces src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts: Loses direct timestamp-formula assertion; no useful independent alarm in removed registration. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1361 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1320 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1301 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): This audit removes the browser native-keyboard fallback inventory case. Its empty-chord, absent-layout and no-op-subscription alarms are lost; retained native input evidence is not an equivalent replacement. Historical commands and results remain historical. Local macOS and containerized Linux evidence, deterministic renderer-unit coverage for the Linux/Sogou candidate-key policy including the legacy orphaned-keyup fallback, xterm preedit visibility and row-occlusion behavior, Electron/CDP preedit geometry, Electron/CDP live-PTY Sogou-style repros, and macOS renderer/main slices for Preview kitty commits and layout-native Option input. The Option slice covers complete CSI-u flag fields including lock state, repeat/release event types, authoritative committed associated text, native dead-key release suppression, functional-versus-printable numpad codes, press-pinned release identity, live keyup modifiers, pending-layout text fallback, atomic layout refresh, rapid in-focus input-source changes, stable native layout characters, and both native/web preload fallbacks. The standalone remote SnapshotStart metadata suite is removed. Its proven-zero, nonzero, absent-field and malformed-value propagation alarms are intentionally lost; retained daemon and preview consumer contracts do not establish equivalent remote projection coverage. Historical commands and results remain historical. Real Linux/Sogou OS IME automation, native Windows candidate-window placement, Windows ConPTY post-agent reset, and the CJK/Vietnamese/Arabic matrix remain registered gaps. The audit removes isolated candidate-anchor width, last-column, timer-ordering and detached-textarea examples. The retained deterministic fixtures do not observe a native candidate window or establish equivalent geometry coverage; separate Electron geometry evidence remains historical. The test-value audit removes the empty end-of-row/no-tail composition baseline from terminal-korean-midline-preedit-occlusion.spec.ts. The placeholder masking and measured row-tail occlusion registrations remain; they are not equivalent replacement coverage for the removed empty-tail alarm. No new execution or native IME evidence is claimed. Audit1301: src/renderer/src/components/terminal-pane/terminal-shortcut-option-compose.test.ts reduced. Dead-key/IME variants, Unicode/language inventories, numpad/CapsLock cases and other protocol samples lose their individual alarms. No equivalent replacement coverage is claimed. Audit1320: src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts reduced. Last-complete snapshot while layout-map/native-snapshot partial refresh settles loses its individual implementation-cache alarm. No equivalent replacement coverage is claimed. Audit1342: src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts reduced. Second Korean-layout replay, ordinary Korean/ASCII no-remap baselines and weak Option nonempty-byte alarm are dropped. No equivalent replacement coverage is claimed. Audit1361: src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts removed. Snapshot/live-proven kitty flags, replacement choice and replay idempotence in the assembled mirror. No equivalent replacement coverage is claimed. Audit1365: focused Linux unit selection passed on source head 8880357cb420c45f1b808ae545a5bc609324624d. This new result has its own exact command; historical results keep their prior scope. Intentional test losses remain recorded in knownGaps. No physical-provider, native input, rendered E2E, p95, soak or replacement-coverage claim. Audit1391: src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts reduced. Lose explicit one-read/unchanged-style work budget across 30 syllables and single-timer burst alarm. Synthetic screen bounds/terminal cursor bound retained proof to DOM anchor updates, not actual OS IME placement. src/renderer/src/components/terminal-pane/terminal-kitty-csi-u-encoding.test.ts reduced. Lose explicit PC-101 alternate omission, multi-codepoint/control associated text filtering, lock modifier integer, shifted punctuation, standalone separator and printable nonfunctional keypad fallbacks. Retained pure encoding is a wire-contract check without host input delivery. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1396: src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts reduced. Lose standalone handled Ctrl, Shift+Space, shifted non-ASCII keydown and active-composition backspace/arrow/text/Process suppression alarms. No actual IME/PTY encoding occurs. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/lib/keyboard-layout/option-as-alt-probe.test.ts removed. Intentionally loses invalidation, focus/manual refresh gating and stale/newest generation settlement outcomes, including direct stale category suppression. No equivalent replacement or default preload input-source delivery claim. src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts removed. Intentionally loses substituted sentence punctuation, shifted/backslash/multi-unit/full-width/letter input and Kitty flag/release/report encoding alarms across14 authored registrations. No equivalent replacement or real pane/browser input delivery claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6699",
"https://github.com/stablyai/orca/pull/6682",
@@ -9772,7 +9795,7 @@
"https://github.com/stablyai/orca/pull/17170"
],
"invariant": "Composition, native text forwarding, synthetic input, paste, and platform keyboard bypass paths must not send preedit/control bytes before commit and must commit text exactly once to the intended PTY. A live preedit must stay visible across an IME-resumed transaction, preserve every committed row-tail cell hidden by its opaque overlay, mask only a structurally verified Codex or Claude placeholder and never a row carrying typed text, keep the themed insertion caret and native candidate anchor inside the terminal at the final column, and clean up without stale overlay children or ownership classes. Layout-native Option text must preserve negotiated CSI-u alternate/associated fields and lock modifiers, distinguish repeat from press, and resolve releases with the press's primary identity plus the actual keyup modifiers without exposing a partial or stale layout refresh. An in-focus macOS input-source change must invalidate both renderer authorities before the next key can use the old source. When the snapshot source proves kitty state, macOS Preview commits must use the application's effective flags after the sequenced snapshot and every proven replay/live transition, and a claimed press delivered under report_event_types must produce exactly one matching release regardless of whether keyup arrives before or after insertText and regardless of xterm's defensive internal reset.",
- "oracle": "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked AgentTerminalPreview component suite is removed, including the snapshot-proven kitty mirror forwarding alarm. Remove its active file, command token and assertion reference; the other IME drivers are unchanged and do not replace the removed component checks. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Exact outbound bytes from the REAL native-text forwarder behind installPreviewImeBridge after initial snapshot restore, replacement resync, live transitions, and both keydown->insertText->keyup and keydown->keyup->insertText orderings; a wiring-only mock is supporting evidence, not the oracle. The current renderer-unit slice asserts native text commits route to the intended PTY once, composition/preedit bookkeeping does not leak premature text, resumed Windows event traces reactivate the visible preedit, an opaque mid-line overlay reproduces the committed row tail it covers, arbitrary DIM output remains visible, and final-column layout keeps both caret and textarea candidate anchor within the available screen width. The retained candidate-anchor slice checks layout-read caching, deferred timer coalescing, recognized-screen follow-ups and refit refresh with deterministic DOM fixtures. A Codex frame whose prompt row is bold and whose dimmed model footer sits below a blank gap acquires the mask class while composing; the same placeholder text without that footer, a framed-versus-unframed Claude prompt, a row of arbitrary dimmed output, and a row carrying typed text do not. The class is gone after composition end, after a blur that is not followed by a session end, and after disposal. Rendered Electron/CDP geometry independently proves the overlay reproduces every committed cell it hides, that a real Codex placeholder at column 2 is masked rather than repeated, and that the final-column caret, preedit, and textarea right edges all land inside the screen. Input-source classification handles synthetic/native paths, paste/runtime forwarding avoids duplicate terminal payloads for covered fixtures, and real fcitx4/Sogou captures send only the committed candidate for Space/digit picks while ordinary typing, literal Space and digits stay available. A main/preload/renderer notification chain proves every live window invalidates immediately, the old native read settles before a coalesced refresh signal, and older refreshes are generation-fenced. The Electron/CDP live-PTY repro verifies Sogou-style Space and digit selectors submit only the committed Chinese text. Real legacy IME commit preservation, native candidate-window placement, and the full CJK/Vietnamese/Arabic/JIS-yen matrix run in follow-up platform soak where automation is possible.",
+ "oracle": "Audit3699 removes the complete restored app-owned-copy xterm bypass predicate suite (3 authored/3 finite). Intentionally lose Linux/Windows Ctrl+Shift+C keydown/keyup and logical-over-physical-key pass-through, selection/Kitty-disabled/defaultPrevented refusal, and macOS Cmd+C pass-through/selection/Kitty-disabled policy alarms. No actual browser dispatch, clipboard operation, negotiated application bytes, native key delivery or PTY result was established by this driver. No equivalent replacement or fresh execution claimed. Preserve all prior dated receipts and historical accounts. Previous oracle (preserved verbatim): Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked AgentTerminalPreview component suite is removed, including the snapshot-proven kitty mirror forwarding alarm. Remove its active file, command token and assertion reference; the other IME drivers are unchanged and do not replace the removed component checks. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Exact outbound bytes from the REAL native-text forwarder behind installPreviewImeBridge after initial snapshot restore, replacement resync, live transitions, and both keydown->insertText->keyup and keydown->keyup->insertText orderings; a wiring-only mock is supporting evidence, not the oracle. The current renderer-unit slice asserts native text commits route to the intended PTY once, composition/preedit bookkeeping does not leak premature text, resumed Windows event traces reactivate the visible preedit, an opaque mid-line overlay reproduces the committed row tail it covers, arbitrary DIM output remains visible, and final-column layout keeps both caret and textarea candidate anchor within the available screen width. The retained candidate-anchor slice checks layout-read caching, deferred timer coalescing, recognized-screen follow-ups and refit refresh with deterministic DOM fixtures. A Codex frame whose prompt row is bold and whose dimmed model footer sits below a blank gap acquires the mask class while composing; the same placeholder text without that footer, a framed-versus-unframed Claude prompt, a row of arbitrary dimmed output, and a row carrying typed text do not. The class is gone after composition end, after a blur that is not followed by a session end, and after disposal. Rendered Electron/CDP geometry independently proves the overlay reproduces every committed cell it hides, that a real Codex placeholder at column 2 is masked rather than repeated, and that the final-column caret, preedit, and textarea right edges all land inside the screen. Input-source classification handles synthetic/native paths, paste/runtime forwarding avoids duplicate terminal payloads for covered fixtures, and real fcitx4/Sogou captures send only the committed candidate for Space/digit picks while ordinary typing, literal Space and digits stay available. A main/preload/renderer notification chain proves every live window invalidates immediately, the old native read settles before a coalesced refresh signal, and older refreshes are generation-fenced. The Electron/CDP live-PTY repro verifies Sogou-style Space and digit selectors submit only the committed Chinese text. Real legacy IME commit preservation, native candidate-window placement, and the full CJK/Vietnamese/Arabic/JIS-yen matrix run in follow-up platform soak where automation is possible.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-macos-keybinding-dict-trace.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-linux-fcitx4-trace-replay.test.ts",
@@ -9930,6 +9953,7 @@
"Pair with Windows ConPTY keyboard reset for Windows standard-key behavior."
],
"knownGaps": [
+ "Audit3699 removes the complete restored app-owned-copy xterm bypass predicate suite (3 authored/3 finite). Intentionally lose Linux/Windows Ctrl+Shift+C keydown/keyup and logical-over-physical-key pass-through, selection/Kitty-disabled/defaultPrevented refusal, and macOS Cmd+C pass-through/selection/Kitty-disabled policy alarms. No actual browser dispatch, clipboard operation, negotiated application bytes, native key delivery or PTY result was established by this driver. No equivalent replacement or fresh execution claimed. Preserve all prior dated receipts and historical accounts.",
"NEXT65 current scope qualification: The NEXT65 knownGaps entries below govern the changed selectors and qualify any broader coverage implication in this gate’s unchanged oracle/coverageNotes narratives. Those narratives and preserved dated evidenceRuns retain their historical text and original exact execution scopes only; no fresh execution, transferred pass or equivalent replacement coverage is claimed. Upstream case removals remain upstream; original NEXT65 proposal descriptions grant no duplicate retirement credit.",
"NEXT65 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-midline-preedit-tail.test.ts, src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence.",
"NEXT65 historical original active selector fields (verbatim JSON values; not current coverage):\ncommands: [\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-macos-keybinding-dict-trace.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-linux-fcitx4-trace-replay.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-midline-preedit-tail.test.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-resumed-preedit-visibility.test.ts src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-composer-placeholder-mask.test.ts src/shared/terminal/input/terminal-composer-draft.test.ts src/main/daemon/emulation/testing/terminal-cursor-line-context.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/shared/terminal/protocol/input-modes/terminal-kitty-keyboard-mode-tracker.test.ts src/main/ipc/terminal-preview-output-stream.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\n \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/keyboard/terminal-option-kitty-release.test.ts src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts src/main/ipc/macos-keyboard-layout-change-notifications.test.ts src/preload/app-restart-checkpoint-routing.test.ts src/renderer/src/web/web-preload-api-ui.test.ts\",\n \"pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts\",\n \"pnpm run test:e2e -- tests/e2e/terminal-korean-endofrow-preedit-cell-span.spec.ts tests/e2e/terminal-korean-midline-preedit-occlusion.spec.ts\",\n \"pnpm run test:e2e -- tests/e2e/terminal-option-composed-ascii.spec.ts\"\n ]\ntestFiles: [\n \"tests/e2e/terminal-option-composed-ascii.spec.ts\",\n \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-native-text-forwarder.test.ts\",\n \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-macos-keybinding-dict-trace.test.ts\",\n \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-linux-fcitx4-trace-replay.test.ts\",\n \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-midline-preedit-tail.test.ts\",\n \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-resumed-preedit-visibility.test.ts\",\n \"src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts\",\n \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-composer-placeholder-mask.test.ts\",\n \"src/shared/terminal/input/terminal-composer-draft.test.ts\",\n \"src/main/daemon/emulation/testing/terminal-cursor-line-context.test.ts\",\n \"src/renderer/src/components/terminal-pane/input/keyboard/terminal-option-kitty-release.test.ts\",\n \"src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts\",\n \"src/main/ipc/macos-keyboard-layout-change-notifications.test.ts\",\n \"src/preload/app-restart-checkpoint-routing.test.ts\",\n \"src/renderer/src/web/web-preload-api-ui.test.ts\",\n \"src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts\",\n \"src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx\",\n \"src/shared/terminal/protocol/input-modes/terminal-kitty-keyboard-mode-tracker.test.ts\",\n \"src/main/ipc/terminal-preview-output-stream.test.ts\",\n \"src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\n \"tests/e2e/chinese-ime-chat-input-repro.spec.ts\",\n \"tests/e2e/terminal-korean-endofrow-preedit-cell-span.spec.ts\",\n \"tests/e2e/terminal-korean-midline-preedit-occlusion.spec.ts\"\n ]\nassertionRefs: [\n {\n \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-linux-fcitx4-trace-replay.test.ts\",\n \"assertions\": [\n \"real fcitx4 Sogou captures (GTK module and XIM) send only the committed candidate for Space and digit picks, under legacy keys and kitty flags 1 and 5\",\n \"a real fcitx4 Google Pinyin in-client preedit still commits through the composition path\",\n \"an XIM pick's code-less keydown pairs with its keyup so kitty event reporting sends one release per pick\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-midline-preedit-tail.test.ts\",\n \"assertions\": [\n \"With supplied geometry, competing xterm render and Orca clamp preserve final-cell caret/candidate anchor positions.\",\n \"Actual xterm buffer repaint updates the row tail while the preedit remains open.\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-resumed-preedit-visibility.test.ts\",\n \"assertions\": [\"A transaction inferred from update alone commits and cleans up.\"]\n },\n {\n \"file\": \"tests/e2e/terminal-option-composed-ascii.spec.ts\",\n \"assertions\": [\n \"a live kitty-negotiated pane receives the Option-composed ASCII character, not the physical alt chord\",\n \"an Option layer that also needs Shift still reaches the pty as text\",\n \"configured Option-as-Alt still reports the layout-resolved physical chord\",\n \"a non-ASCII Option glyph still reaches the application as its alt hotkey\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/terminal-pane/input/keyboard/terminal-option-kitty-release.test.ts\",\n \"assertions\": [\n \"Autorepeat cannot replace the first release sender; a fresh press can replace an orphaned sender for the same key.\"\n ]\n },\n {\n \"file\": \"src/main/ipc/macos-keyboard-layout-change-notifications.test.ts\",\n \"assertions\": [\n \"rapid input-source changes coalesce to one latest-generation refresh signal\"\n ]\n },\n {\n \"file\": \"src/preload/app-restart-checkpoint-routing.test.ts\",\n \"assertions\": [\n \"macOS keyboard reads and the change subscription remain wired after main integration\",\n \"the two-phase change payload reaches the renderer unchanged\",\n \"the subscription disposer removes the exact IPC listener\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts\",\n \"assertions\": [\n \"the real forwarder behind the Preview bridge encodes the commit from the snapshot-proven flags before any live output\",\n \"flags 0/1 commit raw text, flags 2 add one CSI-u release, flags 8 emit one CSI-u press, and flags 10 emit a CSI-u press followed by exactly one release\",\n \"both keydown->insertText->keyup and keydown->keyup->insertText orderings produce the same bytes\",\n \"the release is emitted by the forwarder while xterm's internal kitty flags stay 0\",\n \"the mutable flags getter is read exactly once, at commit time, never on keydown or keyup\",\n \"auto-repeat, two-key rollover, a swallowed commit, a retired claim, blur, and disposal each emit at most one release and never synthesize one\"\n ]\n },\n {\n \"file\": \"src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx\",\n \"assertions\": [\n \"the Preview hands the forwarder the live kitty mirror seeded from the snapshot's proven flags\"\n ]\n },\n {\n \"file\": \"src/shared/terminal/protocol/input-modes/terminal-kitty-keyboard-mode-tracker.test.ts\",\n \"assertions\": [\n \"a fresh PTY's known 0 is distinguishable from a snapshot's unproven 0 fallback\",\n \"restoreSnapshotFlags proves only the active screen\",\n \"provenance survives absolute sets, screen switches, RIS and DECSTR, but a pop past omitted push history returns to unknown rather than a manufactured 0\"\n ]\n },\n {\n \"file\": \"src/main/ipc/terminal-preview-output-stream.test.ts\",\n \"assertions\": [\n \"a partially covered sequenced chunk retains exactly its unseen suffix in live mode\",\n \"a transformed overlap remains unsliced in replay mode\"\n ]\n },\n {\n \"file\": \"tests/e2e/chinese-ime-chat-input-repro.spec.ts\",\n \"assertions\": [\n \"Sogou-style Space candidate selection submits only the committed Chinese character\",\n \"Sogou-style digit candidate selection submits only the committed Chinese phrase\",\n \"Post-composition Sogou-style digit selection stays out of the PTY after compositionend\",\n \"Legacy orphaned-letter-keyup digit selection submits no selector byte to the PTY; real legacy candidate commit preservation remains a platform gap\"\n ]\n },\n {\n \"file\": \"tests/e2e/terminal-korean-endofrow-preedit-cell-span.spec.ts\",\n \"assertions\": [\n \"the rendered final-column preedit caret remains inside the terminal screen\",\n \"a rendered full-width Korean preedit spans materially more than the one terminal cell reported in #12729\"\n ]\n },\n {\n \"file\": \"tests/e2e/terminal-korean-midline-preedit-occlusion.spec.ts\",\n \"assertions\": [\n \"the rendered opaque overlay reproduces every committed row-tail cell its measured rectangle hides\",\n \"a real Codex placeholder with bold prompt, blank footer gap, model footer, and cursor at column 2 stays masked\"\n ]\n }\n ]",
@@ -10273,7 +10297,7 @@
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
- "coverageNotes": "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. NEXT136 retains only unchanged execution receipts at their original scopes. Reduced-source selectors and retained static assertions have no new execution or equivalent replacement credit.",
+ "coverageNotes": "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. NEXT136 retains only unchanged execution receipts at their original scopes. Reduced-source selectors and retained static assertions have no new execution or equivalent replacement credit.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-3800",
"https://linear.app/stably/issue/STA-3904",
@@ -10283,17 +10307,17 @@
"https://github.com/stablyai/orca/issues/14347"
],
"invariant": "Injected orchestration task prompts for recognized agent CLIs must send the prompt body inside one bracketed-paste frame, sanitize embedded ESC bytes, preserve chunk boundaries without losing the frame, and submit exactly once only after the agent can accept Enter. Local worker-start with supported observation must preserve an unobserved turn as start_unknown without revoking authority, closing questions, or triggering a rescue Enter; a worker report during observation must settle normally. Claude and Codex must emit a post-paste composer marker and then settle, or reach the bounded fallback first; every other agent retains the platform delay.",
- "oracle": "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Retained assertion references and unchanged receipts keep their original scopes; retired callbacks and archived receipts provide no current coverage.",
+ "oracle": "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed. Historical prior account (preserved verbatim): Audit3814 deliberately retires60 authored/60 finite cases:53runtime compatibility cases,4native XCTest methods and3Python clipboard methods, including the entire StableElementIndexes suite. Clipboard cuts retire the one-over-cap sample, incoming-offer destruction trace and sequential20-copy replay; actual wire, FD/pipe, startup and Xvfb/GTK boundaries remain without equivalent replacement claims. Accepted losses include narrow terminal-send payload/provider projections, legacy and direct no-op/error permutations, timing/work-count examples, private state/title/activity projections and fixture-driven readiness examples, individually enumerated below. These include real bounded production alarms consciously retired for marginal value; retained failed writes, duplicate submission, stale capture, transcript/ring and allocation fences are not equivalent replacements. No fresh native/remote/browser execution or complete transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3806 deliberately retires40 authored/40 finite runtime compatibility cases, including the terminal-side-effect-facts-part03 headless-snapshots-part02 and agent-status-and-waits-part03 fragments, plus20 scalar Swift precondition sites. Lost runtime alarms include status/title/attention projection examples, simple renderer/headless frame restoration and status waiting outcomes detailed in the accepted-loss ledger. Swift cuts retire duplicate generation-map/schema/navigation/bridge and notification-wrapper assertions; no standalone native program is deleted. These include real bounded production alarms consciously retired for marginal value. Retained races, pending writes/reflow, namespace and waiter ownership are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3798 deliberately retires21 authored/24 finite compatibility cases, including the entire SSH-worktree-lifecycle and repository-project-operations fragments. Accepted losses include navigation-only settings acknowledgement, browser session cleanup and host preservation projections, window positive/policy-state examples, terminal recovery/reload and no-incarnation remint examples, terminal listing compatibility/malformed IDs, directory browse/sort/Windows path smoke, SSH create refusal/manual lineage, recursive parent-folder creation and fork/origin/avatar/icon projections. Real bounded production alarms are consciously retired for marginal value; retained authority races, cleanup/clone ownership, pending waiters, nested-folder and scan invalidation cases are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Retained assertion references and unchanged receipts keep their original scopes; retired callbacks and archived receipts provide no current coverage.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator/coordinator.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/start/readiness/worker-start-prompt-contract.test.ts --reporter=dot",
"node tests/tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000"
],
"testFiles": [
"src/shared/agent-launch/startup/agent-prompt-injection.test.ts",
"src/main/runtime/construction/orca-runtime.test.ts",
"src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts",
- "src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts",
+ "src/main/runtime/rpc/methods/orchestration/worker/start/readiness/worker-start-prompt-contract.test.ts",
"src/main/runtime/orchestration/coordinator/coordinator.test.ts",
"tests/tools/repro-orchestration-long-prompt.mjs"
],
@@ -10360,6 +10384,10 @@
"Capture stable red/green intentional-break evidence in CI before blocking promotion."
],
"knownGaps": [
+ "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed.",
+ "Audit3814 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle from a Codex ready prompt even when stale startup lines remain :: Stale MCP startup lines must not block a later Codex ready header.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle when a stale Codex prompt is followed by the ready header :: A Codex ready header following a stale resume prompt must satisfy tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for an idle Cursor lane past its dismissed trust dialog (#8210) :: Later Cursor idle banner overrides retained trust dialog.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not block a mid-run Cursor lane on its dismissed trust dialog (#8210) :: Dismissed trust dialog must not report blocked for later busy Cursor; wait times out.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not classify unrelated press-enter prompts as Codex blocked prompts :: Unidentified press-enter text must time out rather than be classified Codex blocked.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for quiet background PTY agents without OSC titles :: Quiet Codex background terminal without OSC title eventually resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: sends agent prompts as bracketed paste before submit :: Driving prompt escapes embedded paste-end ESC, writes one framed paste then CR, and counts bytes.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: settles a foreground Codex prompt when launch metadata has not arrived :: Codex inferred from foreground without launch metadata waits for composer marker/quiescence before one CR.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: gives a late Codex render marker a fresh quiescence window :: Marker arriving at7.9s re-arms fresh quiet window instead of submitting at initial cap.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: writes large agent prompt paste frames atomically before delayed submit :: A prompt larger than input chunk budget is a single paste write before delayed CR with exact byte count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects oversized terminal.send text before provider writes :: Oversized ordinary terminal.send rejects input-too-large before any provider write.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects focusing an exited background terminal session :: focusTerminal refuses terminal_exited before invoking background reveal.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: pastes the same bytes the desktop draft paste sent for the prompt :: Launch-ready prompt normalizes CR/LF and renders embedded ESC visibly identically to desktop bracketed paste.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: keeps a prompt into a running agent behind the render settle, as before :: Driving prompt remains held through7s repaint activity then submits once by9s.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reports a queued PTY focus as not navigated when its notifier disappears :: Queued PTY focus and completed active reveal report not navigated after notifier removal; no second reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: does not invoke a stale graph-leaf focus notifier after queued PTY work :: Queued graph-leaf focus must not invoke old notifier after preceding PTY reveal and notifier removal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: paginates retained terminal output with explicit limits and truncation metadata :: Preview120lines, fractional limits,50/200 pages, retained2000line truncation and future-cursor metadata stay consistent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: falls back to renderer visible screen when uncursored TUI tail is blank :: Substantial blank uncursored tail uses mounted renderer visible screen with zero scrollback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reads and shows the runtime-owned alternate-screen grid without serialization :: Actual runtime alternate-screen grid provides read/show content without renderer/provider serialization.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: classifies older provider alternate-screen snapshots from ANSI :: Older provider without alternateScreen metadata classifies ANSI alternate entry and returns Remote Vim screen.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: honors the last ANSI screen transition when older provider metadata is absent :: Last ANSI alternate exit overrides earlier entry when explicit provider mode metadata is absent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: rejects a full provider screen frame after live output advances :: Live output arriving during second full-screen capture causes screen-unavailable rather than stale full frame.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: shares one provider snapshot between concurrent read and show calls :: Concurrent read/show share one successful provider snapshot and both receive Shared TUI content.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps cursor reads provider-free on restored alternate-screen PTYs :: Restored alternate-screen cursor transcript reads never acquire provider snapshot.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: backs off after a provider snapshot failure instead of retrying for show :: Failed provider capture is cached/backed off so later show does not retry.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: falls back once to a mounted renderer when a known alternate provider fails :: A known-alternate failed provider capture falls back exactly once to newly mounted renderer.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: bounds provider visible frames for read and show responses :: Provider visible read/show use six bounded lines and300character preview.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps renderer-fallback composer drafts separate from terminal output :: Renderer fallback strips dim composer draft from terminal output and exposes draft separately.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: does not use renderer visible-screen fallback for a short blank shell tail :: Two blank shell lines must not trigger renderer screen fallback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: trims terminal tail character budget without per-line array shifts :: Tail builder trims to256KiB with correct retained suffix and no Array.shift calls.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains ANSI-only status redraws instead of appending every frame :: Repeated erase/redraw replaces preview until newline then publishes one completed cursor row.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains split multi-line ANSI footer redraw state across chunks :: CUU state across chunks retains corrected footer rows and publishes new cursor entries.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not let stale lower rows hide earlier corrected footer rows from cursor reads :: Earlier corrected footer row must not be hidden by stale lower rows in cursor reads.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: bounds completed transcript entries from a single multi-line redraw chunk :: Single redraw chunk bounds completed transcript to2000retained lines and correct oldest/next/latest cursors.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains multi-line ANSI redraws when the last footer row stays partial :: Partial final redrawn row appears in preview but cursor sees it only after newline.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not retain split ANSI controls as visible terminal preview text :: Split color/mode escapes never leak preview fragments; long split OSC title truncates at MAX_OSC_TITLE_CHARS.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains same-line redraw cursor position across split full-line erase chunks :: Full-line erase preserves column across chunks so XY follows three spaces rather than old ABC.\nsrc/main/runtime/orca-runtime-tests/conpty-stream-read.spec.ts :: fills the requested line count even when blank rows sit below the prompt :: Blank rows below a ConPTY prompt must not consume the requested nonempty-line count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: does not retain split ST-terminated string controls as preview text :: Split ST-terminated Kitty/string controls must remain excluded from preview text.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects split OSC titles before retaining terminal previews :: Split BEL OSC title must update working title/status without leaking into preview.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects ST-terminated OSC titles split before the final backslash :: ST OSC split before final backslash must update title without leaking framing.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: preserves a trailing escape after a completed OSC title :: Completed OSC followed by pending ESC must preserve the next idle-title transition.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: seeds newly synced leaves from PTY pending ANSI state :: A newly synced graph leaf inherits pending ANSI so a split color fragment cannot leak.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: bounds retained partial terminal output before preview reads :: Partial terminal state stays capped at 4000, preserves retained array identity, and preview truncation/cursor output remains correct.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: submits the mail pointer to Cursor Agent only after the paste-burst delay :: Cursor mailbox pointer Enter must wait through the paste-burst delay; this is a real input-timing alarm intentionally retired.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts :: adopts a v1.4.150-shaped agent, setup, and shell orphan as one topology transaction :: Stale incarnation refuses without topology change; three agent/setup/shell lanes adopt atomically with layout/group/revision and preserved read/input/resize; exact replay is idempotent and competing owner refuses.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: retires the exact worker when it exits after renderer reveal :: Exact worker exit after reveal retires that worker and its surface.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: re-reveals a recovered worker after the renderer graph epoch changes :: Changed renderer graph epoch invalidates reveal receipt and forces another reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: defers recovery when the renderer omits the exact reveal identity :: Missing exact reveal identity defers recovery after two attempts.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: reconciles a same-id process replacement before headless adoption :: A process replacement before headless adoption must fence off stale ownership.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retires provider resume only after authoritative inventory proves the legacy PTY exited :: Authoritative owning-host inventory overrides false local hasPty, avoids SSH scanning, retires exited provider resume/surface, adopts live workers without headless reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retries inventory and unknown liveness without revealing a ghost worker :: Inventory failure and unknown liveness must retry without ghost reveal, eventually adopt, and stop retrying.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: refuses a live reserved pane before issuing a handle or revealing it :: A requireFreshPane launch receiving a live reserved owner must reject before handle/reveal/kill, and release its claim. No equivalent replacement claimed.",
+ "Audit3806 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: skips a listener unsubscribed mid-fan-out even with mobile exclusions active :: A listener removed by an earlier listener during one fanout is not called, including with a side-effect-excluded mobile listener present.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: retains bytes emitted before a fresh daemon spawn resolves :: Bytes and title arriving before an initial zero/reset provider response survive in the serialized headless buffer with their counted sequence.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits command-finished facts with best-effort exit codes across chunk splits :: A split OSC133 D exit code becomes130 and a missing code becomes null in ordered command-finished facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits pr-link facts once per URL with batch attribution :: A split GitHub PR URL yields42 rather than4, emits42/43 once each, and carries PTY/worktree/tab attribution.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits 2031-subscribe facts across chunk splits :: Split ESC[?20 then31h emits exactly one2031-subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: restores a provisional 2031 subscribe when daemon scan authority returns :: Returning daemon scan authority with partial scan seed and pending2031 subscription restores exactly one subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers the tracked title over the renderer snapshot lastTitle :: A synthetic live Cursor title overrides stale renderer lastTitle while preserving renderer snapshot source.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers provider history over a partial headless mirror for requested snapshots :: Authoritative requested snapshots return supplied provider frame/history/seq rather than a partial headless mirror, requesting5000rows.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: tracks live alternate-screen transitions after a provider snapshot :: Provider alternateScreen true is accepted, then live1049l/1049h update isTerminalAlternateScreen false/true.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: translates reset provider snapshots without retaining the old title :: A reset provider snapshot translates new local seq into the runtime domain and replaces Old process title with New process.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits the chunk agentStatus events before its side-effect batch :: Agent status callback precedes side-effect batch callback for one coalesced OSC9999/title/bell chunk.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: still emits a throwing chunk’s facts under its own seq, not the next chunk’s :: A tracker throw still flushes first chunk title facts under its own seq, and second chunk does not inherit those facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: seeds the lazily created tracker from the daemon-snapshot title :: A lazy tracker hydrated from renderer snapshot title Codex working emits agent-idle on later Codex done.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits command-code-working facts only after the banner arms the scrape :: Unarmed Thinking text emits no facts; a Command Code0.27.3 banner then hardcoded colored spinner text emits attributed command-code-working with the submitted prompt.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits a command-code-done fact when the idle composer returns :: After hardcoded banner/working text, returned idle composer emits command-code-done with the earlier submitted prompt.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: resizes the headless mirror after an accepted desktop PTY resize :: An external accepted resize produces the resized dimensions and same status-frame lines as a separately driven reference emulator.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: replaces suffix-only headless state with the recovered renderer snapshot :: Replacing suffix-only state removes old suffix, retains renderer history plus later output/cwd, and returns the live47x40PTY grid.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: stamps SSH connection identity on runtime terminal status :: A synthetic mounted-leaf OSC9999 status after registerPty carries the supplied SSH connectionId.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: does not retain WSL context when a PTY id is reused :: After exit and same-ID new null distro context, OSC7 file://server/share/repo uses UNC server path rather than old Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: preserves immutable context while a live daemon attach is unresolved :: preparePtyExecutionContext with preserveExisting refuses a supplied Debian replacement and subsequent OSC7 keeps original Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts :: projects frame-independent live state through main buffer snapshots :: Main-buffer snapshot puts focus-report/cursor-visibility modes in frameRestoreAnsi, excludes STATIC-FRAME there and includes it in data.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts :: continues terminal agent status fanout when a callback throws :: Throwing on the first status callback does not prevent second payload delivery and logs contextual error.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: returns a title-only replay snapshot and never historical attention :: Lose replay:true/title-only fact projection despite earlierbell and unknownPTYnull. No actual delivered-history notification or reattach behavior was exercised. No equivalent replacement claimed.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects a handle rebind while a controller-less status check yields :: A handle rebound while the null-controller status continuation yields must throw terminal_handle_stale.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects confirmation evidence when the owning PTY exits :: A pending strong confirmation resolving after owning PTY exit must reject terminal_exited.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts :: keeps ordinary terminal send suffix failures on the existing not-writable contract :: Ordinary send writes text but refused CR must throw terminal_not_writable with beforeWrite twice and afterWrite once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell the execution host cannot apply instead of spawning its default :: Requested Windows shell on POSIX must refuse before spawning a default shell.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: quotes the agent startup command for the requested shell, not the host default :: Requested cmd shell must override PowerShell default quoting for agent startup command.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: keeps restored receipts outside a targeted worktree scan :: Targeted scan removes the moved-worktree receipt while preserving another worktree receipt.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: observes setup command completion without waiting for its interactive shell to exit :: Nonzero completion marker 17 resolves while interactive shell remains running.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: falls back to setup terminal exit when no completion signal is available :: Setup completion observer without token falls back to actual exit code 9.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: cancels setup completion observation when the caller aborts :: Abort rejects with the original reason and unsubscribes once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps observing after an uncertain setup terminal status :: Unknown exit waiter result must leave observation pending until completion marker arrives.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh omits a record :: Controller inventory omission disconnects the record but preserves its retained transcript.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh times out :: Hung inventory timeout leaves connected record and retained transcript intact.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle for adopted background PTY handles from the renderer title :: An adopted background handle resolves tui-idle from ready Codex renderer title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves live-leaf tui-idle from an OpenCode native title :: A live leaf resolves tui-idle from an OpenCode native title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from a Codex ready prompt preview :: A supplied Codex prompt preview resolves tui-idle without an actual agent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from an Antigravity prompt before the model line :: A supplied Antigravity prompt before model line resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell with no workspace instead of creating a default-shell tab :: Workspace-less explicit shell must reject before renderer default-tab request or spawn. This real guard/wiring alarm is deliberately retired.",
+ "Audit3798 per-case accepted losses:\nsrc/main/runtime/orca-runtime-tests/paired-settings.spec.ts :: awaits navigation-only updates from paired clients (%s) :: Updating only claudeSubagentNavigationEnabled waits for the actual controller call to the supplied pending Claude-view reconcile for both on/off values.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: drops a client page record even when its close command cannot be issued :: A removed workspace loses its runtime client-page record and headless browser projection despite close delivery_required rejection, and emits the asynchronous warning.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: leaves client-hosted pages alone when another host still owns the same worktree id :: Removing runtime:env-b metadata with local ownership leaves the local same-ID client page unchanged and issues no close command.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: marks live bindings again when reopening after a promoted window closes :: A reopened window marks its still-registered live worktree in activeWorktreeIdsOnShutdown after the first promoted window closes.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: preserves live SSH session identities when promoting a headless runtime :: Headless-to-desktop promotion records active worktree, SSH connection and remoteSessionIdsByTabId from the supplied surviving SSH PTY/session.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores a surviving renderer when its reload is cancelled :: A sole ready renderer reload cancelled under its current renderer fence returns true and becomes ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores headless authority when desktop promotion navigation is cancelled :: A cancelled desktop promotion with headless recovery returns false while headless authority remains ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: moves a desktop graph to unavailable when its reload times out :: A ready desktop graph without a headless fallback becomes unavailable at the reload deadline and retains its window/epoch.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: recovers a failed headless promotion and accepts a later renderer generation :: A promotion failure restores ready headless authority; a later valid same-window graph publishes ready desktop authority.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: clears a failed pane recovery so a later reconnect can retry :: After relay_reconnecting rejection, the pending recovery lock clears and the same pane/handle can call createTerminal a second time and return its supplied replacement.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: still preserves a CLI agent leaf when the reloaded renderer has not rebound its PTY :: An empty graph published during renderer reload preserves a preallocated live CLI PTY as one listable terminal before renderer rebind.\nsrc/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts :: keeps a no-incarnation handle across an in-graph pane remint :: Within one graph lifetime an unversioned PTY reminted onto another leaf retains its issued handle and resolves its old exit waiter after onPtyExit.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: matches explicit-id cwd PTYs when the resolved worktree cache is incomplete :: An explicit target absent from a fresh incomplete resolved cache adopts only its cwd PTY, rejects nested cwd PTY and does not rescan Git.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: ignores cwd-only controller PTYs for malformed explicit worktree IDs :: Malformed id:repo-1:: returns no terminals, does not adopt cwd-only controller PTY and avoids Git rescanning.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: refuses an SSH-backed create for mobile/runtime callers instead of creating locally :: Loss of this public unserved SSH create error-class/no-local-add/no-local-list alarm.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: records an app-selected parent workspace as a manual action :: Loss of the local runtime folder-parent manual origin, active-workspace source and explicit confidence projection alarm; no claim that SSH or cleanup coverage replaces it.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: browses runtime server directories before projects are added :: Loss of this public runtime alarm for browse availability before registration, directories-first lexical ordering and native path flavor.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: lists drive roots for a server-root browse :: Loss of the Windows public slash-root drive enumeration smoke and presence of the temporary directory drive.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations-part-02.spec.ts :: creates a missing runtime parent before creating the project directory :: Loss of this runtime createRepo recursive missing-parent/child existence and registered-path alarm.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: preserves selected project %s when a hosted parent is known :: Loss of both parent-selected and origin-selected normal fork-link projection/persisted upstream alarms plus exact single-probe count.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: links a current enterprise remote despite unavailable metadata and a retained %s :: Loss of normal current-enterprise-origin linking with stale automatic GitHub avatar or protected file image, unchanged icon assertion, and serialized project identity under unavailable metadata.",
"Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
"Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
"Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
@@ -10386,7 +10414,8 @@
"Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts. Unresolved local/computed edges remain explicit debt.",
"Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts. Unresolved local/computed edges remain explicit debt.",
"Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
- "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged."
+ "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
+ "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed."
],
"demotionRule": "Demote or quarantine if the live harness flakes without a product bug or harness bug filed to the terminal-input owner."
},
@@ -10505,7 +10534,7 @@
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
- "coverageNotes": "Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. The complete federation-lifecycle-settlement suite is removed, losing its fake remote settlement/protocol/acknowledgment examples. Its exact standalone command, testFiles entry and complete assertionRef are retired and prior fields archived. Existing receipts select unrelated migration and compiled CLI journeys and retain original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit2923 accepts loss of the first/replayed attested legacy worker_done CLI acceptance alarms, including exact send parameters, sender pane proof, lifecycle-wait flag and minted mutation identity. The removed fixture supplied settled runtime verdicts; it did not execute settlement authority, durable replay or outage recovery. Reduced selectors have no new execution, fault-control or equivalent replacement credit. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. NEXT136 retains only unchanged execution receipts at their original scopes. Reduced-source selectors and retained static assertions have no new execution or equivalent replacement credit.",
+ "coverageNotes": "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed. CLI ownership cleanup retires low-value test cases, including explicit-current no-read, legacy success/idempotent acceptance, and caller-pane routing examples. Retained refusal and recovery assertions are listed below; dated receipts keep their original scopes. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. The complete federation-lifecycle-settlement suite is removed, losing its fake remote settlement/protocol/acknowledgment examples. Its exact standalone command, testFiles entry and complete assertionRef are retired and prior fields archived. Existing receipts select unrelated migration and compiled CLI journeys and retain original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit2923 accepts loss of the first/replayed attested legacy worker_done CLI acceptance alarms, including exact send parameters, sender pane proof, lifecycle-wait flag and minted mutation identity. The removed fixture supplied settled runtime verdicts; it did not execute settlement authority, durable replay or outage recovery. Reduced selectors have no new execution, fault-control or equivalent replacement credit. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. NEXT136 retains only unchanged execution receipts at their original scopes. Reduced-source selectors and retained static assertions have no new execution or equivalent replacement credit. CLI command/orchestration owner cleanup intentionally retires three registrations selected by this gate: two mock-supplied lifecycle/Run-home rejection projection examples and the complete manually assembled JSON failure-envelope example. The JSON-envelope suite, its exact command token/testFiles entry and whole assertion reference are removed; the retired Run-home relay assertion is removed from the retained lifecycle suite. These boundary projection alarms are lost without equivalent replacement. Retained fail-closed settlement and mutation-recovery cases keep their own scope. Pure owner moves do not invalidate unrelated dated receipts, which retain their exact original bytes; no fresh reduced-selector execution, native or remote evidence is claimed.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/11107#discussion_r3663321387",
"https://github.com/stablyai/orca/issues/13858",
@@ -10515,11 +10544,11 @@
"https://linear.app/stably/issue/STA-4022"
],
"invariant": "Starting a worker in the coordinator's current workspace must materialize one inactive terminal tab before worker-start returns, preserve coordinator focus, and remain exactly once after workspace re-entry. After an app update or restart, an exact live legacy worker must fence automatic provider resume, adopt its original PTY into its original background pane, retain readable output, and clear the resume record without spawning, writing, signalling, interrupting, replacing, or focusing the worker. A current-contract worker whose renderer graph identity is temporarily absent must retain its Dispatch capability and settle exactly once from exact hook-attested handle, pane, and process evidence; otherwise only an exact attested coordinator may take over. A worker_done caller may report success only after the owning runtime returns an explicit lifecycle verdict or authoritative reads prove that the exact Task, Dispatch, and worker report receipt settled the expected outcome. Federated terminal settlement must remain replay-eligible until the worker durably acknowledges it, and identical same-outcome retries must converge idempotently. Independently updated clients and worker servers must preserve the negotiated protocol: current peers use Run-home lifecycle settlement, while protocol v1/v2 peers retain their legacy completion path without receiving newer-only fields. A federated worker may accept only the authority defined by its negotiated protocol. An exact existing target workspace must receive a discoverable tab without stealing coordinator focus; if renderer reveal fails, worker-start must expose that the live worker remains background-only. Run and Dispatch checks must resolve through the caller's stable pane identity when a terminal handle is reminted, while a live handle outranks mismatched pane metadata. A nested worker's creator edge requires the current creator pane, process incarnation, and owning Run generation; reminting and rebinding that pane to another Run must remove the stale edge. Explicit legacy terminal inspection remains handle-scoped, and remote or headless worker presentation remains background-only.",
- "oracle": "Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. The complete federation-lifecycle-settlement suite is removed, losing its fake remote settlement/protocol/acknowledgment examples. Its exact standalone command, testFiles entry and complete assertionRef are retired and prior fields archived. Existing receipts select unrelated migration and compiled CLI journeys and retain original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit2923 accepts loss of the first/replayed attested legacy worker_done CLI acceptance alarms, including exact send parameters, sender pane proof, lifecycle-wait flag and minted mutation identity. The removed fixture supplied settled runtime verdicts; it did not execute settlement authority, durable replay or outage recovery. Reduced selectors have no new execution, fault-control or equivalent replacement credit. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Retained assertion references and unchanged receipts keep their original scopes; retired callbacks and archived receipts provide no current coverage.",
+ "oracle": "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed. Historical prior account (preserved verbatim): Audit3814 deliberately retires60 authored/60 finite cases:53runtime compatibility cases,4native XCTest methods and3Python clipboard methods, including the entire StableElementIndexes suite. Clipboard cuts retire the one-over-cap sample, incoming-offer destruction trace and sequential20-copy replay; actual wire, FD/pipe, startup and Xvfb/GTK boundaries remain without equivalent replacement claims. Accepted losses include narrow terminal-send payload/provider projections, legacy and direct no-op/error permutations, timing/work-count examples, private state/title/activity projections and fixture-driven readiness examples, individually enumerated below. These include real bounded production alarms consciously retired for marginal value; retained failed writes, duplicate submission, stale capture, transcript/ring and allocation fences are not equivalent replacements. No fresh native/remote/browser execution or complete transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3806 deliberately retires40 authored/40 finite runtime compatibility cases, including the terminal-side-effect-facts-part03 headless-snapshots-part02 and agent-status-and-waits-part03 fragments, plus20 scalar Swift precondition sites. Lost runtime alarms include status/title/attention projection examples, simple renderer/headless frame restoration and status waiting outcomes detailed in the accepted-loss ledger. Swift cuts retire duplicate generation-map/schema/navigation/bridge and notification-wrapper assertions; no standalone native program is deleted. These include real bounded production alarms consciously retired for marginal value. Retained races, pending writes/reflow, namespace and waiter ownership are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3798 deliberately retires21 authored/24 finite compatibility cases, including the entire SSH-worktree-lifecycle and repository-project-operations fragments. Accepted losses include navigation-only settings acknowledgement, browser session cleanup and host preservation projections, window positive/policy-state examples, terminal recovery/reload and no-incarnation remint examples, terminal listing compatibility/malformed IDs, directory browse/sort/Windows path smoke, SSH create refusal/manual lineage, recursive parent-folder creation and fork/origin/avatar/icon projections. Real bounded production alarms are consciously retired for marginal value; retained authority races, cleanup/clone ownership, pending waiters, nested-folder and scan invalidation cases are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. The complete federation-lifecycle-settlement suite is removed, losing its fake remote settlement/protocol/acknowledgment examples. Its exact standalone command, testFiles entry and complete assertionRef are retired and prior fields archived. Existing receipts select unrelated migration and compiled CLI journeys and retain original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit2923 accepts loss of the first/replayed attested legacy worker_done CLI acceptance alarms, including exact send parameters, sender pane proof, lifecycle-wait flag and minted mutation identity. The removed fixture supplied settled runtime verdicts; it did not execute settlement authority, durable replay or outage recovery. Reduced selectors have no new execution, fault-control or equivalent replacement credit. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Retained assertion references and unchanged receipts keep their original scopes; retired callbacks and archived receipts provide no current coverage.",
"commands": [
"ORCA_BACKGROUND_LAUNCH=1 npx vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration.test.ts src/cli/handlers/orchestration-check-identity.test.ts src/cli/handlers/orchestration-worker-cli.test.ts src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/cli/orchestration/orchestration.test.ts src/cli/orchestration/messages/orchestration-check-identity.test.ts src/cli/orchestration/workers/orchestration-worker-cli.test.ts src/main/runtime/rpc/methods/orchestration/worker/start/worker-start-composition.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/cli/orchestration/recovery/orchestration-lifecycle-rejection.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts",
@@ -10529,12 +10558,11 @@
"testFiles": [
"src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts",
"src/main/runtime/construction/orca-runtime.test.ts",
- "src/cli/handlers/orchestration.test.ts",
- "src/cli/handlers/orchestration-lifecycle-rejection.test.ts",
- "src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts",
- "src/cli/handlers/orchestration-check-identity.test.ts",
- "src/cli/handlers/orchestration-worker-cli.test.ts",
- "src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts",
+ "src/cli/orchestration/orchestration.test.ts",
+ "src/cli/orchestration/recovery/orchestration-lifecycle-rejection.test.ts",
+ "src/cli/orchestration/messages/orchestration-check-identity.test.ts",
+ "src/cli/orchestration/workers/orchestration-worker-cli.test.ts",
+ "src/main/runtime/rpc/methods/orchestration/worker/start/worker-start-composition.test.ts",
"src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts",
"src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts",
"src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts",
@@ -10551,26 +10579,16 @@
]
},
{
- "file": "src/cli/handlers/orchestration-lifecycle-rejection.test.ts",
+ "file": "src/cli/orchestration/recovery/orchestration-lifecycle-rejection.test.ts",
"assertions": [
- "an explicit current worker_done verdict completes without a compatibility read",
- "a worker_done response without a lifecycle verdict checks the exact authoritative Dispatch and report receipt",
- "legacy succeeded and failed reports require matching terminal Task and Dispatch state",
+ "a worker_done response without a lifecycle verdict fails closed when authoritative Dispatch and report state cannot confirm settlement",
"stopped or stale Dispatches cannot impersonate report settlement",
- "an idempotent retry accepts the first authoritative report from the same worker",
- "a Run-home relay rejection reaches the CLI error boundary"
+ "post-verification failure preserves the worker_done mutation identity for recovery"
]
},
{
- "file": "src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts",
- "assertions": ["a rejected lifecycle verdict is emitted as a JSON ok=false envelope"]
- },
- {
- "file": "src/cli/handlers/orchestration-check-identity.test.ts",
- "assertions": [
- "implicit check carries the caller pane key with a potentially stale environment handle",
- "explicit legacy terminal inspection does not inherit the caller pane key"
- ]
+ "file": "src/cli/orchestration/messages/orchestration-check-identity.test.ts",
+ "assertions": ["an empty explicit --terminal is refused before reading a mailbox"]
},
{
"file": "src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts",
@@ -10658,6 +10676,10 @@
"Attach saved intentional-break artifacts for hidden local presentation and dropped stable-pane delivery."
],
"knownGaps": [
+ "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed.",
+ "Audit3814 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle from a Codex ready prompt even when stale startup lines remain :: Stale MCP startup lines must not block a later Codex ready header.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle when a stale Codex prompt is followed by the ready header :: A Codex ready header following a stale resume prompt must satisfy tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for an idle Cursor lane past its dismissed trust dialog (#8210) :: Later Cursor idle banner overrides retained trust dialog.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not block a mid-run Cursor lane on its dismissed trust dialog (#8210) :: Dismissed trust dialog must not report blocked for later busy Cursor; wait times out.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not classify unrelated press-enter prompts as Codex blocked prompts :: Unidentified press-enter text must time out rather than be classified Codex blocked.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for quiet background PTY agents without OSC titles :: Quiet Codex background terminal without OSC title eventually resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: sends agent prompts as bracketed paste before submit :: Driving prompt escapes embedded paste-end ESC, writes one framed paste then CR, and counts bytes.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: settles a foreground Codex prompt when launch metadata has not arrived :: Codex inferred from foreground without launch metadata waits for composer marker/quiescence before one CR.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: gives a late Codex render marker a fresh quiescence window :: Marker arriving at7.9s re-arms fresh quiet window instead of submitting at initial cap.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: writes large agent prompt paste frames atomically before delayed submit :: A prompt larger than input chunk budget is a single paste write before delayed CR with exact byte count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects oversized terminal.send text before provider writes :: Oversized ordinary terminal.send rejects input-too-large before any provider write.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects focusing an exited background terminal session :: focusTerminal refuses terminal_exited before invoking background reveal.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: pastes the same bytes the desktop draft paste sent for the prompt :: Launch-ready prompt normalizes CR/LF and renders embedded ESC visibly identically to desktop bracketed paste.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: keeps a prompt into a running agent behind the render settle, as before :: Driving prompt remains held through7s repaint activity then submits once by9s.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reports a queued PTY focus as not navigated when its notifier disappears :: Queued PTY focus and completed active reveal report not navigated after notifier removal; no second reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: does not invoke a stale graph-leaf focus notifier after queued PTY work :: Queued graph-leaf focus must not invoke old notifier after preceding PTY reveal and notifier removal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: paginates retained terminal output with explicit limits and truncation metadata :: Preview120lines, fractional limits,50/200 pages, retained2000line truncation and future-cursor metadata stay consistent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: falls back to renderer visible screen when uncursored TUI tail is blank :: Substantial blank uncursored tail uses mounted renderer visible screen with zero scrollback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reads and shows the runtime-owned alternate-screen grid without serialization :: Actual runtime alternate-screen grid provides read/show content without renderer/provider serialization.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: classifies older provider alternate-screen snapshots from ANSI :: Older provider without alternateScreen metadata classifies ANSI alternate entry and returns Remote Vim screen.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: honors the last ANSI screen transition when older provider metadata is absent :: Last ANSI alternate exit overrides earlier entry when explicit provider mode metadata is absent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: rejects a full provider screen frame after live output advances :: Live output arriving during second full-screen capture causes screen-unavailable rather than stale full frame.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: shares one provider snapshot between concurrent read and show calls :: Concurrent read/show share one successful provider snapshot and both receive Shared TUI content.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps cursor reads provider-free on restored alternate-screen PTYs :: Restored alternate-screen cursor transcript reads never acquire provider snapshot.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: backs off after a provider snapshot failure instead of retrying for show :: Failed provider capture is cached/backed off so later show does not retry.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: falls back once to a mounted renderer when a known alternate provider fails :: A known-alternate failed provider capture falls back exactly once to newly mounted renderer.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: bounds provider visible frames for read and show responses :: Provider visible read/show use six bounded lines and300character preview.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps renderer-fallback composer drafts separate from terminal output :: Renderer fallback strips dim composer draft from terminal output and exposes draft separately.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: does not use renderer visible-screen fallback for a short blank shell tail :: Two blank shell lines must not trigger renderer screen fallback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: trims terminal tail character budget without per-line array shifts :: Tail builder trims to256KiB with correct retained suffix and no Array.shift calls.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains ANSI-only status redraws instead of appending every frame :: Repeated erase/redraw replaces preview until newline then publishes one completed cursor row.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains split multi-line ANSI footer redraw state across chunks :: CUU state across chunks retains corrected footer rows and publishes new cursor entries.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not let stale lower rows hide earlier corrected footer rows from cursor reads :: Earlier corrected footer row must not be hidden by stale lower rows in cursor reads.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: bounds completed transcript entries from a single multi-line redraw chunk :: Single redraw chunk bounds completed transcript to2000retained lines and correct oldest/next/latest cursors.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains multi-line ANSI redraws when the last footer row stays partial :: Partial final redrawn row appears in preview but cursor sees it only after newline.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not retain split ANSI controls as visible terminal preview text :: Split color/mode escapes never leak preview fragments; long split OSC title truncates at MAX_OSC_TITLE_CHARS.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains same-line redraw cursor position across split full-line erase chunks :: Full-line erase preserves column across chunks so XY follows three spaces rather than old ABC.\nsrc/main/runtime/orca-runtime-tests/conpty-stream-read.spec.ts :: fills the requested line count even when blank rows sit below the prompt :: Blank rows below a ConPTY prompt must not consume the requested nonempty-line count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: does not retain split ST-terminated string controls as preview text :: Split ST-terminated Kitty/string controls must remain excluded from preview text.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects split OSC titles before retaining terminal previews :: Split BEL OSC title must update working title/status without leaking into preview.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects ST-terminated OSC titles split before the final backslash :: ST OSC split before final backslash must update title without leaking framing.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: preserves a trailing escape after a completed OSC title :: Completed OSC followed by pending ESC must preserve the next idle-title transition.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: seeds newly synced leaves from PTY pending ANSI state :: A newly synced graph leaf inherits pending ANSI so a split color fragment cannot leak.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: bounds retained partial terminal output before preview reads :: Partial terminal state stays capped at 4000, preserves retained array identity, and preview truncation/cursor output remains correct.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: submits the mail pointer to Cursor Agent only after the paste-burst delay :: Cursor mailbox pointer Enter must wait through the paste-burst delay; this is a real input-timing alarm intentionally retired.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts :: adopts a v1.4.150-shaped agent, setup, and shell orphan as one topology transaction :: Stale incarnation refuses without topology change; three agent/setup/shell lanes adopt atomically with layout/group/revision and preserved read/input/resize; exact replay is idempotent and competing owner refuses.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: retires the exact worker when it exits after renderer reveal :: Exact worker exit after reveal retires that worker and its surface.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: re-reveals a recovered worker after the renderer graph epoch changes :: Changed renderer graph epoch invalidates reveal receipt and forces another reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: defers recovery when the renderer omits the exact reveal identity :: Missing exact reveal identity defers recovery after two attempts.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: reconciles a same-id process replacement before headless adoption :: A process replacement before headless adoption must fence off stale ownership.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retires provider resume only after authoritative inventory proves the legacy PTY exited :: Authoritative owning-host inventory overrides false local hasPty, avoids SSH scanning, retires exited provider resume/surface, adopts live workers without headless reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retries inventory and unknown liveness without revealing a ghost worker :: Inventory failure and unknown liveness must retry without ghost reveal, eventually adopt, and stop retrying.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: refuses a live reserved pane before issuing a handle or revealing it :: A requireFreshPane launch receiving a live reserved owner must reject before handle/reveal/kill, and release its claim. No equivalent replacement claimed.",
+ "Audit3806 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: skips a listener unsubscribed mid-fan-out even with mobile exclusions active :: A listener removed by an earlier listener during one fanout is not called, including with a side-effect-excluded mobile listener present.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: retains bytes emitted before a fresh daemon spawn resolves :: Bytes and title arriving before an initial zero/reset provider response survive in the serialized headless buffer with their counted sequence.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits command-finished facts with best-effort exit codes across chunk splits :: A split OSC133 D exit code becomes130 and a missing code becomes null in ordered command-finished facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits pr-link facts once per URL with batch attribution :: A split GitHub PR URL yields42 rather than4, emits42/43 once each, and carries PTY/worktree/tab attribution.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits 2031-subscribe facts across chunk splits :: Split ESC[?20 then31h emits exactly one2031-subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: restores a provisional 2031 subscribe when daemon scan authority returns :: Returning daemon scan authority with partial scan seed and pending2031 subscription restores exactly one subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers the tracked title over the renderer snapshot lastTitle :: A synthetic live Cursor title overrides stale renderer lastTitle while preserving renderer snapshot source.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers provider history over a partial headless mirror for requested snapshots :: Authoritative requested snapshots return supplied provider frame/history/seq rather than a partial headless mirror, requesting5000rows.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: tracks live alternate-screen transitions after a provider snapshot :: Provider alternateScreen true is accepted, then live1049l/1049h update isTerminalAlternateScreen false/true.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: translates reset provider snapshots without retaining the old title :: A reset provider snapshot translates new local seq into the runtime domain and replaces Old process title with New process.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits the chunk agentStatus events before its side-effect batch :: Agent status callback precedes side-effect batch callback for one coalesced OSC9999/title/bell chunk.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: still emits a throwing chunk’s facts under its own seq, not the next chunk’s :: A tracker throw still flushes first chunk title facts under its own seq, and second chunk does not inherit those facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: seeds the lazily created tracker from the daemon-snapshot title :: A lazy tracker hydrated from renderer snapshot title Codex working emits agent-idle on later Codex done.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits command-code-working facts only after the banner arms the scrape :: Unarmed Thinking text emits no facts; a Command Code0.27.3 banner then hardcoded colored spinner text emits attributed command-code-working with the submitted prompt.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits a command-code-done fact when the idle composer returns :: After hardcoded banner/working text, returned idle composer emits command-code-done with the earlier submitted prompt.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: resizes the headless mirror after an accepted desktop PTY resize :: An external accepted resize produces the resized dimensions and same status-frame lines as a separately driven reference emulator.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: replaces suffix-only headless state with the recovered renderer snapshot :: Replacing suffix-only state removes old suffix, retains renderer history plus later output/cwd, and returns the live47x40PTY grid.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: stamps SSH connection identity on runtime terminal status :: A synthetic mounted-leaf OSC9999 status after registerPty carries the supplied SSH connectionId.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: does not retain WSL context when a PTY id is reused :: After exit and same-ID new null distro context, OSC7 file://server/share/repo uses UNC server path rather than old Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: preserves immutable context while a live daemon attach is unresolved :: preparePtyExecutionContext with preserveExisting refuses a supplied Debian replacement and subsequent OSC7 keeps original Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts :: projects frame-independent live state through main buffer snapshots :: Main-buffer snapshot puts focus-report/cursor-visibility modes in frameRestoreAnsi, excludes STATIC-FRAME there and includes it in data.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts :: continues terminal agent status fanout when a callback throws :: Throwing on the first status callback does not prevent second payload delivery and logs contextual error.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: returns a title-only replay snapshot and never historical attention :: Lose replay:true/title-only fact projection despite earlierbell and unknownPTYnull. No actual delivered-history notification or reattach behavior was exercised. No equivalent replacement claimed.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects a handle rebind while a controller-less status check yields :: A handle rebound while the null-controller status continuation yields must throw terminal_handle_stale.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects confirmation evidence when the owning PTY exits :: A pending strong confirmation resolving after owning PTY exit must reject terminal_exited.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts :: keeps ordinary terminal send suffix failures on the existing not-writable contract :: Ordinary send writes text but refused CR must throw terminal_not_writable with beforeWrite twice and afterWrite once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell the execution host cannot apply instead of spawning its default :: Requested Windows shell on POSIX must refuse before spawning a default shell.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: quotes the agent startup command for the requested shell, not the host default :: Requested cmd shell must override PowerShell default quoting for agent startup command.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: keeps restored receipts outside a targeted worktree scan :: Targeted scan removes the moved-worktree receipt while preserving another worktree receipt.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: observes setup command completion without waiting for its interactive shell to exit :: Nonzero completion marker 17 resolves while interactive shell remains running.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: falls back to setup terminal exit when no completion signal is available :: Setup completion observer without token falls back to actual exit code 9.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: cancels setup completion observation when the caller aborts :: Abort rejects with the original reason and unsubscribes once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps observing after an uncertain setup terminal status :: Unknown exit waiter result must leave observation pending until completion marker arrives.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh omits a record :: Controller inventory omission disconnects the record but preserves its retained transcript.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh times out :: Hung inventory timeout leaves connected record and retained transcript intact.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle for adopted background PTY handles from the renderer title :: An adopted background handle resolves tui-idle from ready Codex renderer title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves live-leaf tui-idle from an OpenCode native title :: A live leaf resolves tui-idle from an OpenCode native title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from a Codex ready prompt preview :: A supplied Codex prompt preview resolves tui-idle without an actual agent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from an Antigravity prompt before the model line :: A supplied Antigravity prompt before model line resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell with no workspace instead of creating a default-shell tab :: Workspace-less explicit shell must reject before renderer default-tab request or spawn. This real guard/wiring alarm is deliberately retired.",
+ "Audit3798 per-case accepted losses:\nsrc/main/runtime/orca-runtime-tests/paired-settings.spec.ts :: awaits navigation-only updates from paired clients (%s) :: Updating only claudeSubagentNavigationEnabled waits for the actual controller call to the supplied pending Claude-view reconcile for both on/off values.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: drops a client page record even when its close command cannot be issued :: A removed workspace loses its runtime client-page record and headless browser projection despite close delivery_required rejection, and emits the asynchronous warning.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: leaves client-hosted pages alone when another host still owns the same worktree id :: Removing runtime:env-b metadata with local ownership leaves the local same-ID client page unchanged and issues no close command.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: marks live bindings again when reopening after a promoted window closes :: A reopened window marks its still-registered live worktree in activeWorktreeIdsOnShutdown after the first promoted window closes.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: preserves live SSH session identities when promoting a headless runtime :: Headless-to-desktop promotion records active worktree, SSH connection and remoteSessionIdsByTabId from the supplied surviving SSH PTY/session.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores a surviving renderer when its reload is cancelled :: A sole ready renderer reload cancelled under its current renderer fence returns true and becomes ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores headless authority when desktop promotion navigation is cancelled :: A cancelled desktop promotion with headless recovery returns false while headless authority remains ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: moves a desktop graph to unavailable when its reload times out :: A ready desktop graph without a headless fallback becomes unavailable at the reload deadline and retains its window/epoch.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: recovers a failed headless promotion and accepts a later renderer generation :: A promotion failure restores ready headless authority; a later valid same-window graph publishes ready desktop authority.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: clears a failed pane recovery so a later reconnect can retry :: After relay_reconnecting rejection, the pending recovery lock clears and the same pane/handle can call createTerminal a second time and return its supplied replacement.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: still preserves a CLI agent leaf when the reloaded renderer has not rebound its PTY :: An empty graph published during renderer reload preserves a preallocated live CLI PTY as one listable terminal before renderer rebind.\nsrc/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts :: keeps a no-incarnation handle across an in-graph pane remint :: Within one graph lifetime an unversioned PTY reminted onto another leaf retains its issued handle and resolves its old exit waiter after onPtyExit.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: matches explicit-id cwd PTYs when the resolved worktree cache is incomplete :: An explicit target absent from a fresh incomplete resolved cache adopts only its cwd PTY, rejects nested cwd PTY and does not rescan Git.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: ignores cwd-only controller PTYs for malformed explicit worktree IDs :: Malformed id:repo-1:: returns no terminals, does not adopt cwd-only controller PTY and avoids Git rescanning.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: refuses an SSH-backed create for mobile/runtime callers instead of creating locally :: Loss of this public unserved SSH create error-class/no-local-add/no-local-list alarm.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: records an app-selected parent workspace as a manual action :: Loss of the local runtime folder-parent manual origin, active-workspace source and explicit confidence projection alarm; no claim that SSH or cleanup coverage replaces it.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: browses runtime server directories before projects are added :: Loss of this public runtime alarm for browse availability before registration, directories-first lexical ordering and native path flavor.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: lists drive roots for a server-root browse :: Loss of the Windows public slash-root drive enumeration smoke and presence of the temporary directory drive.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations-part-02.spec.ts :: creates a missing runtime parent before creating the project directory :: Loss of this runtime createRepo recursive missing-parent/child existence and registered-path alarm.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: preserves selected project %s when a hosted parent is known :: Loss of both parent-selected and origin-selected normal fork-link projection/persisted upstream alarms plus exact single-probe count.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: links a current enterprise remote despite unavailable metadata and a retained %s :: Loss of normal current-enterprise-origin linking with stale automatic GitHub avatar or protected file image, unchanged icon assertion, and serialized project identity under unavailable metadata.",
"Audit2923 accepts loss of the first/replayed attested legacy worker_done CLI acceptance alarms, including exact send parameters, sender pane proof, lifecycle-wait flag and minted mutation identity. The removed fixture supplied settled runtime verdicts; it did not execute settlement authority, durable replay or outage recovery. Reduced selectors have no new execution, fault-control or equivalent replacement credit.",
"Audit2923 retires this entire mixed three-file receipt from current evidenceRuns because its selector included the removed migration suite. Preserved verbatim original JSON object (historical only; no reduced-selector validation):\n{\n \"date\": \"2026-08-11\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts src/cli/handlers/orchestration-migration.test.ts\",\n \"result\": \"passed\",\n \"durationSeconds\": 0.4,\n \"summary\": \"Three focused files passed 12 deterministic tests covering explicit current and Run-home verdicts, JSON failure output, exact report and terminal-state verification for stripped responses, stale/stopped rejection, idempotent retry, and first/replayed attested legacy settlements.\"\n }",
"Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
@@ -10709,7 +10731,9 @@
"Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. The complete federation-lifecycle-settlement suite is removed, losing its fake remote settlement/protocol/acknowledgment examples. Its exact standalone command, testFiles entry and complete assertionRef are retired and prior fields archived. Existing receipts select unrelated migration and compiled CLI journeys and retain original scopes. All prior notes and dated/archived evidence retain original scopes.",
"Complete prior commands before federation-lifecycle suite retirement: [\"ORCA_BACKGROUND_LAUNCH=1 npx vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration.test.ts src/cli/handlers/orchestration-check-identity.test.ts src/cli/handlers/orchestration-worker-cli.test.ts src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts --reporter=dot\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts --reporter=dot\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts\",\"pnpm run test:e2e -- tests/e2e/orchestration-worker-terminal-visibility.spec.ts --workers=1\",\"pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"]",
"Complete prior testFiles before federation-lifecycle suite retirement: [\"src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts\",\"src/main/runtime/construction/orca-runtime.test.ts\",\"src/cli/handlers/orchestration.test.ts\",\"src/cli/handlers/orchestration-lifecycle-rejection.test.ts\",\"src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts\",\"src/cli/handlers/orchestration-check-identity.test.ts\",\"src/cli/handlers/orchestration-worker-cli.test.ts\",\"src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts\",\"src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts\",\"src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts\",\"src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts\",\"src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts\",\"src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts\",\"tests/e2e/orchestration-worker-terminal-visibility.spec.ts\",\"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts\"]",
- "Complete prior assertionRefs before federation-lifecycle suite retirement: [{\"file\":\"src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts\",\"assertions\":[\"replays the coordinator instruction and takes its ack after the app restarts\",\"files loopback mail once under the local Dispatch Run without replacing its owner\"]},{\"file\":\"src/cli/handlers/orchestration-lifecycle-rejection.test.ts\",\"assertions\":[\"an explicit current worker_done verdict completes without a compatibility read\",\"a worker_done response without a lifecycle verdict checks the exact authoritative Dispatch and report receipt\",\"legacy succeeded and failed reports require matching terminal Task and Dispatch state\",\"stopped or stale Dispatches cannot impersonate report settlement\",\"an idempotent retry accepts the first authoritative report from the same worker\",\"a Run-home relay rejection reaches the CLI error boundary\"]},{\"file\":\"src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts\",\"assertions\":[\"a rejected lifecycle verdict is emitted as a JSON ok=false envelope\"]},{\"file\":\"src/cli/handlers/orchestration-check-identity.test.ts\",\"assertions\":[\"implicit check carries the caller pane key with a potentially stale environment handle\",\"explicit legacy terminal inspection does not inherit the caller pane key\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts\",\"assertions\":[\"Run delivery resolves through a stable coordinator pane after handle remint\",\"a live handle cannot be retargeted by mismatched pane metadata\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts\",\"assertions\":[\"Dispatch delivery resolves through a stable worker pane after handle remint\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts\",\"assertions\":[\"a remote worker_done waits for Run-home settlement even when an older CLI omits the wait hint\",\"a current Run home still completes reports from legacy protocol v1/v2 worker servers\",\"persisted protocol v1/v2 workers retain legacy-compatible completion after their worker server updates\",\"preexisting same-outcome terminal ACK batches settle atomically while conflicting outcomes acknowledge nothing\",\"an aborted settlement wait returns operation_unknown instead of accepted success\",\"a Run-home terminal verdict settles the remote attachment and revokes its capability\",\"a terminal verdict cannot settle an unrelated relay item\",\"a terminal verdict cannot contradict the exact queued worker report outcome\",\"a rejected report replays its exact verdict without mutating durable rejection mail twice\"]},{\"file\":\"src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts\",\"assertions\":[\"a v26 database gains a zeroed durable home-to-worker acknowledgment watermark\",\"a complete v26 database starts migration at v26 rather than replaying v7-v26\",\"the migration advances schema version without losing the imported relay cursor\"]},{\"file\":\"tests/e2e/orchestration-worker-terminal-visibility.spec.ts\",\"assertions\":[\"worker-start exposes one inactive worker tab before workspace navigation\",\"the coordinator tab remains active\",\"ACK delivery reaches a stable coordinator pane through a stale handle\",\"one spawn remains live with no interruption event\",\"PTY/incarnation, tab, leaf, worktree, Task, and Dispatch identities remain stable\",\"workspace re-entry does not duplicate the worker tab or print Conversation interrupted\"]},{\"file\":\"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts\",\"assertions\":[\"a compiled CLI worker_done with the wrong identity exits nonzero with ok=false\",\"the exact Task and Dispatch remain dispatched after rejection\",\"the correct worker identity receives an explicit completed lifecycle verdict\",\"an independent runtime read observes the Dispatch completed\"]}]"
+ "Complete prior assertionRefs before federation-lifecycle suite retirement: [{\"file\":\"src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts\",\"assertions\":[\"replays the coordinator instruction and takes its ack after the app restarts\",\"files loopback mail once under the local Dispatch Run without replacing its owner\"]},{\"file\":\"src/cli/handlers/orchestration-lifecycle-rejection.test.ts\",\"assertions\":[\"an explicit current worker_done verdict completes without a compatibility read\",\"a worker_done response without a lifecycle verdict checks the exact authoritative Dispatch and report receipt\",\"legacy succeeded and failed reports require matching terminal Task and Dispatch state\",\"stopped or stale Dispatches cannot impersonate report settlement\",\"an idempotent retry accepts the first authoritative report from the same worker\",\"a Run-home relay rejection reaches the CLI error boundary\"]},{\"file\":\"src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts\",\"assertions\":[\"a rejected lifecycle verdict is emitted as a JSON ok=false envelope\"]},{\"file\":\"src/cli/handlers/orchestration-check-identity.test.ts\",\"assertions\":[\"implicit check carries the caller pane key with a potentially stale environment handle\",\"explicit legacy terminal inspection does not inherit the caller pane key\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts\",\"assertions\":[\"Run delivery resolves through a stable coordinator pane after handle remint\",\"a live handle cannot be retargeted by mismatched pane metadata\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts\",\"assertions\":[\"Dispatch delivery resolves through a stable worker pane after handle remint\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts\",\"assertions\":[\"a remote worker_done waits for Run-home settlement even when an older CLI omits the wait hint\",\"a current Run home still completes reports from legacy protocol v1/v2 worker servers\",\"persisted protocol v1/v2 workers retain legacy-compatible completion after their worker server updates\",\"preexisting same-outcome terminal ACK batches settle atomically while conflicting outcomes acknowledge nothing\",\"an aborted settlement wait returns operation_unknown instead of accepted success\",\"a Run-home terminal verdict settles the remote attachment and revokes its capability\",\"a terminal verdict cannot settle an unrelated relay item\",\"a terminal verdict cannot contradict the exact queued worker report outcome\",\"a rejected report replays its exact verdict without mutating durable rejection mail twice\"]},{\"file\":\"src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts\",\"assertions\":[\"a v26 database gains a zeroed durable home-to-worker acknowledgment watermark\",\"a complete v26 database starts migration at v26 rather than replaying v7-v26\",\"the migration advances schema version without losing the imported relay cursor\"]},{\"file\":\"tests/e2e/orchestration-worker-terminal-visibility.spec.ts\",\"assertions\":[\"worker-start exposes one inactive worker tab before workspace navigation\",\"the coordinator tab remains active\",\"ACK delivery reaches a stable coordinator pane through a stale handle\",\"one spawn remains live with no interruption event\",\"PTY/incarnation, tab, leaf, worktree, Task, and Dispatch identities remain stable\",\"workspace re-entry does not duplicate the worker tab or print Conversation interrupted\"]},{\"file\":\"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts\",\"assertions\":[\"a compiled CLI worker_done with the wrong identity exits nonzero with ok=false\",\"the exact Task and Dispatch remain dispatched after rejection\",\"the correct worker identity receives an explicit completed lifecycle verdict\",\"an independent runtime read observes the Dispatch completed\"]}]",
+ "CLI ownership cleanup intentionally removes the retired success, routing and work-count alarms without replacement. Prior CLI assertion references: [{\"file\":\"src/cli/handlers/orchestration-lifecycle-rejection.test.ts\",\"assertions\":[\"an explicit current worker_done verdict completes without a compatibility read\",\"a worker_done response without a lifecycle verdict checks the exact authoritative Dispatch and report receipt\",\"legacy succeeded and failed reports require matching terminal Task and Dispatch state\",\"stopped or stale Dispatches cannot impersonate report settlement\",\"an idempotent retry accepts the first authoritative report from the same worker\",\"a Run-home relay rejection reaches the CLI error boundary\"]},{\"file\":\"src/cli/handlers/orchestration-check-identity.test.ts\",\"assertions\":[\"implicit check carries the caller pane key with a potentially stale environment handle\",\"explicit legacy terminal inspection does not inherit the caller pane key\"]}]",
+ "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed."
],
"demotionRule": "Keep experimental or demote if either Electron journey flakes without a product or harness defect, if local worker-start can return before tab materialization without an explicit reveal warning, if focus moves to the worker, if restart or workspace re-entry spawns/resumes/duplicates/interferes with the worker, if retained output becomes unreadable, or if pane-stable delivery reads the wrong mailbox."
},
@@ -10731,29 +10755,29 @@
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local"],
- "coverageNotes": "NEXT136 retains only unchanged execution receipts at their original scopes. Reduced-source selectors and retained static assertions have no new execution or equivalent replacement credit.",
+ "coverageNotes": "Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit. Previous account (preserved verbatim): NEXT136 retains only unchanged execution receipts at their original scopes. Reduced-source selectors and retained static assertions have no new execution or equivalent replacement credit.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/13005",
"https://github.com/stablyai/orca/pull/13250"
],
"invariant": "A live Dispatch created by orchestration dispatch can be stopped or abandoned even though it has no supervised worker row. Release must durably record the requested outcome, revoke lifecycle authority, close questions, free the exact assignee identity, and block only the Task whose current Dispatch was released. It must never close the unsupervised terminal process, disturb unrelated or supervised workers, or let a repeat or opposite verb rewrite the persisted outcome.",
- "oracle": "Retained assertion references and unchanged receipts keep their original scopes; retired callbacks and archived receipts provide no current coverage.",
+ "oracle": "Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit. Previous oracle (preserved verbatim): Retained assertion references and unchanged receipts keep their original scopes; retired callbacks and archived receipts provide no current coverage.",
"commands": [
- "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-release.test.ts src/main/runtime/orchestration/db/worker-dispatch/orchestration-worker-dispatch-db.test.ts src/main/runtime/rpc/methods/orchestration/worker/workers-recovery.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/cli/handlers/orchestration-worker-cli.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/stop/manual-dispatch-release.test.ts src/main/runtime/orchestration/db/worker-dispatch/orchestration-worker-dispatch-db.test.ts src/main/runtime/rpc/methods/orchestration/worker/observation/worker-lifecycle-recovery.test.ts src/main/runtime/rpc/methods/orchestration/worker/release/worker-release.test.ts src/cli/orchestration/workers/orchestration-worker-cli.test.ts --reporter=dot",
"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/orchestration-low-level-dispatch-release.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-low-level-dispatch-release.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
- "src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-release.test.ts",
+ "src/main/runtime/rpc/methods/orchestration/worker/stop/manual-dispatch-release.test.ts",
"src/main/runtime/orchestration/db/worker-dispatch/orchestration-worker-dispatch-db.test.ts",
- "src/main/runtime/rpc/methods/orchestration/worker/workers-recovery.test.ts",
- "src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts",
- "src/cli/handlers/orchestration-worker-cli.test.ts",
+ "src/main/runtime/rpc/methods/orchestration/worker/observation/worker-lifecycle-recovery.test.ts",
+ "src/main/runtime/rpc/methods/orchestration/worker/release/worker-release.test.ts",
+ "src/cli/orchestration/workers/orchestration-worker-cli.test.ts",
"tests/e2e/orchestration-low-level-dispatch-release.spec.ts"
],
"assertionRefs": [
{
- "file": "src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-release.test.ts",
+ "file": "src/main/runtime/rpc/methods/orchestration/worker/stop/manual-dispatch-release.test.ts",
"assertions": [
"worker-abandon and worker-stop durably release context-only Dispatches without closing terminals",
"repeat and cross-verb calls preserve the first stored outcome",
@@ -10813,6 +10837,7 @@
"Add Docker SSH and physical Windows WSL same-pane reuse evidence."
],
"knownGaps": [
+ "Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit.",
"Live paired-runtime, headless serve, SSH, WSL, Linux, and Windows evidence is not yet attached.",
"The Electron journey calls production runtime RPC methods directly instead of spawning a separate CLI process.",
"The local journey covers a folder-backed seeded repository through the app fixture but not a git-independent folder workspace.",
@@ -10841,7 +10866,7 @@
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
- "coverageNotes": "Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes. Audit2003: Remove3 preexisting unsupported320-live-PTY,400-retirement/256-history and replacement-lifecycle aliases from the inventory driver: neither its frozen original imported registrars nor proposed candidate owns those callbacks. This metadata correction adds no test-removal credit. The driver loses the empty-worktree-publication suite and3 folder-host/unverifiable scalar examples while retaining concurrent inventory freshness and provider-failure verdict fences. The retained inventory callbacks are not terminal-release, historical-cache capacity or performance-budget replacement coverage. Preserve the independent compiled-CLI Electron receipt exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove unsupported user-taken-over, transferred-owner, exact-reuse, host-scope, immutable-transcript, legacy-ambiguity, reset and50-worker aliases from their claimed sources. Remove the deleted pending-release ledger replay alias. Narrow surviving external-retention and recovery aliases to actual retained callbacks; no transfer to another file or process-restart proof. Preserve the independent receipt. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1955:34): Pruning removes unsupported-provider/out-of-range scalar refusals and the single Grok happy decoder fixture. Retain actual file cursor append/paging, same-inode checkpoint invalidation, opaque IDs and oversized-line progress. Retire the complete dated 3.48s combined receipt through its effective currentCommand, without changing its original command or transferring its 56-test result. Unchanged CLI/Electron receipt retains its independent scope. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1379 changes src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts (7 authored registrations removed; 0 retained). Intentional losses: Loses supplied host lists and record states mapped to liveness enums and routing counts; no live/dead process evidence. No equivalent replacement coverage is claimed. Remaining exact receipts validate only their unchanged selectors. Historical coverage account: Only Keep open keeps a worker; a phone or desktop names it by handle, pane or session, and older clients' typing reports record nothing. Host byte lanes perform zero orchestration SQL work; local and injected SSH Keep open tests fence release. Deterministic service tests cover release-versus-reuse ordering, transactional retain and takeover cancellation, exact host/pane/process identity, dead external/user-owned/transferred/stopped/abandoned reconciliation, host-partition persistence and legacy retirement replay with an absent web-terminal layout map, conservative unknown provider and legacy metadata handling, immutable transcript and bounded terminal archives, mutation restart, reset cleanup, replay idempotency, and 50-resource accounting. A macOS Electron journey invokes the freshly compiled worker-release CLI after the worker process disappears, then independently checks released SQLite state and coordinator liveness. Injected inventories cover local and SSH provider routing; live SSH, WSL, Windows, paired-runtime, and provider-close lost-ack journeys remain explicit gaps. Audit1396: src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts reduced. Retires unary/stream no-database-work call counts and three mobile RPC allowlist membership checks. Ancillary input delivery assertions in the budget registration intentionally lost without equivalence claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
+ "coverageNotes": "Audit3899 intentionally removes the seeded accepted-worker-start receipt callback from the retained orchestration mutation-ledger test suite, without equivalent replacement. It used an in-memory database and no restart or actual worker launch. The lost alarm is operation_unknown with accepted Dispatch recovery guidance and no second handler invocation. The separate independent-database pending-ask recovery callback remains byte-identical. Existing selectors remain executable but reduced source bytes have no fresh execution in this static audit; the complete dated worker-release CLI receipt retains its original unchanged scope and does not validate these reduced ledger bytes. Historical prior account (preserved verbatim): Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit. Previous account (preserved verbatim): Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes. Audit2003: Remove3 preexisting unsupported320-live-PTY,400-retirement/256-history and replacement-lifecycle aliases from the inventory driver: neither its frozen original imported registrars nor proposed candidate owns those callbacks. This metadata correction adds no test-removal credit. The driver loses the empty-worktree-publication suite and3 folder-host/unverifiable scalar examples while retaining concurrent inventory freshness and provider-failure verdict fences. The retained inventory callbacks are not terminal-release, historical-cache capacity or performance-budget replacement coverage. Preserve the independent compiled-CLI Electron receipt exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove unsupported user-taken-over, transferred-owner, exact-reuse, host-scope, immutable-transcript, legacy-ambiguity, reset and50-worker aliases from their claimed sources. Remove the deleted pending-release ledger replay alias. Narrow surviving external-retention and recovery aliases to actual retained callbacks; no transfer to another file or process-restart proof. Preserve the independent receipt. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1955:34): Pruning removes unsupported-provider/out-of-range scalar refusals and the single Grok happy decoder fixture. Retain actual file cursor append/paging, same-inode checkpoint invalidation, opaque IDs and oversized-line progress. Retire the complete dated 3.48s combined receipt through its effective currentCommand, without changing its original command or transferring its 56-test result. Unchanged CLI/Electron receipt retains its independent scope. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1379 changes src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts (7 authored registrations removed; 0 retained). Intentional losses: Loses supplied host lists and record states mapped to liveness enums and routing counts; no live/dead process evidence. No equivalent replacement coverage is claimed. Remaining exact receipts validate only their unchanged selectors. Historical coverage account: Only Keep open keeps a worker; a phone or desktop names it by handle, pane or session, and older clients' typing reports record nothing. Host byte lanes perform zero orchestration SQL work; local and injected SSH Keep open tests fence release. Deterministic service tests cover release-versus-reuse ordering, transactional retain and takeover cancellation, exact host/pane/process identity, dead external/user-owned/transferred/stopped/abandoned reconciliation, host-partition persistence and legacy retirement replay with an absent web-terminal layout map, conservative unknown provider and legacy metadata handling, immutable transcript and bounded terminal archives, mutation restart, reset cleanup, replay idempotency, and 50-resource accounting. A macOS Electron journey invokes the freshly compiled worker-release CLI after the worker process disappears, then independently checks released SQLite state and coordinator liveness. Injected inventories cover local and SSH provider routing; live SSH, WSL, Windows, paired-runtime, and provider-close lost-ack journeys remain explicit gaps. Audit1396: src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts reduced. Retires unary/stream no-database-work call counts and three mobile RPC allowlist membership checks. Ancillary input delivery assertions in the budget registration intentionally lost without equivalence claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/12355",
"https://github.com/stablyai/orca/issues/13860",
@@ -10850,22 +10875,22 @@
"STA-5122"
],
"invariant": "A settled Dispatch may close only its one coordinator-created terminal lease. Explicit reuse, Keep open, retain, identity or host change, ambiguity, and another resource for the same exact host/pane/process must fence closure. Once the authoritative owning provider positively excludes the resource's exact immutable process incarnation, even an external, user-owned, or transferred dead resource must converge to released without any process close. Unknown host scope, missing incarnation metadata, or unavailable inventory must remain retained. Exact terminal-close persistence must settle when a host partition omits renderer-owned layout state. Output preservation and the requested-to-releasing transition are atomic, archives remain readable without the provider file, retries resume idempotently, and orchestration reset removes archive and authority state.",
- "oracle": "Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes. Audit2003: Remove3 preexisting unsupported320-live-PTY,400-retirement/256-history and replacement-lifecycle aliases from the inventory driver: neither its frozen original imported registrars nor proposed candidate owns those callbacks. This metadata correction adds no test-removal credit. The driver loses the empty-worktree-publication suite and3 folder-host/unverifiable scalar examples while retaining concurrent inventory freshness and provider-failure verdict fences. The retained inventory callbacks are not terminal-release, historical-cache capacity or performance-budget replacement coverage. Preserve the independent compiled-CLI Electron receipt exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove unsupported user-taken-over, transferred-owner, exact-reuse, host-scope, immutable-transcript, legacy-ambiguity, reset and50-worker aliases from their claimed sources. Remove the deleted pending-release ledger replay alias. Narrow surviving external-retention and recovery aliases to actual retained callbacks; no transfer to another file or process-restart proof. Preserve the independent receipt. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1955:34): Pruning removes unsupported-provider/out-of-range scalar refusals and the single Grok happy decoder fixture. Retain actual file cursor append/paging, same-inode checkpoint invalidation, opaque IDs and oversized-line progress. Retire the complete dated 3.48s combined receipt through its effective currentCommand, without changing its original command or transferring its 56-test result. Unchanged CLI/Electron receipt retains its independent scope. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Surviving unchanged-source receipts are the current oracle; changed-source assertions await validation. Historical oracle account: Record release intent for a settled owner, attempt exact reuse before close, and require worker-start to fail with terminal_release_in_progress while the terminal stays open; then release the original owner exactly once. Race retain against a controlled archive promise and require no committed archive or close. Rebase a closed web-terminal host partition without terminalLayoutsByTabId and require the persistence write to complete while preserving host-authoritative membership; replay a valid legacy retirement under the same omission and require exact membership removal plus revision advancement. For retained external, user-owned, transferred, stopped, and abandoned resources, run one fresh inventory against the exact local/WSL or SSH provider: an exact live incarnation and every unknown inventory shape stay retained, while positive absence atomically sets ownership_state and release_state to released with processAction none and zero closeTerminal calls. Change host or process identity and inject duplicate resource evidence to require retention. Freeze a structured transcript, delete its source file, and require archived worker-read to return the same bounded redacted messages. Restart a pending mutation, reset orchestration state, and create 50 resources while asserting replay convergence, zero orphan rows, two-query worker listing, and no unrelated close.",
+ "oracle": "Audit3899 intentionally removes the seeded accepted-worker-start receipt callback from the retained orchestration mutation-ledger test suite, without equivalent replacement. It used an in-memory database and no restart or actual worker launch. The lost alarm is operation_unknown with accepted Dispatch recovery guidance and no second handler invocation. The separate independent-database pending-ask recovery callback remains byte-identical. Existing selectors remain executable but reduced source bytes have no fresh execution in this static audit; the complete dated worker-release CLI receipt retains its original unchanged scope and does not validate these reduced ledger bytes. Historical prior account (preserved verbatim): Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit. Previous oracle (preserved verbatim): Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes. Audit2003: Remove3 preexisting unsupported320-live-PTY,400-retirement/256-history and replacement-lifecycle aliases from the inventory driver: neither its frozen original imported registrars nor proposed candidate owns those callbacks. This metadata correction adds no test-removal credit. The driver loses the empty-worktree-publication suite and3 folder-host/unverifiable scalar examples while retaining concurrent inventory freshness and provider-failure verdict fences. The retained inventory callbacks are not terminal-release, historical-cache capacity or performance-budget replacement coverage. Preserve the independent compiled-CLI Electron receipt exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove unsupported user-taken-over, transferred-owner, exact-reuse, host-scope, immutable-transcript, legacy-ambiguity, reset and50-worker aliases from their claimed sources. Remove the deleted pending-release ledger replay alias. Narrow surviving external-retention and recovery aliases to actual retained callbacks; no transfer to another file or process-restart proof. Preserve the independent receipt. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1955:34): Pruning removes unsupported-provider/out-of-range scalar refusals and the single Grok happy decoder fixture. Retain actual file cursor append/paging, same-inode checkpoint invalidation, opaque IDs and oversized-line progress. Retire the complete dated 3.48s combined receipt through its effective currentCommand, without changing its original command or transferring its 56-test result. Unchanged CLI/Electron receipt retains its independent scope. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Surviving unchanged-source receipts are the current oracle; changed-source assertions await validation. Historical oracle account: Record release intent for a settled owner, attempt exact reuse before close, and require worker-start to fail with terminal_release_in_progress while the terminal stays open; then release the original owner exactly once. Race retain against a controlled archive promise and require no committed archive or close. Rebase a closed web-terminal host partition without terminalLayoutsByTabId and require the persistence write to complete while preserving host-authoritative membership; replay a valid legacy retirement under the same omission and require exact membership removal plus revision advancement. For retained external, user-owned, transferred, stopped, and abandoned resources, run one fresh inventory against the exact local/WSL or SSH provider: an exact live incarnation and every unknown inventory shape stay retained, while positive absence atomically sets ownership_state and release_state to released with processAction none and zero closeTerminal calls. Change host or process identity and inject duplicate resource evidence to require retention. Freeze a structured transcript, delete its source file, and require archived worker-read to return the same bounded redacted messages. Restart a pending mutation, reset orchestration state, and create 50 resources while asserting replay convergence, zero orphan rows, two-query worker listing, and no unrelated close.",
"commands": [
- "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts src/main/runtime/terminal/identity/orca-runtime-terminal-handle-incarnation.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot",
+ "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/release/worker-release-mobile-report.test.ts src/main/runtime/terminal/identity/orca-runtime-terminal-handle-incarnation.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts src/main/runtime/rpc/methods/orchestration/worker/release/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/release/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration/mutations/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts src/main/runtime/rpc/methods/orchestration/worker/release/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/release/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration/mutations/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/release/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/release/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration/mutations/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/release/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/release/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration/mutations/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot",
"pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
- "src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts",
+ "src/main/runtime/rpc/methods/orchestration/worker/release/worker-release-mobile-report.test.ts",
"src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts",
"src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts",
- "src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts",
- "src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts",
- "src/main/runtime/rpc/orchestration-mutation-ledger.test.ts",
+ "src/main/runtime/rpc/methods/orchestration/worker/release/worker-release.test.ts",
+ "src/main/runtime/rpc/methods/orchestration/worker/release/worker-release-recovery.test.ts",
+ "src/main/runtime/rpc/orchestration/mutations/orchestration-mutation-ledger.test.ts",
"src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts",
"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts"
],
@@ -10878,15 +10903,11 @@
]
},
{
- "file": "src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts",
- "assertions": [
- "retains a dead external terminal without closing a process",
- "releases a dead stopped or abandoned worker without closing a process",
- "lets an explicit retain cancel a release while output capture is pending"
- ]
+ "file": "src/main/runtime/rpc/methods/orchestration/worker/release/worker-release.test.ts",
+ "assertions": ["retains a dead external terminal without closing a process"]
},
{
- "file": "src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts",
+ "file": "src/main/runtime/rpc/methods/orchestration/worker/release/worker-release-recovery.test.ts",
"assertions": [
"finishes a requested release after restart-style interruption within the same runtime and database",
"coalesces reconciliation joining an interactive release into one recorded recovery attempt and one terminal close"
@@ -10936,6 +10957,7 @@
"Prove provider-close lost acknowledgements converge with an exact durable close receipt."
],
"knownGaps": [
+ "Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit. Audit3681 metadata correction at gate106 retires exactly “releases a dead stopped or abandoned worker without closing a process” because its stopped/abandoned positive-exit matrix is intentionally removed in the20 authored/24 finite source delta, and “lets an explicit retain cancel a release while output capture is pending” because capture is synchronous and that callback was already absent at the reviewed current base. The latter is preexisting unsupported evidence with zero additional removal credit. Preserve every other assertion, command, testFile, evidenceRun and all previous prose/gaps; apply only the two exact assertion-string removals, never a stale assertionRefs whole-field replacement.",
"Provider close has no durable cross-process operation receipt, so a crash after host mutation but before SQLite settlement remains release_pending until exact inventory returns.",
"Federated release remains explicitly unsupported and retained.",
"Mobile/direct remote input takeover and live Linux, Windows, WSL, SSH, headed, and headless paired-runtime release are not exercised; the host-partition fix changes persistence normalization only, not ConPTY, filesystem, update, sleep, firewall, or window lifecycle semantics.",
@@ -10956,7 +10978,8 @@
"Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes. All prior notes and dated/archived evidence retain original scopes.",
"Audit3437 complete prior commands before completed-worker-retirement-resume retirement: [\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts src/main/runtime/terminal/identity/orca-runtime-terminal-handle-incarnation.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot\",\"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts --reporter=verbose\",\"pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"]",
"Audit3437 complete prior testFiles before completed-worker-retirement-resume retirement: [\"src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts\",\"src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts\",\"src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts\",\"src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts\",\"src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts\",\"src/main/runtime/rpc/orchestration-mutation-ledger.test.ts\",\"src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts\",\"tests/e2e/completed-worker-retirement-resume.unit.test.ts\",\"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts\"]",
- "Audit3437 complete prior assertionRefs before completed-worker-retirement-resume retirement: [{\"file\":\"src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts\",\"assertions\":[\"rebases a host partition that no longer carries the closed web-terminal layout\",\"replays a legacy retirement when its host partition omits terminal layouts\"]},{\"file\":\"tests/e2e/completed-worker-retirement-resume.unit.test.ts\",\"assertions\":[\"an already-exited succeeded Dispatch reaches released while its late exact close revokes the missing tab's stale resume record\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts\",\"assertions\":[\"retains a dead external terminal without closing a process\",\"releases a dead stopped or abandoned worker without closing a process\",\"lets an explicit retain cancel a release while output capture is pending\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts\",\"assertions\":[\"finishes a requested release after restart-style interruption within the same runtime and database\",\"coalesces reconciliation joining an interactive release into one recorded recovery attempt and one terminal close\"]},{\"file\":\"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts\",\"assertions\":[\"compiled worker-release reconciles a dead external retained resource to released\",\"the CLI reports processAction none instead of closing a process\",\"SQLite independently records released ownership and release state\",\"the unrelated coordinator terminal remains live\"]}]"
+ "Audit3437 complete prior assertionRefs before completed-worker-retirement-resume retirement: [{\"file\":\"src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts\",\"assertions\":[\"rebases a host partition that no longer carries the closed web-terminal layout\",\"replays a legacy retirement when its host partition omits terminal layouts\"]},{\"file\":\"tests/e2e/completed-worker-retirement-resume.unit.test.ts\",\"assertions\":[\"an already-exited succeeded Dispatch reaches released while its late exact close revokes the missing tab's stale resume record\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts\",\"assertions\":[\"retains a dead external terminal without closing a process\",\"releases a dead stopped or abandoned worker without closing a process\",\"lets an explicit retain cancel a release while output capture is pending\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts\",\"assertions\":[\"finishes a requested release after restart-style interruption within the same runtime and database\",\"coalesces reconciliation joining an interactive release into one recorded recovery attempt and one terminal close\"]},{\"file\":\"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts\",\"assertions\":[\"compiled worker-release reconciles a dead external retained resource to released\",\"the CLI reports processAction none instead of closing a process\",\"SQLite independently records released ownership and release state\",\"the unrelated coordinator terminal remains live\"]}]",
+ "Audit3899 intentionally removes the seeded accepted-worker-start receipt callback from the retained orchestration mutation-ledger test suite, without equivalent replacement. It used an in-memory database and no restart or actual worker launch. The lost alarm is operation_unknown with accepted Dispatch recovery guidance and no second handler invocation. The separate independent-database pending-ask recovery callback remains byte-identical. Existing selectors remain executable but reduced source bytes have no fresh execution in this static audit; the complete dated worker-release CLI receipt retains its original unchanged scope and does not validate these reduced ledger bytes."
],
"demotionRule": "Keep experimental or demote if release can overlap exact reuse, close a conflicting lease, lose immutable output, retain reset archives, fan out per worker, or any focused ordering test flakes without a product or harness defect."
},
@@ -12354,23 +12377,22 @@
"providers": ["local", "remote-runtime", "ssh"],
"coveredPlatforms": ["macos", "linux"],
"coveredProviders": ["local", "remote-runtime", "ssh"],
- "coverageNotes": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts: delivers remote file changes to listeners for the same worktree. src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Exact retired assertionRefs, preserved as historical objects only: {\n \"file\": \"src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts\",\n \"assertions\": [\n \"terminal watcher error and setup failure evict the shared entry before retrying callbacks run\",\n \"an old stream end cannot evict the replacement stream, which still delivers to its listener\",\n \"two same-worktree listeners share a synthetic subscription until the final stop unsubscribes and sends unwatch\"\n ]\n } Historical prior account (preserved verbatim): Audit1973: Delete the standalone mocked watcher cleanup suite and its entire sole-file prospective command. Retire the removed file-command transport-abort alias; preserve the independent cancellation suite and final-overflow/error/end cleanup callback, and13 unrelated receipt objects. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial runtime files-watch suite retains controlled Windows close-event waiting, shared-client survival, late physical-exit ownership/deadline cleanup and shutdown joining. Its combined Windows close/deadline/late-exit alias remains backed by unchanged callbacks. Retire native-error-close, pre-publication setup ownership and failed-delete rearm aliases; associated delegation, failure forwarding, removal routing and recovery examples are lost. These tests inject watch/subscription seams and do not observe an actual native watcher or physical process. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Partial runtime watcher-host suite loses mocked option/event/overflow/resubscription forwarding, supplied teardown-error propagation, aborted-signal/no-call and private ten-thousand-waiter-count inventories. Retire the 10,000-caller bound and failed-recovery-subscriber-ending assertion aliases. Keep same-root owner cancellation, pre-ready replacement, held root-close join, stale-generation recovery delivery and initial failed-root ownership mappings backed by retained real-host callbacks with injected subscription/error/physical-exit promises. No actual native watcher, process termination or resource bound was observed. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1516 removes package-electron-runtime-contract.test.mjs, a copied release-workflow platform and marker matrix. Its workflow wiring alarm is intentionally retired; no actual packaged watcher delivery was exercised and no equivalent replacement is claimed. Unaffected dated execution receipts retain their original scope; changed optional selectors have no fresh full-gate execution result. This audit removes the paired-web stopped-during-outage and late-ready direct-branch examples. The retained pre-ready cancellation, failed-unwatch retry and replay-continuity cases are not equivalent replacements for those ordering alarms. Current web-runtime-client.test.ts assertions below name only its retained pre-ready callback case; replay cases remain in their separate suite. Historical commands and results remain historical. Deterministic tests cover one shared healthy child per runtime process plus at most four bounded fault-quarantine children, native desktop, paired-runtime, and WSL snapshot processes sharing the same eight-physical-child reservation with typed serialized event-driven capacity recovery, including recursive re-wait when crash recovery reclaims an announced slot, one quarantine attempt per watch lifetime, generation-scoped cancellation, bounded termination with removable deadline waiters, replacement-crawl errors that cannot be blessed by a late readiness ack, pre-ready paired-web cancellation registered before an unbounded capacity wait, already-resolved and late physical-exit retry of a rejected paired-web teardown, physical desktop-install and local/SSH PTY teardown, stale-generation rejection, per-child stat bounds, final-overflow RPC delivery, and renderer eviction before terminal callbacks can retry. Destructive local and SSH removal fences both ID-derived and resolved-cwd terminal roots, including sibling-root/cwd combinations with reverse admission rollback, closes descendant relay watches before parent deletion, enumerates authoritative provider/cwd ownership, falls back to daemon spawn cwd before OSC 7, and keeps daemon/relay immediate shutdown pending until native exit or a bounded fail-closed error; a dead relay PID discovered during attach also settles concurrent shutdown before its stale entry is reaped, while Windows runtime watcher deadlines retain one removable physical-close waiter, treat Node's error-close path as positive physical-exit proof, and clear root ownership on late close. The relay policy test maps a standard repository's base, Git common directory, and worktree roots to one healthy supervisor, then proves a shared-child failure recovers those roots in separate quarantine supervisors with overflow and resumed events. Abortable capacity, quarantine, runtime-root, relay, SSH, and relay pre-install setup waits attach one reaction to each shared promise and explicitly remove 10,000 cancelled caller closures while one anchor remains. Built-entry macOS harnesses kill the desktop/runtime and SSH relay watcher children, then require automatic resubscription and later events while the host process and relay PTY survive. SSH bundles the child boundary beside relay.js, requires both artifacts for install completeness, and preserves registration-owned same-root cancellation. The test-value audit corrects the active renderer watch command/file reference to the existing runtime-file-client-watch.test.ts, whose three cases are retained unchanged. They observe synthetic subscription retry/fanout and unsubscribe/unwatch calls, not actual preload/main bookkeeping or physical watcher-process cleanup. The separate read/preview client suite loses forwarding, supplied-error and negative-only examples, retaining binary detection and Unicode SVG decoding. Historical evidence commands/results are unchanged. Test-value audit1293 removes src/main/providers/local-pty/local-pty-provider-session-inventory.test.ts (2 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1412: src/main/workspaces/removal/watcher-removal-gate.test.ts reduced. Loses exact removal-error compatibility with renderer predicate under shared message constants. Kept public refusal outcomes do not establish that renderer classification. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
+ "coverageNotes": "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed. Audit 3959 retires the whole session.test.ts driver (27 authored / 33 finite cases): startup/echo filtering, readiness input gates, ownership confirmation, detach authority, and termination retry/exit ordering alarms are intentionally lost. No equivalent replacement or fresh runtime validation is claimed. Audit3788 retires10 authored/11 expanded cases across six changed drivers, including the entire screencast pending-frame-retry and usage-source-cache-streaming suites. Deliberate losses are false-refused last-frame retry/once-only delivery, ordinary stable-pane reattachment, cleared-chat Dispatch completion, terminal-declared chat-caller refusal, at-rest worker liveness projection, nested depth/cap policy, small unsigned6/sealed7 plain-format and verified-bit examples, generic malformed-ISIZE footer refusal examples, and synthetic10k/100k chunk-size/work-count budgets in gzip and general cache I/O. These include real state/disk/RPC outcomes consciously retired for marginal value; retained E2EE-backlog, receipt/custody/uncertain-ack, integrity/migration and staging-cleanup cases are not equivalent replacements. The footer test did not prove early rejection or bounded allocation; staging cleanup did not seed unrelated files. No replacement or fresh native/remote/performance execution is claimed. Earlier raw selectors and dated receipts remain historical. Audit3779 retires17 authored/17 expanded registrations across six changed drivers, including the entire shared-Codex-home and prompt-telemetry suites. Accepted losses are shared-home wrapper noninterference/opt-out preservation, mocked metric count/provenance filters, SSH activity labeling/clearing and handover idle timing, VM ownership/capability/status projections and asleep-worktree refusal, a link-only external conversation replay sample, and two narrow input-credit noninterference/expiry examples. Retain the direct exact-tab/single-use input-credit case. These bounded real disk/state/routing alarms are intentionally retired for marginal value without equivalent replacement or fresh execution claims; earlier receipts remain historical. Audit3772 retires18 authored/27 expanded cases, including whole Codex service opt-out, RPC capability-parser, creator-provenance, short-ciphertext and readiness-null suites. Accepted losses include service ledger/symlink/mode cleanup, user TOML substring preservation, old-hash cleanup, description pass-through, malformed-file/pending-hash examples, coordinator write/probe counts, capability array bounds, positive creator projections, early short-payload refusal and readiness helper null shape. Two redundant Codex exit-cause rows are also retired; Pi shares their direct-idle path only in this empty-output immediate-exit fixture, and future agent-config drift coverage is lost. Real bounded filesystem/parser/runtime alarms are deliberately retired for marginal value; no equivalent replacements or fresh execution are claimed. Earlier receipts retain their historical scope. Audits3754/3755 intentionally remove9 authored/9 finite registrations: the entire one-case usage-source-cache-streaming.test.ts driver and8 cases from the surviving computer-action-validation.test.ts driver. This gate retains an unfiltered root Vitest command; UNIT_INCLUDE admits both source paths. Accepted losses are the real encoder output chunk-size/work-count alarm on repetitive10k/100k ownership payloads through a mocked durable sink, plus CLI diagnostic precedence, fractional window-id rejection, action-call-site window-target exclusivity, plain-text click-count recovery copy, incomplete click/drag targeting, mouse/modifier/direction allowlist samples and inline/stdin text exclusivity. These CLI cases exercise real argument/handler validation before mocked runtime calls; they are deliberately retired for marginal value, not declared tautologies. Retained cache I/O and CLI cases are not equivalent replacements for these alarms. Existing historical raw receipts remain unchanged and do not validate the deleted or reduced drivers. No fresh execution claim is made. Audits3758/3763 intentionally remove9 authored/11 finite registrations from6 changed drivers, including the entire pane-title-notification, window-linear-notices and worktree-card-lifecycle-effects suites. This gate retains an unfiltered root Vitest command admitting these paths. Accepted losses are same-account linked-row success-notice fanout, sidebar-switch channel forwarding, Linear-only notification forwarding/non-terminal-consumer selection/closed-window detach, destroyed-window refusal and first-send-failure suspension through the pane-title adapter, the100-card synthetic focus/poll absence sample, stored-source local folder badge refresh, unobserved-row badge refusal, and immediate reposChanged lineage invalidation. These exercise real owners with controlled ports; they are retired for marginal value, without equivalent replacement claims. The no-badge-work fixture does not seed its title-promised collection-only cache. Preserved historical receipts do not validate deleted or reduced drivers; no fresh execution is claimed. Audit3759 retires the entire one-case Tailwind compiler/scanner smoke. Accept loss of the direct CSS production/test/spec source-exclusion and rescan alarm; no replacement or current execution is claimed. Audit3752 independently approves audit3749: retire five authored/five finite watcher-process registrations, retaining18 raw-exact registrations. Accept loss of healthy shared-pool joint recovery, last-pending-failure idle retirement/respawn, late VITEST fallback release, missing-entry fail-closed selection and independent-supervisor fuse locality alarms. These are real bounded host-policy alarms intentionally retired for low marginal value; no equivalent replacement is asserted. Remaining driver selections exercise controlled FakeChild supervisor lifecycle, cancellation, physical-exit fencing, recovery and fuse behavior. This source review supplies no fresh native/process/platform/remote/SSH execution; historical receipts retain original source and selector scopes. Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered root Vitest command. Current UNIT_INCLUDE admits the partial push-service, metadata-dialog and two config/scripts browser drivers:10 authored/16 finite removals. Accepted losses: actual retry30s/60s progression and register bucket/refill wiring, explicit seven-day lease arithmetic (its notification lacked seq/epoch and never reached send), equal-name edit latch/save payload, real image/font/meta-refresh/form/popup browser refusal controls, and broad rich-markdown bridge/command/edit-select smoke. Actual production state, callback routing and browser enforcement run in these cases; these alarms are deliberately retired on marginal value. All drivers and selectors survive. Existing unrelated receipts remain historical evidence for their unchanged selectors, not proof of the reduced cases. Audit3732 removes 2 authored/3 finite registrations from two partial suites: nominal custom/Kimi local naming success and deferred context usage row presentation. Real losses: custom/Kimi successful extraction through conversation-name sanitization and agentLabel composition; separate ordered counted/deferred lists and exact percentage/token formatting. No replacement or equivalent coverage claimed. Retain 11 authored/13 finite raw-exact registrations for bounded naming instruction/refusal/cancellation, menu dismissal focus ownership and hover/composer Escape/timer cleanup. Source-only bounded value review, no runtime/CI/native/remote/mobile/folder workspace or global completion credit. Previous account (preserved verbatim): Audit3733 removes2authored/2finite terminal input checks: fixed custom-cap error/secret fixture and three-emoji cap5refusal whose6UTF16units already trip length fast guard (no UTF8-dependent boundary). Accept exact non-disclosure/oversized-refusal alarm losses; no replacement/equivalence claim. Retain13/13scalar/pending input, OSC state and cron DST/cadence outcomes after bounded material reads. Source-only zero runtime/novelty credit; original historical reasons preserved. Previous account (preserved verbatim): Audit3729 removes1authored/3finite by deleting whole CLI runtime pairing advisory-close suite. Accept losing post-real-close injected EIO preservation of native/script/unreadable pairing, env identity/preservation and exact close/release assertions; no actual failed-close leak or replacement coverage claimed. Two retained URL grammar/identity suites11authored16finite raw unchanged. Bounded source/owner/caller value review, zero novelty/runtime credit; other seven3724deferred closures remain. Historical receipts preserve original limits. Previous account (preserved verbatim): Audit3724 removes3authored/3finite checks by deleting two whole suites: TUI clear burst-size singleton and terminal-file-URL target two-case wrapper suite. Deliberate losses: derived widest burst<64byte alarm, UNC authority+line-column anchor composition, and malformed-percent null refusal. Real production algorithms execute in those tests; no mocked-output tautology, equivalent replacement, actual Claude/file-navigation delivery or universal safety-irrelevance claim. TUI58byte bound and URI examples have low marginal value as standalone suites. Actual1262/1264/1742KEEP superseded explicitly. Remaining14drivers83authored136finite raw unchanged. Bounded source-only review; ten closures deferred, four bounded keep judgments repeated with zero new semantic-frontier credit. No runtime/CI/native/remote/mobile/folder/global completion claim; historical receipts retain original scope. Previous account (preserved verbatim): Audit3723 removes 4 authored/4 finite registrations in two whole suites: keybinding cache freeze/token spellings and host-dependent Orca command name examples. Real losses include returned-object freeze, repeated Mod+P key, Space/PageDown/NumpadSubtract mapping, unknown/empty/prototype-token rejection, and headless Linux versus Windows-server/WSL command choice. No equivalent or replacement coverage claimed. Retain 12 authored/21 finite raw-exact registrations exercising generated scaffold validation, artifact failures, shipped editor/hook/worker/panel tests, actual generated typing compilation, independent CLI root routing and intent-name precedence. Source-only bounded audit; no runtime, CI, native, remote, mobile, folder workspace or global completion credit. Previous account (preserved verbatim): Audit3720 removes17authored/23finite checks: whole main catalog-date adapter2 and shared date-helper7, seven renderer nominal ranking/cap/no-date/composition cases, and one browser registration expanding to seven forced-container/DOM-child boundary cases. Deliberate real losses: community oldest-date UTC forwarding, official/undated omission, date sorting/window/invalid/future/skew/clamp and default/override cap; nominal ranking/cap and combined Featured/Newly-added outputs; real CSS459/460,719/720,1055/1056breakpoint, five-card partial-row and720px two-card first-row alarms. Browser cases really measure rendered geometry but force width/remove DOM children; no fake-pixel or tautology rationale. No replacement/equivalent coverage claimed. Retain14authored/19finite raw-exact registrations across4drivers: adversarial featured category/order/tie and installability, date order/window selection, actual PluginManager failure/escaping/duplicate-card suppression, real browser viewport/odd-count geometry/phone catalog visibility, syntax ingress/depth/include/printability and68dlong-bracket auto-close fill-in. No tests/browser/native/UI/provider/remote/mobile/folder/CI/global execution or completion credit. Previous account (preserved verbatim): Audit3717 removes6 authored/6finite checks in two whole thin-adapter/presentation suites. Deliberate real losses: ordinary recipe repository-URL withholding and provisioned-root credential scrubbing/forwarding; repository label lockstep suffix expansion, host-scoped map identity/collision grouping, Windows crosshost paths and WSL distro suffixes. Actual provision options, label/sort consumers and host/scrubber delegates inspected; no replacement/equivalence claim. Retain40 authored/84finite registrations raw exact in14 drivers with bounded owner/context review. Prior KEEP superseded for removed suites; no runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous account (preserved verbatim): Audit3714 removes8 authored/39finite checks: whole CLI selector-recovery, task display-text and ANSI grammar suites plus two name joiner/blank tables. Deliberate real losses: selector flag/value/identity and mutation recovery merge/serialization; exact task suffix, transcript fallback, input immutability, cache reuse and edited blocks; independent failed-escape/resumption and OSC/DCS/BEL/ST/C1/nested/unfinished stripping outputs; meaningful-language joiner preservation and invisible/blank-name rejection. These are real bounded alarms, removed as narrow supplied-error examples, helper/token inventories and repeated internal-work fixtures. Prior2936,1195/1196,1214/1215 and1082 KEEP superseded; no replacement or equivalent coverage claimed. Keep9authored/9finite raw-exact registrations in5surviving drivers: screenshot export/failure filesystem behavior, CLI local tree query, event-local reply provenance, vault role-sensitive content and four hostile/UTF16/dangling/tag-name regressions. No native/UI/provider/remote/mobile/folder/runtime/CI/global completion credit. Previous account (preserved verbatim): Audit3711 retires2authored/4finite cases by deleting whole clipboard-image-temp-file signature-to-name inventory (HEIC/TIFF/unrecognised bytes) and workspace-last-active switch-on supplied visit/reason singleton, plus its now-orphan test fixture. This intentionally loses real generated-filename suffix/extensionless alarms and real newer-visit archived7day versus inactive30day filtering/older-visit identity alarms. Filesystem writing and production reason pruning really execute; no equivalent replacement or universal absence of safety relevance is claimed. The clipboard test does not inspect written bytes, native delivery or decode; the visit test supplies candidate/timestamps and does not exercise persisted visit routing or actual removal.20authored/20finite cases remain unchanged across4bounded Git/sidecar/removal drivers. No new runner/test/module evaluation or runtime result; historical notes and receipts remain historical. Previous account (preserved verbatim): Audit3707 removes10 authored/11finite checks: three whole renderer adapter/assembled-stage suites and two native projection cases. Deliberate losses: plugin URL/ref/default-version/local-path and unsafe credential refusal forwarding; real Task hook/store A→B→A late-save/list/count fences, owner disappearance, legacy-host convergence, query/history/eviction and same-ID host history; native child append ordered-ID/replacement and compound fallback/order/optimistic-admission/child-turn/duplicate/shrink/revision alarms. These are real bounded alarms; removal follows thin adapter, manually assembled Task pipeline and repetitive fixture value judgment, with no replacement or equivalent coverage claim. Prior1179/1182,1220/1221 and1885 KEEP superseded as applicable. Keep36 authored/38finite registrations raw exact across13 surviving drivers. No runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous account (preserved verbatim): Audit3706 removes7authored/7potential cases from3renderer sources: whole usage-label3case and130000-distinct-day usage-overview singleton suites, plus3SSH grouping/ordinary-range examples. Retain11authored/11potential cases across6drivers in this bounded selection; no equivalent replacement or fresh runtime result. Existing bare root-unit commands admit this selection statically; prior command/receipt strings remain historical. Audit3706 intentionally retires first/second-order usage-group label collision alarms; equal50%-weekly bucket versus derived-weekly selection identity and Gemini wk label alarm;130000distinct-day aggregation no-spread-crash/max/intensity alarm; legacy absent-source SSH grouping and ordinary reverse-select/selected-target deselect range alarms. Actual label ambiguity and pathological-input crash are accepted losses. Distinct-day fixture spans~356years; no hard producer/date bound is claimed. Retained filtered-anchor/grouped-order guards do not replace removed deselection/reverse-range/legacy-group coverage. No native SSH, mounted renderer, live provider, remote/folder/mobile end-to-end or current runtime pass was obtained. Previous account (preserved verbatim): Audit3699 removes4 authored/4finite checks, including one whole xterm copy-policy suite and one root/group CLI help case. Deliberate losses: direct copy-chord admission for platform, selection, Kitty mode, defaultPrevented, logical/physical key and key phase; command-group disclosure and group help routing including claude-teams early return without RuntimeClient construction. These are real bounded policy/wiring alarms; no replacement or equivalent coverage claimed. Retain14 authored/19finite raw-exact registrations across6 drivers: unsafe CLI refusal, Claude model event carry and disk reconstruction/OSC-first case, attachment ownership/upload lifetime and mixed BMP file-reference/PNG-chip delivery, actual SQLite authority/admission/mutation, and Electron geometry/hit-testing. No runtime, CI, native-key delivery, external provider, mobile, remote, folder or global completion credit. Previous account (preserved verbatim): Audit3692 removes5 authored/5finite marginal Codex checks: unrelated login URL without notice; ordinary per-account launch resource/config materialization; no-retained-pane skip; preservation of a previously owed full scan through actual preparation and pending-marker update (no actual history scan/settlement); ordinary later-config refresh. Accept these exact branch/wiring alarms as deliberate losses without replacement. Retain32 authored/34finite raw callbacks/registrations/table bytes exact across14suites, including credential/admission refusal, grace/reset readiness, filesystem ownership, commit-dependent queue state, streaming/host trust, path canonicalization and private-state preservation. All14whole suites challenged without keeper quota; no whole deletion warranted on current concrete signals. No runtime/CI/native WSL/remote/mobile/folder/global completion credit Previous account (preserved verbatim): Audit3691 removes two complete runtime-home routing singleton suites (2 authored/2 finite): catalog wrapper mirror login-copy and passive transcript-lookup filesystem noncreation. Exact accepted losses are recorded in knownGaps; no replacement or equivalent coverage claimed. Audit3691: no dedicated alarm remains in the deleted sources for post-launch system login import through prepareHostCodexHomeForReadOnlyAppServer, or for repeated missing-transcript lookups leaving removed Codex account/runtime directories absent and userData entries unchanged. Ownership-marker read avoidance was never independently measured. No real catalog probe, provider, native Windows or crash was validated by those fixtures. Previous account (preserved verbatim): Audit3686 current Claude profile/account review removes5 authored/5 finite cases: whole structured-auth diagnostic-label suite3 and Windows-only command suite1 whose advertised cache alarm is ineffective because cache lifetime is per invocation; remove duplicate setup namespace-link refusal1 at wrapper layer. All5 exact historical KEEP are consciously superseded. Retain49 authored/50 finite unchanged, including filesystem privacy/recovery, route identity and concurrency, built worker/helper, legacy WSL alias compatibility and sign-in handoff. These are deliberate coverage losses without replacement. No runtime/CI/native WSL/macOS Keychain, remote/mobile/folder or global completion credit. Explicit accepted real losses: unknown-account host fallback and mixed-version/WSL-only structured auth diagnostic labels; Windows-only sentinel ENOENT-to-friendly-error translation plus fresh-call successful dispatch smoke; setup catch-to-refused wrapper and no-write outcome for a namespace symlink. The command case does not discriminate removal of its per-invocation noncache guard; it still supplies the error-translation alarm, which is intentionally retired. No replacement/equivalence promise. Previous account (preserved verbatim): Audit3680 removes eleven authored/eleven finite unit cases across four files, including entire launch setup row projection, structured legacy-model metadata, and legacy classifier suites. Accept loss of exact row partition/start selection, Codex supersession/default/unknown and Claude alias/suffix folding examples, other-agent exemption, getter/cache read budgets, same-array per-agent cache isolation, replaced-catalog metadata, and tracked-only model exclusion from structured and PTY legacy inventories. These are real narrow policy/metadata alarms intentionally retired without equivalent replacements. Retain real menu collapse/reopen in dropdown/select, AI picker cancel/accept and stale-effort filing, IME carry/gesture/frame transitions, and typed-flip versus held-dispatch fencing. No production or shared fixtures change. No dead timing entry exists for the three deleted drivers; retained timing keys stay unchanged. Static source-value review only; no project import, test runner, native/app execution or runtime validation established. Earlier receipts retain historical scope. Previous account (preserved verbatim): Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit. Previous account (preserved verbatim): Audit3672 renewed by3676 removes four authored/four finite cases from federation-output.test.ts: nominal show/read routing and terminal-fallback projection; initial archive-table SELECT failure returning retained/no-close; simulated old-peer read/fleet/refusal and method inventory; and absent archive-release capability refusing release. These actual compatibility/guard alarms are intentionally lost without equivalent replacement; the dropped-table case never reaches capture or commit. Current selected frontier9 becomes5: retain actual temporary transcript parsing/path omission, current no-transcript release/unavailable-output/restart/replay regression, and three home deadline/stop nonmutation cases. Prior held-capture case was already removed upstream and receives no new removal credit; prior redacted snapshot archive behavior was rewritten upstream and is not claimed retained here. The surviving driver timing entry stays. Static review/private composition only; no actual peer/network/native/platform or fresh runtime validation. Previous account (preserved verbatim): Audit3671 removes14 authored/32 finite root-unit cases, including the whole WSL move-handler refusal suite, WSL preload object-presence suite and internal gate spelling truth table. Also retire the weak withheld-command non-array shape assertion, static serve-only Add/capability/mock-remove example, grammar scope equality and basic configuration/payload schema roundtrips. Genuine wrong-window/malformed-request/gate-before-work, exact gate spellings/platform/argv precedence, static serve-only routing, declaration mismatch and empty grammar/pair admission alarms are consciously lost without replacement; prior KEEP decisions are reconsidered. Seven unchanged authored/finite root-unit cases retain real image/provider/line budgets, live policy transition/capability broadcast, grammar resource/reference traversal and strict-versus-tolerant literal salvage. Source-value evidence only; no runner/compiler/build/app/native/provider/remote/mobile/folder validation or historical fault claim. Independently remove one authored/finite Playwright closed-gate app-boot inventory: accept loss of real renderer/preload/main refusal composition, saved-host row and Add/Move hiding/Remove visibility alarms. Keep the unchanged scripted-move rendered dialog lifecycle/reload case. It runs no real WSL migration, host connection, file copy or automation restoration. No selector or Playwright participation cleanup is required because the spec remains. Previous account (preserved verbatim): Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence. Audit3634: Remove five authored/five finite cases, including the complete structured chat terminal-refusal, terminal-plus-agent worker-start validation, and canonical Git common-directory parser suites. Also remove the gh free-text -R argument projection case. Consciously supersede prior KEEP decisions and accept chat-versus-stale redirect classification, real RPC refusal-before-SQLite-Dispatch, old-Git echoed-option relative-path parsing, WSL execution-space resolution, and free-text preservation/bare-repo qualification alarms. These are genuine narrow alarms, intentionally retired without equivalent replacements. Retain real Git stdin/EOF delivery, bound-account host admission, naming environment/account precedence, upload iterator cancellation and remote path confinement. Shared fixtures and production code remain. Remove only the dead canonical-repo-key timing entry. Static source-value evidence only; all prior evidence retains historical scope. Audit3636: Remove the entire maintenance opportunity internal-count driver (one authored/two finite cases), the mocked remote worker start-card argument case (one/one), and the follow-up heading mapping table (one/two). Root-unit discovery loses three authored/five finite cases. Independently remove four Python native screenshot methods/five statically enumerated subTest scenarios: grim argv/stub payload, failure-code mapping, X11 mocked capture payload, and capability flags. The Python lane is verify:computer-native and is not root Vitest. Accept loss of exact native command/projection and exception/capability alarms, ready-only card publication arguments/agent forwarding, and serialized follow-up heading mapping; no equivalent replacement is claimed. Retain actual ownership/mail/queue/reopen transitions, remote lost-response fencing and first-result settlement, filesystem/maintenance admission and successor progress, wrong-region screenshot refusal and Sway geometry. The whole-deleted new driver has no timing key; this component requires no timing cleanup. No production changes. Static source-value review only; no project import, runner, app, native desktop or runtime validation established. All prior evidence retains historical scope. Audit3629 removes two singleton parser suites: WSL Claude plugin metadata out-of-range index rejection and Git checkout unlink-warning path extraction. Their real range-refusal and quoted-path extraction alarms are intentionally lost without replacement; no WSL execution, checkout recovery or equivalent remaining coverage is claimed. Audit3630 removes the sole orphan automation availability test (1 authored/1 finite). Its real policy kind, orphan precondition, delete/toggle enablement and run/edit refusal alarms are intentionally lost. The test did not dispatch an action, enforce a server generation fence or observe a remote mutation. No equivalent replacement, actual renderer/transport execution or new platform/provider evidence is claimed. Previous account (preserved verbatim): Audit3628: remove the entire one-authored/one-finite RepositoryRemoveProjectSection happy-dom suite. Accept losing the local zero-to-one-terminal stale-count revalidation alarm: first confirmation defers the removal callback and second confirmation invokes it after the count snapshot updates. The test never asserts updated warning text/count, actual terminal creation or removal/PTY teardown, host/scope routing, cancellation or folder/mobile behavior. No equivalent replacement or end-to-end warning-before-teardown proof asserted. Static evidence only; historical receipts retain original scope. Audit3624: Remove one authored/five finite positive Gemini identity table from the Claude/Gemini title collision driver. The real normalization, legacy label and explicit title evidence owners execute, so ordinary Gemini marker/name/wrapper recognition and normalized-label composition alarms are consciously retired without equivalent replacement; these five supplied title-to-literal identity examples have low marginal value. Preserve the six-row Claude task-text collision oracle, whose unrelated CLI mentions must not rebrand or destructively normalize titles. The other audited drivers preserve real permission-mode session transitions, prompt secret/fence/bounds defenses, JSON-to-Ask option/preview preservation, and optional GitLab failure summary/trace composition. Root-unit discovery loses one authored/five finite cases; no whole driver or timing key is removed. No actual terminal stream, UI routing, application/native or runtime execution established; all prior evidence retains historical scope. Audit3618: Remove three authored/three finite browser reload cases, including the complete renderer reload-actions suite. Agent bridge fake did-fail-load plus permanently supplied manager error projects description/code into a rejection. Renderer seeded empty metadata projects a saved URL into plain webview src; its earlier not-ready case projects a live-id/throwing fake reload into absence of a loading patch. Real queue/wait/error/cache/classifier/hook code executes, but these narrow supplied-state and exception-to-callback wirings have low marginal value; no rerender, lifecycle, actual cache generation/retirement or guest commit is asserted. Explicitly supersede audit1822 not-ready KEEP and preliminary3617 cross-module retain opinion, accepting offline-reload failure reporting, empty guest to saved URL routing, native-reload bypass and premature-loading/stranded-state alarms without replacement. Retain distinct main cancellation queue progression and absent queued side-effect dispatch. Root-unit discovery loses three/three. No Electron guest, network failure, restored navigation/commit, app/native focus or runtime execution established; earlier evidence retains its historical scope. Audit3614: Remove thirty-one authored/thirty-nine finite potential cases across CLI format and argument drivers, including three whole suites: search-result/status sanitation sites, Linear issue/list/warning sanitation sites, and quote-stripped JSON diagnostic secret non-echo. Those real formatter/guard transformations execute on supplied strings; intentionally retire their field-specific CSI/OSC/C1/newline/bell and diagnostic secrecy alarms as low-value caller/output inventories, without replacement. Also retire twenty-one search registrations/twenty-four finite cases covering minimal positional request/default omission, exhaustive all-flags request projection, nominal named query/index routes, repeated syntax/agent examples, enum/agent/path-count/timestamp/numeric/cursor admission examples, unknown/browser flag examples and postcommand last-wins projections; retire one parser sentinel-only case. Keep actual ambiguity, conflicting index request, precommand/crosscommand scoping, variadic reference parsing and missing-repeatable-value controls, without claiming equivalent coverage. Root-unit discovery loses all twenty-nine/thirty-seven. No CLI/RPC/terminal/PowerShell/host/schema/runtime execution is established by this source-only audit; earlier evidence retains its historical scope. Audit3613: remove six authored/six finite callbacks, including whole reviewer-display oversize-input and explorer-root record-filter suites, plus plugin family-emoji/invisible-only-name and pool legacy-name/urgent-countdown samples. Accept losing oversized-input empty-result/no-split, malformed-record/prototype-sensitive-key/nonstring filtering, exact ZWJ family preservation, invisible-only name refusal, no-group old-host full-name preservation, and80/79/null-reset countdown composition alarms. No equivalent replacement asserted. Retained strict/runtime sanitization, SVG parser, mobile focus recovery and collision/tie cases have different scopes. Static evidence only; historical receipts retain original scope. Audit3609: Remove the complete pnpm CLI invocation literal-selection suite (eleven authored/nineteen finite potential cases), with no replacement claimed. Root-unit discovery loses JavaScript-versus-native command selection, npm/npx executable rejection, Windows cmd/bat casing and shell selection, non-Windows cmd behavior, native PNPM_HOME flat/bin preference, explicit-path priority, relative-home rejection, missing-native fallback and non-Windows home-probe refusal alarms. The suite called the real resolver with independently expected objects, but exercised no pnpm/node/cmd process, installed native executable or real filesystem probe. Earlier KEEP decisions are consciously superseded by accepting these narrow branch and probe-inventory alarms as low value. Real symlink entry, Git signing isolation, Bun filesystem/Node child normalization and compiler scheduling/continuation tests remain distinct tests, not equivalent coverage. No runner, compiler, app, platform or remote execution was performed in this source-only audit. Earlier evidence retains its historical scope. Audit3608: remove five authored/five finite callbacks, including whole owner-slug and remote favicon URL suites and two repository-label projections. Lose five owner acceptance samples, eleven negative owner samples plus nonstring refusal, six host-local icon refusal samples, legacy-SSH same-path label-map cardinality, and explicit runtime ownership over stale legacy metadata at label level. These are accepted narrow grammar/presentation alarms with no equivalent replacement claimed. Retained binary parser, React recovery and label grouping/platform cases do not replace these losses. Static evidence only; historical receipts retain their original scope. Audit3606 adopts the enhanced3604/3605 icon cuts: nine authored/nine finite cases removed, including the whole tray-attention-icon suite. Retires the no-encoder oversized-upload null sample, missing-ID/request-order sample, encoder-null PNG-prefix fallback, SVG/404 rejection samples, transparent amber-dot placement and half-alpha white-tint sample, exact small fetched-byte passthrough, host-qualified image-key inventory and constant-encoder large-upload projection. These specific admission, formatting and bitmap alarms are intentionally lost without equivalent replacements. Retained queue/cache, bounded fetch and Dock lifecycle checks do not establish actual raster decoding, native image conversion or rendered appearance. Historical receipts below are preserved evidence for earlier test sets, not fresh validation of this reduced selection. Audit3601 scope: remove the whole custom-sound happy-path IPC suite and one custom-label/multiline notification formatting example (2 authored/2 finite). Intentionally lose configured .ogg selection, exact byte/MIME success wiring, successful dispatch for the formatting fixture, custom-label whitespace/title normalization and assistant-body whitespace/180-character-cap alarms. Retain prompt-exclusion, persisted qualified dismissal/restart, theme ownership/restore and Ghostty precedence/collision cases; none replaces the retired sound/formatting alarms. No actual playback, native delivery, phone/network, cross-platform or new runtime evidence is claimed; historical execution keeps its original scope. Audit3598: Remove seven authored/nine finite literal-table potential test registrations across workflow routing, Claude cold-start and real-zsh preexec drivers. Root-unit discovery loses six authored/six finite: three test-local workflow parser fixtures, the five-positive/three-negative explicit command-paint route inventory, a boot-banner-before-composer sample and an already-painted bare-title positive sample. The separately selected shell_contracts live-shell driver loses one authored/three finite raw-capture paint-only cases across three hook configurations; its real-wrapper launch-order, four rechunkings (twelve finite) and runtime-wait replay remain, without claiming equivalent replacement. Intentionally lose those parser, exact routing-list, banner, post-paint subscription and native-read-boundary paint alarms. Retained workflow/UNIT_EXCLUDE/classifier cross-source routing checks and readiness-race-to-writer timing are distinct bounded alarms. No runner, real shell, PTY, app, native focus, remote delivery, cross-platform execution or full-feature correctness is established by this source-only audit. Earlier evidence retains its historical scope. Audit3597 scope: remove two renderer-hang-capture examples (2 authored/2 finite): an invalid repeated-token oversized reducer fixture and a shorter unanswered-request fixture. Intentionally lose the direct truncated flag/sanitized frame fixture and request-pending status/zero-sample alarms. Retain window-death/stale-result exclusion, generation reconciliation, and baseline-publication cancellation lifecycles; they are not equivalent bound, redaction or pending-status replacements. Historical execution retains its original source scope; no new runtime evidence is claimed. Audit3591: Retire the whole one-case background journal-producer attribution suite and the fabricated malformed-details-block case (two authored/two finite cases). Intentionally lose the fixed own-task versus output/foreign-task attribution examples across flat/message row shapes, missing-root classification, and direct unbalanced/detailsish fabricated-block rejection alarms. Retained parser sibling/depth and editor navigation tests do not replace these alarms. No equivalent replacement or fresh runtime, transport, persistence, native focus or rendered UI validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3592: Retire the whole three-case shared agent smart-key resolver suite, explicitly superseding its Audit3238/3237 keep decisions. Intentionally lose literal permission-versus-question classification, longest-question digit selection, Codex async-question opener/digit/Enter/skip mapping, and unsupported-agent/state/prompt refusal examples. These were real parser/selection and literal-byte alarms; they did not exercise terminal delivery or timing. No equivalent replacement or fresh runtime, native TUI, mobile, remote or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3587/3588: Retire six authored/fourteen finite cases, including the whole WSL stopped-notice and connecting-status selector suites. Intentionally lose direct WSL retry connection field/target/ready-epoch/null-guard examples, connecting/reconnecting distro and absent-state selector samples, and stopped/connecting notice text/button/data-attribute examples. Retained host-ready retry and content-loader/reload lifecycles do not replace these alarms. No equivalent replacement or fresh runtime, native WSL, remote, rendered UI or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed. Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions. Audit3553/3559 current scope: delete worktrees-delete-pty-teardown.test.ts and worktrees-issue-command-overrides.test.ts entirely and remove three cases from worktrees-orphan-directory-cleanup.test.ts (6 authored/6 finite removals). Intentionally retire typed unserved-SSH create/delete admission, exact-name collision/error-token, proven-orphan no-force confirmation, standalone .git-directory refusal, and SSH-owned local-path preservation alarms. Retain only actual authorized orphan deletion and no-marker notes-file preservation; they are not equivalent replacements. The no-marker fixture resolves the default getRepos owner, so it does not prove temporary owner-repo binding. Git/Store/PTY/notifications are mocked; no physical process stop, durable metadata, real SSH delivery or native UI proof is claimed. Unchanged historical oracle, coverage, evidenceRuns and escaped receipts retain their original scopes only; no fresh execution or transferred pass validates the reduced sources. Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts: delivers remote file changes to listeners for the same worktree. src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Exact retired assertionRefs, preserved as historical objects only: {\n \"file\": \"src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts\",\n \"assertions\": [\n \"terminal watcher error and setup failure evict the shared entry before retrying callbacks run\",\n \"an old stream end cannot evict the replacement stream, which still delivers to its listener\",\n \"two same-worktree listeners share a synthetic subscription until the final stop unsubscribes and sends unwatch\"\n ]\n } Historical prior account (preserved verbatim): Audit1973: Delete the standalone mocked watcher cleanup suite and its entire sole-file prospective command. Retire the removed file-command transport-abort alias; preserve the independent cancellation suite and final-overflow/error/end cleanup callback, and13 unrelated receipt objects. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial runtime files-watch suite retains controlled Windows close-event waiting, shared-client survival, late physical-exit ownership/deadline cleanup and shutdown joining. Its combined Windows close/deadline/late-exit alias remains backed by unchanged callbacks. Retire native-error-close, pre-publication setup ownership and failed-delete rearm aliases; associated delegation, failure forwarding, removal routing and recovery examples are lost. These tests inject watch/subscription seams and do not observe an actual native watcher or physical process. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Partial runtime watcher-host suite loses mocked option/event/overflow/resubscription forwarding, supplied teardown-error propagation, aborted-signal/no-call and private ten-thousand-waiter-count inventories. Retire the 10,000-caller bound and failed-recovery-subscriber-ending assertion aliases. Keep same-root owner cancellation, pre-ready replacement, held root-close join, stale-generation recovery delivery and initial failed-root ownership mappings backed by retained real-host callbacks with injected subscription/error/physical-exit promises. No actual native watcher, process termination or resource bound was observed. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1516 removes package-electron-runtime-contract.test.mjs, a copied release-workflow platform and marker matrix. Its workflow wiring alarm is intentionally retired; no actual packaged watcher delivery was exercised and no equivalent replacement is claimed. Unaffected dated execution receipts retain their original scope; changed optional selectors have no fresh full-gate execution result. This audit removes the paired-web stopped-during-outage and late-ready direct-branch examples. The retained pre-ready cancellation, failed-unwatch retry and replay-continuity cases are not equivalent replacements for those ordering alarms. Current web-runtime-client.test.ts assertions below name only its retained pre-ready callback case; replay cases remain in their separate suite. Historical commands and results remain historical. Deterministic tests cover one shared healthy child per runtime process plus at most four bounded fault-quarantine children, native desktop, paired-runtime, and WSL snapshot processes sharing the same eight-physical-child reservation with typed serialized event-driven capacity recovery, including recursive re-wait when crash recovery reclaims an announced slot, one quarantine attempt per watch lifetime, generation-scoped cancellation, bounded termination with removable deadline waiters, replacement-crawl errors that cannot be blessed by a late readiness ack, pre-ready paired-web cancellation registered before an unbounded capacity wait, already-resolved and late physical-exit retry of a rejected paired-web teardown, physical desktop-install and local/SSH PTY teardown, stale-generation rejection, per-child stat bounds, final-overflow RPC delivery, and renderer eviction before terminal callbacks can retry. Destructive local and SSH removal fences both ID-derived and resolved-cwd terminal roots, including sibling-root/cwd combinations with reverse admission rollback, closes descendant relay watches before parent deletion, enumerates authoritative provider/cwd ownership, falls back to daemon spawn cwd before OSC 7, and keeps daemon/relay immediate shutdown pending until native exit or a bounded fail-closed error; a dead relay PID discovered during attach also settles concurrent shutdown before its stale entry is reaped, while Windows runtime watcher deadlines retain one removable physical-close waiter, treat Node's error-close path as positive physical-exit proof, and clear root ownership on late close. The relay policy test maps a standard repository's base, Git common directory, and worktree roots to one healthy supervisor, then proves a shared-child failure recovers those roots in separate quarantine supervisors with overflow and resumed events. Abortable capacity, quarantine, runtime-root, relay, SSH, and relay pre-install setup waits attach one reaction to each shared promise and explicitly remove 10,000 cancelled caller closures while one anchor remains. Built-entry macOS harnesses kill the desktop/runtime and SSH relay watcher children, then require automatic resubscription and later events while the host process and relay PTY survive. SSH bundles the child boundary beside relay.js, requires both artifacts for install completeness, and preserves registration-owned same-root cancellation. The test-value audit corrects the active renderer watch command/file reference to the existing runtime-file-client-watch.test.ts, whose three cases are retained unchanged. They observe synthetic subscription retry/fanout and unsubscribe/unwatch calls, not actual preload/main bookkeeping or physical watcher-process cleanup. The separate read/preview client suite loses forwarding, supplied-error and negative-only examples, retaining binary detection and Unicode SVG decoding. Historical evidence commands/results are unchanged. Test-value audit1293 removes src/main/providers/local-pty/local-pty-provider-session-inventory.test.ts (2 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1412: src/main/workspaces/removal/watcher-removal-gate.test.ts reduced. Loses exact removal-error compatibility with renderer predicate under shared message constants. Kept public refusal outcomes do not establish that renderer classification. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/5308",
"https://github.com/stablyai/orca/issues/7547",
"https://github.com/stablyai/orca/issues/8212"
],
"invariant": "Local runtime and SSH relay roots share one watcher child per host process while healthy and use at most four quarantine children after shard failure; native desktop, paired-runtime, and direct WSL snapshot children consume the same process-wide eight-child reservation and retry transient exhaustion without permanently disabling a root. Cancellation remains owned by its child generation and settles only after acknowledgement or bounded physical exit; paired-web retains cleanup ownership and can cancel before readiness even while capacity is exhausted, retries a failed unwatch after already-resolved or late physical exit without duplicating stream termination, replacements never overlap a still-retiring generation, and aborted or timed-out callers detach immediately even while queued behind same-root relay teardown. Destructive local and SSH cleanup holds one containment-aware watcher/terminal removal fence through descendant watcher and PTY physical exit plus parent Git/filesystem deletion; daemon and relay kill requests retain ownership until the actual subprocess exit callback or an equivalent positive dead-PID proof and propagate rejected signals or a bounded failure otherwise. A crash-fused shared shard moves affected roots into the bounded quarantine pool, a second fused quarantine ends those watch lifetimes, interrupted setup emits overflow after recovery, metadata work stays bounded, and the SSH relay, PTYs, Git, and other filesystem operations never load the watcher native addon or share its fault boundary.",
- "oracle": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts: delivers remote file changes to listeners for the same worktree. src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Exact retired assertionRefs, preserved as historical objects only: {\n \"file\": \"src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts\",\n \"assertions\": [\n \"terminal watcher error and setup failure evict the shared entry before retrying callbacks run\",\n \"an old stream end cannot evict the replacement stream, which still delivers to its listener\",\n \"two same-worktree listeners share a synthetic subscription until the final stop unsubscribes and sends unwatch\"\n ]\n } Historical prior account (preserved verbatim): Audit1973: Delete the standalone mocked watcher cleanup suite and its entire sole-file prospective command. Retire the removed file-command transport-abort alias; preserve the independent cancellation suite and final-overflow/error/end cleanup callback, and13 unrelated receipt objects. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial runtime files-watch suite retains controlled Windows close-event waiting, shared-client survival, late physical-exit ownership/deadline cleanup and shutdown joining. Its combined Windows close/deadline/late-exit alias remains backed by unchanged callbacks. Retire native-error-close, pre-publication setup ownership and failed-delete rearm aliases; associated delegation, failure forwarding, removal routing and recovery examples are lost. These tests inject watch/subscription seams and do not observe an actual native watcher or physical process. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Partial runtime watcher-host suite loses mocked option/event/overflow/resubscription forwarding, supplied teardown-error propagation, aborted-signal/no-call and private ten-thousand-waiter-count inventories. Retire the 10,000-caller bound and failed-recovery-subscriber-ending assertion aliases. Keep same-root owner cancellation, pre-ready replacement, held root-close join, stale-generation recovery delivery and initial failed-root ownership mappings backed by retained real-host callbacks with injected subscription/error/physical-exit promises. No actual native watcher, process termination or resource bound was observed. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Fill the global watcher-child reservation, require native desktop, paired-runtime, and WSL setup to retain typed transient capacity and retry after one serialized release, then cancel pending desktop and paired-client watches and require no retry. Hold one live anchor while aborting 10,000 callers at the capacity, quarantine-assignment, runtime-root, relay-setup, and SSH-registration layers; require exactly one explicit waiter and one base-promise reaction to remain, then zero after settlement. Hold an old relay unsubscribe, queue one same-root setup leader and one anchor, then abort 10,000 joiners; require every cancellation to settle before teardown releases, exactly one anchor waiter, and only one later physical install. Advance the former paired-web callback deadline while capacity remains full, require cancellation ownership to stay live, publish the server token before ready, and require files.unwatch to abort setup before a later slot release can install a native root. Reject the first ready-watch unwatch with a physical-exit promise, resolve that exit later, and require a fresh physical unwatch attempt, registry release, and exactly one stream end. Fill one healthy shared child with multiple roots, map a standard SSH repository's base, Git common directory, and worktree roots to one relay supervisor, then inject IPC disconnect-before-exit, queued and active cancellation, operations during termination, kill-without-exit, repeated unkillable generations, initial and recovery timeouts, and shard failure. During local and SSH deletion, attempt a late terminal spawn whose worktree identity and cwd name different roots, enumerate a non-prefix remote PTY by authoritative worktree ownership, withhold daemon/relay exit callbacks, make attach positively prove a concurrent-shutdown PID dead, and make the provider unavailable; require every acquired admission to roll back on rejection, dead-PID proof to settle physical exit before reaping, timeout to retain ownership, and Git/filesystem deletion never to start. Require bounded watcher process count, physical-exit settlement, healthy-root recovery, stale-generation rejection, overflow plus later events, and fail-closed destructive cleanup. Verify relay build hashes and remote install probes require both relay.js and relay-watcher.js. Launch the built relay with a real PTY and Parcel watch, kill only the watcher child, and require the same relay PID and PTY to answer before a replacement child delivers overflow and a post-crash event.",
+ "oracle": "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed. Historical prior account (preserved verbatim): Audit3814 deliberately retires60 authored/60 finite cases:53runtime compatibility cases,4native XCTest methods and3Python clipboard methods, including the entire StableElementIndexes suite. Clipboard cuts retire the one-over-cap sample, incoming-offer destruction trace and sequential20-copy replay; actual wire, FD/pipe, startup and Xvfb/GTK boundaries remain without equivalent replacement claims. Accepted losses include narrow terminal-send payload/provider projections, legacy and direct no-op/error permutations, timing/work-count examples, private state/title/activity projections and fixture-driven readiness examples, individually enumerated below. These include real bounded production alarms consciously retired for marginal value; retained failed writes, duplicate submission, stale capture, transcript/ring and allocation fences are not equivalent replacements. No fresh native/remote/browser execution or complete transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3806 deliberately retires40 authored/40 finite runtime compatibility cases, including the terminal-side-effect-facts-part03 headless-snapshots-part02 and agent-status-and-waits-part03 fragments, plus20 scalar Swift precondition sites. Lost runtime alarms include status/title/attention projection examples, simple renderer/headless frame restoration and status waiting outcomes detailed in the accepted-loss ledger. Swift cuts retire duplicate generation-map/schema/navigation/bridge and notification-wrapper assertions; no standalone native program is deleted. These include real bounded production alarms consciously retired for marginal value. Retained races, pending writes/reflow, namespace and waiter ownership are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3798 deliberately retires21 authored/24 finite compatibility cases, including the entire SSH-worktree-lifecycle and repository-project-operations fragments. Accepted losses include navigation-only settings acknowledgement, browser session cleanup and host preservation projections, window positive/policy-state examples, terminal recovery/reload and no-incarnation remint examples, terminal listing compatibility/malformed IDs, directory browse/sort/Windows path smoke, SSH create refusal/manual lineage, recursive parent-folder creation and fork/origin/avatar/icon projections. Real bounded production alarms are consciously retired for marginal value; retained authority races, cleanup/clone ownership, pending waiters, nested-folder and scan invalidation cases are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3788 retires10 authored/11 expanded cases across six changed drivers, including the entire screencast pending-frame-retry and usage-source-cache-streaming suites. Deliberate losses are false-refused last-frame retry/once-only delivery, ordinary stable-pane reattachment, cleared-chat Dispatch completion, terminal-declared chat-caller refusal, at-rest worker liveness projection, nested depth/cap policy, small unsigned6/sealed7 plain-format and verified-bit examples, generic malformed-ISIZE footer refusal examples, and synthetic10k/100k chunk-size/work-count budgets in gzip and general cache I/O. These include real state/disk/RPC outcomes consciously retired for marginal value; retained E2EE-backlog, receipt/custody/uncertain-ack, integrity/migration and staging-cleanup cases are not equivalent replacements. The footer test did not prove early rejection or bounded allocation; staging cleanup did not seed unrelated files. No replacement or fresh native/remote/performance execution is claimed. Earlier raw selectors and dated receipts remain historical. Audit3779 retires17 authored/17 expanded registrations across six changed drivers, including the entire shared-Codex-home and prompt-telemetry suites. Accepted losses are shared-home wrapper noninterference/opt-out preservation, mocked metric count/provenance filters, SSH activity labeling/clearing and handover idle timing, VM ownership/capability/status projections and asleep-worktree refusal, a link-only external conversation replay sample, and two narrow input-credit noninterference/expiry examples. Retain the direct exact-tab/single-use input-credit case. These bounded real disk/state/routing alarms are intentionally retired for marginal value without equivalent replacement or fresh execution claims; earlier receipts remain historical. Audit3772 retires18 authored/27 expanded cases, including whole Codex service opt-out, RPC capability-parser, creator-provenance, short-ciphertext and readiness-null suites. Accepted losses include service ledger/symlink/mode cleanup, user TOML substring preservation, old-hash cleanup, description pass-through, malformed-file/pending-hash examples, coordinator write/probe counts, capability array bounds, positive creator projections, early short-payload refusal and readiness helper null shape. Two redundant Codex exit-cause rows are also retired; Pi shares their direct-idle path only in this empty-output immediate-exit fixture, and future agent-config drift coverage is lost. Real bounded filesystem/parser/runtime alarms are deliberately retired for marginal value; no equivalent replacements or fresh execution are claimed. Earlier receipts retain their historical scope. Audits3754/3755 intentionally remove9 authored/9 finite registrations: the entire one-case usage-source-cache-streaming.test.ts driver and8 cases from the surviving computer-action-validation.test.ts driver. This gate retains an unfiltered root Vitest command; UNIT_INCLUDE admits both source paths. Accepted losses are the real encoder output chunk-size/work-count alarm on repetitive10k/100k ownership payloads through a mocked durable sink, plus CLI diagnostic precedence, fractional window-id rejection, action-call-site window-target exclusivity, plain-text click-count recovery copy, incomplete click/drag targeting, mouse/modifier/direction allowlist samples and inline/stdin text exclusivity. These CLI cases exercise real argument/handler validation before mocked runtime calls; they are deliberately retired for marginal value, not declared tautologies. Retained cache I/O and CLI cases are not equivalent replacements for these alarms. Existing historical raw receipts remain unchanged and do not validate the deleted or reduced drivers. No fresh execution claim is made. Audits3758/3763 intentionally remove9 authored/11 finite registrations from6 changed drivers, including the entire pane-title-notification, window-linear-notices and worktree-card-lifecycle-effects suites. This gate retains an unfiltered root Vitest command admitting these paths. Accepted losses are same-account linked-row success-notice fanout, sidebar-switch channel forwarding, Linear-only notification forwarding/non-terminal-consumer selection/closed-window detach, destroyed-window refusal and first-send-failure suspension through the pane-title adapter, the100-card synthetic focus/poll absence sample, stored-source local folder badge refresh, unobserved-row badge refusal, and immediate reposChanged lineage invalidation. These exercise real owners with controlled ports; they are retired for marginal value, without equivalent replacement claims. The no-badge-work fixture does not seed its title-promised collection-only cache. Preserved historical receipts do not validate deleted or reduced drivers; no fresh execution is claimed. Audit3759 retires the entire one-case Tailwind compiler/scanner smoke. Accept loss of the direct CSS production/test/spec source-exclusion and rescan alarm; no replacement or current execution is claimed. Audit3752 independently approves audit3749: retire five authored/five finite watcher-process registrations, retaining18 raw-exact registrations. Accept loss of healthy shared-pool joint recovery, last-pending-failure idle retirement/respawn, late VITEST fallback release, missing-entry fail-closed selection and independent-supervisor fuse locality alarms. These are real bounded host-policy alarms intentionally retired for low marginal value; no equivalent replacement is asserted. Remaining driver selections exercise controlled FakeChild supervisor lifecycle, cancellation, physical-exit fencing, recovery and fuse behavior. This source review supplies no fresh native/process/platform/remote/SSH execution; historical receipts retain original source and selector scopes. Previous oracle (preserved verbatim): Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered root Vitest command. Current UNIT_INCLUDE admits the partial push-service, metadata-dialog and two config/scripts browser drivers:10 authored/16 finite removals. Accepted losses: actual retry30s/60s progression and register bucket/refill wiring, explicit seven-day lease arithmetic (its notification lacked seq/epoch and never reached send), equal-name edit latch/save payload, real image/font/meta-refresh/form/popup browser refusal controls, and broad rich-markdown bridge/command/edit-select smoke. Actual production state, callback routing and browser enforcement run in these cases; these alarms are deliberately retired on marginal value. All drivers and selectors survive. Existing unrelated receipts remain historical evidence for their unchanged selectors, not proof of the reduced cases. Audit3732 removes 2 authored/3 finite registrations from two partial suites: nominal custom/Kimi local naming success and deferred context usage row presentation. Real losses: custom/Kimi successful extraction through conversation-name sanitization and agentLabel composition; separate ordered counted/deferred lists and exact percentage/token formatting. No replacement or equivalent coverage claimed. Retain 11 authored/13 finite raw-exact registrations for bounded naming instruction/refusal/cancellation, menu dismissal focus ownership and hover/composer Escape/timer cleanup. Source-only bounded value review, no runtime/CI/native/remote/mobile/folder workspace or global completion credit. Previous oracle (preserved verbatim): Audit3733 removes2authored/2finite terminal input checks: fixed custom-cap error/secret fixture and three-emoji cap5refusal whose6UTF16units already trip length fast guard (no UTF8-dependent boundary). Accept exact non-disclosure/oversized-refusal alarm losses; no replacement/equivalence claim. Retain13/13scalar/pending input, OSC state and cron DST/cadence outcomes after bounded material reads. Source-only zero runtime/novelty credit; original historical reasons preserved. Previous oracle (preserved verbatim): Audit3729 removes1authored/3finite by deleting whole CLI runtime pairing advisory-close suite. Accept losing post-real-close injected EIO preservation of native/script/unreadable pairing, env identity/preservation and exact close/release assertions; no actual failed-close leak or replacement coverage claimed. Two retained URL grammar/identity suites11authored16finite raw unchanged. Bounded source/owner/caller value review, zero novelty/runtime credit; other seven3724deferred closures remain. Historical receipts preserve original limits. Previous oracle (preserved verbatim): Audit3724 removes3authored/3finite checks by deleting two whole suites: TUI clear burst-size singleton and terminal-file-URL target two-case wrapper suite. Deliberate losses: derived widest burst<64byte alarm, UNC authority+line-column anchor composition, and malformed-percent null refusal. Real production algorithms execute in those tests; no mocked-output tautology, equivalent replacement, actual Claude/file-navigation delivery or universal safety-irrelevance claim. TUI58byte bound and URI examples have low marginal value as standalone suites. Actual1262/1264/1742KEEP superseded explicitly. Remaining14drivers83authored136finite raw unchanged. Bounded source-only review; ten closures deferred, four bounded keep judgments repeated with zero new semantic-frontier credit. No runtime/CI/native/remote/mobile/folder/global completion claim; historical receipts retain original scope. Previous oracle (preserved verbatim): Audit3723 removes 4 authored/4 finite registrations in two whole suites: keybinding cache freeze/token spellings and host-dependent Orca command name examples. Real losses include returned-object freeze, repeated Mod+P key, Space/PageDown/NumpadSubtract mapping, unknown/empty/prototype-token rejection, and headless Linux versus Windows-server/WSL command choice. No equivalent or replacement coverage claimed. Retain 12 authored/21 finite raw-exact registrations exercising generated scaffold validation, artifact failures, shipped editor/hook/worker/panel tests, actual generated typing compilation, independent CLI root routing and intent-name precedence. Source-only bounded audit; no runtime, CI, native, remote, mobile, folder workspace or global completion credit. Previous oracle (preserved verbatim): Audit3720 removes17authored/23finite checks: whole main catalog-date adapter2 and shared date-helper7, seven renderer nominal ranking/cap/no-date/composition cases, and one browser registration expanding to seven forced-container/DOM-child boundary cases. Deliberate real losses: community oldest-date UTC forwarding, official/undated omission, date sorting/window/invalid/future/skew/clamp and default/override cap; nominal ranking/cap and combined Featured/Newly-added outputs; real CSS459/460,719/720,1055/1056breakpoint, five-card partial-row and720px two-card first-row alarms. Browser cases really measure rendered geometry but force width/remove DOM children; no fake-pixel or tautology rationale. No replacement/equivalent coverage claimed. Retain14authored/19finite raw-exact registrations across4drivers: adversarial featured category/order/tie and installability, date order/window selection, actual PluginManager failure/escaping/duplicate-card suppression, real browser viewport/odd-count geometry/phone catalog visibility, syntax ingress/depth/include/printability and68dlong-bracket auto-close fill-in. No tests/browser/native/UI/provider/remote/mobile/folder/CI/global execution or completion credit. Previous oracle (preserved verbatim): Audit3717 removes6 authored/6finite checks in two whole thin-adapter/presentation suites. Deliberate real losses: ordinary recipe repository-URL withholding and provisioned-root credential scrubbing/forwarding; repository label lockstep suffix expansion, host-scoped map identity/collision grouping, Windows crosshost paths and WSL distro suffixes. Actual provision options, label/sort consumers and host/scrubber delegates inspected; no replacement/equivalence claim. Retain40 authored/84finite registrations raw exact in14 drivers with bounded owner/context review. Prior KEEP superseded for removed suites; no runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous oracle (preserved verbatim): Audit3714 removes8 authored/39finite checks: whole CLI selector-recovery, task display-text and ANSI grammar suites plus two name joiner/blank tables. Deliberate real losses: selector flag/value/identity and mutation recovery merge/serialization; exact task suffix, transcript fallback, input immutability, cache reuse and edited blocks; independent failed-escape/resumption and OSC/DCS/BEL/ST/C1/nested/unfinished stripping outputs; meaningful-language joiner preservation and invisible/blank-name rejection. These are real bounded alarms, removed as narrow supplied-error examples, helper/token inventories and repeated internal-work fixtures. Prior2936,1195/1196,1214/1215 and1082 KEEP superseded; no replacement or equivalent coverage claimed. Keep9authored/9finite raw-exact registrations in5surviving drivers: screenshot export/failure filesystem behavior, CLI local tree query, event-local reply provenance, vault role-sensitive content and four hostile/UTF16/dangling/tag-name regressions. No native/UI/provider/remote/mobile/folder/runtime/CI/global completion credit. Previous oracle (preserved verbatim): Audit3711 retires2authored/4finite cases by deleting whole clipboard-image-temp-file signature-to-name inventory (HEIC/TIFF/unrecognised bytes) and workspace-last-active switch-on supplied visit/reason singleton, plus its now-orphan test fixture. This intentionally loses real generated-filename suffix/extensionless alarms and real newer-visit archived7day versus inactive30day filtering/older-visit identity alarms. Filesystem writing and production reason pruning really execute; no equivalent replacement or universal absence of safety relevance is claimed. The clipboard test does not inspect written bytes, native delivery or decode; the visit test supplies candidate/timestamps and does not exercise persisted visit routing or actual removal.20authored/20finite cases remain unchanged across4bounded Git/sidecar/removal drivers. No new runner/test/module evaluation or runtime result; historical notes and receipts remain historical. Previous oracle (preserved verbatim): Audit3707 removes10 authored/11finite checks: three whole renderer adapter/assembled-stage suites and two native projection cases. Deliberate losses: plugin URL/ref/default-version/local-path and unsafe credential refusal forwarding; real Task hook/store A→B→A late-save/list/count fences, owner disappearance, legacy-host convergence, query/history/eviction and same-ID host history; native child append ordered-ID/replacement and compound fallback/order/optimistic-admission/child-turn/duplicate/shrink/revision alarms. These are real bounded alarms; removal follows thin adapter, manually assembled Task pipeline and repetitive fixture value judgment, with no replacement or equivalent coverage claim. Prior1179/1182,1220/1221 and1885 KEEP superseded as applicable. Keep36 authored/38finite registrations raw exact across13 surviving drivers. No runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous oracle (preserved verbatim): Audit3706 removes7authored/7potential cases from3renderer sources: whole usage-label3case and130000-distinct-day usage-overview singleton suites, plus3SSH grouping/ordinary-range examples. Retain11authored/11potential cases across6drivers in this bounded selection; no equivalent replacement or fresh runtime result. Existing bare root-unit commands admit this selection statically; prior command/receipt strings remain historical. Audit3706 intentionally retires first/second-order usage-group label collision alarms; equal50%-weekly bucket versus derived-weekly selection identity and Gemini wk label alarm;130000distinct-day aggregation no-spread-crash/max/intensity alarm; legacy absent-source SSH grouping and ordinary reverse-select/selected-target deselect range alarms. Actual label ambiguity and pathological-input crash are accepted losses. Distinct-day fixture spans~356years; no hard producer/date bound is claimed. Retained filtered-anchor/grouped-order guards do not replace removed deselection/reverse-range/legacy-group coverage. No native SSH, mounted renderer, live provider, remote/folder/mobile end-to-end or current runtime pass was obtained. Previous oracle (preserved verbatim): Audit3699 removes4 authored/4finite checks, including one whole xterm copy-policy suite and one root/group CLI help case. Deliberate losses: direct copy-chord admission for platform, selection, Kitty mode, defaultPrevented, logical/physical key and key phase; command-group disclosure and group help routing including claude-teams early return without RuntimeClient construction. These are real bounded policy/wiring alarms; no replacement or equivalent coverage claimed. Retain14 authored/19finite raw-exact registrations across6 drivers: unsafe CLI refusal, Claude model event carry and disk reconstruction/OSC-first case, attachment ownership/upload lifetime and mixed BMP file-reference/PNG-chip delivery, actual SQLite authority/admission/mutation, and Electron geometry/hit-testing. No runtime, CI, native-key delivery, external provider, mobile, remote, folder or global completion credit. Previous oracle (preserved verbatim): Audit3692 removes5 authored/5finite marginal Codex checks: unrelated login URL without notice; ordinary per-account launch resource/config materialization; no-retained-pane skip; preservation of a previously owed full scan through actual preparation and pending-marker update (no actual history scan/settlement); ordinary later-config refresh. Accept these exact branch/wiring alarms as deliberate losses without replacement. Retain32 authored/34finite raw callbacks/registrations/table bytes exact across14suites, including credential/admission refusal, grace/reset readiness, filesystem ownership, commit-dependent queue state, streaming/host trust, path canonicalization and private-state preservation. All14whole suites challenged without keeper quota; no whole deletion warranted on current concrete signals. No runtime/CI/native WSL/remote/mobile/folder/global completion credit Previous oracle (preserved verbatim): Audit3691 removes two complete runtime-home routing singleton suites (2 authored/2 finite): catalog wrapper mirror login-copy and passive transcript-lookup filesystem noncreation. Exact accepted losses are recorded in knownGaps; no replacement or equivalent coverage claimed. Audit3691: no dedicated alarm remains in the deleted sources for post-launch system login import through prepareHostCodexHomeForReadOnlyAppServer, or for repeated missing-transcript lookups leaving removed Codex account/runtime directories absent and userData entries unchanged. Ownership-marker read avoidance was never independently measured. No real catalog probe, provider, native Windows or crash was validated by those fixtures. Previous oracle (preserved verbatim): Audit3686 current Claude profile/account review removes5 authored/5 finite cases: whole structured-auth diagnostic-label suite3 and Windows-only command suite1 whose advertised cache alarm is ineffective because cache lifetime is per invocation; remove duplicate setup namespace-link refusal1 at wrapper layer. All5 exact historical KEEP are consciously superseded. Retain49 authored/50 finite unchanged, including filesystem privacy/recovery, route identity and concurrency, built worker/helper, legacy WSL alias compatibility and sign-in handoff. These are deliberate coverage losses without replacement. No runtime/CI/native WSL/macOS Keychain, remote/mobile/folder or global completion credit. Explicit accepted real losses: unknown-account host fallback and mixed-version/WSL-only structured auth diagnostic labels; Windows-only sentinel ENOENT-to-friendly-error translation plus fresh-call successful dispatch smoke; setup catch-to-refused wrapper and no-write outcome for a namespace symlink. The command case does not discriminate removal of its per-invocation noncache guard; it still supplies the error-translation alarm, which is intentionally retired. No replacement/equivalence promise. Previous oracle (preserved verbatim): Audit3680 removes eleven authored/eleven finite unit cases across four files, including entire launch setup row projection, structured legacy-model metadata, and legacy classifier suites. Accept loss of exact row partition/start selection, Codex supersession/default/unknown and Claude alias/suffix folding examples, other-agent exemption, getter/cache read budgets, same-array per-agent cache isolation, replaced-catalog metadata, and tracked-only model exclusion from structured and PTY legacy inventories. These are real narrow policy/metadata alarms intentionally retired without equivalent replacements. Retain real menu collapse/reopen in dropdown/select, AI picker cancel/accept and stale-effort filing, IME carry/gesture/frame transitions, and typed-flip versus held-dispatch fencing. No production or shared fixtures change. No dead timing entry exists for the three deleted drivers; retained timing keys stay unchanged. Static source-value review only; no project import, test runner, native/app execution or runtime validation established. Earlier receipts retain historical scope. Previous oracle (preserved verbatim): Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit. Previous oracle (preserved verbatim): Audit3672 renewed by3676 removes four authored/four finite cases from federation-output.test.ts: nominal show/read routing and terminal-fallback projection; initial archive-table SELECT failure returning retained/no-close; simulated old-peer read/fleet/refusal and method inventory; and absent archive-release capability refusing release. These actual compatibility/guard alarms are intentionally lost without equivalent replacement; the dropped-table case never reaches capture or commit. Current selected frontier9 becomes5: retain actual temporary transcript parsing/path omission, current no-transcript release/unavailable-output/restart/replay regression, and three home deadline/stop nonmutation cases. Prior held-capture case was already removed upstream and receives no new removal credit; prior redacted snapshot archive behavior was rewritten upstream and is not claimed retained here. The surviving driver timing entry stays. Static review/private composition only; no actual peer/network/native/platform or fresh runtime validation. Previous oracle (preserved verbatim): Audit3671 removes14 authored/32 finite root-unit cases, including the whole WSL move-handler refusal suite, WSL preload object-presence suite and internal gate spelling truth table. Also retire the weak withheld-command non-array shape assertion, static serve-only Add/capability/mock-remove example, grammar scope equality and basic configuration/payload schema roundtrips. Genuine wrong-window/malformed-request/gate-before-work, exact gate spellings/platform/argv precedence, static serve-only routing, declaration mismatch and empty grammar/pair admission alarms are consciously lost without replacement; prior KEEP decisions are reconsidered. Seven unchanged authored/finite root-unit cases retain real image/provider/line budgets, live policy transition/capability broadcast, grammar resource/reference traversal and strict-versus-tolerant literal salvage. Source-value evidence only; no runner/compiler/build/app/native/provider/remote/mobile/folder validation or historical fault claim. Previous oracle (preserved verbatim): Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence. Audit3634: Remove five authored/five finite cases, including the complete structured chat terminal-refusal, terminal-plus-agent worker-start validation, and canonical Git common-directory parser suites. Also remove the gh free-text -R argument projection case. Consciously supersede prior KEEP decisions and accept chat-versus-stale redirect classification, real RPC refusal-before-SQLite-Dispatch, old-Git echoed-option relative-path parsing, WSL execution-space resolution, and free-text preservation/bare-repo qualification alarms. These are genuine narrow alarms, intentionally retired without equivalent replacements. Retain real Git stdin/EOF delivery, bound-account host admission, naming environment/account precedence, upload iterator cancellation and remote path confinement. Shared fixtures and production code remain. Remove only the dead canonical-repo-key timing entry. Static source-value evidence only; all prior evidence retains historical scope. Audit3636: Remove the entire maintenance opportunity internal-count driver (one authored/two finite cases), the mocked remote worker start-card argument case (one/one), and the follow-up heading mapping table (one/two). Root-unit discovery loses three authored/five finite cases. Independently remove four Python native screenshot methods/five statically enumerated subTest scenarios: grim argv/stub payload, failure-code mapping, X11 mocked capture payload, and capability flags. The Python lane is verify:computer-native and is not root Vitest. Accept loss of exact native command/projection and exception/capability alarms, ready-only card publication arguments/agent forwarding, and serialized follow-up heading mapping; no equivalent replacement is claimed. Retain actual ownership/mail/queue/reopen transitions, remote lost-response fencing and first-result settlement, filesystem/maintenance admission and successor progress, wrong-region screenshot refusal and Sway geometry. The whole-deleted new driver has no timing key; this component requires no timing cleanup. No production changes. Static source-value review only; no project import, runner, app, native desktop or runtime validation established. All prior evidence retains historical scope. Audit3629 removes two singleton parser suites: WSL Claude plugin metadata out-of-range index rejection and Git checkout unlink-warning path extraction. Their real range-refusal and quoted-path extraction alarms are intentionally lost without replacement; no WSL execution, checkout recovery or equivalent remaining coverage is claimed. Audit3630 removes the sole orphan automation availability test (1 authored/1 finite). Its real policy kind, orphan precondition, delete/toggle enablement and run/edit refusal alarms are intentionally lost. The test did not dispatch an action, enforce a server generation fence or observe a remote mutation. No equivalent replacement, actual renderer/transport execution or new platform/provider evidence is claimed. Previous account (preserved verbatim): Audit3628: remove the entire one-authored/one-finite RepositoryRemoveProjectSection happy-dom suite. Accept losing the local zero-to-one-terminal stale-count revalidation alarm: first confirmation defers the removal callback and second confirmation invokes it after the count snapshot updates. The test never asserts updated warning text/count, actual terminal creation or removal/PTY teardown, host/scope routing, cancellation or folder/mobile behavior. No equivalent replacement or end-to-end warning-before-teardown proof asserted. Static evidence only; historical receipts retain original scope. Audit3624: Remove one authored/five finite positive Gemini identity table from the Claude/Gemini title collision driver. The real normalization, legacy label and explicit title evidence owners execute, so ordinary Gemini marker/name/wrapper recognition and normalized-label composition alarms are consciously retired without equivalent replacement; these five supplied title-to-literal identity examples have low marginal value. Preserve the six-row Claude task-text collision oracle, whose unrelated CLI mentions must not rebrand or destructively normalize titles. The other audited drivers preserve real permission-mode session transitions, prompt secret/fence/bounds defenses, JSON-to-Ask option/preview preservation, and optional GitLab failure summary/trace composition. Root-unit discovery loses one authored/five finite cases; no whole driver or timing key is removed. No actual terminal stream, UI routing, application/native or runtime execution established; all prior evidence retains historical scope. Audit3618: Remove three authored/three finite browser reload cases, including the complete renderer reload-actions suite. Agent bridge fake did-fail-load plus permanently supplied manager error projects description/code into a rejection. Renderer seeded empty metadata projects a saved URL into plain webview src; its earlier not-ready case projects a live-id/throwing fake reload into absence of a loading patch. Real queue/wait/error/cache/classifier/hook code executes, but these narrow supplied-state and exception-to-callback wirings have low marginal value; no rerender, lifecycle, actual cache generation/retirement or guest commit is asserted. Explicitly supersede audit1822 not-ready KEEP and preliminary3617 cross-module retain opinion, accepting offline-reload failure reporting, empty guest to saved URL routing, native-reload bypass and premature-loading/stranded-state alarms without replacement. Retain distinct main cancellation queue progression and absent queued side-effect dispatch. Root-unit discovery loses three/three. No Electron guest, network failure, restored navigation/commit, app/native focus or runtime execution established; earlier evidence retains its historical scope. Audit3614: Remove thirty-one authored/thirty-nine finite potential cases across CLI format and argument drivers, including three whole suites: search-result/status sanitation sites, Linear issue/list/warning sanitation sites, and quote-stripped JSON diagnostic secret non-echo. Those real formatter/guard transformations execute on supplied strings; intentionally retire their field-specific CSI/OSC/C1/newline/bell and diagnostic secrecy alarms as low-value caller/output inventories, without replacement. Also retire twenty-one search registrations/twenty-four finite cases covering minimal positional request/default omission, exhaustive all-flags request projection, nominal named query/index routes, repeated syntax/agent examples, enum/agent/path-count/timestamp/numeric/cursor admission examples, unknown/browser flag examples and postcommand last-wins projections; retire one parser sentinel-only case. Keep actual ambiguity, conflicting index request, precommand/crosscommand scoping, variadic reference parsing and missing-repeatable-value controls, without claiming equivalent coverage. Root-unit discovery loses all twenty-nine/thirty-seven. No CLI/RPC/terminal/PowerShell/host/schema/runtime execution is established by this source-only audit; earlier evidence retains its historical scope. Audit3613: remove six authored/six finite callbacks, including whole reviewer-display oversize-input and explorer-root record-filter suites, plus plugin family-emoji/invisible-only-name and pool legacy-name/urgent-countdown samples. Accept losing oversized-input empty-result/no-split, malformed-record/prototype-sensitive-key/nonstring filtering, exact ZWJ family preservation, invisible-only name refusal, no-group old-host full-name preservation, and80/79/null-reset countdown composition alarms. No equivalent replacement asserted. Retained strict/runtime sanitization, SVG parser, mobile focus recovery and collision/tie cases have different scopes. Static evidence only; historical receipts retain original scope. Audit3609: Remove the complete pnpm CLI invocation literal-selection suite (eleven authored/nineteen finite potential cases), with no replacement claimed. Root-unit discovery loses JavaScript-versus-native command selection, npm/npx executable rejection, Windows cmd/bat casing and shell selection, non-Windows cmd behavior, native PNPM_HOME flat/bin preference, explicit-path priority, relative-home rejection, missing-native fallback and non-Windows home-probe refusal alarms. The suite called the real resolver with independently expected objects, but exercised no pnpm/node/cmd process, installed native executable or real filesystem probe. Earlier KEEP decisions are consciously superseded by accepting these narrow branch and probe-inventory alarms as low value. Real symlink entry, Git signing isolation, Bun filesystem/Node child normalization and compiler scheduling/continuation tests remain distinct tests, not equivalent coverage. No runner, compiler, app, platform or remote execution was performed in this source-only audit. Earlier evidence retains its historical scope. Audit3608: remove five authored/five finite callbacks, including whole owner-slug and remote favicon URL suites and two repository-label projections. Lose five owner acceptance samples, eleven negative owner samples plus nonstring refusal, six host-local icon refusal samples, legacy-SSH same-path label-map cardinality, and explicit runtime ownership over stale legacy metadata at label level. These are accepted narrow grammar/presentation alarms with no equivalent replacement claimed. Retained binary parser, React recovery and label grouping/platform cases do not replace these losses. Static evidence only; historical receipts retain their original scope. Audit3606 adopts the enhanced3604/3605 icon cuts: nine authored/nine finite cases removed, including the whole tray-attention-icon suite. Retires the no-encoder oversized-upload null sample, missing-ID/request-order sample, encoder-null PNG-prefix fallback, SVG/404 rejection samples, transparent amber-dot placement and half-alpha white-tint sample, exact small fetched-byte passthrough, host-qualified image-key inventory and constant-encoder large-upload projection. These specific admission, formatting and bitmap alarms are intentionally lost without equivalent replacements. Retained queue/cache, bounded fetch and Dock lifecycle checks do not establish actual raster decoding, native image conversion or rendered appearance. Historical receipts below are preserved evidence for earlier test sets, not fresh validation of this reduced selection. Audit3601 scope: remove the whole custom-sound happy-path IPC suite and one custom-label/multiline notification formatting example (2 authored/2 finite). Intentionally lose configured .ogg selection, exact byte/MIME success wiring, successful dispatch for the formatting fixture, custom-label whitespace/title normalization and assistant-body whitespace/180-character-cap alarms. Retain prompt-exclusion, persisted qualified dismissal/restart, theme ownership/restore and Ghostty precedence/collision cases; none replaces the retired sound/formatting alarms. No actual playback, native delivery, phone/network, cross-platform or new runtime evidence is claimed; historical execution keeps its original scope. Audit3598: Remove seven authored/nine finite literal-table potential test registrations across workflow routing, Claude cold-start and real-zsh preexec drivers. Root-unit discovery loses six authored/six finite: three test-local workflow parser fixtures, the five-positive/three-negative explicit command-paint route inventory, a boot-banner-before-composer sample and an already-painted bare-title positive sample. The separately selected shell_contracts live-shell driver loses one authored/three finite raw-capture paint-only cases across three hook configurations; its real-wrapper launch-order, four rechunkings (twelve finite) and runtime-wait replay remain, without claiming equivalent replacement. Intentionally lose those parser, exact routing-list, banner, post-paint subscription and native-read-boundary paint alarms. Retained workflow/UNIT_EXCLUDE/classifier cross-source routing checks and readiness-race-to-writer timing are distinct bounded alarms. No runner, real shell, PTY, app, native focus, remote delivery, cross-platform execution or full-feature correctness is established by this source-only audit. Earlier evidence retains its historical scope. Audit3597 scope: remove two renderer-hang-capture examples (2 authored/2 finite): an invalid repeated-token oversized reducer fixture and a shorter unanswered-request fixture. Intentionally lose the direct truncated flag/sanitized frame fixture and request-pending status/zero-sample alarms. Retain window-death/stale-result exclusion, generation reconciliation, and baseline-publication cancellation lifecycles; they are not equivalent bound, redaction or pending-status replacements. Historical execution retains its original source scope; no new runtime evidence is claimed. Audit3591: Retire the whole one-case background journal-producer attribution suite and the fabricated malformed-details-block case (two authored/two finite cases). Intentionally lose the fixed own-task versus output/foreign-task attribution examples across flat/message row shapes, missing-root classification, and direct unbalanced/detailsish fabricated-block rejection alarms. Retained parser sibling/depth and editor navigation tests do not replace these alarms. No equivalent replacement or fresh runtime, transport, persistence, native focus or rendered UI validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3592: Retire the whole three-case shared agent smart-key resolver suite, explicitly superseding its Audit3238/3237 keep decisions. Intentionally lose literal permission-versus-question classification, longest-question digit selection, Codex async-question opener/digit/Enter/skip mapping, and unsupported-agent/state/prompt refusal examples. These were real parser/selection and literal-byte alarms; they did not exercise terminal delivery or timing. No equivalent replacement or fresh runtime, native TUI, mobile, remote or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3587/3588: Retire six authored/fourteen finite cases, including the whole WSL stopped-notice and connecting-status selector suites. Intentionally lose direct WSL retry connection field/target/ready-epoch/null-guard examples, connecting/reconnecting distro and absent-state selector samples, and stopped/connecting notice text/button/data-attribute examples. Retained host-ready retry and content-loader/reload lifecycles do not replace these alarms. No equivalent replacement or fresh runtime, native WSL, remote, rendered UI or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed. Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions. Audit3553/3559 current scope: delete worktrees-delete-pty-teardown.test.ts and worktrees-issue-command-overrides.test.ts entirely and remove three cases from worktrees-orphan-directory-cleanup.test.ts (6 authored/6 finite removals). Intentionally retire typed unserved-SSH create/delete admission, exact-name collision/error-token, proven-orphan no-force confirmation, standalone .git-directory refusal, and SSH-owned local-path preservation alarms. Retain only actual authorized orphan deletion and no-marker notes-file preservation; they are not equivalent replacements. The no-marker fixture resolves the default getRepos owner, so it does not prove temporary owner-repo binding. Git/Store/PTY/notifications are mocked; no physical process stop, durable metadata, real SSH delivery or native UI proof is claimed. Unchanged historical oracle, coverage, evidenceRuns and escaped receipts retain their original scopes only; no fresh execution or transferred pass validates the reduced sources. Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts: delivers remote file changes to listeners for the same worktree. src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Exact retired assertionRefs, preserved as historical objects only: {\n \"file\": \"src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts\",\n \"assertions\": [\n \"terminal watcher error and setup failure evict the shared entry before retrying callbacks run\",\n \"an old stream end cannot evict the replacement stream, which still delivers to its listener\",\n \"two same-worktree listeners share a synthetic subscription until the final stop unsubscribes and sends unwatch\"\n ]\n } Historical prior account (preserved verbatim): Audit1973: Delete the standalone mocked watcher cleanup suite and its entire sole-file prospective command. Retire the removed file-command transport-abort alias; preserve the independent cancellation suite and final-overflow/error/end cleanup callback, and13 unrelated receipt objects. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial runtime files-watch suite retains controlled Windows close-event waiting, shared-client survival, late physical-exit ownership/deadline cleanup and shutdown joining. Its combined Windows close/deadline/late-exit alias remains backed by unchanged callbacks. Retire native-error-close, pre-publication setup ownership and failed-delete rearm aliases; associated delegation, failure forwarding, removal routing and recovery examples are lost. These tests inject watch/subscription seams and do not observe an actual native watcher or physical process. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Partial runtime watcher-host suite loses mocked option/event/overflow/resubscription forwarding, supplied teardown-error propagation, aborted-signal/no-call and private ten-thousand-waiter-count inventories. Retire the 10,000-caller bound and failed-recovery-subscriber-ending assertion aliases. Keep same-root owner cancellation, pre-ready replacement, held root-close join, stale-generation recovery delivery and initial failed-root ownership mappings backed by retained real-host callbacks with injected subscription/error/physical-exit promises. No actual native watcher, process termination or resource bound was observed. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Fill the global watcher-child reservation, require native desktop, paired-runtime, and WSL setup to retain typed transient capacity and retry after one serialized release, then cancel pending desktop and paired-client watches and require no retry. Hold one live anchor while aborting 10,000 callers at the capacity, quarantine-assignment, runtime-root, relay-setup, and SSH-registration layers; require exactly one explicit waiter and one base-promise reaction to remain, then zero after settlement. Hold an old relay unsubscribe, queue one same-root setup leader and one anchor, then abort 10,000 joiners; require every cancellation to settle before teardown releases, exactly one anchor waiter, and only one later physical install. Advance the former paired-web callback deadline while capacity remains full, require cancellation ownership to stay live, publish the server token before ready, and require files.unwatch to abort setup before a later slot release can install a native root. Reject the first ready-watch unwatch with a physical-exit promise, resolve that exit later, and require a fresh physical unwatch attempt, registry release, and exactly one stream end. Fill one healthy shared child with multiple roots, map a standard SSH repository's base, Git common directory, and worktree roots to one relay supervisor, then inject IPC disconnect-before-exit, queued and active cancellation, operations during termination, kill-without-exit, repeated unkillable generations, initial and recovery timeouts, and shard failure. During local and SSH deletion, attempt a late terminal spawn whose worktree identity and cwd name different roots, enumerate a non-prefix remote PTY by authoritative worktree ownership, withhold daemon/relay exit callbacks, make attach positively prove a concurrent-shutdown PID dead, and make the provider unavailable; require every acquired admission to roll back on rejection, dead-PID proof to settle physical exit before reaping, timeout to retain ownership, and Git/filesystem deletion never to start. Require bounded watcher process count, physical-exit settlement, healthy-root recovery, stale-generation rejection, overflow plus later events, and fail-closed destructive cleanup. Verify relay build hashes and remote install probes require both relay.js and relay-watcher.js. Launch the built relay with a real PTY and Parcel watch, kill only the watcher child, and require the same relay PID and PTY to answer before a replacement child delivers overflow and a post-crash event.",
"commands": [
- "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-unsubscribe-timeout.test.ts --reporter=dot",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-pending-assignment.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/main/runtime/rpc/methods/files/files-watch-cancellation.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts --reporter=dot",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/main/runtime/rpc/methods/files/files-watch-cancellation.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts --reporter=dot",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts --reporter=dot",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watcher-process/child-lifecycle/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/main/runtime/rpc/methods/files/files-watch-cancellation.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watcher-process/child-lifecycle/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/main/runtime/rpc/methods/files/files-watch-cancellation.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts",
"pnpm run build:electron-vite",
"node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs",
"node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs",
@@ -12380,25 +12402,19 @@
"testFiles": [
"src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts",
"src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts",
- "src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts",
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts",
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.test.ts",
+ "src/main/ipc/filesystem/watcher-process/child-lifecycle/parcel-watcher-child-registry.test.ts",
"src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts",
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-unsubscribe-timeout.test.ts",
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts",
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts",
- "src/main/ipc/filesystem/watcher-process/runtime-watcher-pending-assignment.test.ts",
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts",
+ "src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-supervisor-capacity.test.ts",
+ "src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts",
+ "src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts",
"src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts",
"src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts",
- "src/main/ipc/worktrees-delete-pty-teardown.test.ts",
"src/main/ipc/worktrees-orphan-directory-cleanup.test.ts",
"src/main/ipc/worktrees-remove-preflight.test.ts",
"src/main/workspaces/removal/watcher-removal-gate.test.ts",
"src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts",
"src/main/providers/local-pty/local-pty-provider-shutdown.test.ts",
"src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts",
- "src/main/daemon/sessions/testing/session.test.ts",
"src/main/daemon/terminal-host/testing/terminal-host.test.ts",
"src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts",
"src/main/runtime/files/watch/orca-runtime-files-watch.test.ts",
@@ -12417,19 +12433,11 @@
{
"file": "src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts",
"assertions": [
- "a transient WSL child-capacity rejection automatically retries on release and renderer unwatch cancels the wait",
- "failed SSH worktree removal restores every live renderer listener, emits overflow, and resumes precise events"
+ "pins Parcel to the Windows backend for local Windows watches; rejects installs during destructive removal and allows a retry afterward; never watches an SSH path on the local disk"
]
},
{
- "file": "src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts",
- "assertions": [
- "typed native child-capacity exhaustion automatically retries after a serialized slot release",
- "renderer unwatch cancels a pending native capacity retry before subscription restarts"
- ]
- },
- {
- "file": "src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts",
+ "file": "src/main/ipc/filesystem/watcher-process/child-lifecycle/parcel-watcher-child-registry.test.ts",
"assertions": [
"capacity notification closes the release-before-listen race and serializes reserving waiters per released slot"
]
@@ -12455,28 +12463,19 @@
"watch errors during replacement crawl terminate recovery and a late readiness ack cannot revive the failed root",
"IPC disconnect recovery restores every existing root before accepting new setup",
"queued abort removes one request without restarting healthy roots, while active abort or crawl-scoped timeout restores the shard",
- "a crash-resubscribe crawl deadline and concurrent unsubscribe settle only after physical shard exit, or report physical-exit failure at the termination deadline",
- "a close-only asynchronous spawn failure settles physical termination without waiting for the exit deadline",
+ "queues subscribe and unsubscribe behind the retiring child; bounds a pending crawl and restores healthy roots after setup timeout",
"production runtime-pool disposal rejects later subscriptions without forking an overlapping child",
- "missing built entries fail closed"
+ "Historical assertion retired by audit3749/3752; no current direct driver or replacement coverage is claimed. Original assertion (preserved verbatim): missing built entries fail closed"
]
},
{
- "file": "src/main/ipc/filesystem/watcher-process/parcel-watcher-unsubscribe-timeout.test.ts",
+ "file": "src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-supervisor-capacity.test.ts",
"assertions": [
- "a canary-independent native-unsubscribe deadline restarts the shard and restores healthy siblings after physical child exit",
- "an unkillable child rejects the native unsubscribe with its retained physical-exit promise only at the bounded exit deadline"
- ]
- },
- {
- "file": "src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts",
- "assertions": [
- "one released physical slot launches one shared supervisor child for every waiting root, while partial/all cancellation and disposal remove the shared capacity barrier",
"a waiter recursively re-enters the event-driven barrier when crash recovery reclaims its announced slot"
]
},
{
- "file": "src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts",
+ "file": "src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts",
"assertions": [
"pending-crawl cancellation after disconnect remains pending until the exact child exits",
"ready and pending-crawl cancellation force disconnected-child exit even while a healthy sibling root remains",
@@ -12484,13 +12483,6 @@
"an exit-deadline failure replaces the early cancellation and remains visible to synchronous unsubscribe until physical exit"
]
},
- {
- "file": "src/main/ipc/filesystem/watcher-process/runtime-watcher-pending-assignment.test.ts",
- "assertions": [
- "10,000 cancelled quarantine-assignment callers leave exactly one live anchor and zero waiters after grant",
- "an already-aborted first caller synchronously releases pending assignment ownership"
- ]
- },
{
"file": "src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts",
"assertions": [
@@ -12712,6 +12704,50 @@
"Add a packaged orca serve pairing scenario that proves a connected client refreshes after child replacement."
],
"knownGaps": [
+ "Audit3994 retires two authored callbacks imported by the shared construction test driver: split OSC 9999 carry and rendererless status ownership, plus OpenCode permission text taking priority in status and tui-idle refusal. Remaining imports and selectors keep their scope. No equivalent replacement or fresh gate execution is claimed.",
+ "Audit3814 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle from a Codex ready prompt even when stale startup lines remain :: Stale MCP startup lines must not block a later Codex ready header.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle when a stale Codex prompt is followed by the ready header :: A Codex ready header following a stale resume prompt must satisfy tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for an idle Cursor lane past its dismissed trust dialog (#8210) :: Later Cursor idle banner overrides retained trust dialog.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not block a mid-run Cursor lane on its dismissed trust dialog (#8210) :: Dismissed trust dialog must not report blocked for later busy Cursor; wait times out.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not classify unrelated press-enter prompts as Codex blocked prompts :: Unidentified press-enter text must time out rather than be classified Codex blocked.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for quiet background PTY agents without OSC titles :: Quiet Codex background terminal without OSC title eventually resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: sends agent prompts as bracketed paste before submit :: Driving prompt escapes embedded paste-end ESC, writes one framed paste then CR, and counts bytes.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: settles a foreground Codex prompt when launch metadata has not arrived :: Codex inferred from foreground without launch metadata waits for composer marker/quiescence before one CR.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: gives a late Codex render marker a fresh quiescence window :: Marker arriving at7.9s re-arms fresh quiet window instead of submitting at initial cap.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: writes large agent prompt paste frames atomically before delayed submit :: A prompt larger than input chunk budget is a single paste write before delayed CR with exact byte count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects oversized terminal.send text before provider writes :: Oversized ordinary terminal.send rejects input-too-large before any provider write.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects focusing an exited background terminal session :: focusTerminal refuses terminal_exited before invoking background reveal.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: pastes the same bytes the desktop draft paste sent for the prompt :: Launch-ready prompt normalizes CR/LF and renders embedded ESC visibly identically to desktop bracketed paste.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: keeps a prompt into a running agent behind the render settle, as before :: Driving prompt remains held through7s repaint activity then submits once by9s.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reports a queued PTY focus as not navigated when its notifier disappears :: Queued PTY focus and completed active reveal report not navigated after notifier removal; no second reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: does not invoke a stale graph-leaf focus notifier after queued PTY work :: Queued graph-leaf focus must not invoke old notifier after preceding PTY reveal and notifier removal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: paginates retained terminal output with explicit limits and truncation metadata :: Preview120lines, fractional limits,50/200 pages, retained2000line truncation and future-cursor metadata stay consistent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: falls back to renderer visible screen when uncursored TUI tail is blank :: Substantial blank uncursored tail uses mounted renderer visible screen with zero scrollback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reads and shows the runtime-owned alternate-screen grid without serialization :: Actual runtime alternate-screen grid provides read/show content without renderer/provider serialization.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: classifies older provider alternate-screen snapshots from ANSI :: Older provider without alternateScreen metadata classifies ANSI alternate entry and returns Remote Vim screen.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: honors the last ANSI screen transition when older provider metadata is absent :: Last ANSI alternate exit overrides earlier entry when explicit provider mode metadata is absent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: rejects a full provider screen frame after live output advances :: Live output arriving during second full-screen capture causes screen-unavailable rather than stale full frame.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: shares one provider snapshot between concurrent read and show calls :: Concurrent read/show share one successful provider snapshot and both receive Shared TUI content.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps cursor reads provider-free on restored alternate-screen PTYs :: Restored alternate-screen cursor transcript reads never acquire provider snapshot.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: backs off after a provider snapshot failure instead of retrying for show :: Failed provider capture is cached/backed off so later show does not retry.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: falls back once to a mounted renderer when a known alternate provider fails :: A known-alternate failed provider capture falls back exactly once to newly mounted renderer.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: bounds provider visible frames for read and show responses :: Provider visible read/show use six bounded lines and300character preview.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps renderer-fallback composer drafts separate from terminal output :: Renderer fallback strips dim composer draft from terminal output and exposes draft separately.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: does not use renderer visible-screen fallback for a short blank shell tail :: Two blank shell lines must not trigger renderer screen fallback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: trims terminal tail character budget without per-line array shifts :: Tail builder trims to256KiB with correct retained suffix and no Array.shift calls.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains ANSI-only status redraws instead of appending every frame :: Repeated erase/redraw replaces preview until newline then publishes one completed cursor row.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains split multi-line ANSI footer redraw state across chunks :: CUU state across chunks retains corrected footer rows and publishes new cursor entries.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not let stale lower rows hide earlier corrected footer rows from cursor reads :: Earlier corrected footer row must not be hidden by stale lower rows in cursor reads.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: bounds completed transcript entries from a single multi-line redraw chunk :: Single redraw chunk bounds completed transcript to2000retained lines and correct oldest/next/latest cursors.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains multi-line ANSI redraws when the last footer row stays partial :: Partial final redrawn row appears in preview but cursor sees it only after newline.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not retain split ANSI controls as visible terminal preview text :: Split color/mode escapes never leak preview fragments; long split OSC title truncates at MAX_OSC_TITLE_CHARS.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains same-line redraw cursor position across split full-line erase chunks :: Full-line erase preserves column across chunks so XY follows three spaces rather than old ABC.\nsrc/main/runtime/orca-runtime-tests/conpty-stream-read.spec.ts :: fills the requested line count even when blank rows sit below the prompt :: Blank rows below a ConPTY prompt must not consume the requested nonempty-line count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: does not retain split ST-terminated string controls as preview text :: Split ST-terminated Kitty/string controls must remain excluded from preview text.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects split OSC titles before retaining terminal previews :: Split BEL OSC title must update working title/status without leaking into preview.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects ST-terminated OSC titles split before the final backslash :: ST OSC split before final backslash must update title without leaking framing.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: preserves a trailing escape after a completed OSC title :: Completed OSC followed by pending ESC must preserve the next idle-title transition.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: seeds newly synced leaves from PTY pending ANSI state :: A newly synced graph leaf inherits pending ANSI so a split color fragment cannot leak.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: bounds retained partial terminal output before preview reads :: Partial terminal state stays capped at 4000, preserves retained array identity, and preview truncation/cursor output remains correct.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: submits the mail pointer to Cursor Agent only after the paste-burst delay :: Cursor mailbox pointer Enter must wait through the paste-burst delay; this is a real input-timing alarm intentionally retired.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts :: adopts a v1.4.150-shaped agent, setup, and shell orphan as one topology transaction :: Stale incarnation refuses without topology change; three agent/setup/shell lanes adopt atomically with layout/group/revision and preserved read/input/resize; exact replay is idempotent and competing owner refuses.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: retires the exact worker when it exits after renderer reveal :: Exact worker exit after reveal retires that worker and its surface.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: re-reveals a recovered worker after the renderer graph epoch changes :: Changed renderer graph epoch invalidates reveal receipt and forces another reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: defers recovery when the renderer omits the exact reveal identity :: Missing exact reveal identity defers recovery after two attempts.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: reconciles a same-id process replacement before headless adoption :: A process replacement before headless adoption must fence off stale ownership.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retires provider resume only after authoritative inventory proves the legacy PTY exited :: Authoritative owning-host inventory overrides false local hasPty, avoids SSH scanning, retires exited provider resume/surface, adopts live workers without headless reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retries inventory and unknown liveness without revealing a ghost worker :: Inventory failure and unknown liveness must retry without ghost reveal, eventually adopt, and stop retrying.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: refuses a live reserved pane before issuing a handle or revealing it :: A requireFreshPane launch receiving a live reserved owner must reject before handle/reveal/kill, and release its claim. No equivalent replacement claimed.",
+ "Audit3806 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: skips a listener unsubscribed mid-fan-out even with mobile exclusions active :: A listener removed by an earlier listener during one fanout is not called, including with a side-effect-excluded mobile listener present.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: retains bytes emitted before a fresh daemon spawn resolves :: Bytes and title arriving before an initial zero/reset provider response survive in the serialized headless buffer with their counted sequence.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits command-finished facts with best-effort exit codes across chunk splits :: A split OSC133 D exit code becomes130 and a missing code becomes null in ordered command-finished facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits pr-link facts once per URL with batch attribution :: A split GitHub PR URL yields42 rather than4, emits42/43 once each, and carries PTY/worktree/tab attribution.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits 2031-subscribe facts across chunk splits :: Split ESC[?20 then31h emits exactly one2031-subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: restores a provisional 2031 subscribe when daemon scan authority returns :: Returning daemon scan authority with partial scan seed and pending2031 subscription restores exactly one subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers the tracked title over the renderer snapshot lastTitle :: A synthetic live Cursor title overrides stale renderer lastTitle while preserving renderer snapshot source.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers provider history over a partial headless mirror for requested snapshots :: Authoritative requested snapshots return supplied provider frame/history/seq rather than a partial headless mirror, requesting5000rows.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: tracks live alternate-screen transitions after a provider snapshot :: Provider alternateScreen true is accepted, then live1049l/1049h update isTerminalAlternateScreen false/true.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: translates reset provider snapshots without retaining the old title :: A reset provider snapshot translates new local seq into the runtime domain and replaces Old process title with New process.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits the chunk agentStatus events before its side-effect batch :: Agent status callback precedes side-effect batch callback for one coalesced OSC9999/title/bell chunk.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: still emits a throwing chunk’s facts under its own seq, not the next chunk’s :: A tracker throw still flushes first chunk title facts under its own seq, and second chunk does not inherit those facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: seeds the lazily created tracker from the daemon-snapshot title :: A lazy tracker hydrated from renderer snapshot title Codex working emits agent-idle on later Codex done.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits command-code-working facts only after the banner arms the scrape :: Unarmed Thinking text emits no facts; a Command Code0.27.3 banner then hardcoded colored spinner text emits attributed command-code-working with the submitted prompt.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits a command-code-done fact when the idle composer returns :: After hardcoded banner/working text, returned idle composer emits command-code-done with the earlier submitted prompt.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: resizes the headless mirror after an accepted desktop PTY resize :: An external accepted resize produces the resized dimensions and same status-frame lines as a separately driven reference emulator.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: replaces suffix-only headless state with the recovered renderer snapshot :: Replacing suffix-only state removes old suffix, retains renderer history plus later output/cwd, and returns the live47x40PTY grid.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: stamps SSH connection identity on runtime terminal status :: A synthetic mounted-leaf OSC9999 status after registerPty carries the supplied SSH connectionId.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: does not retain WSL context when a PTY id is reused :: After exit and same-ID new null distro context, OSC7 file://server/share/repo uses UNC server path rather than old Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: preserves immutable context while a live daemon attach is unresolved :: preparePtyExecutionContext with preserveExisting refuses a supplied Debian replacement and subsequent OSC7 keeps original Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts :: projects frame-independent live state through main buffer snapshots :: Main-buffer snapshot puts focus-report/cursor-visibility modes in frameRestoreAnsi, excludes STATIC-FRAME there and includes it in data.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts :: continues terminal agent status fanout when a callback throws :: Throwing on the first status callback does not prevent second payload delivery and logs contextual error.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: returns a title-only replay snapshot and never historical attention :: Lose replay:true/title-only fact projection despite earlierbell and unknownPTYnull. No actual delivered-history notification or reattach behavior was exercised. No equivalent replacement claimed.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects a handle rebind while a controller-less status check yields :: A handle rebound while the null-controller status continuation yields must throw terminal_handle_stale.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects confirmation evidence when the owning PTY exits :: A pending strong confirmation resolving after owning PTY exit must reject terminal_exited.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts :: keeps ordinary terminal send suffix failures on the existing not-writable contract :: Ordinary send writes text but refused CR must throw terminal_not_writable with beforeWrite twice and afterWrite once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell the execution host cannot apply instead of spawning its default :: Requested Windows shell on POSIX must refuse before spawning a default shell.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: quotes the agent startup command for the requested shell, not the host default :: Requested cmd shell must override PowerShell default quoting for agent startup command.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: keeps restored receipts outside a targeted worktree scan :: Targeted scan removes the moved-worktree receipt while preserving another worktree receipt.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: observes setup command completion without waiting for its interactive shell to exit :: Nonzero completion marker 17 resolves while interactive shell remains running.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: falls back to setup terminal exit when no completion signal is available :: Setup completion observer without token falls back to actual exit code 9.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: cancels setup completion observation when the caller aborts :: Abort rejects with the original reason and unsubscribes once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps observing after an uncertain setup terminal status :: Unknown exit waiter result must leave observation pending until completion marker arrives.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh omits a record :: Controller inventory omission disconnects the record but preserves its retained transcript.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh times out :: Hung inventory timeout leaves connected record and retained transcript intact.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle for adopted background PTY handles from the renderer title :: An adopted background handle resolves tui-idle from ready Codex renderer title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves live-leaf tui-idle from an OpenCode native title :: A live leaf resolves tui-idle from an OpenCode native title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from a Codex ready prompt preview :: A supplied Codex prompt preview resolves tui-idle without an actual agent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from an Antigravity prompt before the model line :: A supplied Antigravity prompt before model line resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell with no workspace instead of creating a default-shell tab :: Workspace-less explicit shell must reject before renderer default-tab request or spawn. This real guard/wiring alarm is deliberately retired.",
+ "Audit3798 per-case accepted losses:\nsrc/main/runtime/orca-runtime-tests/paired-settings.spec.ts :: awaits navigation-only updates from paired clients (%s) :: Updating only claudeSubagentNavigationEnabled waits for the actual controller call to the supplied pending Claude-view reconcile for both on/off values.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: drops a client page record even when its close command cannot be issued :: A removed workspace loses its runtime client-page record and headless browser projection despite close delivery_required rejection, and emits the asynchronous warning.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: leaves client-hosted pages alone when another host still owns the same worktree id :: Removing runtime:env-b metadata with local ownership leaves the local same-ID client page unchanged and issues no close command.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: marks live bindings again when reopening after a promoted window closes :: A reopened window marks its still-registered live worktree in activeWorktreeIdsOnShutdown after the first promoted window closes.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: preserves live SSH session identities when promoting a headless runtime :: Headless-to-desktop promotion records active worktree, SSH connection and remoteSessionIdsByTabId from the supplied surviving SSH PTY/session.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores a surviving renderer when its reload is cancelled :: A sole ready renderer reload cancelled under its current renderer fence returns true and becomes ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores headless authority when desktop promotion navigation is cancelled :: A cancelled desktop promotion with headless recovery returns false while headless authority remains ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: moves a desktop graph to unavailable when its reload times out :: A ready desktop graph without a headless fallback becomes unavailable at the reload deadline and retains its window/epoch.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: recovers a failed headless promotion and accepts a later renderer generation :: A promotion failure restores ready headless authority; a later valid same-window graph publishes ready desktop authority.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: clears a failed pane recovery so a later reconnect can retry :: After relay_reconnecting rejection, the pending recovery lock clears and the same pane/handle can call createTerminal a second time and return its supplied replacement.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: still preserves a CLI agent leaf when the reloaded renderer has not rebound its PTY :: An empty graph published during renderer reload preserves a preallocated live CLI PTY as one listable terminal before renderer rebind.\nsrc/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts :: keeps a no-incarnation handle across an in-graph pane remint :: Within one graph lifetime an unversioned PTY reminted onto another leaf retains its issued handle and resolves its old exit waiter after onPtyExit.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: matches explicit-id cwd PTYs when the resolved worktree cache is incomplete :: An explicit target absent from a fresh incomplete resolved cache adopts only its cwd PTY, rejects nested cwd PTY and does not rescan Git.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: ignores cwd-only controller PTYs for malformed explicit worktree IDs :: Malformed id:repo-1:: returns no terminals, does not adopt cwd-only controller PTY and avoids Git rescanning.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: refuses an SSH-backed create for mobile/runtime callers instead of creating locally :: Loss of this public unserved SSH create error-class/no-local-add/no-local-list alarm.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: records an app-selected parent workspace as a manual action :: Loss of the local runtime folder-parent manual origin, active-workspace source and explicit confidence projection alarm; no claim that SSH or cleanup coverage replaces it.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: browses runtime server directories before projects are added :: Loss of this public runtime alarm for browse availability before registration, directories-first lexical ordering and native path flavor.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: lists drive roots for a server-root browse :: Loss of the Windows public slash-root drive enumeration smoke and presence of the temporary directory drive.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations-part-02.spec.ts :: creates a missing runtime parent before creating the project directory :: Loss of this runtime createRepo recursive missing-parent/child existence and registered-path alarm.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: preserves selected project %s when a hosted parent is known :: Loss of both parent-selected and origin-selected normal fork-link projection/persisted upstream alarms plus exact single-probe count.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: links a current enterprise remote despite unavailable metadata and a retained %s :: Loss of normal current-enterprise-origin linking with stale automatic GitHub avatar or protected file image, unchanged icon assertion, and serialized project identity under unavailable metadata.",
+ "Audit3788 retires10 authored/11 expanded cases across six changed drivers, including the entire screencast pending-frame-retry and usage-source-cache-streaming suites. Deliberate losses are false-refused last-frame retry/once-only delivery, ordinary stable-pane reattachment, cleared-chat Dispatch completion, terminal-declared chat-caller refusal, at-rest worker liveness projection, nested depth/cap policy, small unsigned6/sealed7 plain-format and verified-bit examples, generic malformed-ISIZE footer refusal examples, and synthetic10k/100k chunk-size/work-count budgets in gzip and general cache I/O. These include real state/disk/RPC outcomes consciously retired for marginal value; retained E2EE-backlog, receipt/custody/uncertain-ack, integrity/migration and staging-cleanup cases are not equivalent replacements. The footer test did not prove early rejection or bounded allocation; staging cleanup did not seed unrelated files. No replacement or fresh native/remote/performance execution is claimed. Earlier raw selectors and dated receipts remain historical.",
+ "Audit3779 retires17 authored/17 expanded registrations across six changed drivers, including the entire shared-Codex-home and prompt-telemetry suites. Accepted losses are shared-home wrapper noninterference/opt-out preservation, mocked metric count/provenance filters, SSH activity labeling/clearing and handover idle timing, VM ownership/capability/status projections and asleep-worktree refusal, a link-only external conversation replay sample, and two narrow input-credit noninterference/expiry examples. Retain the direct exact-tab/single-use input-credit case. These bounded real disk/state/routing alarms are intentionally retired for marginal value without equivalent replacement or fresh execution claims; earlier receipts remain historical.",
+ "Audit3772 retires18 authored/27 expanded cases, including whole Codex service opt-out, RPC capability-parser, creator-provenance, short-ciphertext and readiness-null suites. Accepted losses include service ledger/symlink/mode cleanup, user TOML substring preservation, old-hash cleanup, description pass-through, malformed-file/pending-hash examples, coordinator write/probe counts, capability array bounds, positive creator projections, early short-payload refusal and readiness helper null shape. Two redundant Codex exit-cause rows are also retired; Pi shares their direct-idle path only in this empty-output immediate-exit fixture, and future agent-config drift coverage is lost. Real bounded filesystem/parser/runtime alarms are deliberately retired for marginal value; no equivalent replacements or fresh execution are claimed. Earlier receipts retain their historical scope.",
+ "Audits3754/3755 intentionally remove9 authored/9 finite registrations: the entire one-case usage-source-cache-streaming.test.ts driver and8 cases from the surviving computer-action-validation.test.ts driver. This gate retains an unfiltered root Vitest command; UNIT_INCLUDE admits both source paths. Accepted losses are the real encoder output chunk-size/work-count alarm on repetitive10k/100k ownership payloads through a mocked durable sink, plus CLI diagnostic precedence, fractional window-id rejection, action-call-site window-target exclusivity, plain-text click-count recovery copy, incomplete click/drag targeting, mouse/modifier/direction allowlist samples and inline/stdin text exclusivity. These CLI cases exercise real argument/handler validation before mocked runtime calls; they are deliberately retired for marginal value, not declared tautologies. Retained cache I/O and CLI cases are not equivalent replacements for these alarms. Existing historical raw receipts remain unchanged and do not validate the deleted or reduced drivers. No fresh execution claim is made. Audits3758/3763 intentionally remove9 authored/11 finite registrations from6 changed drivers, including the entire pane-title-notification, window-linear-notices and worktree-card-lifecycle-effects suites. This gate retains an unfiltered root Vitest command admitting these paths. Accepted losses are same-account linked-row success-notice fanout, sidebar-switch channel forwarding, Linear-only notification forwarding/non-terminal-consumer selection/closed-window detach, destroyed-window refusal and first-send-failure suspension through the pane-title adapter, the100-card synthetic focus/poll absence sample, stored-source local folder badge refresh, unobserved-row badge refusal, and immediate reposChanged lineage invalidation. These exercise real owners with controlled ports; they are retired for marginal value, without equivalent replacement claims. The no-badge-work fixture does not seed its title-promised collection-only cache. Preserved historical receipts do not validate deleted or reduced drivers; no fresh execution is claimed. Audit3759 retires the entire one-case Tailwind compiler/scanner smoke. Accept loss of the direct CSS production/test/spec source-exclusion and rescan alarm; no replacement or current execution is claimed.",
+ "Audit3752 independently approves audit3749: retire five authored/five finite watcher-process registrations, retaining18 raw-exact registrations. Accept loss of healthy shared-pool joint recovery, last-pending-failure idle retirement/respawn, late VITEST fallback release, missing-entry fail-closed selection and independent-supervisor fuse locality alarms. These are real bounded host-policy alarms intentionally retired for low marginal value; no equivalent replacement is asserted. Remaining driver selections exercise controlled FakeChild supervisor lifecycle, cancellation, physical-exit fencing, recovery and fuse behavior. This source review supplies no fresh native/process/platform/remote/SSH execution; historical receipts retain original source and selector scopes.",
+ "Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered root Vitest command. Current UNIT_INCLUDE admits the partial push-service, metadata-dialog and two config/scripts browser drivers:10 authored/16 finite removals. Accepted losses: actual retry30s/60s progression and register bucket/refill wiring, explicit seven-day lease arithmetic (its notification lacked seq/epoch and never reached send), equal-name edit latch/save payload, real image/font/meta-refresh/form/popup browser refusal controls, and broad rich-markdown bridge/command/edit-select smoke. Actual production state, callback routing and browser enforcement run in these cases; these alarms are deliberately retired on marginal value. All drivers and selectors survive. Existing unrelated receipts remain historical evidence for their unchanged selectors, not proof of the reduced cases.",
+ "Audit3732 removes 2 authored/3 finite registrations from two partial suites: nominal custom/Kimi local naming success and deferred context usage row presentation. Real losses: custom/Kimi successful extraction through conversation-name sanitization and agentLabel composition; separate ordered counted/deferred lists and exact percentage/token formatting. No replacement or equivalent coverage claimed. Retain 11 authored/13 finite raw-exact registrations for bounded naming instruction/refusal/cancellation, menu dismissal focus ownership and hover/composer Escape/timer cleanup. Source-only bounded value review, no runtime/CI/native/remote/mobile/folder workspace or global completion credit.",
+ "Audit3733 removes2authored/2finite terminal input checks: fixed custom-cap error/secret fixture and three-emoji cap5refusal whose6UTF16units already trip length fast guard (no UTF8-dependent boundary). Accept exact non-disclosure/oversized-refusal alarm losses; no replacement/equivalence claim. Retain13/13scalar/pending input, OSC state and cron DST/cadence outcomes after bounded material reads. Source-only zero runtime/novelty credit; original historical reasons preserved.",
+ "Audit3729 removes1authored/3finite by deleting whole CLI runtime pairing advisory-close suite. Accept losing post-real-close injected EIO preservation of native/script/unreadable pairing, env identity/preservation and exact close/release assertions; no actual failed-close leak or replacement coverage claimed. Two retained URL grammar/identity suites11authored16finite raw unchanged. Bounded source/owner/caller value review, zero novelty/runtime credit; other seven3724deferred closures remain. Historical receipts preserve original limits.",
+ "Audit3724 removes3authored/3finite checks by deleting two whole suites: TUI clear burst-size singleton and terminal-file-URL target two-case wrapper suite. Deliberate losses: derived widest burst<64byte alarm, UNC authority+line-column anchor composition, and malformed-percent null refusal. Real production algorithms execute in those tests; no mocked-output tautology, equivalent replacement, actual Claude/file-navigation delivery or universal safety-irrelevance claim. TUI58byte bound and URI examples have low marginal value as standalone suites. Actual1262/1264/1742KEEP superseded explicitly. Remaining14drivers83authored136finite raw unchanged. Bounded source-only review; ten closures deferred, four bounded keep judgments repeated with zero new semantic-frontier credit. No runtime/CI/native/remote/mobile/folder/global completion claim; historical receipts retain original scope.",
+ "Audit3723 removes 4 authored/4 finite registrations in two whole suites: keybinding cache freeze/token spellings and host-dependent Orca command name examples. Real losses include returned-object freeze, repeated Mod+P key, Space/PageDown/NumpadSubtract mapping, unknown/empty/prototype-token rejection, and headless Linux versus Windows-server/WSL command choice. No equivalent or replacement coverage claimed. Retain 12 authored/21 finite raw-exact registrations exercising generated scaffold validation, artifact failures, shipped editor/hook/worker/panel tests, actual generated typing compilation, independent CLI root routing and intent-name precedence. Source-only bounded audit; no runtime, CI, native, remote, mobile, folder workspace or global completion credit.",
+ "Audit3720 removes17authored/23finite checks: whole main catalog-date adapter2 and shared date-helper7, seven renderer nominal ranking/cap/no-date/composition cases, and one browser registration expanding to seven forced-container/DOM-child boundary cases. Deliberate real losses: community oldest-date UTC forwarding, official/undated omission, date sorting/window/invalid/future/skew/clamp and default/override cap; nominal ranking/cap and combined Featured/Newly-added outputs; real CSS459/460,719/720,1055/1056breakpoint, five-card partial-row and720px two-card first-row alarms. Browser cases really measure rendered geometry but force width/remove DOM children; no fake-pixel or tautology rationale. No replacement/equivalent coverage claimed. Retain14authored/19finite raw-exact registrations across4drivers: adversarial featured category/order/tie and installability, date order/window selection, actual PluginManager failure/escaping/duplicate-card suppression, real browser viewport/odd-count geometry/phone catalog visibility, syntax ingress/depth/include/printability and68dlong-bracket auto-close fill-in. No tests/browser/native/UI/provider/remote/mobile/folder/CI/global execution or completion credit.",
+ "Audit3717 removes6 authored/6finite checks in two whole thin-adapter/presentation suites. Deliberate real losses: ordinary recipe repository-URL withholding and provisioned-root credential scrubbing/forwarding; repository label lockstep suffix expansion, host-scoped map identity/collision grouping, Windows crosshost paths and WSL distro suffixes. Actual provision options, label/sort consumers and host/scrubber delegates inspected; no replacement/equivalence claim. Retain40 authored/84finite registrations raw exact in14 drivers with bounded owner/context review. Prior KEEP superseded for removed suites; no runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit.",
+ "Audit3714 removes8 authored/39finite checks: whole CLI selector-recovery, task display-text and ANSI grammar suites plus two name joiner/blank tables. Deliberate real losses: selector flag/value/identity and mutation recovery merge/serialization; exact task suffix, transcript fallback, input immutability, cache reuse and edited blocks; independent failed-escape/resumption and OSC/DCS/BEL/ST/C1/nested/unfinished stripping outputs; meaningful-language joiner preservation and invisible/blank-name rejection. These are real bounded alarms, removed as narrow supplied-error examples, helper/token inventories and repeated internal-work fixtures. Prior2936,1195/1196,1214/1215 and1082 KEEP superseded; no replacement or equivalent coverage claimed. Keep9authored/9finite raw-exact registrations in5surviving drivers: screenshot export/failure filesystem behavior, CLI local tree query, event-local reply provenance, vault role-sensitive content and four hostile/UTF16/dangling/tag-name regressions. No native/UI/provider/remote/mobile/folder/runtime/CI/global completion credit.",
+ "Audit3711 retires2authored/4finite cases by deleting whole clipboard-image-temp-file signature-to-name inventory (HEIC/TIFF/unrecognised bytes) and workspace-last-active switch-on supplied visit/reason singleton, plus its now-orphan test fixture. This intentionally loses real generated-filename suffix/extensionless alarms and real newer-visit archived7day versus inactive30day filtering/older-visit identity alarms. Filesystem writing and production reason pruning really execute; no equivalent replacement or universal absence of safety relevance is claimed. The clipboard test does not inspect written bytes, native delivery or decode; the visit test supplies candidate/timestamps and does not exercise persisted visit routing or actual removal.20authored/20finite cases remain unchanged across4bounded Git/sidecar/removal drivers. No new runner/test/module evaluation or runtime result; historical notes and receipts remain historical.",
+ "Audit3707 removes10 authored/11finite checks: three whole renderer adapter/assembled-stage suites and two native projection cases. Deliberate losses: plugin URL/ref/default-version/local-path and unsafe credential refusal forwarding; real Task hook/store A→B→A late-save/list/count fences, owner disappearance, legacy-host convergence, query/history/eviction and same-ID host history; native child append ordered-ID/replacement and compound fallback/order/optimistic-admission/child-turn/duplicate/shrink/revision alarms. These are real bounded alarms; removal follows thin adapter, manually assembled Task pipeline and repetitive fixture value judgment, with no replacement or equivalent coverage claim. Prior1179/1182,1220/1221 and1885 KEEP superseded as applicable. Keep36 authored/38finite registrations raw exact across13 surviving drivers. No runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit.",
+ "Audit3706 removes7authored/7potential cases from3renderer sources: whole usage-label3case and130000-distinct-day usage-overview singleton suites, plus3SSH grouping/ordinary-range examples. Retain11authored/11potential cases across6drivers in this bounded selection; no equivalent replacement or fresh runtime result. Existing bare root-unit commands admit this selection statically; prior command/receipt strings remain historical. Audit3706 intentionally retires first/second-order usage-group label collision alarms; equal50%-weekly bucket versus derived-weekly selection identity and Gemini wk label alarm;130000distinct-day aggregation no-spread-crash/max/intensity alarm; legacy absent-source SSH grouping and ordinary reverse-select/selected-target deselect range alarms. Actual label ambiguity and pathological-input crash are accepted losses. Distinct-day fixture spans~356years; no hard producer/date bound is claimed. Retained filtered-anchor/grouped-order guards do not replace removed deselection/reverse-range/legacy-group coverage. No native SSH, mounted renderer, live provider, remote/folder/mobile end-to-end or current runtime pass was obtained.",
+ "Audit3699 removes4 authored/4finite checks, including one whole xterm copy-policy suite and one root/group CLI help case. Deliberate losses: direct copy-chord admission for platform, selection, Kitty mode, defaultPrevented, logical/physical key and key phase; command-group disclosure and group help routing including claude-teams early return without RuntimeClient construction. These are real bounded policy/wiring alarms; no replacement or equivalent coverage claimed. Retain14 authored/19finite raw-exact registrations across6 drivers: unsafe CLI refusal, Claude model event carry and disk reconstruction/OSC-first case, attachment ownership/upload lifetime and mixed BMP file-reference/PNG-chip delivery, actual SQLite authority/admission/mutation, and Electron geometry/hit-testing. No runtime, CI, native-key delivery, external provider, mobile, remote, folder or global completion credit.",
+ "Audit3692 removes5 authored/5finite marginal Codex checks: unrelated login URL without notice; ordinary per-account launch resource/config materialization; no-retained-pane skip; preservation of a previously owed full scan through actual preparation and pending-marker update (no actual history scan/settlement); ordinary later-config refresh. Accept these exact branch/wiring alarms as deliberate losses without replacement. Retain32 authored/34finite raw callbacks/registrations/table bytes exact across14suites, including credential/admission refusal, grace/reset readiness, filesystem ownership, commit-dependent queue state, streaming/host trust, path canonicalization and private-state preservation. All14whole suites challenged without keeper quota; no whole deletion warranted on current concrete signals. No runtime/CI/native WSL/remote/mobile/folder/global completion credit",
+ "Audit3691 removes two complete runtime-home routing singleton suites (2 authored/2 finite): catalog wrapper mirror login-copy and passive transcript-lookup filesystem noncreation. Exact accepted losses are recorded in knownGaps; no replacement or equivalent coverage claimed. Audit3691: no dedicated alarm remains in the deleted sources for post-launch system login import through prepareHostCodexHomeForReadOnlyAppServer, or for repeated missing-transcript lookups leaving removed Codex account/runtime directories absent and userData entries unchanged. Ownership-marker read avoidance was never independently measured. No real catalog probe, provider, native Windows or crash was validated by those fixtures.",
+ "Audit3686 current Claude profile/account review removes5 authored/5 finite cases: whole structured-auth diagnostic-label suite3 and Windows-only command suite1 whose advertised cache alarm is ineffective because cache lifetime is per invocation; remove duplicate setup namespace-link refusal1 at wrapper layer. All5 exact historical KEEP are consciously superseded. Retain49 authored/50 finite unchanged, including filesystem privacy/recovery, route identity and concurrency, built worker/helper, legacy WSL alias compatibility and sign-in handoff. These are deliberate coverage losses without replacement. No runtime/CI/native WSL/macOS Keychain, remote/mobile/folder or global completion credit. Explicit accepted real losses: unknown-account host fallback and mixed-version/WSL-only structured auth diagnostic labels; Windows-only sentinel ENOENT-to-friendly-error translation plus fresh-call successful dispatch smoke; setup catch-to-refused wrapper and no-write outcome for a namespace symlink. The command case does not discriminate removal of its per-invocation noncache guard; it still supplies the error-translation alarm, which is intentionally retired. No replacement/equivalence promise.",
+ "Audit3680 removes eleven authored/eleven finite unit cases across four files, including entire launch setup row projection, structured legacy-model metadata, and legacy classifier suites. Accept loss of exact row partition/start selection, Codex supersession/default/unknown and Claude alias/suffix folding examples, other-agent exemption, getter/cache read budgets, same-array per-agent cache isolation, replaced-catalog metadata, and tracked-only model exclusion from structured and PTY legacy inventories. These are real narrow policy/metadata alarms intentionally retired without equivalent replacements. Retain real menu collapse/reopen in dropdown/select, AI picker cancel/accept and stale-effort filing, IME carry/gesture/frame transitions, and typed-flip versus held-dispatch fencing. No production or shared fixtures change. No dead timing entry exists for the three deleted drivers; retained timing keys stay unchanged. Static source-value review only; no project import, test runner, native/app execution or runtime validation established. Earlier receipts retain historical scope.",
+ "Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit.",
+ "Audit3672 renewed by3676 removes four authored/four finite cases from federation-output.test.ts: nominal show/read routing and terminal-fallback projection; initial archive-table SELECT failure returning retained/no-close; simulated old-peer read/fleet/refusal and method inventory; and absent archive-release capability refusing release. These actual compatibility/guard alarms are intentionally lost without equivalent replacement; the dropped-table case never reaches capture or commit. Current selected frontier9 becomes5: retain actual temporary transcript parsing/path omission, current no-transcript release/unavailable-output/restart/replay regression, and three home deadline/stop nonmutation cases. Prior held-capture case was already removed upstream and receives no new removal credit; prior redacted snapshot archive behavior was rewritten upstream and is not claimed retained here. The surviving driver timing entry stays. Static review/private composition only; no actual peer/network/native/platform or fresh runtime validation.",
+ "Audit3671 removes14 authored/32 finite root-unit cases, including the whole WSL move-handler refusal suite, WSL preload object-presence suite and internal gate spelling truth table. Also retire the weak withheld-command non-array shape assertion, static serve-only Add/capability/mock-remove example, grammar scope equality and basic configuration/payload schema roundtrips. Genuine wrong-window/malformed-request/gate-before-work, exact gate spellings/platform/argv precedence, static serve-only routing, declaration mismatch and empty grammar/pair admission alarms are consciously lost without replacement; prior KEEP decisions are reconsidered. Seven unchanged authored/finite root-unit cases retain real image/provider/line budgets, live policy transition/capability broadcast, grammar resource/reference traversal and strict-versus-tolerant literal salvage. Source-value evidence only; no runner/compiler/build/app/native/provider/remote/mobile/folder validation or historical fault claim. Independently remove one authored/finite Playwright closed-gate app-boot inventory: accept loss of real renderer/preload/main refusal composition, saved-host row and Add/Move hiding/Remove visibility alarms. Keep the unchanged scripted-move rendered dialog lifecycle/reload case. It runs no real WSL migration, host connection, file copy or automation restoration. No selector or Playwright participation cleanup is required because the spec remains.",
+ "Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence.",
+ "Audit3634: Remove five authored/five finite cases, including the complete structured chat terminal-refusal, terminal-plus-agent worker-start validation, and canonical Git common-directory parser suites. Also remove the gh free-text -R argument projection case. Consciously supersede prior KEEP decisions and accept chat-versus-stale redirect classification, real RPC refusal-before-SQLite-Dispatch, old-Git echoed-option relative-path parsing, WSL execution-space resolution, and free-text preservation/bare-repo qualification alarms. These are genuine narrow alarms, intentionally retired without equivalent replacements. Retain real Git stdin/EOF delivery, bound-account host admission, naming environment/account precedence, upload iterator cancellation and remote path confinement. Shared fixtures and production code remain. Remove only the dead canonical-repo-key timing entry. Static source-value evidence only; all prior evidence retains historical scope.",
+ "Audit3636: Remove the entire maintenance opportunity internal-count driver (one authored/two finite cases), the mocked remote worker start-card argument case (one/one), and the follow-up heading mapping table (one/two). Root-unit discovery loses three authored/five finite cases. Independently remove four Python native screenshot methods/five statically enumerated subTest scenarios: grim argv/stub payload, failure-code mapping, X11 mocked capture payload, and capability flags. The Python lane is verify:computer-native and is not root Vitest. Accept loss of exact native command/projection and exception/capability alarms, ready-only card publication arguments/agent forwarding, and serialized follow-up heading mapping; no equivalent replacement is claimed. Retain actual ownership/mail/queue/reopen transitions, remote lost-response fencing and first-result settlement, filesystem/maintenance admission and successor progress, wrong-region screenshot refusal and Sway geometry. The whole-deleted new driver has no timing key; this component requires no timing cleanup. No production changes. Static source-value review only; no project import, runner, app, native desktop or runtime validation established. All prior evidence retains historical scope.",
+ "Audit3630 removed orphan delete/toggle capability/precondition and run/edit refusal assertions. Real dispatch, mutation fencing, mixed-version and host outcomes are not established by this removal or by a substitute test.",
+ "Audit3624: Remove one authored/five finite positive Gemini identity table from the Claude/Gemini title collision driver. The real normalization, legacy label and explicit title evidence owners execute, so ordinary Gemini marker/name/wrapper recognition and normalized-label composition alarms are consciously retired without equivalent replacement; these five supplied title-to-literal identity examples have low marginal value. Preserve the six-row Claude task-text collision oracle, whose unrelated CLI mentions must not rebrand or destructively normalize titles. The other audited drivers preserve real permission-mode session transitions, prompt secret/fence/bounds defenses, JSON-to-Ask option/preview preservation, and optional GitLab failure summary/trace composition. Root-unit discovery loses one authored/five finite cases; no whole driver or timing key is removed. No actual terminal stream, UI routing, application/native or runtime execution established; all prior evidence retains historical scope.",
+ "Audit3618: Remove three authored/three finite browser reload cases, including the complete renderer reload-actions suite. Agent bridge fake did-fail-load plus permanently supplied manager error projects description/code into a rejection. Renderer seeded empty metadata projects a saved URL into plain webview src; its earlier not-ready case projects a live-id/throwing fake reload into absence of a loading patch. Real queue/wait/error/cache/classifier/hook code executes, but these narrow supplied-state and exception-to-callback wirings have low marginal value; no rerender, lifecycle, actual cache generation/retirement or guest commit is asserted. Explicitly supersede audit1822 not-ready KEEP and preliminary3617 cross-module retain opinion, accepting offline-reload failure reporting, empty guest to saved URL routing, native-reload bypass and premature-loading/stranded-state alarms without replacement. Retain distinct main cancellation queue progression and absent queued side-effect dispatch. Root-unit discovery loses three/three. No Electron guest, network failure, restored navigation/commit, app/native focus or runtime execution established; earlier evidence retains its historical scope.",
+ "Audit3614: Remove thirty-one authored/thirty-nine finite potential cases across CLI format and argument drivers, including three whole suites: search-result/status sanitation sites, Linear issue/list/warning sanitation sites, and quote-stripped JSON diagnostic secret non-echo. Those real formatter/guard transformations execute on supplied strings; intentionally retire their field-specific CSI/OSC/C1/newline/bell and diagnostic secrecy alarms as low-value caller/output inventories, without replacement. Also retire twenty-one search registrations/twenty-four finite cases covering minimal positional request/default omission, exhaustive all-flags request projection, nominal named query/index routes, repeated syntax/agent examples, enum/agent/path-count/timestamp/numeric/cursor admission examples, unknown/browser flag examples and postcommand last-wins projections; retire one parser sentinel-only case. Keep actual ambiguity, conflicting index request, precommand/crosscommand scoping, variadic reference parsing and missing-repeatable-value controls, without claiming equivalent coverage. Root-unit discovery loses all twenty-nine/thirty-seven. No CLI/RPC/terminal/PowerShell/host/schema/runtime execution is established by this source-only audit; earlier evidence retains its historical scope.",
+ "Audit3609: Remove the complete pnpm CLI invocation literal-selection suite (eleven authored/nineteen finite potential cases), with no replacement claimed. Root-unit discovery loses JavaScript-versus-native command selection, npm/npx executable rejection, Windows cmd/bat casing and shell selection, non-Windows cmd behavior, native PNPM_HOME flat/bin preference, explicit-path priority, relative-home rejection, missing-native fallback and non-Windows home-probe refusal alarms. The suite called the real resolver with independently expected objects, but exercised no pnpm/node/cmd process, installed native executable or real filesystem probe. Earlier KEEP decisions are consciously superseded by accepting these narrow branch and probe-inventory alarms as low value. Real symlink entry, Git signing isolation, Bun filesystem/Node child normalization and compiler scheduling/continuation tests remain distinct tests, not equivalent coverage. No runner, compiler, app, platform or remote execution was performed in this source-only audit. Earlier evidence retains its historical scope.",
+ "Audit3598: Remove seven authored/nine finite literal-table potential test registrations across workflow routing, Claude cold-start and real-zsh preexec drivers. Root-unit discovery loses six authored/six finite: three test-local workflow parser fixtures, the five-positive/three-negative explicit command-paint route inventory, a boot-banner-before-composer sample and an already-painted bare-title positive sample. The separately selected shell_contracts live-shell driver loses one authored/three finite raw-capture paint-only cases across three hook configurations; its real-wrapper launch-order, four rechunkings (twelve finite) and runtime-wait replay remain, without claiming equivalent replacement. Intentionally lose those parser, exact routing-list, banner, post-paint subscription and native-read-boundary paint alarms. Retained workflow/UNIT_EXCLUDE/classifier cross-source routing checks and readiness-race-to-writer timing are distinct bounded alarms. No runner, real shell, PTY, app, native focus, remote delivery, cross-platform execution or full-feature correctness is established by this source-only audit. Earlier evidence retains its historical scope.",
+ "Audit3591: Retire the whole one-case background journal-producer attribution suite and the fabricated malformed-details-block case (two authored/two finite cases). Intentionally lose the fixed own-task versus output/foreign-task attribution examples across flat/message row shapes, missing-root classification, and direct unbalanced/detailsish fabricated-block rejection alarms. Retained parser sibling/depth and editor navigation tests do not replace these alarms. No equivalent replacement or fresh runtime, transport, persistence, native focus or rendered UI validation is claimed. Earlier dated text and evidence retain their historical scopes.",
+ "Audit3592: Retire the whole three-case shared agent smart-key resolver suite, explicitly superseding its Audit3238/3237 keep decisions. Intentionally lose literal permission-versus-question classification, longest-question digit selection, Codex async-question opener/digit/Enter/skip mapping, and unsupported-agent/state/prompt refusal examples. These were real parser/selection and literal-byte alarms; they did not exercise terminal delivery or timing. No equivalent replacement or fresh runtime, native TUI, mobile, remote or performance validation is claimed. Earlier dated text and evidence retain their historical scopes.",
+ "Audit3587/3588: Retire six authored/fourteen finite cases, including the whole WSL stopped-notice and connecting-status selector suites. Intentionally lose direct WSL retry connection field/target/ready-epoch/null-guard examples, connecting/reconnecting distro and absent-state selector samples, and stopped/connecting notice text/button/data-attribute examples. Retained host-ready retry and content-loader/reload lifecycles do not replace these alarms. No equivalent replacement or fresh runtime, native WSL, remote, rendered UI or performance validation is claimed. Earlier dated text and evidence retain their historical scopes.",
+ "Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed.",
+ "Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions.",
+ "Audit3553/3559 current scope: delete worktrees-delete-pty-teardown.test.ts and worktrees-issue-command-overrides.test.ts entirely and remove three cases from worktrees-orphan-directory-cleanup.test.ts (6 authored/6 finite removals). Intentionally retire typed unserved-SSH create/delete admission, exact-name collision/error-token, proven-orphan no-force confirmation, standalone .git-directory refusal, and SSH-owned local-path preservation alarms. Retain only actual authorized orphan deletion and no-marker notes-file preservation; they are not equivalent replacements. The no-marker fixture resolves the default getRepos owner, so it does not prove temporary owner-repo binding. Git/Store/PTY/notifications are mocked; no physical process stop, durable metadata, real SSH delivery or native UI proof is claimed. Unchanged historical oracle, coverage, evidenceRuns and escaped receipts retain their original scopes only; no fresh execution or transferred pass validates the reduced sources.",
"Launch direct-owner cleanup current scope: This gate’s unfiltered unit command now selects a suite reduced by 82 whole registrations / 159 potential table examples in 10 whole test Programs, including 8 registrations / 15 examples from five once-registered create-message factory closures. Lost alarms include frozen first-message/options and legacy-host fallback; distinct actions and redelivery; uncertain/refused/reloaded input custody, Retry and late proof; rich prompt/attachment upload Stop/close and handback; ordinary draft/editor/IME/StrictMode lifetime and accepted topology; provisional fallback tab placement/group/pin/order and rich worktree handoff. Four whole consent/resume-identity cases remain in two Programs; they do not replace these alarms. This entry governs current reduced-unit scope and qualifies any broader implication of unchanged oracle/coverageNotes history. Entire dated evidenceRuns, original commands/currentCommand values, counts/results and existing history retain their original scopes only; no fresh execution, transferred pass, replacement equivalence or prior upstream-removal credit is claimed.",
"Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
"Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. src/main/persistence/worktree-sort-order-write.test.ts: re-ranks every writable row when a blocked row sits in the requested order. src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts: continues skill management after startup recovery fails. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts: uses bounded ownership lookup for direct arrivals while the agent cannot take input; wakes a bound Run waiter when same-Run direct mail arrives; keeps an unowned detached-recipient message in its direct mailbox; uses primary-key lookups for bounded routing updates. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts: remove only literal registration import/call pairs import './orchestration-mailbox-pointer-cli-command.spec'; no additional authored credit. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts: renders the %s CLI command in a mailbox pointer. src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts: sizes a slow high-latency link near twice its bandwidth-delay product; never paces a LAN, even when its client parses slowly; never paces a fast link; returns to legacy windows when the path RTT jumps. src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts: steps down the row ladder when history is over the byte budget; tries the larger first row count, then the usual ladder within the same byte budget. src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts: returns unknown when route inspection fails or emits malformed data; does not inspect routes outside Windows. src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts: is refused to a paired %s client; reports a failed widening instead of advertising an unreachable address. src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts: reports exited only when the owning runtime completes the exit waiter; reports unverifiable when the runtime cannot observe the exit waiter; reports unverifiable when a disconnected PTY resolves with unknown liveness. src/main/runtime/session-graph/headless-runtime-graph.spec.ts: lets a session tab inventory settle on a host no renderer publishes for. src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts: remove only literal registration import/call pairs import { registerHeadlessRuntimeGraphTests } from './headless-runtime-graph.spec', registerHeadlessRuntimeGraphTests(); no additional authored credit. src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts: bumps the stored snapshot version only when the title changes. src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts: keeps the healthy aggregate verification and delayed physical exit behavior; uses a stamped exit for the incarnation that was actually being closed. src/main/runtime/terminal/identity/terminal-identity-probe.test.ts: answers live for a structured worker without touching the PTY graph; answers live for a PTY handle the runtime still holds; runs the full leaf check for a handle with no live PTY; answers not-live for a stale handle; propagates \"could not look\" rather than reporting it as a dead handle. src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts: names the tab in main’s layout through terminal.rename; takes a window-style layout.apply close as already stopped, so the terminal runs on. src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts: retains no lifecycle generation after a spawn/exit cycle. src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts: reads a freshly spawned terminal as used once a user opens its tab, not on a probe; keeps the open mark on the process a user open starts. src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts: from a desktop window that mounts both panes; from a server with no window. src/main/runtime/terminal/surface/workspace-layout-projection.test.ts: carries views for a partition that holds none yet. src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts: releases a signalled exit-waiter when the signal aborts. src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts: selects a local hook status for a local pane. src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts: keeps the footer and the bare caret on screen mid-turn; %s: the screen alone reads ready during %s. src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts: uses per-launch arguments and preserves launch telemetry; attributes a startup agent whose caller named no surface as unknown; launches %s bare for an absent or blank prompt; attributes a %s draft launch named %s as %s; merges an automation's extras over the host defaults; threads worktree-create extras into the startup build; returns an enabled requested agent without detecting; returns the default when nothing was requested; detects instead of using the default when the requested agent is disabled; starts no agent when the default is blank; detects an enabled agent on this host when nothing usable was named; starts no agent when detection finds none. src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts: pastes and submits through composer readiness, never typing raw input; types the follow-up on WSL or SSH-to-Windows once the agent is in front, as before; cleans up the deadline when the composer was already captured; a draft that is not submitted is pasted on the box cursor, as before; takes the box after the grace when the row never comes, whatever repaints; takes the box at the deadline when the grace would outlast the budget; lets a dialog on screen veto a grace; refuses the deadline inside a pending grace while a shell is in front; takes the box at the deadline inside a pending grace with the agent in front; takes the box at the deadline after a refused grace once the agent is in front. src/main/skills/skill-install-transaction.test.ts: installs, previews unchanged bytes, and updates a clean receipt-owned skill; preserves the old version after a %s filesystem failure. src/main/speech/model-manager-download-resume.test.ts: requests the remaining bytes when a clean range response ends before the file total; bounds a server that advances by pathologically tiny segments forever. src/main/ssh/config/ssh-config-parser.test.ts: parses a basic host block; parses multiple host blocks; skips wildcard-only Host entries; skips Host entries with only pattern characters; parses IdentityFile with ~ expansion; parses Windows-style IdentityFile with ~ expansion; parses quoted scalar values like OpenSSH; parses equals-form scalar directives; parses IdentityAgent with ~ expansion; parses IdentitiesOnly; parses GSSAPIAuthentication; keeps the first GSSAPIAuthentication value like OpenSSH; parses ProxyCommand, ProxyUseFdpass, and ProxyJump; ignores comments and blank lines; handles case-insensitive keywords; stops current block on Match directive; returns empty array for empty input; creates one parsed host per concrete alias on a multi-pattern Host line; applies identity agent settings to every concrete alias on a multi-pattern Host line; defaults port to 22 for invalid port values; converts hosts to SshTarget objects; uses host alias as hostname when HostName is missing; skips hosts that are already imported; defaults username to empty string when not specified; carries through identityFile, identityAgent, identitiesOnly, proxyCommand, and jumpHost; carries through gssapiAuthentication; imports duplicate aliases only once and keeps the first concrete host; maps hosts for the picker and flags aliases already in Orca; de-dupes aliases and defaults missing fields; parses hostname, user, port from ssh -G output; collects multiple identity files; parses forwardagent yes; defaults port to 22 when missing; returns empty hostname when missing; returns undefined user when missing; handles empty output; skips lines without spaces; parses proxycommand and filters \"none\"; parses proxyusefdpass yes; parses proxyjump and filters \"none\"; handles ~ expansion in identity file paths; handles Windows-style ~ expansion in identity file paths; parses identityagent with ~ expansion; preserves identityagent none so auth can disable agent fallback; parses identitiesonly yes; parses gssapiauthentication; parses controlmaster options and filters controlpath none. src/main/ssh/config/ssh-known-hosts-source.test.ts: splits the space-separated list ssh -G prints on one line; expands ~ in a reported path; keeps a double-quoted path containing spaces whole; falls back to the default files when ssh -G reported nothing; drops an explicit none without falling back to the defaults; splits both known_hosts lists on one line each; reads StrictHostKeyChecking, including accept-new; reads HostKeyAlias and prefers it for the lookup; reads the non-default port; reports that the lookup came from an alias, so the port is not appended; reports no alias when the dialed host is used; unions the entries of every file; skips a path that is a directory; returns nothing when no file can be read; reports nothing unreadable when every file parses; does not count an empty file as unreadable; prefers HostKeyAlias over the resolved hostname; uses the dialed host, because a resolved hostname can just echo the label; still prefers an explicit HostKeyAlias over the dialed host; falls back to the dialed host when nothing was resolved; is rejoined when the split fragments resolve to nothing; leaves a single unresolvable path alone rather than inventing one; expands the __PROGRAMDATA__ token rather than passing it through as a path; does not rewrite a path that merely BEGINS with the token characters; keeps a drive-letter path with mixed separators intact; splits a spaced Windows home into the fragments the rejoin has to put back. src/main/ssh/config/ssh-known-hosts.test.ts: reads the algorithm from the blob rather than trusting the line; rejects %s; refuses a malformed blob: %s; uses the bare host on the default port; tries the bracketed form first and falls back to bare off-port; matches an exact line; matches case-insensitively; reports a changed key of the same type; reports unknown for %s; matches any host in a comma list; matches the bracketed form on its port; does not apply a bracketed entry to the default port; falls back to a bare line when off-port; never reports a change from the fallback pass; matches a bare literal on the default port; matches a bracketed literal on its port; reports a change for a literal; handles %s; still reports a change for a different key on a revoked host; skips a line carrying an unrecognised marker; does not report a change when only another key type is on file; matches within the same type; accepts CRLF terminators; skips blanks, comments and surrounding whitespace; accepts a hit regardless of which file holds it (%s); never brackets the alias, whatever the port; still brackets an ordinary host on a non-default port; matches a bare alias entry on a non-default port; still accepts the unmodified key field; accepts a hashed entry whose salt is a full SHA1 digest; still accepts the unmutated ssh-keygen -H vector; falls back to the bare host line on a non-default port, as ssh did; refuses a key type it has not seen for a host it knows, as ssh did. src/main/ssh/connection/ssh-connect-config.test.ts: returns undefined when no default keys exist; returns the first existing key file; probes regular and FIDO2 keys in stable default order; keeps a regular default ahead of a malformed FIDO2 default; uses target host/port/username; falls back to resolved config when target fields are empty; keeps imported endpoint fields as the fallback when ssh -G is unavailable; sets readyTimeout to CONNECT_TIMEOUT_MS; sets keepaliveInterval to 15s; enables keyboard-interactive auth so MFA challenges can be answered; uses agent auth when no explicit key and SSH_AUTH_SOCK is set; enables agent forwarding when OpenSSH config requests it and an agent is available; does not enable agent forwarding without a usable agent; resolves IdentityAgent SSH_AUTH_SOCK from the environment; uses the Windows OpenSSH agent pipe when no environment socket is available on Windows; wraps agent auth with IdentityFile filtering when IdentitiesOnly is enabled; applies a manual target IdentitiesOnly setting when ssh -G reports it off; includes unencrypted target.identityFile auth when an agent is available; defers encrypted target.identityFile auth when an agent is available; uses keyFile auth when target.identityFile is set and no agent is available; includes unencrypted resolved identityFile auth when an agent is available; defers a default-path resolved identityFile to the no-agent retry; offers the keyboard-interactive challenge when the agent defers no key; provides fallback key when no agent is available; can force private key inclusion for the post-agent fallback path; falls back to resolved proxyCommand; returns structured jump-host config for target.jumpHost; returns structured jump-host config for resolved proxyJump; returns undefined when no proxy is configured. src/main/ssh/connection/ssh-connection-auth-fallback.test.ts: resolves OpenSSH config using configHost when present; tries ssh-agent before reading an explicit private key; falls back to direct private key auth when agent auth fails; falls back to direct private key auth after too many agent authentication failures; answers bounded keyboard-interactive challenges such as Duo 2FA. src/main/ssh/connection/ssh-connection-store.test.ts: lists picker suppression aliases without consulting re-adoption tombstones; getTarget delegates to store; addTarget generates an id and persists; saves the CLI control switch as given, with no consent stamp; addTarget stamps source as manual by default; addTarget preserves an explicitly provided source; inserts a new config host stamped as ssh-config; asks the parser for all hosts — reconciliation happens in the store; updates an existing config-sourced target when the port changed; refreshes gssapiAuthentication on sync; never overwrites a manual target that owns the alias; does not rewrite an unchanged config-sourced target; returns empty array when nothing changed; tombstones a deleted config-sourced host so re-import skips it; suppresses a deleted manual target from config discovery; re-adding a deleted host reclaims its alias so sync stops suppressing it; editing a target reclaims its alias from the deleted set; records a tombstone when removing any user-facing target; re-adopts orphaned repos when the same host is re-added. src/main/ssh/connection/ssh-connection.test.ts: transitions to connected on successful connect; captures the negotiated SSH server key fingerprint; allows concurrent exec commands for ssh2 transport; removes startup listeners after ssh2 connect succeeds; scopes lifecycle events and pending handshake timers to one mock client; enables TCP_NODELAY on the new ssh2 client after a reconnect cycle; transitions through connecting → connected states; reports error state on connection failure; disconnect cleans up and sets state to disconnected; getTarget returns a copy of the target; getState returns a copy of the state; throws when connecting a disposed connection. src/main/ssh/orcad-migration-stuck-host-profiles.test.ts: never leaves a running terminal behind; is offered only when leaving saved state behind would clear the refusal. src/main/ssh/orcad-runtime-maintenance.test.ts: keeps a connect from retrying a build an explicit Update also failed; offers Force when Update was refused by policy; forwards anew after an activation, since the new slot may bind another port; passes a refusal through and leaves the server linked; forwards anew once a serving slot is restored, which may have bound another port. src/main/ssh/port-forwarding/ssh-port-forward.test.ts: reports the port the OS bound when an ssh2 forward asks for port 0; adds an ssh2 port forward and returns entry; adds a system SSH port forward when no ssh2 client is available; reports the port a system SSH forward resolved when asked for port 0; passes resolved OpenSSH config to system SSH port forwards; disposes a system SSH tunnel when removing the forward; lists forwards filtered by connectionId; removes a forward by id; awaits forward close when removing a forward for user actions; returns null when removing nonexistent forward; removes all forwards for a connection; dispose removes all forwards; stores label in the entry; preserves the existing id when updating a forward succeeds. src/main/ssh/ssh-channel-multiplexer.test.ts: sends a JSON-RPC request and resolves on response; assigns unique request IDs; sends notifications without expecting a response; dispatches incoming notifications to handler; sends one keepalive frame per cadence tick; drives keepalive sends AND dead-link detection from a single interval; resolves false immediately on a disposed mux; throws on request after dispose; reports isDisposed correctly; clears registered handlers on dispose; does not retain handlers registered after dispose. src/main/ssh/system-transport/system-ssh-forward-process.test.ts: spawns exactly the argv the orphan matcher is given, LogLevel=INFO included; runs port forwards unmultiplexed even when ssh_config disables muxing; preserves manual target port and identity options in the forwarded ssh command; does not spawn ssh when the requested local forward port is already in use; spawns ssh after the requested local forward port preflight succeeds; resolves startup after the grace period when ssh keeps running; sends SIGTERM then SIGKILL when the process does not exit; does not resolve stop until the process exits. src/main/ssh/system-transport/system-ssh-loopback-route.test.ts: dials the held forward ahead of the alias so OpenSSH keeps these over ssh_config; drops a manual target's own port and proxies, which would fight the route; never routes a forward, whose argv must stay stable for orphan recovery; %s → %s; opens the forward over the real proxy, then proves a login over the route; lands the forward on the sshd and known_hosts name the direct route resolved; holds the forward with server-alive probes; never lets the background forward or probe ask for credentials; starts no forward when admission refuses the route; stops the forward when sshd refuses logins over it; stops the whole forward process tree on Windows, once; reports a forward that already exited before anyone listened for it. src/main/startup/browser-process-user-agent-ordering.test.ts: explains admission refusal before a desktop launch exits; explains an orcad holding the profile instead of exiting silently; does not acquire profile admission for a duplicate launch; executes after the dev app name and before later preflight work; exits and releases admission after pending profile move recovery fails; keeps Linux background startup failures console-only and immediate; keeps Linux serve startup failures console-only and immediate. src/main/startup/quit/quit-path-durable-write-blocking.test.ts: store.flushAsync() issues no synchronous fs syscalls; store.flushAsync() also moves the active-view and github-cache sidecars off the thread; stats.flushAsync() issues no synchronous fs syscalls; Grok session cleanup issues no synchronous fs syscalls; stats.flushAsync() closes out live agents before it returns, not when its write lands; a stalled mount leaves the event loop live instead of parking it; store.flushAsync() is one idempotent final barrier; store.flushAsync() resolves instead of throwing when the profile mount rejects writes. src/main/stats/agent-session-transition-recorder.test.ts: counts a hook-only agent that never writes an agent-shaped terminal title; never opens a session from a replayed or disk-restored working status; still closes a live session when the terminating status arrives as a replay; counts one session per turn across repeated working/done cycles; closes an open session when its pane is torn down; bounds the mirror and closes what it evicts; stops the session when the main agent settles and only a watch loop holds the row working; keeps the session open while a subagent outlives the main agent, and closes it when the child settles; dates the stop by the evidence when a shell outlives the last subagent; opens a new session dated by the observation when the main agent resumes after monitoring; never dates a reopen before the close a fact-less OSC repaint caused; dates the first live row after a restored one by the evidence, not the restored clock; treats an unchanged answer as a snapshot, never a transition; opens only on a live working edge; closes only a session it opened. src/main/text-generation/commit-message-text-generation-model-discovery.test.ts: returns static catalog models without spawning for static agents; discovers dynamic models through the agent CLI; discovers dynamic models through the configured agent command override; falls back to static models when dynamic discovery returns no parseable models; falls back to the first discovered non-Pi model when its static default is unavailable. src/main/text-generation/pull-request-context.test.ts: does not fetch unrelated fork remotes before generating PR context; bounds exact remote-ref probe concurrency for a large remote list; reports no branch change because PR context preparation is read-only; keeps a remote-qualified base when the selected base includes the remote. src/main/text-generation/source-control-local-process.test.ts: asks the supervisor to stop and leaves its group to it; signals nothing once the supervisor has exited; stops an agent that ignores its stdin end through its supervisor. src/main/updater/linux-package/linux-package-update-recovery.test.ts: retains the downloaded package with the digest from the event metadata; requires a string downloaded path; accepts an uppercase extension; requires a non-empty string version; matches an absolute file URL by basename; accepts duplicate entries that agree on the digest; refuses an entry with a missing or non-string digest; refuses a digest that is not base64 at all; refuses a malformed percent-encoded URL; refuses a missing or non-array file list; tolerates a non-object event; replaces the retained artifact with a newer download; keeps the retained artifact when a new download has no usable digest; keeps the retained artifact when an unrelated download event arrives; clears the retained artifact; preserves the artifact across a recheck of the same version; clears the artifact when another version takes over; preserves the artifact for an unknown or empty version; is a no-op without a retained artifact; returns the built command and package file name for a verified package; reports missing without a retained artifact; propagates a package-manager discovery failure; rejects a well-formed digest that belongs to another file; never hashes a package that a malformed digest failed to arm; rejects a path outside the cache root; rejects the cache root itself; rejects a package in the updater directory itself; rejects a pending directory that is a symlink out of the cache; performs one hash pass for concurrent requests; revalidates once the in-flight pass settles; does not reuse an in-flight pass for a different artifact; starts a fresh proof when the same package is captured again; returns the verified package path; returns missing without a retained artifact. src/main/updater/releases/updater-prerelease-feed-readiness.test.ts: accepts a GitHub %s asset redirect as ready; reports a GitHub asset request error as unavailable; reports not-ready with a verified last-good tag when the newest assets are unavailable; does not classify a non-positive tag limit as feed unavailability; reproduces the v1.4.142 publishing incident as not-ready; reports transport failures as unavailable instead of not-ready; treats an explicit asset 404 as not-ready when another asset is unavailable; accepts absolute manifest asset URLs without rewriting them to release asset paths; returns not-ready with an older ready update as last-good while newest is publishing. src/main/updater/releases/updater-release-builds.test.ts: lists hourly builds from the dedicated repo, newest first; lists daily builds from the dedicated repo, newest first; separates stable from rc in the shared main repo; skips drafts and unparseable tags; keeps a composed release title and drops one that repeats the tag; hides builds that published no artifact for this platform; returns an empty list when no build has this platform artifact; keeps mac builds visible on macOS regardless of the Windows leg; resolves the platform installer download url; leaves the installer url null when the release published no installer; tolerates a release whose assets are missing or malformed; sends the local gh token as a bearer header when one is available; sends no authorization header when gh has no token; retries unauthenticated once when GitHub rejects the token; does not retry a 401 that was already unauthenticated; falls back to the per-IP bucket when the token is rate limited and tells the gh breaker; reports a secondary limit carrying retry-after without retrying or tripping the breaker; records a primary limit in the token scope %s; keeps %s authenticated when only %s is blocked; skips the token while its scope %s is blocked; surfaces a rate limit with its reset time and a sign-in hint when unauthenticated; omits the sign-in hint when the rate-limited request was authenticated; treats 429 as a rate limit; reports a 403 without rate-limit headers as a plain HTTP error; reports a missing hourly repo distinctly; is null when GitHub sent no reset; prefers retry-after over the primary reset epoch; falls back to the primary reset epoch when there is no retry-after; reads retry-after as seconds; reads retry-after as an HTTP date; pins an hourly tag at the hourly repo download path; pins a daily tag at the daily repo download path; pins a stable tag at the main repo download path; rejects a tag that is not a version. src/main/updater/updater.build-channel-selection.test.ts: uses the display label in the unsupported-platform %s pinned-build error; still pins %s from an unsigned Windows dev build; restores ordinary release checks after local build selection fails; opts into the RC channel when checkForUpdatesFromMenu is called with includePrerelease; pins the generic feed to a perf-tagged prerelease when requested; surfaces no-update feedback when no newer perf-tagged prerelease exists; keeps prerelease publishing-window misses on the generic retry path; leaves the feed URL alone for a normal user-initiated check. src/main/updater/updater.check-preflight.test.ts: ignores a stale update-not-available event after a new check starts preflight; deduplicates repeated manual checks while the immediate checking status is active. src/main/updater/updater.prerelease-fallback.test.ts: retries a prerelease check once against the previous feed tag when the manifest is missing; surfaces a promise-only prerelease fallback failure after the primary error event. src/main/updater/updater.publishing-window-feed.test.ts: repins the generic feed to the newest RC tag for a prerelease user; repins the generic feed to a newer stable tag for a prerelease user; pins a stable fallback when Atom has no newer prerelease; uses last-good concrete feed when a user-initiated check lands during publishing; can offer an older fully published update while the newest release is publishing; keeps background publishing-window fallback on the short retry cadence. src/main/updater/updater.quit-and-install.test.ts: surfaces an accepted retry before electron-updater emits download progress; defers quitAndInstall and runs its launcher within the launch PATH scope; runs pre-quit cleanup before local PTY cleanup during update install; keeps optional pre-quit cleanup fail-and-continue behavior by default; ignores duplicate quitAndInstall requests while the shared delay is pending; arms the forced-exit watchdog once the install commits; disarms the forced-exit watchdog when sync install error recovery keeps the app open. src/main/window/createMainWindow-markdown-editor-focus.test.ts: ignores traffic light sync IPC on non-macOS; still intercepts Cmd+Shift+B and Cmd+Alt+B when the markdown editor is focused; coerces non-boolean setMarkdownEditorFocused payloads to false; opens a table-aware context menu synchronously without a renderer query; builds the plain edit menu for the one right-click the renderer marks as plain text. src/main/window/createMainWindow-renderer-crash-recovery.test.ts: notifies the caller when the renderer process is gone; passes the renderer webContents id through crash recording and recovery callbacks; forwards expected renderer teardowns so the recorder can diagnose suppression; reloads the app shell after an unexpected renderer process loss; does not reload after renderer loss when recovery is disabled; stops auto-reloading after a rapid renderer crash loop trips the breaker. src/main/window/dashboard-popout-window.test.ts: updates the title after language initialization and unsubscribes when closed; lets its preload expose saved WSL hosts in serve-only, and passes nothing otherwise; creates a native-frame window with the shared preload and no webview surface; shows the window on ready-to-show; loads the prod file entry; loads the dev server URL when in dev; focuses the existing window instead of creating a second one; trusts only the live popout webContents; restores a minimized window when re-requested; restores valid persisted bounds; discards off-screen persisted bounds and falls back to defaults; persists bounds on resize after the debounce, guarding near-minimum sizes; keeps saving bounds after a vetoed quit and freezes them only on an allowed quit; closeDashboardPopout closes an open window; applies the persisted app zoom level on dom-ready; follows app zoom changes while open and unsubscribes on close; zoomDashboardPopoutIfFocused steps the popout zoom only while focused; handles the zoom-in chord via before-input-event and ignores other keys; handles mouse-wheel zoom requests outside before-input-event; respects zoom keybinding overrides for keyboard and mouse-wheel paths. src/main/window/dropped-path-preparation.test.ts: opens and stores each unique source once as drop size grows tenfold; passes ordinary paths without copying for %s; preserves ordinary successes and copied successes when another file fails; serializes copy requests from different owners; reports all lost paths without a shared reason when their failures differ. src/main/window/main-window-updater-deferred-setup.test.ts: releases all 64 completed fallback handles without repeating initialization; keeps setup after ready-to-show and releases its fallback afterward; preserves the 15-second fallback when first paint never arrives; preserves destroyed-window guard reads before and at the fallback deadline; keeps the exact %s error and releases its completed fallback; keeps the exact fallback %s error without retrying initialization; preserves pending manual setup after failed ready registration; keeps setup options, live store reads, nudge writes and required quit flush. src/main/worker-threads/worker-thread-request-queue.test.ts: posts one request at a time and in the order it was dispatched; fires a posted call at its own deadline; stops respawning and fails the rest of the queue once deaths hit the cap; clears the death count when a fresh burst starts from full idle. src/main/workspace-hooks/hooks-setup-runner-script.test.ts: builds Windows runners for newline-heavy scripts without line-array splitting; builds POSIX runners without regex-wide CRLF normalization; writes POSIX setup runners for shebang-declared scripts on native Windows paths; keeps batch setup scripts on cmd.exe when the terminal is Git Bash; hands a Git Bash pane a launch command MSYS cannot rewrite for a cmd runner; replays interpreter flags declared on the shebang line; preserves cmd.exe setup runner semantics for configured cmd users; keeps POSIX runner behavior on POSIX platforms; waits when either local or project policy requires completed setup; marks setup-runner terminals for the always-on credential guard; maps git-bash to POSIX setup launch metadata on Windows; falls back to the cmd runner when the git-bash setting has no installed Git Bash; keeps the cmd runner for a non-Git bash such as Cygwin; keeps the cmd runner for a bare bash whose flavor cannot be resolved; uses the POSIX runner for a bare bash that resolves to Git Bash; uses the POSIX runner for an extension-less Git Bash path; preserves the existing cmd runner for PowerShell terminals; preserves cmd setup compatibility when a Windows-host project has a WSL shell setting; classifies an installed explicit Git Bash executable as a POSIX runner; falls back to the cmd runner when the explicit Git Bash path no longer exists. src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts: schedules remote identity enrichment without blocking the caller; probes a drive project whose runtime is WSL %s; sweeps a local repo: %s; probes an SSH row that carries only executionHostId on its own host; keeps same-path rows on two different SSH hosts from sharing one backoff; coalesces concurrent probes for the same repo location; caches no-identity probes briefly so list calls do not retry every time; does not rewrite the no-remote marker on a later retry; resolves a settled no-remote repo once it gains a remote; does not re-probe a resolved identity before the refresh window elapses; re-probes a resolved identity after the refresh window elapses; bounds re-probes per sweep so a large repo list drains gradually; forgets a removed repo location so its deadline cannot outlive the repo; keeps a surviving repo backoff when a sibling repo is removed; probes again when the same location is re-added after its probe was retired; coalesces concurrent sweeps instead of running one pass per list call. src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts: preserves create priority through claim probes on %s; starts the checkout only once the async workspace root resolves; still deduplicates when both callers await the same pending root lookup; namespaces native Windows preparation directories for long paths; deduplicates preparation for the same repo, base, runtime, and workspace root; does not spend a divergence walk when the base matches exactly; claims when the two sides spell the same ref differently; evicts a repo's own stale preparation before another repo's; still discards armed checkouts when the project runtime needs repair; routes preparation and finalization through the selected WSL runtime; retries stale cleanup after a transient listing failure; does not discard a detached worktree with caller-controlled preparation metadata; does not re-arm after an isolated create; re-arms a preparation once creates arrive in a burst; holds the re-arm checkout until the create runs the deferred thunk; starts one explicit prefetch after the create completes; does not re-arm when finalization failed; reports a pending create while a stale-cleanup scan is running. src/main/workspaces/removal/local-worktree-removal-recovery.test.ts: recovers Git for Windows partial filesystem deletion failures; finishes a clean non-force deletion after Git leaves a Windows directory behind; recovers localized Windows failures after Git already removed the registration; does not recover unrelated localized failures while Git still owns the row; finishes a macOS deletion Git deregistered before failing with Directory not empty; leaves an orphaned checkout to the orphan cleanup instead of deleting it; prunes and strictly verifies on the selected WSL host without deleting files or branches. src/main/workspaces/removal/worktree-removal-safety.test.ts: rejects deleting a worktree that contains another registered worktree; rejects POSIX home directories even when host homedir has a different path shape; refuses a home the host reported even when no path rule recognises it; refuses the Windows host's home directory from a POSIX client; refuses the Windows host's home directory even when the host reported nothing. src/main/wsl/discovery/distro-catalog.test.ts: retries asynchronous discovery after a transient wsl.exe failure; retries synchronous discovery after a transient wsl.exe failure; retries asynchronous discovery after wsl.exe reports no distros yet; retries synchronous discovery after wsl.exe reports no distros yet; bounds the wsl.exe spawn rate while no distros are installed; bounds the asynchronous spawn rate while no distros are installed; still caches a non-empty distro list for the process lifetime; re-probes a docker-desktop-only machine once a user distro can appear; backs off while the list keeps coming back empty; backs off after repeated distro-list failures; caps the empty-list backoff at five minutes; keeps reporting an empty result after it goes stale; keeps reporting a known distro list indefinitely; bounds cached homes while retaining the most recently used distros; still lists distros, and an excluded distro home probe fails like any other probe; gives the async home probe time for a cold boot instead of killing it at 5 s; retries availability after a probe timeout instead of latching false; bounds the probe rate while the failure window is open; caches a successful probe for the process lifetime; names an explicit spawn directory, so no deleted cwd can read as ENOENT; shares one wsl.exe spawn between concurrent probes; keeps reporting the last observed answer after it goes stale; holds a definitive failure far longer than a timeout when %s; backs off after repeated probe failures; re-probes a seeded retryable failure once its window lapses; re-probes availability once a distro list succeeds after %s; does not drop an availability failure for an empty distro list; keeps reporting unavailable off Windows without probing. src/main/wsl/discovery/wsl-distro-holder.test.ts: runs a busybox-safe loop through --exec and names the distro; spawns a detached-style holder, records it, and waits for the distro to run; a holder exiting with code 1 notes its distro may have stopped (E9); rejects a pid whose command line is not our holder for that distro; cleans up stale and corrupt records; keeps a holder and its record when release cannot verify it; reports unverifiable when the command line is unreadable even with a matching pid; release kills a verified holder and removes its record; release never kills a pid that is no longer our holder; reports a spawned holder exit so liveness can re-check. src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts: skips 9p shares that are not drvfs, and malformed lines. src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts: plans the update on the census the running orcad reports, not an unknown one; forwards force to the update planner; does not serve the incumbent past a refusal that is not a wait; does not re-activate the build this host rolled back from; labels the launch with the build the adoption found serving, not the stale record; defers while another run holds the host fence; lets an explicit force deploy past both skips; names a newer host refusal apart from a rolled-back one, so only Force is offered; updates an older host as before, without asking to adopt it; never asks the incumbent when it already runs this build. src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts: keeps a completed listing usable when the host rejects the wait parameter. src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts: delivers to chat-default users in all targeting while holding out not-switched users. src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts: completes the row on a pick, even when the command is already typed; ignores a pick of the row while side chats are unavailable. src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts: explains a too-large refusal that arrives through the IPC error prefix. src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts: keeps the question with the caller and says once that it never went; tells the user to check the side chat when delivery is unconfirmed; reports a delivered question as sent, silently. src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts: decides each of %i tool-only turns once per layout, and nothing without a listener. src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx: places a side chat whose question was %s: %o. src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts: calls back once for %s; stops watching once unsubscribed. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts: records a mode 2031 subscribe from the raw chunk boundary without answering. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts: routes terminal input through deferPtyInput so the host can withhold it; forwards terminal input directly when the host supplies no deferPtyInput. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts: forwards onBell to pane attention and notification policy; hands the bell to the attention module with its pane even when pane attention is off. src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts: repaints from the main-owned snapshot when main drops pending output at the cap. src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts: retries a fresh-spawn native follow reset when renderer dimensions return. src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts: requests a tab remount for an unbound spawn; leaves recovery to a remote transport that armed its own retry; requests a remount when the transport reports no recovery of its own; settles the spawn as failed before requesting a remount; prefers the restored leaf id when reporting the anomaly; falls back to the pane leaf id when no restored leaf exists. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionDeferredInputForwardingTests } from '../input/pty-connection-deferred-input-forwarding.spec', registerPtyConnectionDeferredInputForwardingTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts: structural support changed only; no new authored removal credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionFreshNativeFollowResetTests } from '../output/pty-connection-fresh-native-follow-reset.spec', registerPtyConnectionFreshNativeFollowResetTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionTerminalBellAttentionTests } from '../notifications/pty-connection-terminal-bell-attention.spec', registerPtyConnectionTerminalBellAttentionTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts: registers interest on the first sidecar and releases on the last unsubscribe; releases sidecar interest only once for repeated unsubscribes; does not let an eager pre-mount buffer defeat hidden delivery gating; keeps eager buffers outside delivery interest when the PTY exits before mount; lets a sidecar exclusively own interest while an eager buffer overlaps. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts: blackholed delivery reproduces the wedge: no handler dispatch, no ACK ever. src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts: sends preferences to the execution host and attaches only to its returned PTY; preserves one operation ID across a lost reply and reconnect; preserves ordinary raw startup and captured-session attachment. src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts: sums registered gauges and drops disposed ones; ignores a repeated dispose instead of dropping another gauge; stops tracking new gauges past the cap so a missed dispose cannot grow it; tracks a live output processor queue through enqueue, drain, and dispose; excludes cleared consumed entries from retention after a bounded drain. src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts: says nothing once the pane is closed. src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts: refreshes after each scheduled atlas reset; falls back to a timeout when animation frames are unavailable; continues recovery when a manager throws after scheduling. src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts: tracks a remounted quiet title source even when the stale owner unregisters later; preserves the renderer-parsed output sequence in the response; preserves a pending escape tail for snapshot replay; routes a host's Reset Terminal request to the pane that owns the PTY. src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts: marks panes with restored scrollback for fresh-shell viewport blanking. src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts: recovers a 0x0 spawn whose container is briefly unmeasurable then settles. src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts: removes global listeners when the last pane unregisters. src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx: keeps trust text readable on a host-owned dialog surface; applies the hostile surface to ordinary dialogs, so the case above is exercised. src/renderer/src/components/use-terminal-parking-pass.test.tsx: does not queue a render when a pass produces the same parking sets; keeps parking transitions working under StrictMode. src/renderer/src/hooks/client-workspace-view-report.test.ts: reports an away user’s screen with no presence, and renews as soon as input returns; retries a failed send, empty or not, no sooner than a refresh. src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts: is new work in a workspace with no live terminal: its first bind moves it up in Recent. src/renderer/src/hooks/use-bundled-skill-install.test.tsx: ignores a repeated click while the install runs; retries the last requested skills on this host. src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx: adds seeds to a successful empty list but not to loading or failed results; retains seed projection after expiry and fetches fresh metadata for a new reader. src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx: retranslates the settings nav labels when the UI language changes live. src/renderer/src/lib/codex-stale-pane-account-identity.test.ts: keeps the prompt when the roster read fails and every label collapses. src/renderer/src/lib/image-blob-png.test.ts: downscales a pasted image above the pixel cap; releases its temporary URL on a decode error; releases its temporary URL when PNG encoding fails or exceeds the byte cap. src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts: names callers above the frame the write came from; restores Error.stackTraceLimit when the capture throws; stops collecting after the sample cap when captureStackTrace is unavailable; caps reported changed keys from a single wide write. src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts: applies the rendered text hard cap last and reserves the final overflow marker. src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts: keeps the runtime target identity stable across unrelated store writes. src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts: keeps creation available on old hosts and explains the missing operation; preserves landed warnings and direct collision recovery data; propagates remote discovery failure instead of a false empty page. src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts: reuses unchanged worktree tab projections when one worktree title changes; bumps only the changed worktree version when a sibling stays byte-identical. src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts: shares safe-auto fork sync cooldown attempts across store instances. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts: collapses a 193-workspace hydration to one store write; leaves the store byte-identical to the per-workspace path; re-reconciling the batched result is a no-op, as it is for the per-workspace path. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts: dedicated zero-case helper retirement; no authored test credit. src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts: persists each batch metadata update to its workspace owner. src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts: dismisses a rename error on its capable remote owner; clears pending first-agent rename when the title is updated. src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts: orders capture, guards, handlers, main's stop, commit, cleanup, and exit settlement. src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts: publishes the first terminal and root tab group atomically; publishes the first terminal and root tab group atomically, then marks it starting in main. src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts: restores daemon terminal wake hints before declaring the session ready. src/renderer/src/web/web-runtime-connection-auth-framing.test.ts: keeps legacy framing for sockets that cannot absorb a refused attempt. src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts: moves the old Windows default to Regular once and queues the notice; keeps custom weights and fresh profiles without a notice; leaves macOS and Linux profiles untouched. tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, src/main/persistence/worktree-sort-order-write.test.ts, src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts, src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts, src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts, src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts, src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts, src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts, src/main/runtime/session-graph/headless-runtime-graph.spec.ts, src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts, src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts, src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts, src/main/runtime/terminal/identity/terminal-identity-probe.test.ts, src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts, src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts, src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts, src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts, src/main/runtime/terminal/surface/workspace-layout-projection.test.ts, src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts, src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts, src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts, src/main/skills/skill-install-transaction.test.ts, src/main/speech/model-manager-download-resume.test.ts, src/main/ssh/config/ssh-config-parser.test.ts, src/main/ssh/config/ssh-known-hosts-source.test.ts, src/main/ssh/config/ssh-known-hosts.test.ts, src/main/ssh/connection/ssh-connect-config.test.ts, src/main/ssh/connection/ssh-connection-auth-fallback.test.ts, src/main/ssh/connection/ssh-connection-store.test.ts, src/main/ssh/connection/ssh-connection.test.ts, src/main/ssh/orcad-migration-stuck-host-profiles.test.ts, src/main/ssh/orcad-runtime-maintenance.test.ts, src/main/ssh/port-forwarding/ssh-port-forward.test.ts, src/main/ssh/ssh-channel-multiplexer.test.ts, src/main/ssh/system-transport/system-ssh-forward-process.test.ts, src/main/ssh/system-transport/system-ssh-loopback-route.test.ts, src/main/startup/browser-process-user-agent-ordering.test.ts, src/main/startup/quit/quit-path-durable-write-blocking.test.ts, src/main/stats/agent-session-transition-recorder.test.ts, src/main/text-generation/commit-message-text-generation-model-discovery.test.ts, src/main/text-generation/pull-request-context.test.ts, src/main/text-generation/source-control-local-process.test.ts, src/main/updater/linux-package/linux-package-update-recovery.test.ts, src/main/updater/releases/updater-prerelease-feed-readiness.test.ts, src/main/updater/releases/updater-release-builds.test.ts, src/main/updater/updater.build-channel-selection.test.ts, src/main/updater/updater.check-preflight.test.ts, src/main/updater/updater.prerelease-fallback.test.ts, src/main/updater/updater.publishing-window-feed.test.ts, src/main/updater/updater.quit-and-install.test.ts, src/main/window/createMainWindow-markdown-editor-focus.test.ts, src/main/window/createMainWindow-renderer-crash-recovery.test.ts, src/main/window/dashboard-popout-window.test.ts, src/main/window/dropped-path-preparation.test.ts, src/main/window/main-window-updater-deferred-setup.test.ts, src/main/worker-threads/worker-thread-request-queue.test.ts, src/main/workspace-hooks/hooks-setup-runner-script.test.ts, src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts, src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts, src/main/workspaces/removal/local-worktree-removal-recovery.test.ts, src/main/workspaces/removal/worktree-removal-safety.test.ts, src/main/wsl/discovery/distro-catalog.test.ts, src/main/wsl/discovery/wsl-distro-holder.test.ts, src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts, src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts, src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts, src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts, src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts, src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts, src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx, src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts, src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts, src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts, src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts, src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts, src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts, src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts, src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts, src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts, src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx, src/renderer/src/components/use-terminal-parking-pass.test.tsx, src/renderer/src/hooks/client-workspace-view-report.test.ts, src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts, src/renderer/src/hooks/use-bundled-skill-install.test.tsx, src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx, src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx, src/renderer/src/lib/codex-stale-pane-account-identity.test.ts, src/renderer/src/lib/image-blob-png.test.ts, src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts, src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts, src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts, src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts, src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts, src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts, src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts, src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts, src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts, src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts, src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts, src/renderer/src/web/web-runtime-connection-auth-framing.test.ts, src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts, tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
@@ -12826,7 +12862,15 @@
"Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
"Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. All prior notes and dated/archived evidence retain original scopes.",
"Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
- "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Earlier notes, complete dated receipts and archived gaps retain their original scopes."
+ "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
+ "Audit3597 scope: remove two renderer-hang-capture examples (2 authored/2 finite): an invalid repeated-token oversized reducer fixture and a shorter unanswered-request fixture. Intentionally lose the direct truncated flag/sanitized frame fixture and request-pending status/zero-sample alarms. Retain window-death/stale-result exclusion, generation reconciliation, and baseline-publication cancellation lifecycles; they are not equivalent bound, redaction or pending-status replacements. Historical execution retains its original source scope; no new runtime evidence is claimed.",
+ "Audit3601 scope: remove the whole custom-sound happy-path IPC suite and one custom-label/multiline notification formatting example (2 authored/2 finite). Intentionally lose configured .ogg selection, exact byte/MIME success wiring, successful dispatch for the formatting fixture, custom-label whitespace/title normalization and assistant-body whitespace/180-character-cap alarms. Retain prompt-exclusion, persisted qualified dismissal/restart, theme ownership/restore and Ghostty precedence/collision cases; none replaces the retired sound/formatting alarms. No actual playback, native delivery, phone/network, cross-platform or new runtime evidence is claimed; historical execution keeps its original scope.",
+ "Audit3606 adopts the enhanced3604/3605 icon cuts: nine authored/nine finite cases removed, including the whole tray-attention-icon suite. Retires the no-encoder oversized-upload null sample, missing-ID/request-order sample, encoder-null PNG-prefix fallback, SVG/404 rejection samples, transparent amber-dot placement and half-alpha white-tint sample, exact small fetched-byte passthrough, host-qualified image-key inventory and constant-encoder large-upload projection. These specific admission, formatting and bitmap alarms are intentionally lost without equivalent replacements. Retained queue/cache, bounded fetch and Dock lifecycle checks do not establish actual raster decoding, native image conversion or rendered appearance. Historical receipts below are preserved evidence for earlier test sets, not fresh validation of this reduced selection.",
+ "Audit3608: remove five authored/five finite callbacks, including whole owner-slug and remote favicon URL suites and two repository-label projections. Lose five owner acceptance samples, eleven negative owner samples plus nonstring refusal, six host-local icon refusal samples, legacy-SSH same-path label-map cardinality, and explicit runtime ownership over stale legacy metadata at label level. These are accepted narrow grammar/presentation alarms with no equivalent replacement claimed. Retained binary parser, React recovery and label grouping/platform cases do not replace these losses. Static evidence only; historical receipts retain their original scope.",
+ "Audit3613: remove six authored/six finite callbacks, including whole reviewer-display oversize-input and explorer-root record-filter suites, plus plugin family-emoji/invisible-only-name and pool legacy-name/urgent-countdown samples. Accept losing oversized-input empty-result/no-split, malformed-record/prototype-sensitive-key/nonstring filtering, exact ZWJ family preservation, invisible-only name refusal, no-group old-host full-name preservation, and80/79/null-reset countdown composition alarms. No equivalent replacement asserted. Retained strict/runtime sanitization, SVG parser, mobile focus recovery and collision/tie cases have different scopes. Static evidence only; historical receipts retain original scope.",
+ "Audit3628: remove the entire one-authored/one-finite RepositoryRemoveProjectSection happy-dom suite. Accept losing the local zero-to-one-terminal stale-count revalidation alarm: first confirmation defers the removal callback and second confirmation invokes it after the count snapshot updates. The test never asserts updated warning text/count, actual terminal creation or removal/PTY teardown, host/scope routing, cancellation or folder/mobile behavior. No equivalent replacement or end-to-end warning-before-teardown proof asserted. Static evidence only; historical receipts retain original scope.",
+ "Audit3629 removes two singleton parser suites: WSL Claude plugin metadata out-of-range index rejection and Git checkout unlink-warning path extraction. Their real range-refusal and quoted-path extraction alarms are intentionally lost without replacement; no WSL execution, checkout recovery or equivalent remaining coverage is claimed.",
+ "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed."
],
"demotionRule": "Demote or quarantine if the fault harness flakes without a product or harness bug, if healthy operation exceeds one runtime watcher child, if total physical operation exceeds eight children including retiring generations, if quarantine children outlive their roots or repeat after fusing, if event delivery becomes unbounded, or if metadata/stat work returns to the serve process."
},
@@ -13122,26 +13166,14 @@
"shellcheck config/docker/headless-serve-shutdown/run-signal-case.sh",
"shellcheck config/docker/headless-serve-shutdown/run-appimage-desktop-startup-case.sh",
"node config/scripts/runtime-verification/daemon-lifecycle/run-headless-serve-shutdown-docker.mjs --appimage dist/orca-linux.AppImage",
- "node config/scripts/runtime-verification/daemon-lifecycle/run-headless-serve-shutdown-docker.mjs --appimage dist/orca-linux.AppImage --platform linux/amd64",
- "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/startup/ensure-virtual-display.test.ts --maxWorkers=2 --reporter=dot"
+ "node config/scripts/runtime-verification/daemon-lifecycle/run-headless-serve-shutdown-docker.mjs --appimage dist/orca-linux.AppImage --platform linux/amd64"
],
"testFiles": [
- "src/main/startup/ensure-virtual-display.test.ts",
"config/scripts/runtime-verification/daemon-lifecycle/run-headless-serve-shutdown-docker.mjs",
"config/docker/headless-serve-shutdown/run-signal-case.sh",
"config/docker/headless-serve-shutdown/run-appimage-desktop-startup-case.sh"
],
"assertionRefs": [
- {
- "file": "src/main/startup/ensure-virtual-display.test.ts",
- "assertions": [
- "owned Xvfb starts with terminate-after-last-client semantics",
- "owned Xvfb uses an independent process group so terminal Ctrl-C cannot preempt Electron teardown",
- "owned Xvfb retains an early-process-exit guard until Electron is ready",
- "owned Xvfb is not stopped from Electron's cancelable will-quit event",
- "external displays and non-Linux startup remain untouched"
- ]
- },
{
"file": "config/scripts/runtime-verification/daemon-lifecycle/run-headless-serve-shutdown-docker.mjs",
"assertions": [
@@ -13214,6 +13246,7 @@
"Keep exact listener, Xvfb, descendant, fatal-evidence, and canary identity assertions green."
],
"knownGaps": [
+ "The portable startup unit suite was removed after a source value audit; its mocked display admission, ownership, bind-race and protocol-selection alarms were deliberately dropped. Recorded unit runs are historical evidence only. The retained packaged signal journey does not replace those unit alarms.",
"The local arm64 Docker host uses Rosetta for amd64 containers; native amd64 PR CI supplies the non-emulated repeat of the same extracted-AppRun PID contract.",
"Ubuntu 20.04 is covered by the packaged native-binary glibc floor gate; this lifecycle journey runs on the reported Ubuntu 26.04 topology.",
"Systemd units that override or omit the documented KillMode=mixed policy can still terminate owned Xvfb before Electron disconnects.",
@@ -13238,13 +13271,13 @@
"providers": ["local-daemon"],
"coveredPlatforms": ["linux"],
"coveredProviders": ["local-daemon"],
- "coverageNotes": "A restricted Ubuntu container stages the extracted AppImage payload with no /dev/fuse and with unprivileged user namespaces denied, then runs eight CLI cases across the bundled launcher and the extracted direct binary. x64 only, because PR CI builds only --x64.",
+ "coverageNotes": "Audit3930: The two dated evidenceRuns remain verbatim historical records for their original eight-case source. They are not fresh execution of the reduced three-case selector and do not validate all current output oracles: the original red/green account notes that earlier skills passes predated the stronger own-output matcher. Audit3925: Reduce eight hostile CLI examples to three: bundled status with no runtime, direct-binary skills text dispatch, and stale-display GUI diagnosis. Remove extra bundled help/version/skills/worktree and absent-display GUI examples; accept loss of packaged version equality and their exact output alarms without equivalent replacement. The reduced selector has no fresh execution evidence. Historical prior account (preserved verbatim): A restricted Ubuntu container stages the extracted AppImage payload with no /dev/fuse and with unprivileged user namespaces denied, then runs eight CLI cases across the bundled launcher and the extracted direct binary. x64 only, because PR CI builds only --x64.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/13719",
"https://github.com/stablyai/orca/issues/14229"
],
"invariant": "On a host without FUSE and without unprivileged user namespaces, every packaged CLI entrypoint either completes its command or reports a diagnosis, and never terminates on a signal.",
- "oracle": "Build the image, stage the AppImage payload, and run each case in the restricted container. Assert the preconditions first: unshare -Ur must fail and /dev/fuse must be absent, so a relaxed runner fails the job rather than silently skipping. For each case require the exact expected exit status and an expected substring of the command's own output, with the harness RESULT/CRASHED/PRECONDITION_FAILED control lines excluded so a case name can never satisfy its own assertion. Any status of 128 or above is a crash and fails immediately. The per-case timeout is a failure deadline, never a success condition.",
+ "oracle": "Audit3925: Reduce eight hostile CLI examples to three: bundled status with no runtime, direct-binary skills text dispatch, and stale-display GUI diagnosis. Remove extra bundled help/version/skills/worktree and absent-display GUI examples; accept loss of packaged version equality and their exact output alarms without equivalent replacement. The reduced selector has no fresh execution evidence. Historical prior account (preserved verbatim): Build the image, stage the AppImage payload, and run each case in the restricted container. Assert the preconditions first: unshare -Ur must fail and /dev/fuse must be absent, so a relaxed runner fails the job rather than silently skipping. For each case require the exact expected exit status and an expected substring of the command's own output, with the harness RESULT/CRASHED/PRECONDITION_FAILED control lines excluded so a case name can never satisfy its own assertion. Any status of 128 or above is a crash and fails immediately. The per-case timeout is a failure deadline, never a success condition.",
"commands": [
"node config/scripts/runtime-verification/desktop-transport/run-linux-cli-launch-contract-docker.mjs --appimage dist/orca-linux.AppImage",
"shellcheck config/docker/cli-launch-contract/run-cli-case.sh"
@@ -13257,9 +13290,8 @@
{
"file": "config/scripts/runtime-verification/desktop-transport/run-linux-cli-launch-contract-docker.mjs",
"assertions": [
- "the bundled launcher serves --help, --version, status, skills --help, and worktree list without Chromium",
+ "the bundled launcher reports status with no runtime without Chromium",
"a direct binary launch reaching JavaScript runs the command instead of booting a GUI",
- "a desktop launch with no display reports the missing-display diagnosis instead of trapping",
"a stale DISPLAY is diagnosed rather than trusted",
"expected output is matched against the command's own output, not the harness control lines"
]
@@ -13296,15 +13328,15 @@
],
"runtimeBudget": {
"p95Seconds": 300,
- "scope": "eight CLI launch cases in one restricted Ubuntu container"
+ "scope": "three CLI launch cases in separate restricted Ubuntu containers"
},
"flakeHistory": {
"status": "not-started",
- "evidence": "The harness is new; soak history is not yet available."
+ "evidence": "Audit3925: Historical prior-source evidence only; reduced selector has no fresh execution evidence. The harness is new; soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
- "evidence": "The same harness run against a stock release AppImage failed four of eight cases: nofuse-userns-bundled-version at status 93, and all three direct-binary cases crashed at status 133 (SIGTRAP, the uv_close abort of #13719 and #14229). The stack-tip AppImage passed all eight. Corroborated at artifact level: the stack-tip runtime is a static-pie ELF with no PT_INTERP, the stock runtime is dynamically linked. Caveat: the two skills cases previously asserted a substring that the harness's own RESULT line contained, so they passed independently of command output; both now assert the rendered help header, and the green runs above predate that change."
+ "evidence": "Audit3925: Historical prior-source evidence only; reduced selector has no fresh execution evidence. The same harness run against a stock release AppImage failed four of eight cases: nofuse-userns-bundled-version at status 93, and all three direct-binary cases crashed at status 133 (SIGTRAP, the uv_close abort of #13719 and #14229). The stack-tip AppImage passed all eight. Corroborated at artifact level: the stack-tip runtime is a static-pie ELF with no PT_INTERP, the stock runtime is dynamically linked. Caveat: the two skills cases previously asserted a substring that the harness's own RESULT line contained, so they passed independently of command output; both now assert the rendered help header, and the green runs above predate that change."
},
"performanceBudget": {
"required": false,
@@ -13316,6 +13348,7 @@
"Re-run red/green against a stock AppImage after any change to the launcher entrypoint."
],
"knownGaps": [
+ "Audit3925: Reduce eight hostile CLI examples to three: bundled status with no runtime, direct-binary skills text dispatch, and stale-display GUI diagnosis. Remove extra bundled help/version/skills/worktree and absent-display GUI examples; accept loss of packaged version equality and their exact output alarms without equivalent replacement. The reduced selector has no fresh execution evidence. Original dated receipt objects are preserved in evidenceRuns as historical records only; no fresh native or reduced-selector validation is claimed. Skills matcher limitations remain in redGreenEvidence.",
"The preconditions depend on moby's default seccomp profile denying unshare(CLONE_NEWUSER) and on /dev/fuse being absent. A runner with a relaxed profile or a mounted /dev/fuse trips PRECONDITION_FAILED and fails the job rather than skipping.",
"x64 only: PR CI builds only --x64, so the arm64 launcher path is unexercised.",
"The harness covers CLI entrypoints only; it does not exercise a full desktop session."
@@ -14064,10 +14097,10 @@
"providers": ["paired-runtime"],
"coveredPlatforms": ["linux"],
"coveredProviders": ["paired-runtime"],
- "coverageNotes": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1579 removes workflow/manifest/regex/private binary-header and diagnostic metric inventories, fixture selectors, injected forwarding/platform/signature/process examples, unproven overlap and internal churn counters without equivalent replacement coverage. Retains actual Git trust/diffs; filesystem hash/ELF-region/native discovery; child CLI module repair; compiler/lock/publication/rollback and synthetic Electron install/cache ownership; executable shell quoting/exit; controlled notary/timer cleanup; local patched extractor file/AST freshness; real Chromium/WebKit CSP/sandbox/HTTPS image/referrer/link/preservation controls under parsed Android headers. Five unchanged setup-pnpm/VM request-cleanup definitions reviewed and not rerun. GitHub, installer/archive, OS metric, client, native delegate, compressor, builder and Apple boundaries injected or absent where recorded. No actual native PTY, shipped full/native app, real Actions/cache/npm signature authority, downloaded Electron archive, real objdump/linker/native CLI/AppImage, signing/NSIS/notary/upload/updater or live freeze proof. Historical scope before this audit: Published Linux 1.4.188 desktop against current source in both directions; scheduled weekly and manually runnable. No required PR check.",
+ "coverageNotes": "Audit3788 retires10 authored/11 expanded cases across six changed drivers, including the entire screencast pending-frame-retry and usage-source-cache-streaming suites. Deliberate losses are false-refused last-frame retry/once-only delivery, ordinary stable-pane reattachment, cleared-chat Dispatch completion, terminal-declared chat-caller refusal, at-rest worker liveness projection, nested depth/cap policy, small unsigned6/sealed7 plain-format and verified-bit examples, generic malformed-ISIZE footer refusal examples, and synthetic10k/100k chunk-size/work-count budgets in gzip and general cache I/O. These include real state/disk/RPC outcomes consciously retired for marginal value; retained E2EE-backlog, receipt/custody/uncertain-ack, integrity/migration and staging-cleanup cases are not equivalent replacements. The footer test did not prove early rejection or bounded allocation; staging cleanup did not seed unrelated files. No replacement or fresh native/remote/performance execution is claimed. Earlier raw selectors and dated receipts remain historical. Audit3779 retires17 authored/17 expanded registrations across six changed drivers, including the entire shared-Codex-home and prompt-telemetry suites. Accepted losses are shared-home wrapper noninterference/opt-out preservation, mocked metric count/provenance filters, SSH activity labeling/clearing and handover idle timing, VM ownership/capability/status projections and asleep-worktree refusal, a link-only external conversation replay sample, and two narrow input-credit noninterference/expiry examples. Retain the direct exact-tab/single-use input-credit case. These bounded real disk/state/routing alarms are intentionally retired for marginal value without equivalent replacement or fresh execution claims; earlier receipts remain historical. Audit3772 retires18 authored/27 expanded cases, including whole Codex service opt-out, RPC capability-parser, creator-provenance, short-ciphertext and readiness-null suites. Accepted losses include service ledger/symlink/mode cleanup, user TOML substring preservation, old-hash cleanup, description pass-through, malformed-file/pending-hash examples, coordinator write/probe counts, capability array bounds, positive creator projections, early short-payload refusal and readiness helper null shape. Two redundant Codex exit-cause rows are also retired; Pi shares their direct-idle path only in this empty-output immediate-exit fixture, and future agent-config drift coverage is lost. Real bounded filesystem/parser/runtime alarms are deliberately retired for marginal value; no equivalent replacements or fresh execution are claimed. Earlier receipts retain their historical scope. Audits3754/3755 intentionally remove9 authored/9 finite registrations: the entire one-case usage-source-cache-streaming.test.ts driver and8 cases from the surviving computer-action-validation.test.ts driver. This gate retains an unfiltered root Vitest command; UNIT_INCLUDE admits both source paths. Accepted losses are the real encoder output chunk-size/work-count alarm on repetitive10k/100k ownership payloads through a mocked durable sink, plus CLI diagnostic precedence, fractional window-id rejection, action-call-site window-target exclusivity, plain-text click-count recovery copy, incomplete click/drag targeting, mouse/modifier/direction allowlist samples and inline/stdin text exclusivity. These CLI cases exercise real argument/handler validation before mocked runtime calls; they are deliberately retired for marginal value, not declared tautologies. Retained cache I/O and CLI cases are not equivalent replacements for these alarms. Existing historical raw receipts remain unchanged and do not validate the deleted or reduced drivers. No fresh execution claim is made. Audits3758/3763 intentionally remove9 authored/11 finite registrations from6 changed drivers, including the entire pane-title-notification, window-linear-notices and worktree-card-lifecycle-effects suites. This gate retains an unfiltered root Vitest command admitting these paths. Accepted losses are same-account linked-row success-notice fanout, sidebar-switch channel forwarding, Linear-only notification forwarding/non-terminal-consumer selection/closed-window detach, destroyed-window refusal and first-send-failure suspension through the pane-title adapter, the100-card synthetic focus/poll absence sample, stored-source local folder badge refresh, unobserved-row badge refusal, and immediate reposChanged lineage invalidation. These exercise real owners with controlled ports; they are retired for marginal value, without equivalent replacement claims. The no-badge-work fixture does not seed its title-promised collection-only cache. Preserved historical receipts do not validate deleted or reduced drivers; no fresh execution is claimed. Audit3759 retires the entire one-case Tailwind compiler/scanner smoke. Accept loss of the direct CSS production/test/spec source-exclusion and rescan alarm; no replacement or current execution is claimed. Audit3752 independently approves audit3749: retire five authored/five finite watcher-process registrations, retaining18 raw-exact registrations. Accept loss of healthy shared-pool joint recovery, last-pending-failure idle retirement/respawn, late VITEST fallback release, missing-entry fail-closed selection and independent-supervisor fuse locality alarms. These are real bounded host-policy alarms intentionally retired for low marginal value; no equivalent replacement is asserted. Remaining driver selections exercise controlled FakeChild supervisor lifecycle, cancellation, physical-exit fencing, recovery and fuse behavior. This source review supplies no fresh native/process/platform/remote/SSH execution; historical receipts retain original source and selector scopes. Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered root Vitest command. Current UNIT_INCLUDE admits the partial push-service, metadata-dialog and two config/scripts browser drivers:10 authored/16 finite removals. Accepted losses: actual retry30s/60s progression and register bucket/refill wiring, explicit seven-day lease arithmetic (its notification lacked seq/epoch and never reached send), equal-name edit latch/save payload, real image/font/meta-refresh/form/popup browser refusal controls, and broad rich-markdown bridge/command/edit-select smoke. Actual production state, callback routing and browser enforcement run in these cases; these alarms are deliberately retired on marginal value. All drivers and selectors survive. Existing unrelated receipts remain historical evidence for their unchanged selectors, not proof of the reduced cases. Audit3732 removes 2 authored/3 finite registrations from two partial suites: nominal custom/Kimi local naming success and deferred context usage row presentation. Real losses: custom/Kimi successful extraction through conversation-name sanitization and agentLabel composition; separate ordered counted/deferred lists and exact percentage/token formatting. No replacement or equivalent coverage claimed. Retain 11 authored/13 finite raw-exact registrations for bounded naming instruction/refusal/cancellation, menu dismissal focus ownership and hover/composer Escape/timer cleanup. Source-only bounded value review, no runtime/CI/native/remote/mobile/folder workspace or global completion credit. Previous account (preserved verbatim): Audit3733 removes2authored/2finite terminal input checks: fixed custom-cap error/secret fixture and three-emoji cap5refusal whose6UTF16units already trip length fast guard (no UTF8-dependent boundary). Accept exact non-disclosure/oversized-refusal alarm losses; no replacement/equivalence claim. Retain13/13scalar/pending input, OSC state and cron DST/cadence outcomes after bounded material reads. Source-only zero runtime/novelty credit; original historical reasons preserved. Previous account (preserved verbatim): Audit3729 removes1authored/3finite by deleting whole CLI runtime pairing advisory-close suite. Accept losing post-real-close injected EIO preservation of native/script/unreadable pairing, env identity/preservation and exact close/release assertions; no actual failed-close leak or replacement coverage claimed. Two retained URL grammar/identity suites11authored16finite raw unchanged. Bounded source/owner/caller value review, zero novelty/runtime credit; other seven3724deferred closures remain. Historical receipts preserve original limits. Previous account (preserved verbatim): Audit3724 removes3authored/3finite checks by deleting two whole suites: TUI clear burst-size singleton and terminal-file-URL target two-case wrapper suite. Deliberate losses: derived widest burst<64byte alarm, UNC authority+line-column anchor composition, and malformed-percent null refusal. Real production algorithms execute in those tests; no mocked-output tautology, equivalent replacement, actual Claude/file-navigation delivery or universal safety-irrelevance claim. TUI58byte bound and URI examples have low marginal value as standalone suites. Actual1262/1264/1742KEEP superseded explicitly. Remaining14drivers83authored136finite raw unchanged. Bounded source-only review; ten closures deferred, four bounded keep judgments repeated with zero new semantic-frontier credit. No runtime/CI/native/remote/mobile/folder/global completion claim; historical receipts retain original scope. Previous account (preserved verbatim): Audit3723 removes 4 authored/4 finite registrations in two whole suites: keybinding cache freeze/token spellings and host-dependent Orca command name examples. Real losses include returned-object freeze, repeated Mod+P key, Space/PageDown/NumpadSubtract mapping, unknown/empty/prototype-token rejection, and headless Linux versus Windows-server/WSL command choice. No equivalent or replacement coverage claimed. Retain 12 authored/21 finite raw-exact registrations exercising generated scaffold validation, artifact failures, shipped editor/hook/worker/panel tests, actual generated typing compilation, independent CLI root routing and intent-name precedence. Source-only bounded audit; no runtime, CI, native, remote, mobile, folder workspace or global completion credit. Previous account (preserved verbatim): Audit3720 removes17authored/23finite checks: whole main catalog-date adapter2 and shared date-helper7, seven renderer nominal ranking/cap/no-date/composition cases, and one browser registration expanding to seven forced-container/DOM-child boundary cases. Deliberate real losses: community oldest-date UTC forwarding, official/undated omission, date sorting/window/invalid/future/skew/clamp and default/override cap; nominal ranking/cap and combined Featured/Newly-added outputs; real CSS459/460,719/720,1055/1056breakpoint, five-card partial-row and720px two-card first-row alarms. Browser cases really measure rendered geometry but force width/remove DOM children; no fake-pixel or tautology rationale. No replacement/equivalent coverage claimed. Retain14authored/19finite raw-exact registrations across4drivers: adversarial featured category/order/tie and installability, date order/window selection, actual PluginManager failure/escaping/duplicate-card suppression, real browser viewport/odd-count geometry/phone catalog visibility, syntax ingress/depth/include/printability and68dlong-bracket auto-close fill-in. No tests/browser/native/UI/provider/remote/mobile/folder/CI/global execution or completion credit. Previous account (preserved verbatim): Audit3717 removes6 authored/6finite checks in two whole thin-adapter/presentation suites. Deliberate real losses: ordinary recipe repository-URL withholding and provisioned-root credential scrubbing/forwarding; repository label lockstep suffix expansion, host-scoped map identity/collision grouping, Windows crosshost paths and WSL distro suffixes. Actual provision options, label/sort consumers and host/scrubber delegates inspected; no replacement/equivalence claim. Retain40 authored/84finite registrations raw exact in14 drivers with bounded owner/context review. Prior KEEP superseded for removed suites; no runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous account (preserved verbatim): Audit3714 removes8 authored/39finite checks: whole CLI selector-recovery, task display-text and ANSI grammar suites plus two name joiner/blank tables. Deliberate real losses: selector flag/value/identity and mutation recovery merge/serialization; exact task suffix, transcript fallback, input immutability, cache reuse and edited blocks; independent failed-escape/resumption and OSC/DCS/BEL/ST/C1/nested/unfinished stripping outputs; meaningful-language joiner preservation and invisible/blank-name rejection. These are real bounded alarms, removed as narrow supplied-error examples, helper/token inventories and repeated internal-work fixtures. Prior2936,1195/1196,1214/1215 and1082 KEEP superseded; no replacement or equivalent coverage claimed. Keep9authored/9finite raw-exact registrations in5surviving drivers: screenshot export/failure filesystem behavior, CLI local tree query, event-local reply provenance, vault role-sensitive content and four hostile/UTF16/dangling/tag-name regressions. No native/UI/provider/remote/mobile/folder/runtime/CI/global completion credit. Previous account (preserved verbatim): Audit3711 retires2authored/4finite cases by deleting whole clipboard-image-temp-file signature-to-name inventory (HEIC/TIFF/unrecognised bytes) and workspace-last-active switch-on supplied visit/reason singleton, plus its now-orphan test fixture. This intentionally loses real generated-filename suffix/extensionless alarms and real newer-visit archived7day versus inactive30day filtering/older-visit identity alarms. Filesystem writing and production reason pruning really execute; no equivalent replacement or universal absence of safety relevance is claimed. The clipboard test does not inspect written bytes, native delivery or decode; the visit test supplies candidate/timestamps and does not exercise persisted visit routing or actual removal.20authored/20finite cases remain unchanged across4bounded Git/sidecar/removal drivers. No new runner/test/module evaluation or runtime result; historical notes and receipts remain historical. Previous account (preserved verbatim): Audit3707 removes10 authored/11finite checks: three whole renderer adapter/assembled-stage suites and two native projection cases. Deliberate losses: plugin URL/ref/default-version/local-path and unsafe credential refusal forwarding; real Task hook/store A→B→A late-save/list/count fences, owner disappearance, legacy-host convergence, query/history/eviction and same-ID host history; native child append ordered-ID/replacement and compound fallback/order/optimistic-admission/child-turn/duplicate/shrink/revision alarms. These are real bounded alarms; removal follows thin adapter, manually assembled Task pipeline and repetitive fixture value judgment, with no replacement or equivalent coverage claim. Prior1179/1182,1220/1221 and1885 KEEP superseded as applicable. Keep36 authored/38finite registrations raw exact across13 surviving drivers. No runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous account (preserved verbatim): Audit3706 removes7authored/7potential cases from3renderer sources: whole usage-label3case and130000-distinct-day usage-overview singleton suites, plus3SSH grouping/ordinary-range examples. Retain11authored/11potential cases across6drivers in this bounded selection; no equivalent replacement or fresh runtime result. Existing bare root-unit commands admit this selection statically; prior command/receipt strings remain historical. Audit3706 intentionally retires first/second-order usage-group label collision alarms; equal50%-weekly bucket versus derived-weekly selection identity and Gemini wk label alarm;130000distinct-day aggregation no-spread-crash/max/intensity alarm; legacy absent-source SSH grouping and ordinary reverse-select/selected-target deselect range alarms. Actual label ambiguity and pathological-input crash are accepted losses. Distinct-day fixture spans~356years; no hard producer/date bound is claimed. Retained filtered-anchor/grouped-order guards do not replace removed deselection/reverse-range/legacy-group coverage. No native SSH, mounted renderer, live provider, remote/folder/mobile end-to-end or current runtime pass was obtained. Previous account (preserved verbatim): Audit3699 removes4 authored/4finite checks, including one whole xterm copy-policy suite and one root/group CLI help case. Deliberate losses: direct copy-chord admission for platform, selection, Kitty mode, defaultPrevented, logical/physical key and key phase; command-group disclosure and group help routing including claude-teams early return without RuntimeClient construction. These are real bounded policy/wiring alarms; no replacement or equivalent coverage claimed. Retain14 authored/19finite raw-exact registrations across6 drivers: unsafe CLI refusal, Claude model event carry and disk reconstruction/OSC-first case, attachment ownership/upload lifetime and mixed BMP file-reference/PNG-chip delivery, actual SQLite authority/admission/mutation, and Electron geometry/hit-testing. No runtime, CI, native-key delivery, external provider, mobile, remote, folder or global completion credit. Previous account (preserved verbatim): Audit3692 removes5 authored/5finite marginal Codex checks: unrelated login URL without notice; ordinary per-account launch resource/config materialization; no-retained-pane skip; preservation of a previously owed full scan through actual preparation and pending-marker update (no actual history scan/settlement); ordinary later-config refresh. Accept these exact branch/wiring alarms as deliberate losses without replacement. Retain32 authored/34finite raw callbacks/registrations/table bytes exact across14suites, including credential/admission refusal, grace/reset readiness, filesystem ownership, commit-dependent queue state, streaming/host trust, path canonicalization and private-state preservation. All14whole suites challenged without keeper quota; no whole deletion warranted on current concrete signals. No runtime/CI/native WSL/remote/mobile/folder/global completion credit Previous account (preserved verbatim): Audit3691 removes two complete runtime-home routing singleton suites (2 authored/2 finite): catalog wrapper mirror login-copy and passive transcript-lookup filesystem noncreation. Exact accepted losses are recorded in knownGaps; no replacement or equivalent coverage claimed. Audit3691: no dedicated alarm remains in the deleted sources for post-launch system login import through prepareHostCodexHomeForReadOnlyAppServer, or for repeated missing-transcript lookups leaving removed Codex account/runtime directories absent and userData entries unchanged. Ownership-marker read avoidance was never independently measured. No real catalog probe, provider, native Windows or crash was validated by those fixtures. Previous account (preserved verbatim): Audit3686 current Claude profile/account review removes5 authored/5 finite cases: whole structured-auth diagnostic-label suite3 and Windows-only command suite1 whose advertised cache alarm is ineffective because cache lifetime is per invocation; remove duplicate setup namespace-link refusal1 at wrapper layer. All5 exact historical KEEP are consciously superseded. Retain49 authored/50 finite unchanged, including filesystem privacy/recovery, route identity and concurrency, built worker/helper, legacy WSL alias compatibility and sign-in handoff. These are deliberate coverage losses without replacement. No runtime/CI/native WSL/macOS Keychain, remote/mobile/folder or global completion credit. Explicit accepted real losses: unknown-account host fallback and mixed-version/WSL-only structured auth diagnostic labels; Windows-only sentinel ENOENT-to-friendly-error translation plus fresh-call successful dispatch smoke; setup catch-to-refused wrapper and no-write outcome for a namespace symlink. The command case does not discriminate removal of its per-invocation noncache guard; it still supplies the error-translation alarm, which is intentionally retired. No replacement/equivalence promise. Previous account (preserved verbatim): Audit3680 removes eleven authored/eleven finite unit cases across four files, including entire launch setup row projection, structured legacy-model metadata, and legacy classifier suites. Accept loss of exact row partition/start selection, Codex supersession/default/unknown and Claude alias/suffix folding examples, other-agent exemption, getter/cache read budgets, same-array per-agent cache isolation, replaced-catalog metadata, and tracked-only model exclusion from structured and PTY legacy inventories. These are real narrow policy/metadata alarms intentionally retired without equivalent replacements. Retain real menu collapse/reopen in dropdown/select, AI picker cancel/accept and stale-effort filing, IME carry/gesture/frame transitions, and typed-flip versus held-dispatch fencing. No production or shared fixtures change. No dead timing entry exists for the three deleted drivers; retained timing keys stay unchanged. Static source-value review only; no project import, test runner, native/app execution or runtime validation established. Earlier receipts retain historical scope. Previous account (preserved verbatim): Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit. Previous account (preserved verbatim): Audit3672 renewed by3676 removes four authored/four finite cases from federation-output.test.ts: nominal show/read routing and terminal-fallback projection; initial archive-table SELECT failure returning retained/no-close; simulated old-peer read/fleet/refusal and method inventory; and absent archive-release capability refusing release. These actual compatibility/guard alarms are intentionally lost without equivalent replacement; the dropped-table case never reaches capture or commit. Current selected frontier9 becomes5: retain actual temporary transcript parsing/path omission, current no-transcript release/unavailable-output/restart/replay regression, and three home deadline/stop nonmutation cases. Prior held-capture case was already removed upstream and receives no new removal credit; prior redacted snapshot archive behavior was rewritten upstream and is not claimed retained here. The surviving driver timing entry stays. Static review/private composition only; no actual peer/network/native/platform or fresh runtime validation. Previous account (preserved verbatim): Audit3671 removes14 authored/32 finite root-unit cases, including the whole WSL move-handler refusal suite, WSL preload object-presence suite and internal gate spelling truth table. Also retire the weak withheld-command non-array shape assertion, static serve-only Add/capability/mock-remove example, grammar scope equality and basic configuration/payload schema roundtrips. Genuine wrong-window/malformed-request/gate-before-work, exact gate spellings/platform/argv precedence, static serve-only routing, declaration mismatch and empty grammar/pair admission alarms are consciously lost without replacement; prior KEEP decisions are reconsidered. Seven unchanged authored/finite root-unit cases retain real image/provider/line budgets, live policy transition/capability broadcast, grammar resource/reference traversal and strict-versus-tolerant literal salvage. Source-value evidence only; no runner/compiler/build/app/native/provider/remote/mobile/folder validation or historical fault claim. Independently remove one authored/finite Playwright closed-gate app-boot inventory: accept loss of real renderer/preload/main refusal composition, saved-host row and Add/Move hiding/Remove visibility alarms. Keep the unchanged scripted-move rendered dialog lifecycle/reload case. It runs no real WSL migration, host connection, file copy or automation restoration. No selector or Playwright participation cleanup is required because the spec remains. Previous account (preserved verbatim): Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence. Audit3634: Remove five authored/five finite cases, including the complete structured chat terminal-refusal, terminal-plus-agent worker-start validation, and canonical Git common-directory parser suites. Also remove the gh free-text -R argument projection case. Consciously supersede prior KEEP decisions and accept chat-versus-stale redirect classification, real RPC refusal-before-SQLite-Dispatch, old-Git echoed-option relative-path parsing, WSL execution-space resolution, and free-text preservation/bare-repo qualification alarms. These are genuine narrow alarms, intentionally retired without equivalent replacements. Retain real Git stdin/EOF delivery, bound-account host admission, naming environment/account precedence, upload iterator cancellation and remote path confinement. Shared fixtures and production code remain. Remove only the dead canonical-repo-key timing entry. Static source-value evidence only; all prior evidence retains historical scope. Audit3636: Remove the entire maintenance opportunity internal-count driver (one authored/two finite cases), the mocked remote worker start-card argument case (one/one), and the follow-up heading mapping table (one/two). Root-unit discovery loses three authored/five finite cases. Independently remove four Python native screenshot methods/five statically enumerated subTest scenarios: grim argv/stub payload, failure-code mapping, X11 mocked capture payload, and capability flags. The Python lane is verify:computer-native and is not root Vitest. Accept loss of exact native command/projection and exception/capability alarms, ready-only card publication arguments/agent forwarding, and serialized follow-up heading mapping; no equivalent replacement is claimed. Retain actual ownership/mail/queue/reopen transitions, remote lost-response fencing and first-result settlement, filesystem/maintenance admission and successor progress, wrong-region screenshot refusal and Sway geometry. The whole-deleted new driver has no timing key; this component requires no timing cleanup. No production changes. Static source-value review only; no project import, runner, app, native desktop or runtime validation established. All prior evidence retains historical scope. Audit3629 removes two singleton parser suites: WSL Claude plugin metadata out-of-range index rejection and Git checkout unlink-warning path extraction. Their real range-refusal and quoted-path extraction alarms are intentionally lost without replacement; no WSL execution, checkout recovery or equivalent remaining coverage is claimed. Audit3630 removes the sole orphan automation availability test (1 authored/1 finite). Its real policy kind, orphan precondition, delete/toggle enablement and run/edit refusal alarms are intentionally lost. The test did not dispatch an action, enforce a server generation fence or observe a remote mutation. No equivalent replacement, actual renderer/transport execution or new platform/provider evidence is claimed. Previous account (preserved verbatim): Audit3628: remove the entire one-authored/one-finite RepositoryRemoveProjectSection happy-dom suite. Accept losing the local zero-to-one-terminal stale-count revalidation alarm: first confirmation defers the removal callback and second confirmation invokes it after the count snapshot updates. The test never asserts updated warning text/count, actual terminal creation or removal/PTY teardown, host/scope routing, cancellation or folder/mobile behavior. No equivalent replacement or end-to-end warning-before-teardown proof asserted. Static evidence only; historical receipts retain original scope. Audit3624: Remove one authored/five finite positive Gemini identity table from the Claude/Gemini title collision driver. The real normalization, legacy label and explicit title evidence owners execute, so ordinary Gemini marker/name/wrapper recognition and normalized-label composition alarms are consciously retired without equivalent replacement; these five supplied title-to-literal identity examples have low marginal value. Preserve the six-row Claude task-text collision oracle, whose unrelated CLI mentions must not rebrand or destructively normalize titles. The other audited drivers preserve real permission-mode session transitions, prompt secret/fence/bounds defenses, JSON-to-Ask option/preview preservation, and optional GitLab failure summary/trace composition. Root-unit discovery loses one authored/five finite cases; no whole driver or timing key is removed. No actual terminal stream, UI routing, application/native or runtime execution established; all prior evidence retains historical scope. Audit3618: Remove three authored/three finite browser reload cases, including the complete renderer reload-actions suite. Agent bridge fake did-fail-load plus permanently supplied manager error projects description/code into a rejection. Renderer seeded empty metadata projects a saved URL into plain webview src; its earlier not-ready case projects a live-id/throwing fake reload into absence of a loading patch. Real queue/wait/error/cache/classifier/hook code executes, but these narrow supplied-state and exception-to-callback wirings have low marginal value; no rerender, lifecycle, actual cache generation/retirement or guest commit is asserted. Explicitly supersede audit1822 not-ready KEEP and preliminary3617 cross-module retain opinion, accepting offline-reload failure reporting, empty guest to saved URL routing, native-reload bypass and premature-loading/stranded-state alarms without replacement. Retain distinct main cancellation queue progression and absent queued side-effect dispatch. Root-unit discovery loses three/three. No Electron guest, network failure, restored navigation/commit, app/native focus or runtime execution established; earlier evidence retains its historical scope. Audit3614: Remove thirty-one authored/thirty-nine finite potential cases across CLI format and argument drivers, including three whole suites: search-result/status sanitation sites, Linear issue/list/warning sanitation sites, and quote-stripped JSON diagnostic secret non-echo. Those real formatter/guard transformations execute on supplied strings; intentionally retire their field-specific CSI/OSC/C1/newline/bell and diagnostic secrecy alarms as low-value caller/output inventories, without replacement. Also retire twenty-one search registrations/twenty-four finite cases covering minimal positional request/default omission, exhaustive all-flags request projection, nominal named query/index routes, repeated syntax/agent examples, enum/agent/path-count/timestamp/numeric/cursor admission examples, unknown/browser flag examples and postcommand last-wins projections; retire one parser sentinel-only case. Keep actual ambiguity, conflicting index request, precommand/crosscommand scoping, variadic reference parsing and missing-repeatable-value controls, without claiming equivalent coverage. Root-unit discovery loses all twenty-nine/thirty-seven. No CLI/RPC/terminal/PowerShell/host/schema/runtime execution is established by this source-only audit; earlier evidence retains its historical scope. Audit3613: remove six authored/six finite callbacks, including whole reviewer-display oversize-input and explorer-root record-filter suites, plus plugin family-emoji/invisible-only-name and pool legacy-name/urgent-countdown samples. Accept losing oversized-input empty-result/no-split, malformed-record/prototype-sensitive-key/nonstring filtering, exact ZWJ family preservation, invisible-only name refusal, no-group old-host full-name preservation, and80/79/null-reset countdown composition alarms. No equivalent replacement asserted. Retained strict/runtime sanitization, SVG parser, mobile focus recovery and collision/tie cases have different scopes. Static evidence only; historical receipts retain original scope. Audit3609: Remove the complete pnpm CLI invocation literal-selection suite (eleven authored/nineteen finite potential cases), with no replacement claimed. Root-unit discovery loses JavaScript-versus-native command selection, npm/npx executable rejection, Windows cmd/bat casing and shell selection, non-Windows cmd behavior, native PNPM_HOME flat/bin preference, explicit-path priority, relative-home rejection, missing-native fallback and non-Windows home-probe refusal alarms. The suite called the real resolver with independently expected objects, but exercised no pnpm/node/cmd process, installed native executable or real filesystem probe. Earlier KEEP decisions are consciously superseded by accepting these narrow branch and probe-inventory alarms as low value. Real symlink entry, Git signing isolation, Bun filesystem/Node child normalization and compiler scheduling/continuation tests remain distinct tests, not equivalent coverage. No runner, compiler, app, platform or remote execution was performed in this source-only audit. Earlier evidence retains its historical scope. Audit3608: remove five authored/five finite callbacks, including whole owner-slug and remote favicon URL suites and two repository-label projections. Lose five owner acceptance samples, eleven negative owner samples plus nonstring refusal, six host-local icon refusal samples, legacy-SSH same-path label-map cardinality, and explicit runtime ownership over stale legacy metadata at label level. These are accepted narrow grammar/presentation alarms with no equivalent replacement claimed. Retained binary parser, React recovery and label grouping/platform cases do not replace these losses. Static evidence only; historical receipts retain their original scope. Audit3606 adopts the enhanced3604/3605 icon cuts: nine authored/nine finite cases removed, including the whole tray-attention-icon suite. Retires the no-encoder oversized-upload null sample, missing-ID/request-order sample, encoder-null PNG-prefix fallback, SVG/404 rejection samples, transparent amber-dot placement and half-alpha white-tint sample, exact small fetched-byte passthrough, host-qualified image-key inventory and constant-encoder large-upload projection. These specific admission, formatting and bitmap alarms are intentionally lost without equivalent replacements. Retained queue/cache, bounded fetch and Dock lifecycle checks do not establish actual raster decoding, native image conversion or rendered appearance. Historical receipts below are preserved evidence for earlier test sets, not fresh validation of this reduced selection. Audit3601 scope: remove the whole custom-sound happy-path IPC suite and one custom-label/multiline notification formatting example (2 authored/2 finite). Intentionally lose configured .ogg selection, exact byte/MIME success wiring, successful dispatch for the formatting fixture, custom-label whitespace/title normalization and assistant-body whitespace/180-character-cap alarms. Retain prompt-exclusion, persisted qualified dismissal/restart, theme ownership/restore and Ghostty precedence/collision cases; none replaces the retired sound/formatting alarms. No actual playback, native delivery, phone/network, cross-platform or new runtime evidence is claimed; historical execution keeps its original scope. Audit3598: Remove seven authored/nine finite literal-table potential test registrations across workflow routing, Claude cold-start and real-zsh preexec drivers. Root-unit discovery loses six authored/six finite: three test-local workflow parser fixtures, the five-positive/three-negative explicit command-paint route inventory, a boot-banner-before-composer sample and an already-painted bare-title positive sample. The separately selected shell_contracts live-shell driver loses one authored/three finite raw-capture paint-only cases across three hook configurations; its real-wrapper launch-order, four rechunkings (twelve finite) and runtime-wait replay remain, without claiming equivalent replacement. Intentionally lose those parser, exact routing-list, banner, post-paint subscription and native-read-boundary paint alarms. Retained workflow/UNIT_EXCLUDE/classifier cross-source routing checks and readiness-race-to-writer timing are distinct bounded alarms. No runner, real shell, PTY, app, native focus, remote delivery, cross-platform execution or full-feature correctness is established by this source-only audit. Earlier evidence retains its historical scope. Audit3597 scope: remove two renderer-hang-capture examples (2 authored/2 finite): an invalid repeated-token oversized reducer fixture and a shorter unanswered-request fixture. Intentionally lose the direct truncated flag/sanitized frame fixture and request-pending status/zero-sample alarms. Retain window-death/stale-result exclusion, generation reconciliation, and baseline-publication cancellation lifecycles; they are not equivalent bound, redaction or pending-status replacements. Historical execution retains its original source scope; no new runtime evidence is claimed. Audit3591: Retire the whole one-case background journal-producer attribution suite and the fabricated malformed-details-block case (two authored/two finite cases). Intentionally lose the fixed own-task versus output/foreign-task attribution examples across flat/message row shapes, missing-root classification, and direct unbalanced/detailsish fabricated-block rejection alarms. Retained parser sibling/depth and editor navigation tests do not replace these alarms. No equivalent replacement or fresh runtime, transport, persistence, native focus or rendered UI validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3592: Retire the whole three-case shared agent smart-key resolver suite, explicitly superseding its Audit3238/3237 keep decisions. Intentionally lose literal permission-versus-question classification, longest-question digit selection, Codex async-question opener/digit/Enter/skip mapping, and unsupported-agent/state/prompt refusal examples. These were real parser/selection and literal-byte alarms; they did not exercise terminal delivery or timing. No equivalent replacement or fresh runtime, native TUI, mobile, remote or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3587/3588: Retire six authored/fourteen finite cases, including the whole WSL stopped-notice and connecting-status selector suites. Intentionally lose direct WSL retry connection field/target/ready-epoch/null-guard examples, connecting/reconnecting distro and absent-state selector samples, and stopped/connecting notice text/button/data-attribute examples. Retained host-ready retry and content-loader/reload lifecycles do not replace these alarms. No equivalent replacement or fresh runtime, native WSL, remote, rendered UI or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed. Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions. Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1579 removes workflow/manifest/regex/private binary-header and diagnostic metric inventories, fixture selectors, injected forwarding/platform/signature/process examples, unproven overlap and internal churn counters without equivalent replacement coverage. Retains actual Git trust/diffs; filesystem hash/ELF-region/native discovery; child CLI module repair; compiler/lock/publication/rollback and synthetic Electron install/cache ownership; executable shell quoting/exit; controlled notary/timer cleanup; local patched extractor file/AST freshness; real Chromium/WebKit CSP/sandbox/HTTPS image/referrer/link/preservation controls under parsed Android headers. Five unchanged setup-pnpm/VM request-cleanup definitions reviewed and not rerun. GitHub, installer/archive, OS metric, client, native delegate, compressor, builder and Apple boundaries injected or absent where recorded. No actual native PTY, shipped full/native app, real Actions/cache/npm signature authority, downloaded Electron archive, real objdump/linker/native CLI/AppImage, signing/NSIS/notary/upload/updater or live freeze proof. Historical scope before this audit: Published Linux 1.4.188 desktop against current source in both directions; scheduled weekly and manually runnable. No required PR check.",
"motivatingLinks": ["https://github.com/stablyai/orca/actions/runs/34069063016"],
"invariant": "A paired client and host without client-hosted browser capabilities retain server-hosted browser placement across supported version skew.",
- "oracle": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Require both existing named browser placement scenarios to pass three times with one attempt, zero skips, zero failures, and no report errors.",
+ "oracle": "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed. Historical prior account (preserved verbatim): Audit3814 deliberately retires60 authored/60 finite cases:53runtime compatibility cases,4native XCTest methods and3Python clipboard methods, including the entire StableElementIndexes suite. Clipboard cuts retire the one-over-cap sample, incoming-offer destruction trace and sequential20-copy replay; actual wire, FD/pipe, startup and Xvfb/GTK boundaries remain without equivalent replacement claims. Accepted losses include narrow terminal-send payload/provider projections, legacy and direct no-op/error permutations, timing/work-count examples, private state/title/activity projections and fixture-driven readiness examples, individually enumerated below. These include real bounded production alarms consciously retired for marginal value; retained failed writes, duplicate submission, stale capture, transcript/ring and allocation fences are not equivalent replacements. No fresh native/remote/browser execution or complete transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3806 deliberately retires40 authored/40 finite runtime compatibility cases, including the terminal-side-effect-facts-part03 headless-snapshots-part02 and agent-status-and-waits-part03 fragments, plus20 scalar Swift precondition sites. Lost runtime alarms include status/title/attention projection examples, simple renderer/headless frame restoration and status waiting outcomes detailed in the accepted-loss ledger. Swift cuts retire duplicate generation-map/schema/navigation/bridge and notification-wrapper assertions; no standalone native program is deleted. These include real bounded production alarms consciously retired for marginal value. Retained races, pending writes/reflow, namespace and waiter ownership are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3798 deliberately retires21 authored/24 finite compatibility cases, including the entire SSH-worktree-lifecycle and repository-project-operations fragments. Accepted losses include navigation-only settings acknowledgement, browser session cleanup and host preservation projections, window positive/policy-state examples, terminal recovery/reload and no-incarnation remint examples, terminal listing compatibility/malformed IDs, directory browse/sort/Windows path smoke, SSH create refusal/manual lineage, recursive parent-folder creation and fork/origin/avatar/icon projections. Real bounded production alarms are consciously retired for marginal value; retained authority races, cleanup/clone ownership, pending waiters, nested-folder and scan invalidation cases are not equivalent replacements. No fresh native/remote/browser execution or full transitive closure is claimed. Earlier dated receipts and raw selectors remain historical accounts of prior callback sets. Audit3788 retires10 authored/11 expanded cases across six changed drivers, including the entire screencast pending-frame-retry and usage-source-cache-streaming suites. Deliberate losses are false-refused last-frame retry/once-only delivery, ordinary stable-pane reattachment, cleared-chat Dispatch completion, terminal-declared chat-caller refusal, at-rest worker liveness projection, nested depth/cap policy, small unsigned6/sealed7 plain-format and verified-bit examples, generic malformed-ISIZE footer refusal examples, and synthetic10k/100k chunk-size/work-count budgets in gzip and general cache I/O. These include real state/disk/RPC outcomes consciously retired for marginal value; retained E2EE-backlog, receipt/custody/uncertain-ack, integrity/migration and staging-cleanup cases are not equivalent replacements. The footer test did not prove early rejection or bounded allocation; staging cleanup did not seed unrelated files. No replacement or fresh native/remote/performance execution is claimed. Earlier raw selectors and dated receipts remain historical. Audit3779 retires17 authored/17 expanded registrations across six changed drivers, including the entire shared-Codex-home and prompt-telemetry suites. Accepted losses are shared-home wrapper noninterference/opt-out preservation, mocked metric count/provenance filters, SSH activity labeling/clearing and handover idle timing, VM ownership/capability/status projections and asleep-worktree refusal, a link-only external conversation replay sample, and two narrow input-credit noninterference/expiry examples. Retain the direct exact-tab/single-use input-credit case. These bounded real disk/state/routing alarms are intentionally retired for marginal value without equivalent replacement or fresh execution claims; earlier receipts remain historical. Audit3772 retires18 authored/27 expanded cases, including whole Codex service opt-out, RPC capability-parser, creator-provenance, short-ciphertext and readiness-null suites. Accepted losses include service ledger/symlink/mode cleanup, user TOML substring preservation, old-hash cleanup, description pass-through, malformed-file/pending-hash examples, coordinator write/probe counts, capability array bounds, positive creator projections, early short-payload refusal and readiness helper null shape. Two redundant Codex exit-cause rows are also retired; Pi shares their direct-idle path only in this empty-output immediate-exit fixture, and future agent-config drift coverage is lost. Real bounded filesystem/parser/runtime alarms are deliberately retired for marginal value; no equivalent replacements or fresh execution are claimed. Earlier receipts retain their historical scope. Audits3754/3755 intentionally remove9 authored/9 finite registrations: the entire one-case usage-source-cache-streaming.test.ts driver and8 cases from the surviving computer-action-validation.test.ts driver. This gate retains an unfiltered root Vitest command; UNIT_INCLUDE admits both source paths. Accepted losses are the real encoder output chunk-size/work-count alarm on repetitive10k/100k ownership payloads through a mocked durable sink, plus CLI diagnostic precedence, fractional window-id rejection, action-call-site window-target exclusivity, plain-text click-count recovery copy, incomplete click/drag targeting, mouse/modifier/direction allowlist samples and inline/stdin text exclusivity. These CLI cases exercise real argument/handler validation before mocked runtime calls; they are deliberately retired for marginal value, not declared tautologies. Retained cache I/O and CLI cases are not equivalent replacements for these alarms. Existing historical raw receipts remain unchanged and do not validate the deleted or reduced drivers. No fresh execution claim is made. Audits3758/3763 intentionally remove9 authored/11 finite registrations from6 changed drivers, including the entire pane-title-notification, window-linear-notices and worktree-card-lifecycle-effects suites. This gate retains an unfiltered root Vitest command admitting these paths. Accepted losses are same-account linked-row success-notice fanout, sidebar-switch channel forwarding, Linear-only notification forwarding/non-terminal-consumer selection/closed-window detach, destroyed-window refusal and first-send-failure suspension through the pane-title adapter, the100-card synthetic focus/poll absence sample, stored-source local folder badge refresh, unobserved-row badge refusal, and immediate reposChanged lineage invalidation. These exercise real owners with controlled ports; they are retired for marginal value, without equivalent replacement claims. The no-badge-work fixture does not seed its title-promised collection-only cache. Preserved historical receipts do not validate deleted or reduced drivers; no fresh execution is claimed. Audit3759 retires the entire one-case Tailwind compiler/scanner smoke. Accept loss of the direct CSS production/test/spec source-exclusion and rescan alarm; no replacement or current execution is claimed. Audit3752 independently approves audit3749: retire five authored/five finite watcher-process registrations, retaining18 raw-exact registrations. Accept loss of healthy shared-pool joint recovery, last-pending-failure idle retirement/respawn, late VITEST fallback release, missing-entry fail-closed selection and independent-supervisor fuse locality alarms. These are real bounded host-policy alarms intentionally retired for low marginal value; no equivalent replacement is asserted. Remaining driver selections exercise controlled FakeChild supervisor lifecycle, cancellation, physical-exit fencing, recovery and fuse behavior. This source review supplies no fresh native/process/platform/remote/SSH execution; historical receipts retain original source and selector scopes. Previous oracle (preserved verbatim): Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered root Vitest command. Current UNIT_INCLUDE admits the partial push-service, metadata-dialog and two config/scripts browser drivers:10 authored/16 finite removals. Accepted losses: actual retry30s/60s progression and register bucket/refill wiring, explicit seven-day lease arithmetic (its notification lacked seq/epoch and never reached send), equal-name edit latch/save payload, real image/font/meta-refresh/form/popup browser refusal controls, and broad rich-markdown bridge/command/edit-select smoke. Actual production state, callback routing and browser enforcement run in these cases; these alarms are deliberately retired on marginal value. All drivers and selectors survive. Existing unrelated receipts remain historical evidence for their unchanged selectors, not proof of the reduced cases. Audit3732 removes 2 authored/3 finite registrations from two partial suites: nominal custom/Kimi local naming success and deferred context usage row presentation. Real losses: custom/Kimi successful extraction through conversation-name sanitization and agentLabel composition; separate ordered counted/deferred lists and exact percentage/token formatting. No replacement or equivalent coverage claimed. Retain 11 authored/13 finite raw-exact registrations for bounded naming instruction/refusal/cancellation, menu dismissal focus ownership and hover/composer Escape/timer cleanup. Source-only bounded value review, no runtime/CI/native/remote/mobile/folder workspace or global completion credit. Previous oracle (preserved verbatim): Audit3733 removes2authored/2finite terminal input checks: fixed custom-cap error/secret fixture and three-emoji cap5refusal whose6UTF16units already trip length fast guard (no UTF8-dependent boundary). Accept exact non-disclosure/oversized-refusal alarm losses; no replacement/equivalence claim. Retain13/13scalar/pending input, OSC state and cron DST/cadence outcomes after bounded material reads. Source-only zero runtime/novelty credit; original historical reasons preserved. Previous oracle (preserved verbatim): Audit3729 removes1authored/3finite by deleting whole CLI runtime pairing advisory-close suite. Accept losing post-real-close injected EIO preservation of native/script/unreadable pairing, env identity/preservation and exact close/release assertions; no actual failed-close leak or replacement coverage claimed. Two retained URL grammar/identity suites11authored16finite raw unchanged. Bounded source/owner/caller value review, zero novelty/runtime credit; other seven3724deferred closures remain. Historical receipts preserve original limits. Previous oracle (preserved verbatim): Audit3724 removes3authored/3finite checks by deleting two whole suites: TUI clear burst-size singleton and terminal-file-URL target two-case wrapper suite. Deliberate losses: derived widest burst<64byte alarm, UNC authority+line-column anchor composition, and malformed-percent null refusal. Real production algorithms execute in those tests; no mocked-output tautology, equivalent replacement, actual Claude/file-navigation delivery or universal safety-irrelevance claim. TUI58byte bound and URI examples have low marginal value as standalone suites. Actual1262/1264/1742KEEP superseded explicitly. Remaining14drivers83authored136finite raw unchanged. Bounded source-only review; ten closures deferred, four bounded keep judgments repeated with zero new semantic-frontier credit. No runtime/CI/native/remote/mobile/folder/global completion claim; historical receipts retain original scope. Previous oracle (preserved verbatim): Audit3723 removes 4 authored/4 finite registrations in two whole suites: keybinding cache freeze/token spellings and host-dependent Orca command name examples. Real losses include returned-object freeze, repeated Mod+P key, Space/PageDown/NumpadSubtract mapping, unknown/empty/prototype-token rejection, and headless Linux versus Windows-server/WSL command choice. No equivalent or replacement coverage claimed. Retain 12 authored/21 finite raw-exact registrations exercising generated scaffold validation, artifact failures, shipped editor/hook/worker/panel tests, actual generated typing compilation, independent CLI root routing and intent-name precedence. Source-only bounded audit; no runtime, CI, native, remote, mobile, folder workspace or global completion credit. Previous oracle (preserved verbatim): Audit3720 removes17authored/23finite checks: whole main catalog-date adapter2 and shared date-helper7, seven renderer nominal ranking/cap/no-date/composition cases, and one browser registration expanding to seven forced-container/DOM-child boundary cases. Deliberate real losses: community oldest-date UTC forwarding, official/undated omission, date sorting/window/invalid/future/skew/clamp and default/override cap; nominal ranking/cap and combined Featured/Newly-added outputs; real CSS459/460,719/720,1055/1056breakpoint, five-card partial-row and720px two-card first-row alarms. Browser cases really measure rendered geometry but force width/remove DOM children; no fake-pixel or tautology rationale. No replacement/equivalent coverage claimed. Retain14authored/19finite raw-exact registrations across4drivers: adversarial featured category/order/tie and installability, date order/window selection, actual PluginManager failure/escaping/duplicate-card suppression, real browser viewport/odd-count geometry/phone catalog visibility, syntax ingress/depth/include/printability and68dlong-bracket auto-close fill-in. No tests/browser/native/UI/provider/remote/mobile/folder/CI/global execution or completion credit. Previous oracle (preserved verbatim): Audit3717 removes6 authored/6finite checks in two whole thin-adapter/presentation suites. Deliberate real losses: ordinary recipe repository-URL withholding and provisioned-root credential scrubbing/forwarding; repository label lockstep suffix expansion, host-scoped map identity/collision grouping, Windows crosshost paths and WSL distro suffixes. Actual provision options, label/sort consumers and host/scrubber delegates inspected; no replacement/equivalence claim. Retain40 authored/84finite registrations raw exact in14 drivers with bounded owner/context review. Prior KEEP superseded for removed suites; no runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous oracle (preserved verbatim): Audit3714 removes8 authored/39finite checks: whole CLI selector-recovery, task display-text and ANSI grammar suites plus two name joiner/blank tables. Deliberate real losses: selector flag/value/identity and mutation recovery merge/serialization; exact task suffix, transcript fallback, input immutability, cache reuse and edited blocks; independent failed-escape/resumption and OSC/DCS/BEL/ST/C1/nested/unfinished stripping outputs; meaningful-language joiner preservation and invisible/blank-name rejection. These are real bounded alarms, removed as narrow supplied-error examples, helper/token inventories and repeated internal-work fixtures. Prior2936,1195/1196,1214/1215 and1082 KEEP superseded; no replacement or equivalent coverage claimed. Keep9authored/9finite raw-exact registrations in5surviving drivers: screenshot export/failure filesystem behavior, CLI local tree query, event-local reply provenance, vault role-sensitive content and four hostile/UTF16/dangling/tag-name regressions. No native/UI/provider/remote/mobile/folder/runtime/CI/global completion credit. Previous oracle (preserved verbatim): Audit3711 retires2authored/4finite cases by deleting whole clipboard-image-temp-file signature-to-name inventory (HEIC/TIFF/unrecognised bytes) and workspace-last-active switch-on supplied visit/reason singleton, plus its now-orphan test fixture. This intentionally loses real generated-filename suffix/extensionless alarms and real newer-visit archived7day versus inactive30day filtering/older-visit identity alarms. Filesystem writing and production reason pruning really execute; no equivalent replacement or universal absence of safety relevance is claimed. The clipboard test does not inspect written bytes, native delivery or decode; the visit test supplies candidate/timestamps and does not exercise persisted visit routing or actual removal.20authored/20finite cases remain unchanged across4bounded Git/sidecar/removal drivers. No new runner/test/module evaluation or runtime result; historical notes and receipts remain historical. Previous oracle (preserved verbatim): Audit3707 removes10 authored/11finite checks: three whole renderer adapter/assembled-stage suites and two native projection cases. Deliberate losses: plugin URL/ref/default-version/local-path and unsafe credential refusal forwarding; real Task hook/store A→B→A late-save/list/count fences, owner disappearance, legacy-host convergence, query/history/eviction and same-ID host history; native child append ordered-ID/replacement and compound fallback/order/optimistic-admission/child-turn/duplicate/shrink/revision alarms. These are real bounded alarms; removal follows thin adapter, manually assembled Task pipeline and repetitive fixture value judgment, with no replacement or equivalent coverage claim. Prior1179/1182,1220/1221 and1885 KEEP superseded as applicable. Keep36 authored/38finite registrations raw exact across13 surviving drivers. No runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit. Previous oracle (preserved verbatim): Audit3706 removes7authored/7potential cases from3renderer sources: whole usage-label3case and130000-distinct-day usage-overview singleton suites, plus3SSH grouping/ordinary-range examples. Retain11authored/11potential cases across6drivers in this bounded selection; no equivalent replacement or fresh runtime result. Existing bare root-unit commands admit this selection statically; prior command/receipt strings remain historical. Audit3706 intentionally retires first/second-order usage-group label collision alarms; equal50%-weekly bucket versus derived-weekly selection identity and Gemini wk label alarm;130000distinct-day aggregation no-spread-crash/max/intensity alarm; legacy absent-source SSH grouping and ordinary reverse-select/selected-target deselect range alarms. Actual label ambiguity and pathological-input crash are accepted losses. Distinct-day fixture spans~356years; no hard producer/date bound is claimed. Retained filtered-anchor/grouped-order guards do not replace removed deselection/reverse-range/legacy-group coverage. No native SSH, mounted renderer, live provider, remote/folder/mobile end-to-end or current runtime pass was obtained. Previous oracle (preserved verbatim): Audit3699 removes4 authored/4finite checks, including one whole xterm copy-policy suite and one root/group CLI help case. Deliberate losses: direct copy-chord admission for platform, selection, Kitty mode, defaultPrevented, logical/physical key and key phase; command-group disclosure and group help routing including claude-teams early return without RuntimeClient construction. These are real bounded policy/wiring alarms; no replacement or equivalent coverage claimed. Retain14 authored/19finite raw-exact registrations across6 drivers: unsafe CLI refusal, Claude model event carry and disk reconstruction/OSC-first case, attachment ownership/upload lifetime and mixed BMP file-reference/PNG-chip delivery, actual SQLite authority/admission/mutation, and Electron geometry/hit-testing. No runtime, CI, native-key delivery, external provider, mobile, remote, folder or global completion credit. Previous oracle (preserved verbatim): Audit3692 removes5 authored/5finite marginal Codex checks: unrelated login URL without notice; ordinary per-account launch resource/config materialization; no-retained-pane skip; preservation of a previously owed full scan through actual preparation and pending-marker update (no actual history scan/settlement); ordinary later-config refresh. Accept these exact branch/wiring alarms as deliberate losses without replacement. Retain32 authored/34finite raw callbacks/registrations/table bytes exact across14suites, including credential/admission refusal, grace/reset readiness, filesystem ownership, commit-dependent queue state, streaming/host trust, path canonicalization and private-state preservation. All14whole suites challenged without keeper quota; no whole deletion warranted on current concrete signals. No runtime/CI/native WSL/remote/mobile/folder/global completion credit Previous oracle (preserved verbatim): Audit3691 removes two complete runtime-home routing singleton suites (2 authored/2 finite): catalog wrapper mirror login-copy and passive transcript-lookup filesystem noncreation. Exact accepted losses are recorded in knownGaps; no replacement or equivalent coverage claimed. Audit3691: no dedicated alarm remains in the deleted sources for post-launch system login import through prepareHostCodexHomeForReadOnlyAppServer, or for repeated missing-transcript lookups leaving removed Codex account/runtime directories absent and userData entries unchanged. Ownership-marker read avoidance was never independently measured. No real catalog probe, provider, native Windows or crash was validated by those fixtures. Previous oracle (preserved verbatim): Audit3686 current Claude profile/account review removes5 authored/5 finite cases: whole structured-auth diagnostic-label suite3 and Windows-only command suite1 whose advertised cache alarm is ineffective because cache lifetime is per invocation; remove duplicate setup namespace-link refusal1 at wrapper layer. All5 exact historical KEEP are consciously superseded. Retain49 authored/50 finite unchanged, including filesystem privacy/recovery, route identity and concurrency, built worker/helper, legacy WSL alias compatibility and sign-in handoff. These are deliberate coverage losses without replacement. No runtime/CI/native WSL/macOS Keychain, remote/mobile/folder or global completion credit. Explicit accepted real losses: unknown-account host fallback and mixed-version/WSL-only structured auth diagnostic labels; Windows-only sentinel ENOENT-to-friendly-error translation plus fresh-call successful dispatch smoke; setup catch-to-refused wrapper and no-write outcome for a namespace symlink. The command case does not discriminate removal of its per-invocation noncache guard; it still supplies the error-translation alarm, which is intentionally retired. No replacement/equivalence promise. Previous oracle (preserved verbatim): Audit3680 removes eleven authored/eleven finite unit cases across four files, including entire launch setup row projection, structured legacy-model metadata, and legacy classifier suites. Accept loss of exact row partition/start selection, Codex supersession/default/unknown and Claude alias/suffix folding examples, other-agent exemption, getter/cache read budgets, same-array per-agent cache isolation, replaced-catalog metadata, and tracked-only model exclusion from structured and PTY legacy inventories. These are real narrow policy/metadata alarms intentionally retired without equivalent replacements. Retain real menu collapse/reopen in dropdown/select, AI picker cancel/accept and stale-effort filing, IME carry/gesture/frame transitions, and typed-flip versus held-dispatch fencing. No production or shared fixtures change. No dead timing entry exists for the three deleted drivers; retained timing keys stay unchanged. Static source-value review only; no project import, test runner, native/app execution or runtime validation established. Earlier receipts retain historical scope. Previous oracle (preserved verbatim): Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit. Previous oracle (preserved verbatim): Audit3672 renewed by3676 removes four authored/four finite cases from federation-output.test.ts: nominal show/read routing and terminal-fallback projection; initial archive-table SELECT failure returning retained/no-close; simulated old-peer read/fleet/refusal and method inventory; and absent archive-release capability refusing release. These actual compatibility/guard alarms are intentionally lost without equivalent replacement; the dropped-table case never reaches capture or commit. Current selected frontier9 becomes5: retain actual temporary transcript parsing/path omission, current no-transcript release/unavailable-output/restart/replay regression, and three home deadline/stop nonmutation cases. Prior held-capture case was already removed upstream and receives no new removal credit; prior redacted snapshot archive behavior was rewritten upstream and is not claimed retained here. The surviving driver timing entry stays. Static review/private composition only; no actual peer/network/native/platform or fresh runtime validation. Previous oracle (preserved verbatim): Audit3671 removes14 authored/32 finite root-unit cases, including the whole WSL move-handler refusal suite, WSL preload object-presence suite and internal gate spelling truth table. Also retire the weak withheld-command non-array shape assertion, static serve-only Add/capability/mock-remove example, grammar scope equality and basic configuration/payload schema roundtrips. Genuine wrong-window/malformed-request/gate-before-work, exact gate spellings/platform/argv precedence, static serve-only routing, declaration mismatch and empty grammar/pair admission alarms are consciously lost without replacement; prior KEEP decisions are reconsidered. Seven unchanged authored/finite root-unit cases retain real image/provider/line budgets, live policy transition/capability broadcast, grammar resource/reference traversal and strict-versus-tolerant literal salvage. Source-value evidence only; no runner/compiler/build/app/native/provider/remote/mobile/folder validation or historical fault claim. Previous oracle (preserved verbatim): Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence. Audit3634: Remove five authored/five finite cases, including the complete structured chat terminal-refusal, terminal-plus-agent worker-start validation, and canonical Git common-directory parser suites. Also remove the gh free-text -R argument projection case. Consciously supersede prior KEEP decisions and accept chat-versus-stale redirect classification, real RPC refusal-before-SQLite-Dispatch, old-Git echoed-option relative-path parsing, WSL execution-space resolution, and free-text preservation/bare-repo qualification alarms. These are genuine narrow alarms, intentionally retired without equivalent replacements. Retain real Git stdin/EOF delivery, bound-account host admission, naming environment/account precedence, upload iterator cancellation and remote path confinement. Shared fixtures and production code remain. Remove only the dead canonical-repo-key timing entry. Static source-value evidence only; all prior evidence retains historical scope. Audit3636: Remove the entire maintenance opportunity internal-count driver (one authored/two finite cases), the mocked remote worker start-card argument case (one/one), and the follow-up heading mapping table (one/two). Root-unit discovery loses three authored/five finite cases. Independently remove four Python native screenshot methods/five statically enumerated subTest scenarios: grim argv/stub payload, failure-code mapping, X11 mocked capture payload, and capability flags. The Python lane is verify:computer-native and is not root Vitest. Accept loss of exact native command/projection and exception/capability alarms, ready-only card publication arguments/agent forwarding, and serialized follow-up heading mapping; no equivalent replacement is claimed. Retain actual ownership/mail/queue/reopen transitions, remote lost-response fencing and first-result settlement, filesystem/maintenance admission and successor progress, wrong-region screenshot refusal and Sway geometry. The whole-deleted new driver has no timing key; this component requires no timing cleanup. No production changes. Static source-value review only; no project import, runner, app, native desktop or runtime validation established. All prior evidence retains historical scope. Audit3629 removes two singleton parser suites: WSL Claude plugin metadata out-of-range index rejection and Git checkout unlink-warning path extraction. Their real range-refusal and quoted-path extraction alarms are intentionally lost without replacement; no WSL execution, checkout recovery or equivalent remaining coverage is claimed. Audit3630 removes the sole orphan automation availability test (1 authored/1 finite). Its real policy kind, orphan precondition, delete/toggle enablement and run/edit refusal alarms are intentionally lost. The test did not dispatch an action, enforce a server generation fence or observe a remote mutation. No equivalent replacement, actual renderer/transport execution or new platform/provider evidence is claimed. Previous account (preserved verbatim): Audit3628: remove the entire one-authored/one-finite RepositoryRemoveProjectSection happy-dom suite. Accept losing the local zero-to-one-terminal stale-count revalidation alarm: first confirmation defers the removal callback and second confirmation invokes it after the count snapshot updates. The test never asserts updated warning text/count, actual terminal creation or removal/PTY teardown, host/scope routing, cancellation or folder/mobile behavior. No equivalent replacement or end-to-end warning-before-teardown proof asserted. Static evidence only; historical receipts retain original scope. Audit3624: Remove one authored/five finite positive Gemini identity table from the Claude/Gemini title collision driver. The real normalization, legacy label and explicit title evidence owners execute, so ordinary Gemini marker/name/wrapper recognition and normalized-label composition alarms are consciously retired without equivalent replacement; these five supplied title-to-literal identity examples have low marginal value. Preserve the six-row Claude task-text collision oracle, whose unrelated CLI mentions must not rebrand or destructively normalize titles. The other audited drivers preserve real permission-mode session transitions, prompt secret/fence/bounds defenses, JSON-to-Ask option/preview preservation, and optional GitLab failure summary/trace composition. Root-unit discovery loses one authored/five finite cases; no whole driver or timing key is removed. No actual terminal stream, UI routing, application/native or runtime execution established; all prior evidence retains historical scope. Audit3618: Remove three authored/three finite browser reload cases, including the complete renderer reload-actions suite. Agent bridge fake did-fail-load plus permanently supplied manager error projects description/code into a rejection. Renderer seeded empty metadata projects a saved URL into plain webview src; its earlier not-ready case projects a live-id/throwing fake reload into absence of a loading patch. Real queue/wait/error/cache/classifier/hook code executes, but these narrow supplied-state and exception-to-callback wirings have low marginal value; no rerender, lifecycle, actual cache generation/retirement or guest commit is asserted. Explicitly supersede audit1822 not-ready KEEP and preliminary3617 cross-module retain opinion, accepting offline-reload failure reporting, empty guest to saved URL routing, native-reload bypass and premature-loading/stranded-state alarms without replacement. Retain distinct main cancellation queue progression and absent queued side-effect dispatch. Root-unit discovery loses three/three. No Electron guest, network failure, restored navigation/commit, app/native focus or runtime execution established; earlier evidence retains its historical scope. Audit3614: Remove thirty-one authored/thirty-nine finite potential cases across CLI format and argument drivers, including three whole suites: search-result/status sanitation sites, Linear issue/list/warning sanitation sites, and quote-stripped JSON diagnostic secret non-echo. Those real formatter/guard transformations execute on supplied strings; intentionally retire their field-specific CSI/OSC/C1/newline/bell and diagnostic secrecy alarms as low-value caller/output inventories, without replacement. Also retire twenty-one search registrations/twenty-four finite cases covering minimal positional request/default omission, exhaustive all-flags request projection, nominal named query/index routes, repeated syntax/agent examples, enum/agent/path-count/timestamp/numeric/cursor admission examples, unknown/browser flag examples and postcommand last-wins projections; retire one parser sentinel-only case. Keep actual ambiguity, conflicting index request, precommand/crosscommand scoping, variadic reference parsing and missing-repeatable-value controls, without claiming equivalent coverage. Root-unit discovery loses all twenty-nine/thirty-seven. No CLI/RPC/terminal/PowerShell/host/schema/runtime execution is established by this source-only audit; earlier evidence retains its historical scope. Audit3613: remove six authored/six finite callbacks, including whole reviewer-display oversize-input and explorer-root record-filter suites, plus plugin family-emoji/invisible-only-name and pool legacy-name/urgent-countdown samples. Accept losing oversized-input empty-result/no-split, malformed-record/prototype-sensitive-key/nonstring filtering, exact ZWJ family preservation, invisible-only name refusal, no-group old-host full-name preservation, and80/79/null-reset countdown composition alarms. No equivalent replacement asserted. Retained strict/runtime sanitization, SVG parser, mobile focus recovery and collision/tie cases have different scopes. Static evidence only; historical receipts retain original scope. Audit3609: Remove the complete pnpm CLI invocation literal-selection suite (eleven authored/nineteen finite potential cases), with no replacement claimed. Root-unit discovery loses JavaScript-versus-native command selection, npm/npx executable rejection, Windows cmd/bat casing and shell selection, non-Windows cmd behavior, native PNPM_HOME flat/bin preference, explicit-path priority, relative-home rejection, missing-native fallback and non-Windows home-probe refusal alarms. The suite called the real resolver with independently expected objects, but exercised no pnpm/node/cmd process, installed native executable or real filesystem probe. Earlier KEEP decisions are consciously superseded by accepting these narrow branch and probe-inventory alarms as low value. Real symlink entry, Git signing isolation, Bun filesystem/Node child normalization and compiler scheduling/continuation tests remain distinct tests, not equivalent coverage. No runner, compiler, app, platform or remote execution was performed in this source-only audit. Earlier evidence retains its historical scope. Audit3608: remove five authored/five finite callbacks, including whole owner-slug and remote favicon URL suites and two repository-label projections. Lose five owner acceptance samples, eleven negative owner samples plus nonstring refusal, six host-local icon refusal samples, legacy-SSH same-path label-map cardinality, and explicit runtime ownership over stale legacy metadata at label level. These are accepted narrow grammar/presentation alarms with no equivalent replacement claimed. Retained binary parser, React recovery and label grouping/platform cases do not replace these losses. Static evidence only; historical receipts retain their original scope. Audit3606 adopts the enhanced3604/3605 icon cuts: nine authored/nine finite cases removed, including the whole tray-attention-icon suite. Retires the no-encoder oversized-upload null sample, missing-ID/request-order sample, encoder-null PNG-prefix fallback, SVG/404 rejection samples, transparent amber-dot placement and half-alpha white-tint sample, exact small fetched-byte passthrough, host-qualified image-key inventory and constant-encoder large-upload projection. These specific admission, formatting and bitmap alarms are intentionally lost without equivalent replacements. Retained queue/cache, bounded fetch and Dock lifecycle checks do not establish actual raster decoding, native image conversion or rendered appearance. Historical receipts below are preserved evidence for earlier test sets, not fresh validation of this reduced selection. Audit3601 scope: remove the whole custom-sound happy-path IPC suite and one custom-label/multiline notification formatting example (2 authored/2 finite). Intentionally lose configured .ogg selection, exact byte/MIME success wiring, successful dispatch for the formatting fixture, custom-label whitespace/title normalization and assistant-body whitespace/180-character-cap alarms. Retain prompt-exclusion, persisted qualified dismissal/restart, theme ownership/restore and Ghostty precedence/collision cases; none replaces the retired sound/formatting alarms. No actual playback, native delivery, phone/network, cross-platform or new runtime evidence is claimed; historical execution keeps its original scope. Audit3598: Remove seven authored/nine finite literal-table potential test registrations across workflow routing, Claude cold-start and real-zsh preexec drivers. Root-unit discovery loses six authored/six finite: three test-local workflow parser fixtures, the five-positive/three-negative explicit command-paint route inventory, a boot-banner-before-composer sample and an already-painted bare-title positive sample. The separately selected shell_contracts live-shell driver loses one authored/three finite raw-capture paint-only cases across three hook configurations; its real-wrapper launch-order, four rechunkings (twelve finite) and runtime-wait replay remain, without claiming equivalent replacement. Intentionally lose those parser, exact routing-list, banner, post-paint subscription and native-read-boundary paint alarms. Retained workflow/UNIT_EXCLUDE/classifier cross-source routing checks and readiness-race-to-writer timing are distinct bounded alarms. No runner, real shell, PTY, app, native focus, remote delivery, cross-platform execution or full-feature correctness is established by this source-only audit. Earlier evidence retains its historical scope. Audit3597 scope: remove two renderer-hang-capture examples (2 authored/2 finite): an invalid repeated-token oversized reducer fixture and a shorter unanswered-request fixture. Intentionally lose the direct truncated flag/sanitized frame fixture and request-pending status/zero-sample alarms. Retain window-death/stale-result exclusion, generation reconciliation, and baseline-publication cancellation lifecycles; they are not equivalent bound, redaction or pending-status replacements. Historical execution retains its original source scope; no new runtime evidence is claimed. Audit3591: Retire the whole one-case background journal-producer attribution suite and the fabricated malformed-details-block case (two authored/two finite cases). Intentionally lose the fixed own-task versus output/foreign-task attribution examples across flat/message row shapes, missing-root classification, and direct unbalanced/detailsish fabricated-block rejection alarms. Retained parser sibling/depth and editor navigation tests do not replace these alarms. No equivalent replacement or fresh runtime, transport, persistence, native focus or rendered UI validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3592: Retire the whole three-case shared agent smart-key resolver suite, explicitly superseding its Audit3238/3237 keep decisions. Intentionally lose literal permission-versus-question classification, longest-question digit selection, Codex async-question opener/digit/Enter/skip mapping, and unsupported-agent/state/prompt refusal examples. These were real parser/selection and literal-byte alarms; they did not exercise terminal delivery or timing. No equivalent replacement or fresh runtime, native TUI, mobile, remote or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3587/3588: Retire six authored/fourteen finite cases, including the whole WSL stopped-notice and connecting-status selector suites. Intentionally lose direct WSL retry connection field/target/ready-epoch/null-guard examples, connecting/reconnecting distro and absent-state selector samples, and stopped/connecting notice text/button/data-attribute examples. Retained host-ready retry and content-loader/reload lifecycles do not replace these alarms. No equivalent replacement or fresh runtime, native WSL, remote, rendered UI or performance validation is claimed. Earlier dated text and evidence retain their historical scopes. Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed. Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions. Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews. Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Require both existing named browser placement scenarios to pass three times with one attempt, zero skips, zero failures, and no report errors.",
"commands": [
"gh workflow run packaged-browser-e2e.yml",
"pnpm exec playwright test tests/e2e/packaged-mixed-version-browser-placement.spec.ts --config tests/playwright.config.ts --project=electron-headless --workers=1 --repeat-each=3 --retries=0",
@@ -14116,6 +14149,48 @@
"Collect repeated scheduled history before making this required."
],
"knownGaps": [
+ "Audit3814 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle from a Codex ready prompt even when stale startup lines remain :: Stale MCP startup lines must not block a later Codex ready header.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle when a stale Codex prompt is followed by the ready header :: A Codex ready header following a stale resume prompt must satisfy tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for an idle Cursor lane past its dismissed trust dialog (#8210) :: Later Cursor idle banner overrides retained trust dialog.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not block a mid-run Cursor lane on its dismissed trust dialog (#8210) :: Dismissed trust dialog must not report blocked for later busy Cursor; wait times out.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: does not classify unrelated press-enter prompts as Codex blocked prompts :: Unidentified press-enter text must time out rather than be classified Codex blocked.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: resolves tui-idle for quiet background PTY agents without OSC titles :: Quiet Codex background terminal without OSC title eventually resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts :: sends agent prompts as bracketed paste before submit :: Driving prompt escapes embedded paste-end ESC, writes one framed paste then CR, and counts bytes.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: settles a foreground Codex prompt when launch metadata has not arrived :: Codex inferred from foreground without launch metadata waits for composer marker/quiescence before one CR.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: gives a late Codex render marker a fresh quiescence window :: Marker arriving at7.9s re-arms fresh quiet window instead of submitting at initial cap.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: writes large agent prompt paste frames atomically before delayed submit :: A prompt larger than input chunk budget is a single paste write before delayed CR with exact byte count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects oversized terminal.send text before provider writes :: Oversized ordinary terminal.send rejects input-too-large before any provider write.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts :: rejects focusing an exited background terminal session :: focusTerminal refuses terminal_exited before invoking background reveal.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: pastes the same bytes the desktop draft paste sent for the prompt :: Launch-ready prompt normalizes CR/LF and renders embedded ESC visibly identically to desktop bracketed paste.\nsrc/main/runtime/orca-runtime-tests/agent-launch-prompt-submit.spec.ts :: keeps a prompt into a running agent behind the render settle, as before :: Driving prompt remains held through7s repaint activity then submits once by9s.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reports a queued PTY focus as not navigated when its notifier disappears :: Queued PTY focus and completed active reveal report not navigated after notifier removal; no second reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: does not invoke a stale graph-leaf focus notifier after queued PTY work :: Queued graph-leaf focus must not invoke old notifier after preceding PTY reveal and notifier removal.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: paginates retained terminal output with explicit limits and truncation metadata :: Preview120lines, fractional limits,50/200 pages, retained2000line truncation and future-cursor metadata stay consistent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: falls back to renderer visible screen when uncursored TUI tail is blank :: Substantial blank uncursored tail uses mounted renderer visible screen with zero scrollback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: reads and shows the runtime-owned alternate-screen grid without serialization :: Actual runtime alternate-screen grid provides read/show content without renderer/provider serialization.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: classifies older provider alternate-screen snapshots from ANSI :: Older provider without alternateScreen metadata classifies ANSI alternate entry and returns Remote Vim screen.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts :: honors the last ANSI screen transition when older provider metadata is absent :: Last ANSI alternate exit overrides earlier entry when explicit provider mode metadata is absent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: rejects a full provider screen frame after live output advances :: Live output arriving during second full-screen capture causes screen-unavailable rather than stale full frame.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: shares one provider snapshot between concurrent read and show calls :: Concurrent read/show share one successful provider snapshot and both receive Shared TUI content.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps cursor reads provider-free on restored alternate-screen PTYs :: Restored alternate-screen cursor transcript reads never acquire provider snapshot.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: backs off after a provider snapshot failure instead of retrying for show :: Failed provider capture is cached/backed off so later show does not retry.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: falls back once to a mounted renderer when a known alternate provider fails :: A known-alternate failed provider capture falls back exactly once to newly mounted renderer.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: bounds provider visible frames for read and show responses :: Provider visible read/show use six bounded lines and300character preview.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: keeps renderer-fallback composer drafts separate from terminal output :: Renderer fallback strips dim composer draft from terminal output and exposes draft separately.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts :: does not use renderer visible-screen fallback for a short blank shell tail :: Two blank shell lines must not trigger renderer screen fallback.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: trims terminal tail character budget without per-line array shifts :: Tail builder trims to256KiB with correct retained suffix and no Array.shift calls.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains ANSI-only status redraws instead of appending every frame :: Repeated erase/redraw replaces preview until newline then publishes one completed cursor row.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains split multi-line ANSI footer redraw state across chunks :: CUU state across chunks retains corrected footer rows and publishes new cursor entries.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not let stale lower rows hide earlier corrected footer rows from cursor reads :: Earlier corrected footer row must not be hidden by stale lower rows in cursor reads.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: bounds completed transcript entries from a single multi-line redraw chunk :: Single redraw chunk bounds completed transcript to2000retained lines and correct oldest/next/latest cursors.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains multi-line ANSI redraws when the last footer row stays partial :: Partial final redrawn row appears in preview but cursor sees it only after newline.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: does not retain split ANSI controls as visible terminal preview text :: Split color/mode escapes never leak preview fragments; long split OSC title truncates at MAX_OSC_TITLE_CHARS.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts :: retains same-line redraw cursor position across split full-line erase chunks :: Full-line erase preserves column across chunks so XY follows three spaces rather than old ABC.\nsrc/main/runtime/orca-runtime-tests/conpty-stream-read.spec.ts :: fills the requested line count even when blank rows sit below the prompt :: Blank rows below a ConPTY prompt must not consume the requested nonempty-line count.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: does not retain split ST-terminated string controls as preview text :: Split ST-terminated Kitty/string controls must remain excluded from preview text.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects split OSC titles before retaining terminal previews :: Split BEL OSC title must update working title/status without leaking into preview.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: detects ST-terminated OSC titles split before the final backslash :: ST OSC split before final backslash must update title without leaking framing.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: preserves a trailing escape after a completed OSC title :: Completed OSC followed by pending ESC must preserve the next idle-title transition.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: seeds newly synced leaves from PTY pending ANSI state :: A newly synced graph leaf inherits pending ANSI so a split color fragment cannot leak.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: bounds retained partial terminal output before preview reads :: Partial terminal state stays capped at 4000, preserves retained array identity, and preview truncation/cursor output remains correct.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery.spec.ts :: submits the mail pointer to Cursor Agent only after the paste-burst delay :: Cursor mailbox pointer Enter must wait through the paste-burst delay; this is a real input-timing alarm intentionally retired.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts :: adopts a v1.4.150-shaped agent, setup, and shell orphan as one topology transaction :: Stale incarnation refuses without topology change; three agent/setup/shell lanes adopt atomically with layout/group/revision and preserved read/input/resize; exact replay is idempotent and competing owner refuses.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: retires the exact worker when it exits after renderer reveal :: Exact worker exit after reveal retires that worker and its surface.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: re-reveals a recovered worker after the renderer graph epoch changes :: Changed renderer graph epoch invalidates reveal receipt and forces another reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: defers recovery when the renderer omits the exact reveal identity :: Missing exact reveal identity defers recovery after two attempts.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts :: reconciles a same-id process replacement before headless adoption :: A process replacement before headless adoption must fence off stale ownership.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retires provider resume only after authoritative inventory proves the legacy PTY exited :: Authoritative owning-host inventory overrides false local hasPty, avoids SSH scanning, retires exited provider resume/surface, adopts live workers without headless reveal.\nsrc/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts :: retries inventory and unknown liveness without revealing a ghost worker :: Inventory failure and unknown liveness must retry without ghost reveal, eventually adopt, and stop retrying.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts :: refuses a live reserved pane before issuing a handle or revealing it :: A requireFreshPane launch receiving a live reserved owner must reject before handle/reveal/kill, and release its claim. No equivalent replacement claimed.",
+ "Audit3806 per-case accepted runtime losses:\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: skips a listener unsubscribed mid-fan-out even with mobile exclusions active :: A listener removed by an earlier listener during one fanout is not called, including with a side-effect-excluded mobile listener present.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: retains bytes emitted before a fresh daemon spawn resolves :: Bytes and title arriving before an initial zero/reset provider response survive in the serialized headless buffer with their counted sequence.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits command-finished facts with best-effort exit codes across chunk splits :: A split OSC133 D exit code becomes130 and a missing code becomes null in ordered command-finished facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts.spec.ts :: emits pr-link facts once per URL with batch attribution :: A split GitHub PR URL yields42 rather than4, emits42/43 once each, and carries PTY/worktree/tab attribution.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits 2031-subscribe facts across chunk splits :: Split ESC[?20 then31h emits exactly one2031-subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: restores a provisional 2031 subscribe when daemon scan authority returns :: Returning daemon scan authority with partial scan seed and pending2031 subscription restores exactly one subscribe fact.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers the tracked title over the renderer snapshot lastTitle :: A synthetic live Cursor title overrides stale renderer lastTitle while preserving renderer snapshot source.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: prefers provider history over a partial headless mirror for requested snapshots :: Authoritative requested snapshots return supplied provider frame/history/seq rather than a partial headless mirror, requesting5000rows.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: tracks live alternate-screen transitions after a provider snapshot :: Provider alternateScreen true is accepted, then live1049l/1049h update isTerminalAlternateScreen false/true.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: translates reset provider snapshots without retaining the old title :: A reset provider snapshot translates new local seq into the runtime domain and replaces Old process title with New process.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: emits the chunk agentStatus events before its side-effect batch :: Agent status callback precedes side-effect batch callback for one coalesced OSC9999/title/bell chunk.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: still emits a throwing chunk’s facts under its own seq, not the next chunk’s :: A tracker throw still flushes first chunk title facts under its own seq, and second chunk does not inherit those facts.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: seeds the lazily created tracker from the daemon-snapshot title :: A lazy tracker hydrated from renderer snapshot title Codex working emits agent-idle on later Codex done.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits command-code-working facts only after the banner arms the scrape :: Unarmed Thinking text emits no facts; a Command Code0.27.3 banner then hardcoded colored spinner text emits attributed command-code-working with the submitted prompt.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts :: emits a command-code-done fact when the idle composer returns :: After hardcoded banner/working text, returned idle composer emits command-code-done with the earlier submitted prompt.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: resizes the headless mirror after an accepted desktop PTY resize :: An external accepted resize produces the resized dimensions and same status-frame lines as a separately driven reference emulator.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: replaces suffix-only headless state with the recovered renderer snapshot :: Replacing suffix-only state removes old suffix, retains renderer history plus later output/cwd, and returns the live47x40PTY grid.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: stamps SSH connection identity on runtime terminal status :: A synthetic mounted-leaf OSC9999 status after registerPty carries the supplied SSH connectionId.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: does not retain WSL context when a PTY id is reused :: After exit and same-ID new null distro context, OSC7 file://server/share/repo uses UNC server path rather than old Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts :: preserves immutable context while a live daemon attach is unresolved :: preparePtyExecutionContext with preserveExisting refuses a supplied Debian replacement and subsequent OSC7 keeps original Ubuntu namespace.\nsrc/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts :: projects frame-independent live state through main buffer snapshots :: Main-buffer snapshot puts focus-report/cursor-visibility modes in frameRestoreAnsi, excludes STATIC-FRAME there and includes it in data.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts :: continues terminal agent status fanout when a callback throws :: Throwing on the first status callback does not prevent second payload delivery and logs contextual error.\nsrc/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts :: returns a title-only replay snapshot and never historical attention :: Lose replay:true/title-only fact projection despite earlierbell and unknownPTYnull. No actual delivered-history notification or reattach behavior was exercised. No equivalent replacement claimed.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects a handle rebind while a controller-less status check yields :: A handle rebound while the null-controller status continuation yields must throw terminal_handle_stale.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts :: rejects confirmation evidence when the owning PTY exits :: A pending strong confirmation resolving after owning PTY exit must reject terminal_exited.\nsrc/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts :: keeps ordinary terminal send suffix failures on the existing not-writable contract :: Ordinary send writes text but refused CR must throw terminal_not_writable with beforeWrite twice and afterWrite once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell the execution host cannot apply instead of spawning its default :: Requested Windows shell on POSIX must refuse before spawning a default shell.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: quotes the agent startup command for the requested shell, not the host default :: Requested cmd shell must override PowerShell default quoting for agent startup command.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: keeps restored receipts outside a targeted worktree scan :: Targeted scan removes the moved-worktree receipt while preserving another worktree receipt.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: observes setup command completion without waiting for its interactive shell to exit :: Nonzero completion marker 17 resolves while interactive shell remains running.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: falls back to setup terminal exit when no completion signal is available :: Setup completion observer without token falls back to actual exit code 9.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: cancels setup completion observation when the caller aborts :: Abort rejects with the original reason and unsubscribes once.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps observing after an uncertain setup terminal status :: Unknown exit waiter result must leave observation pending until completion marker arrives.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh omits a record :: Controller inventory omission disconnects the record but preserves its retained transcript.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: keeps retained PTY transcript memory when controller refresh times out :: Hung inventory timeout leaves connected record and retained transcript intact.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle for adopted background PTY handles from the renderer title :: An adopted background handle resolves tui-idle from ready Codex renderer title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves live-leaf tui-idle from an OpenCode native title :: A live leaf resolves tui-idle from an OpenCode native title.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from a Codex ready prompt preview :: A supplied Codex prompt preview resolves tui-idle without an actual agent.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts :: resolves tui-idle from an Antigravity prompt before the model line :: A supplied Antigravity prompt before model line resolves tui-idle.\nsrc/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts :: refuses a requested shell with no workspace instead of creating a default-shell tab :: Workspace-less explicit shell must reject before renderer default-tab request or spawn. This real guard/wiring alarm is deliberately retired.",
+ "Audit3798 per-case accepted losses:\nsrc/main/runtime/orca-runtime-tests/paired-settings.spec.ts :: awaits navigation-only updates from paired clients (%s) :: Updating only claudeSubagentNavigationEnabled waits for the actual controller call to the supplied pending Claude-view reconcile for both on/off values.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: drops a client page record even when its close command cannot be issued :: A removed workspace loses its runtime client-page record and headless browser projection despite close delivery_required rejection, and emits the asynchronous warning.\nsrc/main/runtime/orca-runtime-tests/browser-capabilities.spec.ts :: leaves client-hosted pages alone when another host still owns the same worktree id :: Removing runtime:env-b metadata with local ownership leaves the local same-ID client page unchanged and issues no close command.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: marks live bindings again when reopening after a promoted window closes :: A reopened window marks its still-registered live worktree in activeWorktreeIdsOnShutdown after the first promoted window closes.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: preserves live SSH session identities when promoting a headless runtime :: Headless-to-desktop promotion records active worktree, SSH connection and remoteSessionIdsByTabId from the supplied surviving SSH PTY/session.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores a surviving renderer when its reload is cancelled :: A sole ready renderer reload cancelled under its current renderer fence returns true and becomes ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: restores headless authority when desktop promotion navigation is cancelled :: A cancelled desktop promotion with headless recovery returns false while headless authority remains ready.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: moves a desktop graph to unavailable when its reload times out :: A ready desktop graph without a headless fallback becomes unavailable at the reload deadline and retains its window/epoch.\nsrc/main/runtime/orca-runtime-tests/window-authority.spec.ts :: recovers a failed headless promotion and accepts a later renderer generation :: A promotion failure restores ready headless authority; a later valid same-window graph publishes ready desktop authority.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: clears a failed pane recovery so a later reconnect can retry :: After relay_reconnecting rejection, the pending recovery lock clears and the same pane/handle can call createTerminal a second time and return its supplied replacement.\nsrc/main/runtime/orca-runtime-tests/terminal-handles.spec.ts :: still preserves a CLI agent leaf when the reloaded renderer has not rebound its PTY :: An empty graph published during renderer reload preserves a preallocated live CLI PTY as one listable terminal before renderer rebind.\nsrc/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts :: keeps a no-incarnation handle across an in-graph pane remint :: Within one graph lifetime an unversioned PTY reminted onto another leaf retains its issued handle and resolves its old exit waiter after onPtyExit.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: matches explicit-id cwd PTYs when the resolved worktree cache is incomplete :: An explicit target absent from a fresh incomplete resolved cache adopts only its cwd PTY, rejects nested cwd PTY and does not rescan Git.\nsrc/main/runtime/orca-runtime-tests/terminal-listing.spec.ts :: ignores cwd-only controller PTYs for malformed explicit worktree IDs :: Malformed id:repo-1:: returns no terminals, does not adopt cwd-only controller PTY and avoids Git rescanning.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: refuses an SSH-backed create for mobile/runtime callers instead of creating locally :: Loss of this public unserved SSH create error-class/no-local-add/no-local-list alarm.\nsrc/main/runtime/orca-runtime-tests/ssh-worktree-lifecycle.spec.ts :: records an app-selected parent workspace as a manual action :: Loss of the local runtime folder-parent manual origin, active-workspace source and explicit confidence projection alarm; no claim that SSH or cleanup coverage replaces it.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: browses runtime server directories before projects are added :: Loss of this public runtime alarm for browse availability before registration, directories-first lexical ordering and native path flavor.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations.spec.ts :: lists drive roots for a server-root browse :: Loss of the Windows public slash-root drive enumeration smoke and presence of the temporary directory drive.\nsrc/main/runtime/orca-runtime-tests/repository-project-operations-part-02.spec.ts :: creates a missing runtime parent before creating the project directory :: Loss of this runtime createRepo recursive missing-parent/child existence and registered-path alarm.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: preserves selected project %s when a hosted parent is known :: Loss of both parent-selected and origin-selected normal fork-link projection/persisted upstream alarms plus exact single-probe count.\nsrc/main/runtime/orca-runtime-tests/project-setup-folder-remote-identity.spec.ts :: links a current enterprise remote despite unavailable metadata and a retained %s :: Loss of normal current-enterprise-origin linking with stale automatic GitHub avatar or protected file image, unchanged icon assertion, and serialized project identity under unavailable metadata.",
+ "Audit3788 retires10 authored/11 expanded cases across six changed drivers, including the entire screencast pending-frame-retry and usage-source-cache-streaming suites. Deliberate losses are false-refused last-frame retry/once-only delivery, ordinary stable-pane reattachment, cleared-chat Dispatch completion, terminal-declared chat-caller refusal, at-rest worker liveness projection, nested depth/cap policy, small unsigned6/sealed7 plain-format and verified-bit examples, generic malformed-ISIZE footer refusal examples, and synthetic10k/100k chunk-size/work-count budgets in gzip and general cache I/O. These include real state/disk/RPC outcomes consciously retired for marginal value; retained E2EE-backlog, receipt/custody/uncertain-ack, integrity/migration and staging-cleanup cases are not equivalent replacements. The footer test did not prove early rejection or bounded allocation; staging cleanup did not seed unrelated files. No replacement or fresh native/remote/performance execution is claimed. Earlier raw selectors and dated receipts remain historical.",
+ "Audit3779 retires17 authored/17 expanded registrations across six changed drivers, including the entire shared-Codex-home and prompt-telemetry suites. Accepted losses are shared-home wrapper noninterference/opt-out preservation, mocked metric count/provenance filters, SSH activity labeling/clearing and handover idle timing, VM ownership/capability/status projections and asleep-worktree refusal, a link-only external conversation replay sample, and two narrow input-credit noninterference/expiry examples. Retain the direct exact-tab/single-use input-credit case. These bounded real disk/state/routing alarms are intentionally retired for marginal value without equivalent replacement or fresh execution claims; earlier receipts remain historical.",
+ "Audit3772 retires18 authored/27 expanded cases, including whole Codex service opt-out, RPC capability-parser, creator-provenance, short-ciphertext and readiness-null suites. Accepted losses include service ledger/symlink/mode cleanup, user TOML substring preservation, old-hash cleanup, description pass-through, malformed-file/pending-hash examples, coordinator write/probe counts, capability array bounds, positive creator projections, early short-payload refusal and readiness helper null shape. Two redundant Codex exit-cause rows are also retired; Pi shares their direct-idle path only in this empty-output immediate-exit fixture, and future agent-config drift coverage is lost. Real bounded filesystem/parser/runtime alarms are deliberately retired for marginal value; no equivalent replacements or fresh execution are claimed. Earlier receipts retain their historical scope.",
+ "Audits3754/3755 intentionally remove9 authored/9 finite registrations: the entire one-case usage-source-cache-streaming.test.ts driver and8 cases from the surviving computer-action-validation.test.ts driver. This gate retains an unfiltered root Vitest command; UNIT_INCLUDE admits both source paths. Accepted losses are the real encoder output chunk-size/work-count alarm on repetitive10k/100k ownership payloads through a mocked durable sink, plus CLI diagnostic precedence, fractional window-id rejection, action-call-site window-target exclusivity, plain-text click-count recovery copy, incomplete click/drag targeting, mouse/modifier/direction allowlist samples and inline/stdin text exclusivity. These CLI cases exercise real argument/handler validation before mocked runtime calls; they are deliberately retired for marginal value, not declared tautologies. Retained cache I/O and CLI cases are not equivalent replacements for these alarms. Existing historical raw receipts remain unchanged and do not validate the deleted or reduced drivers. No fresh execution claim is made. Audits3758/3763 intentionally remove9 authored/11 finite registrations from6 changed drivers, including the entire pane-title-notification, window-linear-notices and worktree-card-lifecycle-effects suites. This gate retains an unfiltered root Vitest command admitting these paths. Accepted losses are same-account linked-row success-notice fanout, sidebar-switch channel forwarding, Linear-only notification forwarding/non-terminal-consumer selection/closed-window detach, destroyed-window refusal and first-send-failure suspension through the pane-title adapter, the100-card synthetic focus/poll absence sample, stored-source local folder badge refresh, unobserved-row badge refusal, and immediate reposChanged lineage invalidation. These exercise real owners with controlled ports; they are retired for marginal value, without equivalent replacement claims. The no-badge-work fixture does not seed its title-promised collection-only cache. Preserved historical receipts do not validate deleted or reduced drivers; no fresh execution is claimed. Audit3759 retires the entire one-case Tailwind compiler/scanner smoke. Accept loss of the direct CSS production/test/spec source-exclusion and rescan alarm; no replacement or current execution is claimed.",
+ "Audit3752 independently approves audit3749: retire five authored/five finite watcher-process registrations, retaining18 raw-exact registrations. Accept loss of healthy shared-pool joint recovery, last-pending-failure idle retirement/respawn, late VITEST fallback release, missing-entry fail-closed selection and independent-supervisor fuse locality alarms. These are real bounded host-policy alarms intentionally retired for low marginal value; no equivalent replacement is asserted. Remaining driver selections exercise controlled FakeChild supervisor lifecycle, cancellation, physical-exit fencing, recovery and fuse behavior. This source review supplies no fresh native/process/platform/remote/SSH execution; historical receipts retain original source and selector scopes.",
+ "Audits3738/3742/3743/3744 intentionally remove15 authored/21 finite registrations from six surviving drivers, with no equivalent replacement or fresh execution claim. This gate retains an unfiltered root Vitest command. Current UNIT_INCLUDE admits the partial push-service, metadata-dialog and two config/scripts browser drivers:10 authored/16 finite removals. Accepted losses: actual retry30s/60s progression and register bucket/refill wiring, explicit seven-day lease arithmetic (its notification lacked seq/epoch and never reached send), equal-name edit latch/save payload, real image/font/meta-refresh/form/popup browser refusal controls, and broad rich-markdown bridge/command/edit-select smoke. Actual production state, callback routing and browser enforcement run in these cases; these alarms are deliberately retired on marginal value. All drivers and selectors survive. Existing unrelated receipts remain historical evidence for their unchanged selectors, not proof of the reduced cases.",
+ "Audit3732 removes 2 authored/3 finite registrations from two partial suites: nominal custom/Kimi local naming success and deferred context usage row presentation. Real losses: custom/Kimi successful extraction through conversation-name sanitization and agentLabel composition; separate ordered counted/deferred lists and exact percentage/token formatting. No replacement or equivalent coverage claimed. Retain 11 authored/13 finite raw-exact registrations for bounded naming instruction/refusal/cancellation, menu dismissal focus ownership and hover/composer Escape/timer cleanup. Source-only bounded value review, no runtime/CI/native/remote/mobile/folder workspace or global completion credit.",
+ "Audit3733 removes2authored/2finite terminal input checks: fixed custom-cap error/secret fixture and three-emoji cap5refusal whose6UTF16units already trip length fast guard (no UTF8-dependent boundary). Accept exact non-disclosure/oversized-refusal alarm losses; no replacement/equivalence claim. Retain13/13scalar/pending input, OSC state and cron DST/cadence outcomes after bounded material reads. Source-only zero runtime/novelty credit; original historical reasons preserved.",
+ "Audit3729 removes1authored/3finite by deleting whole CLI runtime pairing advisory-close suite. Accept losing post-real-close injected EIO preservation of native/script/unreadable pairing, env identity/preservation and exact close/release assertions; no actual failed-close leak or replacement coverage claimed. Two retained URL grammar/identity suites11authored16finite raw unchanged. Bounded source/owner/caller value review, zero novelty/runtime credit; other seven3724deferred closures remain. Historical receipts preserve original limits.",
+ "Audit3724 removes3authored/3finite checks by deleting two whole suites: TUI clear burst-size singleton and terminal-file-URL target two-case wrapper suite. Deliberate losses: derived widest burst<64byte alarm, UNC authority+line-column anchor composition, and malformed-percent null refusal. Real production algorithms execute in those tests; no mocked-output tautology, equivalent replacement, actual Claude/file-navigation delivery or universal safety-irrelevance claim. TUI58byte bound and URI examples have low marginal value as standalone suites. Actual1262/1264/1742KEEP superseded explicitly. Remaining14drivers83authored136finite raw unchanged. Bounded source-only review; ten closures deferred, four bounded keep judgments repeated with zero new semantic-frontier credit. No runtime/CI/native/remote/mobile/folder/global completion claim; historical receipts retain original scope.",
+ "Audit3723 removes 4 authored/4 finite registrations in two whole suites: keybinding cache freeze/token spellings and host-dependent Orca command name examples. Real losses include returned-object freeze, repeated Mod+P key, Space/PageDown/NumpadSubtract mapping, unknown/empty/prototype-token rejection, and headless Linux versus Windows-server/WSL command choice. No equivalent or replacement coverage claimed. Retain 12 authored/21 finite raw-exact registrations exercising generated scaffold validation, artifact failures, shipped editor/hook/worker/panel tests, actual generated typing compilation, independent CLI root routing and intent-name precedence. Source-only bounded audit; no runtime, CI, native, remote, mobile, folder workspace or global completion credit.",
+ "Audit3720 removes17authored/23finite checks: whole main catalog-date adapter2 and shared date-helper7, seven renderer nominal ranking/cap/no-date/composition cases, and one browser registration expanding to seven forced-container/DOM-child boundary cases. Deliberate real losses: community oldest-date UTC forwarding, official/undated omission, date sorting/window/invalid/future/skew/clamp and default/override cap; nominal ranking/cap and combined Featured/Newly-added outputs; real CSS459/460,719/720,1055/1056breakpoint, five-card partial-row and720px two-card first-row alarms. Browser cases really measure rendered geometry but force width/remove DOM children; no fake-pixel or tautology rationale. No replacement/equivalent coverage claimed. Retain14authored/19finite raw-exact registrations across4drivers: adversarial featured category/order/tie and installability, date order/window selection, actual PluginManager failure/escaping/duplicate-card suppression, real browser viewport/odd-count geometry/phone catalog visibility, syntax ingress/depth/include/printability and68dlong-bracket auto-close fill-in. No tests/browser/native/UI/provider/remote/mobile/folder/CI/global execution or completion credit.",
+ "Audit3717 removes6 authored/6finite checks in two whole thin-adapter/presentation suites. Deliberate real losses: ordinary recipe repository-URL withholding and provisioned-root credential scrubbing/forwarding; repository label lockstep suffix expansion, host-scoped map identity/collision grouping, Windows crosshost paths and WSL distro suffixes. Actual provision options, label/sort consumers and host/scrubber delegates inspected; no replacement/equivalence claim. Retain40 authored/84finite registrations raw exact in14 drivers with bounded owner/context review. Prior KEEP superseded for removed suites; no runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit.",
+ "Audit3714 removes8 authored/39finite checks: whole CLI selector-recovery, task display-text and ANSI grammar suites plus two name joiner/blank tables. Deliberate real losses: selector flag/value/identity and mutation recovery merge/serialization; exact task suffix, transcript fallback, input immutability, cache reuse and edited blocks; independent failed-escape/resumption and OSC/DCS/BEL/ST/C1/nested/unfinished stripping outputs; meaningful-language joiner preservation and invisible/blank-name rejection. These are real bounded alarms, removed as narrow supplied-error examples, helper/token inventories and repeated internal-work fixtures. Prior2936,1195/1196,1214/1215 and1082 KEEP superseded; no replacement or equivalent coverage claimed. Keep9authored/9finite raw-exact registrations in5surviving drivers: screenshot export/failure filesystem behavior, CLI local tree query, event-local reply provenance, vault role-sensitive content and four hostile/UTF16/dangling/tag-name regressions. No native/UI/provider/remote/mobile/folder/runtime/CI/global completion credit.",
+ "Audit3711 retires2authored/4finite cases by deleting whole clipboard-image-temp-file signature-to-name inventory (HEIC/TIFF/unrecognised bytes) and workspace-last-active switch-on supplied visit/reason singleton, plus its now-orphan test fixture. This intentionally loses real generated-filename suffix/extensionless alarms and real newer-visit archived7day versus inactive30day filtering/older-visit identity alarms. Filesystem writing and production reason pruning really execute; no equivalent replacement or universal absence of safety relevance is claimed. The clipboard test does not inspect written bytes, native delivery or decode; the visit test supplies candidate/timestamps and does not exercise persisted visit routing or actual removal.20authored/20finite cases remain unchanged across4bounded Git/sidecar/removal drivers. No new runner/test/module evaluation or runtime result; historical notes and receipts remain historical.",
+ "Audit3707 removes10 authored/11finite checks: three whole renderer adapter/assembled-stage suites and two native projection cases. Deliberate losses: plugin URL/ref/default-version/local-path and unsafe credential refusal forwarding; real Task hook/store A→B→A late-save/list/count fences, owner disappearance, legacy-host convergence, query/history/eviction and same-ID host history; native child append ordered-ID/replacement and compound fallback/order/optimistic-admission/child-turn/duplicate/shrink/revision alarms. These are real bounded alarms; removal follows thin adapter, manually assembled Task pipeline and repetitive fixture value judgment, with no replacement or equivalent coverage claim. Prior1179/1182,1220/1221 and1885 KEEP superseded as applicable. Keep36 authored/38finite registrations raw exact across13 surviving drivers. No runtime/CI/provider/browser/native/mobile/remote/folder/global completion credit.",
+ "Audit3706 removes7authored/7potential cases from3renderer sources: whole usage-label3case and130000-distinct-day usage-overview singleton suites, plus3SSH grouping/ordinary-range examples. Retain11authored/11potential cases across6drivers in this bounded selection; no equivalent replacement or fresh runtime result. Existing bare root-unit commands admit this selection statically; prior command/receipt strings remain historical. Audit3706 intentionally retires first/second-order usage-group label collision alarms; equal50%-weekly bucket versus derived-weekly selection identity and Gemini wk label alarm;130000distinct-day aggregation no-spread-crash/max/intensity alarm; legacy absent-source SSH grouping and ordinary reverse-select/selected-target deselect range alarms. Actual label ambiguity and pathological-input crash are accepted losses. Distinct-day fixture spans~356years; no hard producer/date bound is claimed. Retained filtered-anchor/grouped-order guards do not replace removed deselection/reverse-range/legacy-group coverage. No native SSH, mounted renderer, live provider, remote/folder/mobile end-to-end or current runtime pass was obtained.",
+ "Audit3699 removes4 authored/4finite checks, including one whole xterm copy-policy suite and one root/group CLI help case. Deliberate losses: direct copy-chord admission for platform, selection, Kitty mode, defaultPrevented, logical/physical key and key phase; command-group disclosure and group help routing including claude-teams early return without RuntimeClient construction. These are real bounded policy/wiring alarms; no replacement or equivalent coverage claimed. Retain14 authored/19finite raw-exact registrations across6 drivers: unsafe CLI refusal, Claude model event carry and disk reconstruction/OSC-first case, attachment ownership/upload lifetime and mixed BMP file-reference/PNG-chip delivery, actual SQLite authority/admission/mutation, and Electron geometry/hit-testing. No runtime, CI, native-key delivery, external provider, mobile, remote, folder or global completion credit.",
+ "Audit3692 removes5 authored/5finite marginal Codex checks: unrelated login URL without notice; ordinary per-account launch resource/config materialization; no-retained-pane skip; preservation of a previously owed full scan through actual preparation and pending-marker update (no actual history scan/settlement); ordinary later-config refresh. Accept these exact branch/wiring alarms as deliberate losses without replacement. Retain32 authored/34finite raw callbacks/registrations/table bytes exact across14suites, including credential/admission refusal, grace/reset readiness, filesystem ownership, commit-dependent queue state, streaming/host trust, path canonicalization and private-state preservation. All14whole suites challenged without keeper quota; no whole deletion warranted on current concrete signals. No runtime/CI/native WSL/remote/mobile/folder/global completion credit",
+ "Audit3691 removes two complete runtime-home routing singleton suites (2 authored/2 finite): catalog wrapper mirror login-copy and passive transcript-lookup filesystem noncreation. Exact accepted losses are recorded in knownGaps; no replacement or equivalent coverage claimed. Audit3691: no dedicated alarm remains in the deleted sources for post-launch system login import through prepareHostCodexHomeForReadOnlyAppServer, or for repeated missing-transcript lookups leaving removed Codex account/runtime directories absent and userData entries unchanged. Ownership-marker read avoidance was never independently measured. No real catalog probe, provider, native Windows or crash was validated by those fixtures.",
+ "Audit3686 current Claude profile/account review removes5 authored/5 finite cases: whole structured-auth diagnostic-label suite3 and Windows-only command suite1 whose advertised cache alarm is ineffective because cache lifetime is per invocation; remove duplicate setup namespace-link refusal1 at wrapper layer. All5 exact historical KEEP are consciously superseded. Retain49 authored/50 finite unchanged, including filesystem privacy/recovery, route identity and concurrency, built worker/helper, legacy WSL alias compatibility and sign-in handoff. These are deliberate coverage losses without replacement. No runtime/CI/native WSL/macOS Keychain, remote/mobile/folder or global completion credit. Explicit accepted real losses: unknown-account host fallback and mixed-version/WSL-only structured auth diagnostic labels; Windows-only sentinel ENOENT-to-friendly-error translation plus fresh-call successful dispatch smoke; setup catch-to-refused wrapper and no-write outcome for a namespace symlink. The command case does not discriminate removal of its per-invocation noncache guard; it still supplies the error-translation alarm, which is intentionally retired. No replacement/equivalence promise.",
+ "Audit3680 removes eleven authored/eleven finite unit cases across four files, including entire launch setup row projection, structured legacy-model metadata, and legacy classifier suites. Accept loss of exact row partition/start selection, Codex supersession/default/unknown and Claude alias/suffix folding examples, other-agent exemption, getter/cache read budgets, same-array per-agent cache isolation, replaced-catalog metadata, and tracked-only model exclusion from structured and PTY legacy inventories. These are real narrow policy/metadata alarms intentionally retired without equivalent replacements. Retain real menu collapse/reopen in dropdown/select, AI picker cancel/accept and stale-effort filing, IME carry/gesture/frame transitions, and typed-flip versus held-dispatch fencing. No production or shared fixtures change. No dead timing entry exists for the three deleted drivers; retained timing keys stay unchanged. Static source-value review only; no project import, test runner, native/app execution or runtime validation established. Earlier receipts retain historical scope.",
+ "Audit3678 current-source reassessment removes20 authored/24 finite root-unit cases across7 retained test sources; all10 selected current drivers80 authored/93 finite were read, leaving60 authored/69 finite unchanged. Removed alarms are the in-memory WAL PRAGMA constant, ordinary latest-dispatch/gate-creation inventories, self-reported-failure and explicit-terminal retry policy rows, SSH/unsupported-provider output fallback labels, legacy typing no-op/retain-before-report/manual scheduling rows, exited output status and copied resume-session metadata, incomplete inventory deferral/reset cascade inventory, and nominal release/active-state/corrupt external history/stopped-abandoned outcome/generic close-exception rows. These are intentional coverage losses, not replaced alarms. Retained source includes actual SQLite rollback/custody, mutable transcript/deletion and saved-copy compatibility, cursor mutation, clear lineage, auto-release timing/restart/admission and concurrent recovery seams. Historical KEEP decisions are consciously superseded where stated in decisions.json. Source-only evidence; no runtime, CI, native, provider, remote, mobile/folder or global completion credit.",
+ "Audit3672 renewed by3676 removes four authored/four finite cases from federation-output.test.ts: nominal show/read routing and terminal-fallback projection; initial archive-table SELECT failure returning retained/no-close; simulated old-peer read/fleet/refusal and method inventory; and absent archive-release capability refusing release. These actual compatibility/guard alarms are intentionally lost without equivalent replacement; the dropped-table case never reaches capture or commit. Current selected frontier9 becomes5: retain actual temporary transcript parsing/path omission, current no-transcript release/unavailable-output/restart/replay regression, and three home deadline/stop nonmutation cases. Prior held-capture case was already removed upstream and receives no new removal credit; prior redacted snapshot archive behavior was rewritten upstream and is not claimed retained here. The surviving driver timing entry stays. Static review/private composition only; no actual peer/network/native/platform or fresh runtime validation.",
+ "Audit3671 removes14 authored/32 finite root-unit cases, including the whole WSL move-handler refusal suite, WSL preload object-presence suite and internal gate spelling truth table. Also retire the weak withheld-command non-array shape assertion, static serve-only Add/capability/mock-remove example, grammar scope equality and basic configuration/payload schema roundtrips. Genuine wrong-window/malformed-request/gate-before-work, exact gate spellings/platform/argv precedence, static serve-only routing, declaration mismatch and empty grammar/pair admission alarms are consciously lost without replacement; prior KEEP decisions are reconsidered. Seven unchanged authored/finite root-unit cases retain real image/provider/line budgets, live policy transition/capability broadcast, grammar resource/reference traversal and strict-versus-tolerant literal salvage. Source-value evidence only; no runner/compiler/build/app/native/provider/remote/mobile/folder validation or historical fault claim. Independently remove one authored/finite Playwright closed-gate app-boot inventory: accept loss of real renderer/preload/main refusal composition, saved-host row and Add/Move hiding/Remove visibility alarms. Keep the unchanged scripted-move rendered dialog lifecycle/reload case. It runs no real WSL migration, host connection, file copy or automation restoration. No selector or Playwright participation cleanup is required because the spec remains.",
+ "Audit3663 renews approved3644/3645/3648/amended3651 at privatec1ef: remove10authored/26finite across7changedtestpaths,4whole drivers; retain23authored/24finite including actualcmdkStrictMode defaultcursor race. Retire version1.5.0/1.5.1→shrinksImages capability threshold and launch-to-prompt wiring alarm. Surviving prompt tests explicitly supply capability and do not replace wiring coverage. Retire resolved-before-personOnly precedence; hook-gone/live-dialog guidance; stale-incarnation versus live-looking dialog classification; delayed/clipped warning extraction and wait-for-paint wiring; 3row setting/personOnly approve/deny/disclaimer suggestion composition;13row setting/reason/person/coordinator admission, close/mail attribution, terminal delivery/refusal/preanswered/personOnly/dropped-allow handler propagation alarms. Real state/access/SQLite effects occur; these genuine losses are accepted, not mocked-away. Retire full command extraction from serialized JSON in worker receipt and nontruncation alarm; no rendering, actual worker approval or native shell proof. Retire2row extra-source first/last order and controlled default cursor projection, plus generic open-palette livefolder add/remove render alarm. Explicitly supersede rawexact297KEEP refresh. Keep actualcmdk/StrictMode default cursor race driver; no default-suite loss claim. No equivalent replacement asserted. Retained queue/commit/retryownership/filebudget, terminalfreshness/provenance/competing-answer, RPC DB-effect, qualifiedfolder/runtimehandoff and lingering-reopen cases have distinct scope. Audit3675 preserves the upstream revised unreported-approval close regression, its escalation helper and adapted survivors. Source-only static renewal; no runner/compiler/app/native/remote/CI claim. Upstream41390host-owned approvalwatch/report lifetime reviewed separately; no new lifetime test removed. Preserve all earlier metadata/evidence.",
+ "Audit3634: Remove five authored/five finite cases, including the complete structured chat terminal-refusal, terminal-plus-agent worker-start validation, and canonical Git common-directory parser suites. Also remove the gh free-text -R argument projection case. Consciously supersede prior KEEP decisions and accept chat-versus-stale redirect classification, real RPC refusal-before-SQLite-Dispatch, old-Git echoed-option relative-path parsing, WSL execution-space resolution, and free-text preservation/bare-repo qualification alarms. These are genuine narrow alarms, intentionally retired without equivalent replacements. Retain real Git stdin/EOF delivery, bound-account host admission, naming environment/account precedence, upload iterator cancellation and remote path confinement. Shared fixtures and production code remain. Remove only the dead canonical-repo-key timing entry. Static source-value evidence only; all prior evidence retains historical scope.",
+ "Audit3636: Remove the entire maintenance opportunity internal-count driver (one authored/two finite cases), the mocked remote worker start-card argument case (one/one), and the follow-up heading mapping table (one/two). Root-unit discovery loses three authored/five finite cases. Independently remove four Python native screenshot methods/five statically enumerated subTest scenarios: grim argv/stub payload, failure-code mapping, X11 mocked capture payload, and capability flags. The Python lane is verify:computer-native and is not root Vitest. Accept loss of exact native command/projection and exception/capability alarms, ready-only card publication arguments/agent forwarding, and serialized follow-up heading mapping; no equivalent replacement is claimed. Retain actual ownership/mail/queue/reopen transitions, remote lost-response fencing and first-result settlement, filesystem/maintenance admission and successor progress, wrong-region screenshot refusal and Sway geometry. The whole-deleted new driver has no timing key; this component requires no timing cleanup. No production changes. Static source-value review only; no project import, runner, app, native desktop or runtime validation established. All prior evidence retains historical scope.",
+ "Audit3630 removed orphan delete/toggle capability/precondition and run/edit refusal assertions. Real dispatch, mutation fencing, mixed-version and host outcomes are not established by this removal or by a substitute test.",
+ "Audit3624: Remove one authored/five finite positive Gemini identity table from the Claude/Gemini title collision driver. The real normalization, legacy label and explicit title evidence owners execute, so ordinary Gemini marker/name/wrapper recognition and normalized-label composition alarms are consciously retired without equivalent replacement; these five supplied title-to-literal identity examples have low marginal value. Preserve the six-row Claude task-text collision oracle, whose unrelated CLI mentions must not rebrand or destructively normalize titles. The other audited drivers preserve real permission-mode session transitions, prompt secret/fence/bounds defenses, JSON-to-Ask option/preview preservation, and optional GitLab failure summary/trace composition. Root-unit discovery loses one authored/five finite cases; no whole driver or timing key is removed. No actual terminal stream, UI routing, application/native or runtime execution established; all prior evidence retains historical scope.",
+ "Audit3618: Remove three authored/three finite browser reload cases, including the complete renderer reload-actions suite. Agent bridge fake did-fail-load plus permanently supplied manager error projects description/code into a rejection. Renderer seeded empty metadata projects a saved URL into plain webview src; its earlier not-ready case projects a live-id/throwing fake reload into absence of a loading patch. Real queue/wait/error/cache/classifier/hook code executes, but these narrow supplied-state and exception-to-callback wirings have low marginal value; no rerender, lifecycle, actual cache generation/retirement or guest commit is asserted. Explicitly supersede audit1822 not-ready KEEP and preliminary3617 cross-module retain opinion, accepting offline-reload failure reporting, empty guest to saved URL routing, native-reload bypass and premature-loading/stranded-state alarms without replacement. Retain distinct main cancellation queue progression and absent queued side-effect dispatch. Root-unit discovery loses three/three. No Electron guest, network failure, restored navigation/commit, app/native focus or runtime execution established; earlier evidence retains its historical scope.",
+ "Audit3614: Remove thirty-one authored/thirty-nine finite potential cases across CLI format and argument drivers, including three whole suites: search-result/status sanitation sites, Linear issue/list/warning sanitation sites, and quote-stripped JSON diagnostic secret non-echo. Those real formatter/guard transformations execute on supplied strings; intentionally retire their field-specific CSI/OSC/C1/newline/bell and diagnostic secrecy alarms as low-value caller/output inventories, without replacement. Also retire twenty-one search registrations/twenty-four finite cases covering minimal positional request/default omission, exhaustive all-flags request projection, nominal named query/index routes, repeated syntax/agent examples, enum/agent/path-count/timestamp/numeric/cursor admission examples, unknown/browser flag examples and postcommand last-wins projections; retire one parser sentinel-only case. Keep actual ambiguity, conflicting index request, precommand/crosscommand scoping, variadic reference parsing and missing-repeatable-value controls, without claiming equivalent coverage. Root-unit discovery loses all twenty-nine/thirty-seven. No CLI/RPC/terminal/PowerShell/host/schema/runtime execution is established by this source-only audit; earlier evidence retains its historical scope.",
+ "Audit3609: Remove the complete pnpm CLI invocation literal-selection suite (eleven authored/nineteen finite potential cases), with no replacement claimed. Root-unit discovery loses JavaScript-versus-native command selection, npm/npx executable rejection, Windows cmd/bat casing and shell selection, non-Windows cmd behavior, native PNPM_HOME flat/bin preference, explicit-path priority, relative-home rejection, missing-native fallback and non-Windows home-probe refusal alarms. The suite called the real resolver with independently expected objects, but exercised no pnpm/node/cmd process, installed native executable or real filesystem probe. Earlier KEEP decisions are consciously superseded by accepting these narrow branch and probe-inventory alarms as low value. Real symlink entry, Git signing isolation, Bun filesystem/Node child normalization and compiler scheduling/continuation tests remain distinct tests, not equivalent coverage. No runner, compiler, app, platform or remote execution was performed in this source-only audit. Earlier evidence retains its historical scope.",
+ "Audit3598: Remove seven authored/nine finite literal-table potential test registrations across workflow routing, Claude cold-start and real-zsh preexec drivers. Root-unit discovery loses six authored/six finite: three test-local workflow parser fixtures, the five-positive/three-negative explicit command-paint route inventory, a boot-banner-before-composer sample and an already-painted bare-title positive sample. The separately selected shell_contracts live-shell driver loses one authored/three finite raw-capture paint-only cases across three hook configurations; its real-wrapper launch-order, four rechunkings (twelve finite) and runtime-wait replay remain, without claiming equivalent replacement. Intentionally lose those parser, exact routing-list, banner, post-paint subscription and native-read-boundary paint alarms. Retained workflow/UNIT_EXCLUDE/classifier cross-source routing checks and readiness-race-to-writer timing are distinct bounded alarms. No runner, real shell, PTY, app, native focus, remote delivery, cross-platform execution or full-feature correctness is established by this source-only audit. Earlier evidence retains its historical scope.",
+ "Audit3591: Retire the whole one-case background journal-producer attribution suite and the fabricated malformed-details-block case (two authored/two finite cases). Intentionally lose the fixed own-task versus output/foreign-task attribution examples across flat/message row shapes, missing-root classification, and direct unbalanced/detailsish fabricated-block rejection alarms. Retained parser sibling/depth and editor navigation tests do not replace these alarms. No equivalent replacement or fresh runtime, transport, persistence, native focus or rendered UI validation is claimed. Earlier dated text and evidence retain their historical scopes.",
+ "Audit3592: Retire the whole three-case shared agent smart-key resolver suite, explicitly superseding its Audit3238/3237 keep decisions. Intentionally lose literal permission-versus-question classification, longest-question digit selection, Codex async-question opener/digit/Enter/skip mapping, and unsupported-agent/state/prompt refusal examples. These were real parser/selection and literal-byte alarms; they did not exercise terminal delivery or timing. No equivalent replacement or fresh runtime, native TUI, mobile, remote or performance validation is claimed. Earlier dated text and evidence retain their historical scopes.",
+ "Audit3587/3588: Retire six authored/fourteen finite cases, including the whole WSL stopped-notice and connecting-status selector suites. Intentionally lose direct WSL retry connection field/target/ready-epoch/null-guard examples, connecting/reconnecting distro and absent-state selector samples, and stopped/connecting notice text/button/data-attribute examples. Retained host-ready retry and content-loader/reload lifecycles do not replace these alarms. No equivalent replacement or fresh runtime, native WSL, remote, rendered UI or performance validation is claimed. Earlier dated text and evidence retain their historical scopes.",
+ "Audit3580: Retire the whole one-case runtime host environment prototype/subclass suite. Intentionally lose the exact configured lower-case Windows Claude home to account-identity normalization and host-account override precedence alarm previously retained by Audit3129. No equivalent replacement or fresh runtime validation is claimed. Earlier dated keep statements below describe their historical source scope; the current suite is removed.",
+ "Audit3563 scope: retire the whole Kiro OSC/hook identity suite and the OpenCode2 identity-only case; reduce Codex cached startup child-retirement and missing-session-ID tables to one case each (2 authored/4 finite removals). Intentionally lose Kiro alias/session continuity, OpenCode2 completed OSC identity continuity, cached replacement without relay-generation restart, and missing-previous-ID context-preservation alarms. Remaining provider, remote compatibility, persistence and cross-session pollution cases are not equivalent replacements. Also remove the private Codex roster-size assertion while retaining public child-absence checks. Historical evidence retains its original source scope; no new execution or transferred pass validates these reductions.",
"Launch direct-owner cleanup current scope: This gate’s unfiltered unit command now selects a suite reduced by 82 whole registrations / 159 potential table examples in 10 whole test Programs, including 8 registrations / 15 examples from five once-registered create-message factory closures. Lost alarms include frozen first-message/options and legacy-host fallback; distinct actions and redelivery; uncertain/refused/reloaded input custody, Retry and late proof; rich prompt/attachment upload Stop/close and handback; ordinary draft/editor/IME/StrictMode lifetime and accepted topology; provisional fallback tab placement/group/pin/order and rich worktree handoff. Four whole consent/resume-identity cases remain in two Programs; they do not replace these alarms. This entry governs current reduced-unit scope and qualifies any broader implication of unchanged oracle/coverageNotes history. Entire dated evidenceRuns, original commands/currentCommand values, counts/results and existing history retain their original scopes only; no fresh execution, transferred pass, replacement equivalence or prior upstream-removal credit is claimed.",
"Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/persistence/worktree-sort-order-write.test.ts: re-ranks every writable row when a blocked row sits in the requested order. src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts: continues skill management after startup recovery fails. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts: uses bounded ownership lookup for direct arrivals while the agent cannot take input; wakes a bound Run waiter when same-Run direct mail arrives; keeps an unowned detached-recipient message in its direct mailbox; uses primary-key lookups for bounded routing updates. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts: remove only literal registration import/call pairs import './orchestration-mailbox-pointer-cli-command.spec'; no additional authored credit. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts: renders the %s CLI command in a mailbox pointer. src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts: sizes a slow high-latency link near twice its bandwidth-delay product; never paces a LAN, even when its client parses slowly; never paces a fast link; returns to legacy windows when the path RTT jumps. src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts: steps down the row ladder when history is over the byte budget; tries the larger first row count, then the usual ladder within the same byte budget. src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts: returns unknown when route inspection fails or emits malformed data; does not inspect routes outside Windows. src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts: is refused to a paired %s client; reports a failed widening instead of advertising an unreachable address. src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts: reports exited only when the owning runtime completes the exit waiter; reports unverifiable when the runtime cannot observe the exit waiter; reports unverifiable when a disconnected PTY resolves with unknown liveness. src/main/runtime/session-graph/headless-runtime-graph.spec.ts: lets a session tab inventory settle on a host no renderer publishes for. src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts: remove only literal registration import/call pairs import { registerHeadlessRuntimeGraphTests } from './headless-runtime-graph.spec', registerHeadlessRuntimeGraphTests(); no additional authored credit. src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts: bumps the stored snapshot version only when the title changes. src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts: keeps the healthy aggregate verification and delayed physical exit behavior; uses a stamped exit for the incarnation that was actually being closed. src/main/runtime/terminal/identity/terminal-identity-probe.test.ts: answers live for a structured worker without touching the PTY graph; answers live for a PTY handle the runtime still holds; runs the full leaf check for a handle with no live PTY; answers not-live for a stale handle; propagates \"could not look\" rather than reporting it as a dead handle. src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts: names the tab in main’s layout through terminal.rename; takes a window-style layout.apply close as already stopped, so the terminal runs on. src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts: retains no lifecycle generation after a spawn/exit cycle. src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts: reads a freshly spawned terminal as used once a user opens its tab, not on a probe; keeps the open mark on the process a user open starts. src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts: from a desktop window that mounts both panes; from a server with no window. src/main/runtime/terminal/surface/workspace-layout-projection.test.ts: carries views for a partition that holds none yet. src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts: releases a signalled exit-waiter when the signal aborts. src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts: selects a local hook status for a local pane. src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts: keeps the footer and the bare caret on screen mid-turn; %s: the screen alone reads ready during %s. src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts: uses per-launch arguments and preserves launch telemetry; attributes a startup agent whose caller named no surface as unknown; launches %s bare for an absent or blank prompt; attributes a %s draft launch named %s as %s; merges an automation's extras over the host defaults; threads worktree-create extras into the startup build; returns an enabled requested agent without detecting; returns the default when nothing was requested; detects instead of using the default when the requested agent is disabled; starts no agent when the default is blank; detects an enabled agent on this host when nothing usable was named; starts no agent when detection finds none. src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts: pastes and submits through composer readiness, never typing raw input; types the follow-up on WSL or SSH-to-Windows once the agent is in front, as before; cleans up the deadline when the composer was already captured; a draft that is not submitted is pasted on the box cursor, as before; takes the box after the grace when the row never comes, whatever repaints; takes the box at the deadline when the grace would outlast the budget; lets a dialog on screen veto a grace; refuses the deadline inside a pending grace while a shell is in front; takes the box at the deadline inside a pending grace with the agent in front; takes the box at the deadline after a refused grace once the agent is in front. src/main/skills/skill-install-transaction.test.ts: installs, previews unchanged bytes, and updates a clean receipt-owned skill; preserves the old version after a %s filesystem failure. src/main/speech/model-manager-download-resume.test.ts: requests the remaining bytes when a clean range response ends before the file total; bounds a server that advances by pathologically tiny segments forever. src/main/ssh/config/ssh-config-parser.test.ts: parses a basic host block; parses multiple host blocks; skips wildcard-only Host entries; skips Host entries with only pattern characters; parses IdentityFile with ~ expansion; parses Windows-style IdentityFile with ~ expansion; parses quoted scalar values like OpenSSH; parses equals-form scalar directives; parses IdentityAgent with ~ expansion; parses IdentitiesOnly; parses GSSAPIAuthentication; keeps the first GSSAPIAuthentication value like OpenSSH; parses ProxyCommand, ProxyUseFdpass, and ProxyJump; ignores comments and blank lines; handles case-insensitive keywords; stops current block on Match directive; returns empty array for empty input; creates one parsed host per concrete alias on a multi-pattern Host line; applies identity agent settings to every concrete alias on a multi-pattern Host line; defaults port to 22 for invalid port values; converts hosts to SshTarget objects; uses host alias as hostname when HostName is missing; skips hosts that are already imported; defaults username to empty string when not specified; carries through identityFile, identityAgent, identitiesOnly, proxyCommand, and jumpHost; carries through gssapiAuthentication; imports duplicate aliases only once and keeps the first concrete host; maps hosts for the picker and flags aliases already in Orca; de-dupes aliases and defaults missing fields; parses hostname, user, port from ssh -G output; collects multiple identity files; parses forwardagent yes; defaults port to 22 when missing; returns empty hostname when missing; returns undefined user when missing; handles empty output; skips lines without spaces; parses proxycommand and filters \"none\"; parses proxyusefdpass yes; parses proxyjump and filters \"none\"; handles ~ expansion in identity file paths; handles Windows-style ~ expansion in identity file paths; parses identityagent with ~ expansion; preserves identityagent none so auth can disable agent fallback; parses identitiesonly yes; parses gssapiauthentication; parses controlmaster options and filters controlpath none. src/main/ssh/config/ssh-known-hosts-source.test.ts: splits the space-separated list ssh -G prints on one line; expands ~ in a reported path; keeps a double-quoted path containing spaces whole; falls back to the default files when ssh -G reported nothing; drops an explicit none without falling back to the defaults; splits both known_hosts lists on one line each; reads StrictHostKeyChecking, including accept-new; reads HostKeyAlias and prefers it for the lookup; reads the non-default port; reports that the lookup came from an alias, so the port is not appended; reports no alias when the dialed host is used; unions the entries of every file; skips a path that is a directory; returns nothing when no file can be read; reports nothing unreadable when every file parses; does not count an empty file as unreadable; prefers HostKeyAlias over the resolved hostname; uses the dialed host, because a resolved hostname can just echo the label; still prefers an explicit HostKeyAlias over the dialed host; falls back to the dialed host when nothing was resolved; is rejoined when the split fragments resolve to nothing; leaves a single unresolvable path alone rather than inventing one; expands the __PROGRAMDATA__ token rather than passing it through as a path; does not rewrite a path that merely BEGINS with the token characters; keeps a drive-letter path with mixed separators intact; splits a spaced Windows home into the fragments the rejoin has to put back. src/main/ssh/config/ssh-known-hosts.test.ts: reads the algorithm from the blob rather than trusting the line; rejects %s; refuses a malformed blob: %s; uses the bare host on the default port; tries the bracketed form first and falls back to bare off-port; matches an exact line; matches case-insensitively; reports a changed key of the same type; reports unknown for %s; matches any host in a comma list; matches the bracketed form on its port; does not apply a bracketed entry to the default port; falls back to a bare line when off-port; never reports a change from the fallback pass; matches a bare literal on the default port; matches a bracketed literal on its port; reports a change for a literal; handles %s; still reports a change for a different key on a revoked host; skips a line carrying an unrecognised marker; does not report a change when only another key type is on file; matches within the same type; accepts CRLF terminators; skips blanks, comments and surrounding whitespace; accepts a hit regardless of which file holds it (%s); never brackets the alias, whatever the port; still brackets an ordinary host on a non-default port; matches a bare alias entry on a non-default port; still accepts the unmodified key field; accepts a hashed entry whose salt is a full SHA1 digest; still accepts the unmutated ssh-keygen -H vector; falls back to the bare host line on a non-default port, as ssh did; refuses a key type it has not seen for a host it knows, as ssh did. src/main/ssh/connection/ssh-connect-config.test.ts: returns undefined when no default keys exist; returns the first existing key file; probes regular and FIDO2 keys in stable default order; keeps a regular default ahead of a malformed FIDO2 default; uses target host/port/username; falls back to resolved config when target fields are empty; keeps imported endpoint fields as the fallback when ssh -G is unavailable; sets readyTimeout to CONNECT_TIMEOUT_MS; sets keepaliveInterval to 15s; enables keyboard-interactive auth so MFA challenges can be answered; uses agent auth when no explicit key and SSH_AUTH_SOCK is set; enables agent forwarding when OpenSSH config requests it and an agent is available; does not enable agent forwarding without a usable agent; resolves IdentityAgent SSH_AUTH_SOCK from the environment; uses the Windows OpenSSH agent pipe when no environment socket is available on Windows; wraps agent auth with IdentityFile filtering when IdentitiesOnly is enabled; applies a manual target IdentitiesOnly setting when ssh -G reports it off; includes unencrypted target.identityFile auth when an agent is available; defers encrypted target.identityFile auth when an agent is available; uses keyFile auth when target.identityFile is set and no agent is available; includes unencrypted resolved identityFile auth when an agent is available; defers a default-path resolved identityFile to the no-agent retry; offers the keyboard-interactive challenge when the agent defers no key; provides fallback key when no agent is available; can force private key inclusion for the post-agent fallback path; falls back to resolved proxyCommand; returns structured jump-host config for target.jumpHost; returns structured jump-host config for resolved proxyJump; returns undefined when no proxy is configured. src/main/ssh/connection/ssh-connection-auth-fallback.test.ts: resolves OpenSSH config using configHost when present; tries ssh-agent before reading an explicit private key; falls back to direct private key auth when agent auth fails; falls back to direct private key auth after too many agent authentication failures; answers bounded keyboard-interactive challenges such as Duo 2FA. src/main/ssh/connection/ssh-connection-store.test.ts: lists picker suppression aliases without consulting re-adoption tombstones; getTarget delegates to store; addTarget generates an id and persists; saves the CLI control switch as given, with no consent stamp; addTarget stamps source as manual by default; addTarget preserves an explicitly provided source; inserts a new config host stamped as ssh-config; asks the parser for all hosts — reconciliation happens in the store; updates an existing config-sourced target when the port changed; refreshes gssapiAuthentication on sync; never overwrites a manual target that owns the alias; does not rewrite an unchanged config-sourced target; returns empty array when nothing changed; tombstones a deleted config-sourced host so re-import skips it; suppresses a deleted manual target from config discovery; re-adding a deleted host reclaims its alias so sync stops suppressing it; editing a target reclaims its alias from the deleted set; records a tombstone when removing any user-facing target; re-adopts orphaned repos when the same host is re-added. src/main/ssh/connection/ssh-connection.test.ts: transitions to connected on successful connect; captures the negotiated SSH server key fingerprint; allows concurrent exec commands for ssh2 transport; removes startup listeners after ssh2 connect succeeds; scopes lifecycle events and pending handshake timers to one mock client; enables TCP_NODELAY on the new ssh2 client after a reconnect cycle; transitions through connecting → connected states; reports error state on connection failure; disconnect cleans up and sets state to disconnected; getTarget returns a copy of the target; getState returns a copy of the state; throws when connecting a disposed connection. src/main/ssh/orcad-migration-stuck-host-profiles.test.ts: never leaves a running terminal behind; is offered only when leaving saved state behind would clear the refusal. src/main/ssh/orcad-runtime-maintenance.test.ts: keeps a connect from retrying a build an explicit Update also failed; offers Force when Update was refused by policy; forwards anew after an activation, since the new slot may bind another port; passes a refusal through and leaves the server linked; forwards anew once a serving slot is restored, which may have bound another port. src/main/ssh/port-forwarding/ssh-port-forward.test.ts: reports the port the OS bound when an ssh2 forward asks for port 0; adds an ssh2 port forward and returns entry; adds a system SSH port forward when no ssh2 client is available; reports the port a system SSH forward resolved when asked for port 0; passes resolved OpenSSH config to system SSH port forwards; disposes a system SSH tunnel when removing the forward; lists forwards filtered by connectionId; removes a forward by id; awaits forward close when removing a forward for user actions; returns null when removing nonexistent forward; removes all forwards for a connection; dispose removes all forwards; stores label in the entry; preserves the existing id when updating a forward succeeds. src/main/ssh/ssh-channel-multiplexer.test.ts: sends a JSON-RPC request and resolves on response; assigns unique request IDs; sends notifications without expecting a response; dispatches incoming notifications to handler; sends one keepalive frame per cadence tick; drives keepalive sends AND dead-link detection from a single interval; resolves false immediately on a disposed mux; throws on request after dispose; reports isDisposed correctly; clears registered handlers on dispose; does not retain handlers registered after dispose. src/main/ssh/system-transport/system-ssh-forward-process.test.ts: spawns exactly the argv the orphan matcher is given, LogLevel=INFO included; runs port forwards unmultiplexed even when ssh_config disables muxing; preserves manual target port and identity options in the forwarded ssh command; does not spawn ssh when the requested local forward port is already in use; spawns ssh after the requested local forward port preflight succeeds; resolves startup after the grace period when ssh keeps running; sends SIGTERM then SIGKILL when the process does not exit; does not resolve stop until the process exits. src/main/ssh/system-transport/system-ssh-loopback-route.test.ts: dials the held forward ahead of the alias so OpenSSH keeps these over ssh_config; drops a manual target's own port and proxies, which would fight the route; never routes a forward, whose argv must stay stable for orphan recovery; %s → %s; opens the forward over the real proxy, then proves a login over the route; lands the forward on the sshd and known_hosts name the direct route resolved; holds the forward with server-alive probes; never lets the background forward or probe ask for credentials; starts no forward when admission refuses the route; stops the forward when sshd refuses logins over it; stops the whole forward process tree on Windows, once; reports a forward that already exited before anyone listened for it. src/main/startup/browser-process-user-agent-ordering.test.ts: explains admission refusal before a desktop launch exits; explains an orcad holding the profile instead of exiting silently; does not acquire profile admission for a duplicate launch; executes after the dev app name and before later preflight work; exits and releases admission after pending profile move recovery fails; keeps Linux background startup failures console-only and immediate; keeps Linux serve startup failures console-only and immediate. src/main/startup/quit/quit-path-durable-write-blocking.test.ts: store.flushAsync() issues no synchronous fs syscalls; store.flushAsync() also moves the active-view and github-cache sidecars off the thread; stats.flushAsync() issues no synchronous fs syscalls; Grok session cleanup issues no synchronous fs syscalls; stats.flushAsync() closes out live agents before it returns, not when its write lands; a stalled mount leaves the event loop live instead of parking it; store.flushAsync() is one idempotent final barrier; store.flushAsync() resolves instead of throwing when the profile mount rejects writes. src/main/stats/agent-session-transition-recorder.test.ts: counts a hook-only agent that never writes an agent-shaped terminal title; never opens a session from a replayed or disk-restored working status; still closes a live session when the terminating status arrives as a replay; counts one session per turn across repeated working/done cycles; closes an open session when its pane is torn down; bounds the mirror and closes what it evicts; stops the session when the main agent settles and only a watch loop holds the row working; keeps the session open while a subagent outlives the main agent, and closes it when the child settles; dates the stop by the evidence when a shell outlives the last subagent; opens a new session dated by the observation when the main agent resumes after monitoring; never dates a reopen before the close a fact-less OSC repaint caused; dates the first live row after a restored one by the evidence, not the restored clock; treats an unchanged answer as a snapshot, never a transition; opens only on a live working edge; closes only a session it opened. src/main/text-generation/commit-message-text-generation-model-discovery.test.ts: returns static catalog models without spawning for static agents; discovers dynamic models through the agent CLI; discovers dynamic models through the configured agent command override; falls back to static models when dynamic discovery returns no parseable models; falls back to the first discovered non-Pi model when its static default is unavailable. src/main/text-generation/pull-request-context.test.ts: does not fetch unrelated fork remotes before generating PR context; bounds exact remote-ref probe concurrency for a large remote list; reports no branch change because PR context preparation is read-only; keeps a remote-qualified base when the selected base includes the remote. src/main/text-generation/source-control-local-process.test.ts: asks the supervisor to stop and leaves its group to it; signals nothing once the supervisor has exited; stops an agent that ignores its stdin end through its supervisor. src/main/updater/linux-package/linux-package-update-recovery.test.ts: retains the downloaded package with the digest from the event metadata; requires a string downloaded path; accepts an uppercase extension; requires a non-empty string version; matches an absolute file URL by basename; accepts duplicate entries that agree on the digest; refuses an entry with a missing or non-string digest; refuses a digest that is not base64 at all; refuses a malformed percent-encoded URL; refuses a missing or non-array file list; tolerates a non-object event; replaces the retained artifact with a newer download; keeps the retained artifact when a new download has no usable digest; keeps the retained artifact when an unrelated download event arrives; clears the retained artifact; preserves the artifact across a recheck of the same version; clears the artifact when another version takes over; preserves the artifact for an unknown or empty version; is a no-op without a retained artifact; returns the built command and package file name for a verified package; reports missing without a retained artifact; propagates a package-manager discovery failure; rejects a well-formed digest that belongs to another file; never hashes a package that a malformed digest failed to arm; rejects a path outside the cache root; rejects the cache root itself; rejects a package in the updater directory itself; rejects a pending directory that is a symlink out of the cache; performs one hash pass for concurrent requests; revalidates once the in-flight pass settles; does not reuse an in-flight pass for a different artifact; starts a fresh proof when the same package is captured again; returns the verified package path; returns missing without a retained artifact. src/main/updater/releases/updater-prerelease-feed-readiness.test.ts: accepts a GitHub %s asset redirect as ready; reports a GitHub asset request error as unavailable; reports not-ready with a verified last-good tag when the newest assets are unavailable; does not classify a non-positive tag limit as feed unavailability; reproduces the v1.4.142 publishing incident as not-ready; reports transport failures as unavailable instead of not-ready; treats an explicit asset 404 as not-ready when another asset is unavailable; accepts absolute manifest asset URLs without rewriting them to release asset paths; returns not-ready with an older ready update as last-good while newest is publishing. src/main/updater/releases/updater-release-builds.test.ts: lists hourly builds from the dedicated repo, newest first; lists daily builds from the dedicated repo, newest first; separates stable from rc in the shared main repo; skips drafts and unparseable tags; keeps a composed release title and drops one that repeats the tag; hides builds that published no artifact for this platform; returns an empty list when no build has this platform artifact; keeps mac builds visible on macOS regardless of the Windows leg; resolves the platform installer download url; leaves the installer url null when the release published no installer; tolerates a release whose assets are missing or malformed; sends the local gh token as a bearer header when one is available; sends no authorization header when gh has no token; retries unauthenticated once when GitHub rejects the token; does not retry a 401 that was already unauthenticated; falls back to the per-IP bucket when the token is rate limited and tells the gh breaker; reports a secondary limit carrying retry-after without retrying or tripping the breaker; records a primary limit in the token scope %s; keeps %s authenticated when only %s is blocked; skips the token while its scope %s is blocked; surfaces a rate limit with its reset time and a sign-in hint when unauthenticated; omits the sign-in hint when the rate-limited request was authenticated; treats 429 as a rate limit; reports a 403 without rate-limit headers as a plain HTTP error; reports a missing hourly repo distinctly; is null when GitHub sent no reset; prefers retry-after over the primary reset epoch; falls back to the primary reset epoch when there is no retry-after; reads retry-after as seconds; reads retry-after as an HTTP date; pins an hourly tag at the hourly repo download path; pins a daily tag at the daily repo download path; pins a stable tag at the main repo download path; rejects a tag that is not a version. src/main/updater/updater.build-channel-selection.test.ts: uses the display label in the unsupported-platform %s pinned-build error; still pins %s from an unsigned Windows dev build; restores ordinary release checks after local build selection fails; opts into the RC channel when checkForUpdatesFromMenu is called with includePrerelease; pins the generic feed to a perf-tagged prerelease when requested; surfaces no-update feedback when no newer perf-tagged prerelease exists; keeps prerelease publishing-window misses on the generic retry path; leaves the feed URL alone for a normal user-initiated check. src/main/updater/updater.check-preflight.test.ts: ignores a stale update-not-available event after a new check starts preflight; deduplicates repeated manual checks while the immediate checking status is active. src/main/updater/updater.prerelease-fallback.test.ts: retries a prerelease check once against the previous feed tag when the manifest is missing; surfaces a promise-only prerelease fallback failure after the primary error event. src/main/updater/updater.publishing-window-feed.test.ts: repins the generic feed to the newest RC tag for a prerelease user; repins the generic feed to a newer stable tag for a prerelease user; pins a stable fallback when Atom has no newer prerelease; uses last-good concrete feed when a user-initiated check lands during publishing; can offer an older fully published update while the newest release is publishing; keeps background publishing-window fallback on the short retry cadence. src/main/updater/updater.quit-and-install.test.ts: surfaces an accepted retry before electron-updater emits download progress; defers quitAndInstall and runs its launcher within the launch PATH scope; runs pre-quit cleanup before local PTY cleanup during update install; keeps optional pre-quit cleanup fail-and-continue behavior by default; ignores duplicate quitAndInstall requests while the shared delay is pending; arms the forced-exit watchdog once the install commits; disarms the forced-exit watchdog when sync install error recovery keeps the app open. src/main/window/createMainWindow-markdown-editor-focus.test.ts: ignores traffic light sync IPC on non-macOS; still intercepts Cmd+Shift+B and Cmd+Alt+B when the markdown editor is focused; coerces non-boolean setMarkdownEditorFocused payloads to false; opens a table-aware context menu synchronously without a renderer query; builds the plain edit menu for the one right-click the renderer marks as plain text. src/main/window/createMainWindow-renderer-crash-recovery.test.ts: notifies the caller when the renderer process is gone; passes the renderer webContents id through crash recording and recovery callbacks; forwards expected renderer teardowns so the recorder can diagnose suppression; reloads the app shell after an unexpected renderer process loss; does not reload after renderer loss when recovery is disabled; stops auto-reloading after a rapid renderer crash loop trips the breaker. src/main/window/dashboard-popout-window.test.ts: updates the title after language initialization and unsubscribes when closed; lets its preload expose saved WSL hosts in serve-only, and passes nothing otherwise; creates a native-frame window with the shared preload and no webview surface; shows the window on ready-to-show; loads the prod file entry; loads the dev server URL when in dev; focuses the existing window instead of creating a second one; trusts only the live popout webContents; restores a minimized window when re-requested; restores valid persisted bounds; discards off-screen persisted bounds and falls back to defaults; persists bounds on resize after the debounce, guarding near-minimum sizes; keeps saving bounds after a vetoed quit and freezes them only on an allowed quit; closeDashboardPopout closes an open window; applies the persisted app zoom level on dom-ready; follows app zoom changes while open and unsubscribes on close; zoomDashboardPopoutIfFocused steps the popout zoom only while focused; handles the zoom-in chord via before-input-event and ignores other keys; handles mouse-wheel zoom requests outside before-input-event; respects zoom keybinding overrides for keyboard and mouse-wheel paths. src/main/window/dropped-path-preparation.test.ts: opens and stores each unique source once as drop size grows tenfold; passes ordinary paths without copying for %s; preserves ordinary successes and copied successes when another file fails; serializes copy requests from different owners; reports all lost paths without a shared reason when their failures differ. src/main/window/main-window-updater-deferred-setup.test.ts: releases all 64 completed fallback handles without repeating initialization; keeps setup after ready-to-show and releases its fallback afterward; preserves the 15-second fallback when first paint never arrives; preserves destroyed-window guard reads before and at the fallback deadline; keeps the exact %s error and releases its completed fallback; keeps the exact fallback %s error without retrying initialization; preserves pending manual setup after failed ready registration; keeps setup options, live store reads, nudge writes and required quit flush. src/main/worker-threads/worker-thread-request-queue.test.ts: posts one request at a time and in the order it was dispatched; fires a posted call at its own deadline; stops respawning and fails the rest of the queue once deaths hit the cap; clears the death count when a fresh burst starts from full idle. src/main/workspace-hooks/hooks-setup-runner-script.test.ts: builds Windows runners for newline-heavy scripts without line-array splitting; builds POSIX runners without regex-wide CRLF normalization; writes POSIX setup runners for shebang-declared scripts on native Windows paths; keeps batch setup scripts on cmd.exe when the terminal is Git Bash; hands a Git Bash pane a launch command MSYS cannot rewrite for a cmd runner; replays interpreter flags declared on the shebang line; preserves cmd.exe setup runner semantics for configured cmd users; keeps POSIX runner behavior on POSIX platforms; waits when either local or project policy requires completed setup; marks setup-runner terminals for the always-on credential guard; maps git-bash to POSIX setup launch metadata on Windows; falls back to the cmd runner when the git-bash setting has no installed Git Bash; keeps the cmd runner for a non-Git bash such as Cygwin; keeps the cmd runner for a bare bash whose flavor cannot be resolved; uses the POSIX runner for a bare bash that resolves to Git Bash; uses the POSIX runner for an extension-less Git Bash path; preserves the existing cmd runner for PowerShell terminals; preserves cmd setup compatibility when a Windows-host project has a WSL shell setting; classifies an installed explicit Git Bash executable as a POSIX runner; falls back to the cmd runner when the explicit Git Bash path no longer exists. src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts: schedules remote identity enrichment without blocking the caller; probes a drive project whose runtime is WSL %s; sweeps a local repo: %s; probes an SSH row that carries only executionHostId on its own host; keeps same-path rows on two different SSH hosts from sharing one backoff; coalesces concurrent probes for the same repo location; caches no-identity probes briefly so list calls do not retry every time; does not rewrite the no-remote marker on a later retry; resolves a settled no-remote repo once it gains a remote; does not re-probe a resolved identity before the refresh window elapses; re-probes a resolved identity after the refresh window elapses; bounds re-probes per sweep so a large repo list drains gradually; forgets a removed repo location so its deadline cannot outlive the repo; keeps a surviving repo backoff when a sibling repo is removed; probes again when the same location is re-added after its probe was retired; coalesces concurrent sweeps instead of running one pass per list call. src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts: preserves create priority through claim probes on %s; starts the checkout only once the async workspace root resolves; still deduplicates when both callers await the same pending root lookup; namespaces native Windows preparation directories for long paths; deduplicates preparation for the same repo, base, runtime, and workspace root; does not spend a divergence walk when the base matches exactly; claims when the two sides spell the same ref differently; evicts a repo's own stale preparation before another repo's; still discards armed checkouts when the project runtime needs repair; routes preparation and finalization through the selected WSL runtime; retries stale cleanup after a transient listing failure; does not discard a detached worktree with caller-controlled preparation metadata; does not re-arm after an isolated create; re-arms a preparation once creates arrive in a burst; holds the re-arm checkout until the create runs the deferred thunk; starts one explicit prefetch after the create completes; does not re-arm when finalization failed; reports a pending create while a stale-cleanup scan is running. src/main/workspaces/removal/local-worktree-removal-recovery.test.ts: recovers Git for Windows partial filesystem deletion failures; finishes a clean non-force deletion after Git leaves a Windows directory behind; recovers localized Windows failures after Git already removed the registration; does not recover unrelated localized failures while Git still owns the row; finishes a macOS deletion Git deregistered before failing with Directory not empty; leaves an orphaned checkout to the orphan cleanup instead of deleting it; prunes and strictly verifies on the selected WSL host without deleting files or branches. src/main/workspaces/removal/worktree-removal-safety.test.ts: rejects deleting a worktree that contains another registered worktree; rejects POSIX home directories even when host homedir has a different path shape; refuses a home the host reported even when no path rule recognises it; refuses the Windows host's home directory from a POSIX client; refuses the Windows host's home directory even when the host reported nothing. src/main/wsl/discovery/distro-catalog.test.ts: retries asynchronous discovery after a transient wsl.exe failure; retries synchronous discovery after a transient wsl.exe failure; retries asynchronous discovery after wsl.exe reports no distros yet; retries synchronous discovery after wsl.exe reports no distros yet; bounds the wsl.exe spawn rate while no distros are installed; bounds the asynchronous spawn rate while no distros are installed; still caches a non-empty distro list for the process lifetime; re-probes a docker-desktop-only machine once a user distro can appear; backs off while the list keeps coming back empty; backs off after repeated distro-list failures; caps the empty-list backoff at five minutes; keeps reporting an empty result after it goes stale; keeps reporting a known distro list indefinitely; bounds cached homes while retaining the most recently used distros; still lists distros, and an excluded distro home probe fails like any other probe; gives the async home probe time for a cold boot instead of killing it at 5 s; retries availability after a probe timeout instead of latching false; bounds the probe rate while the failure window is open; caches a successful probe for the process lifetime; names an explicit spawn directory, so no deleted cwd can read as ENOENT; shares one wsl.exe spawn between concurrent probes; keeps reporting the last observed answer after it goes stale; holds a definitive failure far longer than a timeout when %s; backs off after repeated probe failures; re-probes a seeded retryable failure once its window lapses; re-probes availability once a distro list succeeds after %s; does not drop an availability failure for an empty distro list; keeps reporting unavailable off Windows without probing. src/main/wsl/discovery/wsl-distro-holder.test.ts: runs a busybox-safe loop through --exec and names the distro; spawns a detached-style holder, records it, and waits for the distro to run; a holder exiting with code 1 notes its distro may have stopped (E9); rejects a pid whose command line is not our holder for that distro; cleans up stale and corrupt records; keeps a holder and its record when release cannot verify it; reports unverifiable when the command line is unreadable even with a matching pid; release kills a verified holder and removes its record; release never kills a pid that is no longer our holder; reports a spawned holder exit so liveness can re-check. src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts: skips 9p shares that are not drvfs, and malformed lines. src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts: plans the update on the census the running orcad reports, not an unknown one; forwards force to the update planner; does not serve the incumbent past a refusal that is not a wait; does not re-activate the build this host rolled back from; labels the launch with the build the adoption found serving, not the stale record; defers while another run holds the host fence; lets an explicit force deploy past both skips; names a newer host refusal apart from a rolled-back one, so only Force is offered; updates an older host as before, without asking to adopt it; never asks the incumbent when it already runs this build. src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts: keeps a completed listing usable when the host rejects the wait parameter. src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts: delivers to chat-default users in all targeting while holding out not-switched users. src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts: completes the row on a pick, even when the command is already typed; ignores a pick of the row while side chats are unavailable. src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts: explains a too-large refusal that arrives through the IPC error prefix. src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts: keeps the question with the caller and says once that it never went; tells the user to check the side chat when delivery is unconfirmed; reports a delivered question as sent, silently. src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts: decides each of %i tool-only turns once per layout, and nothing without a listener. src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx: places a side chat whose question was %s: %o. src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts: calls back once for %s; stops watching once unsubscribed. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts: records a mode 2031 subscribe from the raw chunk boundary without answering. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts: routes terminal input through deferPtyInput so the host can withhold it; forwards terminal input directly when the host supplies no deferPtyInput. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts: forwards onBell to pane attention and notification policy; hands the bell to the attention module with its pane even when pane attention is off. src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts: repaints from the main-owned snapshot when main drops pending output at the cap. src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts: retries a fresh-spawn native follow reset when renderer dimensions return. src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts: requests a tab remount for an unbound spawn; leaves recovery to a remote transport that armed its own retry; requests a remount when the transport reports no recovery of its own; settles the spawn as failed before requesting a remount; prefers the restored leaf id when reporting the anomaly; falls back to the pane leaf id when no restored leaf exists. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionDeferredInputForwardingTests } from '../input/pty-connection-deferred-input-forwarding.spec', registerPtyConnectionDeferredInputForwardingTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts: structural support changed only; no new authored removal credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionFreshNativeFollowResetTests } from '../output/pty-connection-fresh-native-follow-reset.spec', registerPtyConnectionFreshNativeFollowResetTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionTerminalBellAttentionTests } from '../notifications/pty-connection-terminal-bell-attention.spec', registerPtyConnectionTerminalBellAttentionTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts: registers interest on the first sidecar and releases on the last unsubscribe; releases sidecar interest only once for repeated unsubscribes; does not let an eager pre-mount buffer defeat hidden delivery gating; keeps eager buffers outside delivery interest when the PTY exits before mount; lets a sidecar exclusively own interest while an eager buffer overlaps. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts: blackholed delivery reproduces the wedge: no handler dispatch, no ACK ever. src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts: sends preferences to the execution host and attaches only to its returned PTY; preserves one operation ID across a lost reply and reconnect; preserves ordinary raw startup and captured-session attachment. src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts: sums registered gauges and drops disposed ones; ignores a repeated dispose instead of dropping another gauge; stops tracking new gauges past the cap so a missed dispose cannot grow it; tracks a live output processor queue through enqueue, drain, and dispose; excludes cleared consumed entries from retention after a bounded drain. src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts: says nothing once the pane is closed. src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts: refreshes after each scheduled atlas reset; falls back to a timeout when animation frames are unavailable; continues recovery when a manager throws after scheduling. src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts: tracks a remounted quiet title source even when the stale owner unregisters later; preserves the renderer-parsed output sequence in the response; preserves a pending escape tail for snapshot replay; routes a host's Reset Terminal request to the pane that owns the PTY. src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts: marks panes with restored scrollback for fresh-shell viewport blanking. src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts: recovers a 0x0 spawn whose container is briefly unmeasurable then settles. src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts: removes global listeners when the last pane unregisters. src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx: keeps trust text readable on a host-owned dialog surface; applies the hostile surface to ordinary dialogs, so the case above is exercised. src/renderer/src/components/use-terminal-parking-pass.test.tsx: does not queue a render when a pass produces the same parking sets; keeps parking transitions working under StrictMode. src/renderer/src/hooks/client-workspace-view-report.test.ts: reports an away user’s screen with no presence, and renews as soon as input returns; retries a failed send, empty or not, no sooner than a refresh. src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts: is new work in a workspace with no live terminal: its first bind moves it up in Recent. src/renderer/src/hooks/use-bundled-skill-install.test.tsx: ignores a repeated click while the install runs; retries the last requested skills on this host. src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx: adds seeds to a successful empty list but not to loading or failed results; retains seed projection after expiry and fetches fresh metadata for a new reader. src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx: retranslates the settings nav labels when the UI language changes live. src/renderer/src/lib/codex-stale-pane-account-identity.test.ts: keeps the prompt when the roster read fails and every label collapses. src/renderer/src/lib/image-blob-png.test.ts: downscales a pasted image above the pixel cap; releases its temporary URL on a decode error; releases its temporary URL when PNG encoding fails or exceeds the byte cap. src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts: names callers above the frame the write came from; restores Error.stackTraceLimit when the capture throws; stops collecting after the sample cap when captureStackTrace is unavailable; caps reported changed keys from a single wide write. src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts: applies the rendered text hard cap last and reserves the final overflow marker. src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts: keeps the runtime target identity stable across unrelated store writes. src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts: keeps creation available on old hosts and explains the missing operation; preserves landed warnings and direct collision recovery data; propagates remote discovery failure instead of a false empty page. src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts: reuses unchanged worktree tab projections when one worktree title changes; bumps only the changed worktree version when a sibling stays byte-identical. src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts: shares safe-auto fork sync cooldown attempts across store instances. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts: collapses a 193-workspace hydration to one store write; leaves the store byte-identical to the per-workspace path; re-reconciling the batched result is a no-op, as it is for the per-workspace path. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts: dedicated zero-case helper retirement; no authored test credit. src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts: persists each batch metadata update to its workspace owner. src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts: dismisses a rename error on its capable remote owner; clears pending first-agent rename when the title is updated. src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts: orders capture, guards, handlers, main's stop, commit, cleanup, and exit settlement. src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts: publishes the first terminal and root tab group atomically; publishes the first terminal and root tab group atomically, then marks it starting in main. src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts: restores daemon terminal wake hints before declaring the session ready. src/renderer/src/web/web-runtime-connection-auth-framing.test.ts: keeps legacy framing for sockets that cannot absorb a refused attempt. src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts: moves the old Windows default to Regular once and queues the notice; keeps custom weights and fresh profiles without a notice; leaves macOS and Linux profiles untouched. tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/persistence/worktree-sort-order-write.test.ts, src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts, src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts, src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts, src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts, src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts, src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts, src/main/runtime/session-graph/headless-runtime-graph.spec.ts, src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts, src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts, src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts, src/main/runtime/terminal/identity/terminal-identity-probe.test.ts, src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts, src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts, src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts, src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts, src/main/runtime/terminal/surface/workspace-layout-projection.test.ts, src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts, src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts, src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts, src/main/skills/skill-install-transaction.test.ts, src/main/speech/model-manager-download-resume.test.ts, src/main/ssh/config/ssh-config-parser.test.ts, src/main/ssh/config/ssh-known-hosts-source.test.ts, src/main/ssh/config/ssh-known-hosts.test.ts, src/main/ssh/connection/ssh-connect-config.test.ts, src/main/ssh/connection/ssh-connection-auth-fallback.test.ts, src/main/ssh/connection/ssh-connection-store.test.ts, src/main/ssh/connection/ssh-connection.test.ts, src/main/ssh/orcad-migration-stuck-host-profiles.test.ts, src/main/ssh/orcad-runtime-maintenance.test.ts, src/main/ssh/port-forwarding/ssh-port-forward.test.ts, src/main/ssh/ssh-channel-multiplexer.test.ts, src/main/ssh/system-transport/system-ssh-forward-process.test.ts, src/main/ssh/system-transport/system-ssh-loopback-route.test.ts, src/main/startup/browser-process-user-agent-ordering.test.ts, src/main/startup/quit/quit-path-durable-write-blocking.test.ts, src/main/stats/agent-session-transition-recorder.test.ts, src/main/text-generation/commit-message-text-generation-model-discovery.test.ts, src/main/text-generation/pull-request-context.test.ts, src/main/text-generation/source-control-local-process.test.ts, src/main/updater/linux-package/linux-package-update-recovery.test.ts, src/main/updater/releases/updater-prerelease-feed-readiness.test.ts, src/main/updater/releases/updater-release-builds.test.ts, src/main/updater/updater.build-channel-selection.test.ts, src/main/updater/updater.check-preflight.test.ts, src/main/updater/updater.prerelease-fallback.test.ts, src/main/updater/updater.publishing-window-feed.test.ts, src/main/updater/updater.quit-and-install.test.ts, src/main/window/createMainWindow-markdown-editor-focus.test.ts, src/main/window/createMainWindow-renderer-crash-recovery.test.ts, src/main/window/dashboard-popout-window.test.ts, src/main/window/dropped-path-preparation.test.ts, src/main/window/main-window-updater-deferred-setup.test.ts, src/main/worker-threads/worker-thread-request-queue.test.ts, src/main/workspace-hooks/hooks-setup-runner-script.test.ts, src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts, src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts, src/main/workspaces/removal/local-worktree-removal-recovery.test.ts, src/main/workspaces/removal/worktree-removal-safety.test.ts, src/main/wsl/discovery/distro-catalog.test.ts, src/main/wsl/discovery/wsl-distro-holder.test.ts, src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts, src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts, src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts, src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts, src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts, src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts, src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx, src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts, src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts, src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts, src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts, src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts, src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts, src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts, src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts, src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts, src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx, src/renderer/src/components/use-terminal-parking-pass.test.tsx, src/renderer/src/hooks/client-workspace-view-report.test.ts, src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts, src/renderer/src/hooks/use-bundled-skill-install.test.tsx, src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx, src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx, src/renderer/src/lib/codex-stale-pane-account-identity.test.ts, src/renderer/src/lib/image-blob-png.test.ts, src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts, src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts, src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts, src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts, src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts, src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts, src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts, src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts, src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts, src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts, src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts, src/renderer/src/web/web-runtime-connection-auth-framing.test.ts, src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts, tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
"Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts: stops paged routing when the check is cancelled; keeps an unfiltered redrive unrestricted when reservations merge; keeps an unfiltered parked delivery unrestricted when reservations merge; uses a bounded indexed pane lookup for reminted Dispatch identity. src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts: removes the reported wedged automation workspace without --force; clears PTY state once a failed stop is proven to have exited; names only the PTYs that are actually live, not every failed stop; warns with the specific sweep failure, not the generic deadline; still fails closed on a sweep-level failure without force. src/main/skills/bundled-skill-install/layouts.test.ts: links into a project only where its agent folder already exists; reads a pending cloud transaction as busy and a cloud receipt as another skill. src/main/skills/skill-upload-session-service.test.ts: joins concurrent disposal callers through exact cleanup completion. src/main/source-control/hosted-review-creation.test.ts: creates the pull request after fresh main-process validation passes; routes local WSL git and GitHub review creation through the selected runtime; creates a pull request on a GitHub Enterprise Server remote (#8312); creates a GitLab merge request after fresh main-process validation passes; creates an Azure DevOps pull request after fresh main-process validation passes; creates a Gitea pull request after fresh main-process validation passes. src/main/source-control/hosted-review-execution-host-routing.test.ts: reads a GitHub review on the SSH host a row names only in executionHostId; reads a GitLab review on the executionHostId host when connectionId names a different one; does not dial this client for a runtime row whose nested target shares a local name; keeps a runtime row with no nested target on this process (self-addressed stamp); keeps a legacy connectionId-only SSH row on its target; does not share a cached answer between two rows at one path on different hosts; creates a Bitbucket review locally for a runtime row rather than dialing its nested target; reports creation eligibility from the executionHostId-only SSH host; resolves the GitHub slug for a repo listing on the row it is asked about; refuses to dial a runtime host from this process; answers with the SSH target for both spellings and local otherwise; reads a runtime stamp on a row in this store as self-addressing, not a second machine. src/main/source-control/hosted-review-inflight-invalidation.test.ts: keeps other hosts, paths and their pending promises isolated. src/main/speech/model-manager.test.ts: requires pinned, internally consistent metadata for every model file; verifies downloaded model file hashes before installation; rejects non-HTTPS model downloads; marks OpenAI transcription models ready only when an API key is configured. src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts: writes to the SFTP namespace path discovered on the same session; uploads the bundle into the SFTP namespace directory; issues no discovery requests when the caller supplies no mapping; ignores a mapping on a Windows host; never resolves on the system-SSH transport; leaves writeBuffer and openFileUploadSession on the shell path; keeps the shell path when discovery is inconclusive; preserves a session-limit channel-open error unchanged. src/main/ssh/connection/ssh-connection-system-transport.test.ts: uses system SSH transport when ProxyUseFdpass is resolved by OpenSSH; allows concurrent exec commands for system SSH with an Orca ControlMaster socket; keeps concurrent exec commands disabled for system SSH without a reusable socket; uses system SSH transport for ProxyCommand targets before ssh2 auth; keeps the original ssh2 reachability error when the system SSH probe fails; reports the system SSH failure when ssh2 cannot negotiate with the host; uses system transport for target or resolved OpenSSH proxy directives; allows an environment override for e2e coverage; ignores stale imported proxy fields when fresh OpenSSH config has no proxy. src/main/ssh/orcad-migration-catalog-client.test.ts: keeps each server project’s execution host, so a nested SSH row is never read as local; reads the server’s folder workspaces and the groups that place them on a host; sends and validates the %s operation; validates an abort result without letting it erase committed state; validates a committed receipt against the requested manifest; rejects malformed stage timestamps and abort envelopes; fails closed for method absence, malformed identity, and invalid pairing; refuses a destination without the capability before sending any migration request; reads method-not-found as the same refusal, not as a lost answer. src/main/ssh/runtime-ssh-access.test.ts: persists intent then claim before connecting and publishes redacted authenticated access; names the saved dependency when dependent state blocks an SSH access link; handles lost link responses without connecting or verifying again; invalidates old transport only after authenticated access is published; rejects changed request tuple after a completed link; rejects provisioning and missing durable generations without connecting; treats a lost successful unlink response as an idempotent no-op; hashes connection identity, not display state or owner; strictly validates ports and request IDs. src/main/startup/cli-launch-redirect.test.ts: detects a launch that received the unpacked CLI entrypoint; ignores normal desktop launches; ignores the entrypoint when it is only the executable itself (argv[0]); applies on Linux too; strips injected Chromium switches before node-mode CLI arguments; keeps user flags after the command and malformed boolean assignments; does not treat a later positional entrypoint path as the launcher; redirects a direct binary launch with no AppImage env at all; strips Chromium switches node mode would reject; preserves desktop-shaped switches after the command; leaves direct serve in-process but redirects its help; treats help as a CLI launch even without a command; treats %s as a CLI launch even without a command; does not treat a value of %s as a CLI early-exit flag; does not treat a serve option value as a help request; does not reinterpret help after the argument terminator; leaves a plain desktop launch alone; skips flag values when looking for the command positional; preserves a project selector in %j; does not apply the command form on macOS or Windows; never redirects an unpackaged build; runs the in-package CLI in Electron node mode with sanitized env; refuses to redirect twice so a dropped ELECTRON_RUN_AS_NODE cannot loop; reports a missing CLI entrypoint instead of booting the desktop app; execs a direct serve into the CLI so it keeps its pid and honours profile and supervise; keeps ORCA_USER_DATA_PATH for a direct serve without --user-data-dir; serves in-process when this runtime cannot exec or the exec fails; never execs the --serve child the CLI itself spawns, or serve on other platforms; surfaces a spawn failure as a non-zero exit; re-execs a direct --serve onto X11 when Electron resolved Wayland; leaves $name alone. src/main/startup/main-process-runtime-launch-activation.test.ts: marks startup settled for the launch record only after the window has loaded and settled; loads SSH targets on a windowless serve before paired clients can connect (#25886); pins the serve listener to loopback only for orcad browser sidecars (sidecar=$sidecar, #31895); saves Codex auth before a headless serve update restart, like the desktop does. src/main/startup/run-electron-vite-dev.test.ts: forwards dev instance identity to electron-vite; prepares userData orca and orca-dev wrappers for dev terminals; consumes the stable-name flag before forwarding args to electron-vite. src/main/updater/releases/updater-prerelease-feed.test.ts: returns the newest stable tag when the user is on an RC and a newer stable exists; returns the newest RC tag when no stable is newer than the current RC; can exclude prerelease tags for stable-channel checks; probes the %s %s platform manifest; returns null for stable-channel checks when only prereleases are newer; returns null when nothing in the feed is newer than the current version; ignores entries with unparseable tags; returns null when the fetch is not ok; returns null when the fetch throws; picks semver-newest across a mixed-order feed; ignores perf-tagged prereleases for regular RC checks; reports no RC update when only perf-tagged prereleases are newer; picks the semver-newest perf-tagged prerelease; matches only literal rc.N.perf prerelease tags for perf checks; reports no perf update instead of falling back to stable or RC tags; returns a bounded fallback candidate after the newest newer tag; returns null when the only newer tag has a manifest but its asset still 404s; requires a known old timestamp for a stable-fallback tag. src/main/updater/updater-events.test.ts: hands the whole downloaded event to artifact capture; publishes manual-install recovery after a %s download; publishes the normal downloaded state for AppImage builds; blocks downloaded-state handling when the packaged marker is unusable; passes the actual updater error into the install-failure handler; keeps manual-install recovery when a later check finds only the installed release; drops the artifact when another version takes over the cycle; ignores a downloaded event for an older target; accepts a matching event when the pending cache target was cleared; drops the artifact when progress reports a different pending version. src/main/updater/updater-linux-package-recovery-actions.test.ts: rejects both actions while no package-install recovery is active; validates the retained package on every invocation; restores recovery after a recheck resolves without a terminal event; restores recovery after a recheck fails; restores recovery when a pinned check resolves to the current version; restores recovery when resolving a pinned check fails; clears recovery for both actions once the package is gone; resolves %s as a result and keeps the card usable instead of rejecting; keeps recovery available after a transient read failure. src/main/updater/updater.check-settlement.test.ts: leaves a dismissed release update on the release source; surfaces net::ERR_FAILED to user-initiated checks with a friendly message; shows checking immediately for a user-initiated check while feed pinning is pending; keeps background checks event-driven before checking-for-update fires. src/main/usage/usage-provider-store-lifecycle.test.ts: persists identities for a whole first scan with one write; skips disabled and fresh matching states; invalidates prior sources on fingerprint changes and reuses them for forced scans. src/main/window/createMainWindow-close-confirmation.test.ts: clears the quit latch when the renderer prevents unload; does not notify the crash recorder when renderer teardown follows a confirmed window close; allows close when Electron reports a crashed webContents; requests confirmation for a hung-but-alive renderer instead of bypassing. src/main/workspaces/catalog/worktree-identity-persistence.test.ts: stores independent metadata for colliding locators on two hosts; projects canonical-only metadata for exactly one host; keeps canonical metadata current for legacy writers on a known owner; removes only the selected legacy-owner metadata when locators collide; keeps the canonical identity stable when the locator changes; leaves other hosts at the old locator when one host renames its folder. src/main/wsl/filesystem/wsl-drive-unc-conversion-startup.test.ts: leaves a journaled conversion untouched with the gate closed, %s. src/main/wsl/orcad/wsl-orcad-deploy.test.ts: holds the distro before it deploys and launches, and reports what C5 dials; passes its connect-state read (%s) on as hints; applies the SSH census and downgrade admission to the first deploy; refuses a WSL 1 distro before holding it or touching its files; tells an unregistered distro how to find the installed ones, before holding anything; surfaces an unsupported libc as the SSH host refusal does; starts an already-active slot the distro stop ended, instead of reporting it ready; deploys over an adopted unrecorded orcad under the SSH terminal gate, never a fresh launch; reports the adopted instance once the same version is serving; returns a deferral rather than launching over live terminals; hands a failed first deploy to the fresh-install cleanup before reporting it. src/main/zcode/zcode-v2-plan-credentials.test.ts: prefers migrated credentials over a stale legacy account; keeps legacy support when no personal v2 file exists; honors the upstream personal config override independently of the credential directory; does not borrow credentials from another execution host; preserves the protected Orca key priority even if v2 is corrupt; rejects upstream-invalid selection %j without legacy fallback; accepts a valid optional reasoning level; rejects upstream-invalid rule containers %j without legacy fallback; accepts a valid selected-provider empty personal rule and smart model rule; cannot establish selected credentials from %s rules; leaves encrypted CLI files unchanged across repeated account reads. tests/e2e/automation-terminal-launch.unit.test.ts: launches explicit Chat for %s through the common entry and keeps its actual fallback; does not apply stored Terminal extras to Chat; forwards only complete Chat-consumed values, with no Terminal startup base; refuses an expired admission without minting another launch identity; records the actual chat identity and delegates new workspace setup and provenance. tests/e2e/github-project-provider-columns.unit.test.ts: renders %s through one bounded items request on a named cloud host; preserves zero and complete counters: %j; preserves populated and legacy rows through shared sorting, grouping and cells. tests/e2e/structured-agent-session-launch-continuation.unit.test.ts: carries renderer lifetime through host intent to the real %s provider builders. tests/e2e/terminal-account-restart.unit.test.ts: replaces a tombstoned owner while its persisted pane binding has not yet been cleared; paired restart retains the old owner (host authority: %s). tests/e2e/terminal-hidden-view-parking.spec.ts: does not park excluded tabs; reproduces a static frame byte-for-byte across 25 park/reveal cycles. tests/e2e/terminal-long-table-scroll-restore.spec.ts: reproduces long markdown table artifacts after workspace switch and scroll; keeps narrow wrapped signer markdown table coherent after restore and scroll; keeps real emoji markdown table right edge clean after restore and scroll. tests/e2e/terminal-long-table-fixtures.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-paste-ownership.spec.ts: Windows multiline keyboard paste normalizes terminal newlines with one PTY owner; right-click paste sends clipboard text to the focused terminal exactly once. tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts: uses WebGL by default for ordinary terminal output when available @terminal-rendering-golden. tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. tests/e2e/workspace-board-lane-virtualization.spec.ts: mounts a window of cards for a large lane and keeps lane indexes; renders later lane indexes after the lane scrolls. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts, src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts, src/main/skills/bundled-skill-install/layouts.test.ts, src/main/skills/skill-upload-session-service.test.ts, src/main/source-control/hosted-review-creation.test.ts, src/main/source-control/hosted-review-execution-host-routing.test.ts, src/main/source-control/hosted-review-inflight-invalidation.test.ts, src/main/speech/model-manager.test.ts, src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts, src/main/ssh/connection/ssh-connection-system-transport.test.ts, src/main/ssh/orcad-migration-catalog-client.test.ts, src/main/ssh/runtime-ssh-access.test.ts, src/main/startup/cli-launch-redirect.test.ts, src/main/startup/main-process-runtime-launch-activation.test.ts, src/main/startup/run-electron-vite-dev.test.ts, src/main/updater/releases/updater-prerelease-feed.test.ts, src/main/updater/updater-events.test.ts, src/main/updater/updater-linux-package-recovery-actions.test.ts, src/main/updater/updater.check-settlement.test.ts, src/main/usage/usage-provider-store-lifecycle.test.ts, src/main/window/createMainWindow-close-confirmation.test.ts, src/main/workspaces/catalog/worktree-identity-persistence.test.ts, src/main/wsl/filesystem/wsl-drive-unc-conversion-startup.test.ts, src/main/wsl/orcad/wsl-orcad-deploy.test.ts, src/main/zcode/zcode-v2-plan-credentials.test.ts, tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts. Unresolved local/computed edges remain explicit debt.",
@@ -14179,7 +14254,15 @@
"Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
"Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. All prior notes and dated/archived evidence retain original scopes.",
"Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
- "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Earlier notes, complete dated receipts and archived gaps retain their original scopes."
+ "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
+ "Audit3597 scope: remove two renderer-hang-capture examples (2 authored/2 finite): an invalid repeated-token oversized reducer fixture and a shorter unanswered-request fixture. Intentionally lose the direct truncated flag/sanitized frame fixture and request-pending status/zero-sample alarms. Retain window-death/stale-result exclusion, generation reconciliation, and baseline-publication cancellation lifecycles; they are not equivalent bound, redaction or pending-status replacements. Historical execution retains its original source scope; no new runtime evidence is claimed.",
+ "Audit3601 scope: remove the whole custom-sound happy-path IPC suite and one custom-label/multiline notification formatting example (2 authored/2 finite). Intentionally lose configured .ogg selection, exact byte/MIME success wiring, successful dispatch for the formatting fixture, custom-label whitespace/title normalization and assistant-body whitespace/180-character-cap alarms. Retain prompt-exclusion, persisted qualified dismissal/restart, theme ownership/restore and Ghostty precedence/collision cases; none replaces the retired sound/formatting alarms. No actual playback, native delivery, phone/network, cross-platform or new runtime evidence is claimed; historical execution keeps its original scope.",
+ "Audit3606 adopts the enhanced3604/3605 icon cuts: nine authored/nine finite cases removed, including the whole tray-attention-icon suite. Retires the no-encoder oversized-upload null sample, missing-ID/request-order sample, encoder-null PNG-prefix fallback, SVG/404 rejection samples, transparent amber-dot placement and half-alpha white-tint sample, exact small fetched-byte passthrough, host-qualified image-key inventory and constant-encoder large-upload projection. These specific admission, formatting and bitmap alarms are intentionally lost without equivalent replacements. Retained queue/cache, bounded fetch and Dock lifecycle checks do not establish actual raster decoding, native image conversion or rendered appearance. Historical receipts below are preserved evidence for earlier test sets, not fresh validation of this reduced selection.",
+ "Audit3608: remove five authored/five finite callbacks, including whole owner-slug and remote favicon URL suites and two repository-label projections. Lose five owner acceptance samples, eleven negative owner samples plus nonstring refusal, six host-local icon refusal samples, legacy-SSH same-path label-map cardinality, and explicit runtime ownership over stale legacy metadata at label level. These are accepted narrow grammar/presentation alarms with no equivalent replacement claimed. Retained binary parser, React recovery and label grouping/platform cases do not replace these losses. Static evidence only; historical receipts retain their original scope.",
+ "Audit3613: remove six authored/six finite callbacks, including whole reviewer-display oversize-input and explorer-root record-filter suites, plus plugin family-emoji/invisible-only-name and pool legacy-name/urgent-countdown samples. Accept losing oversized-input empty-result/no-split, malformed-record/prototype-sensitive-key/nonstring filtering, exact ZWJ family preservation, invisible-only name refusal, no-group old-host full-name preservation, and80/79/null-reset countdown composition alarms. No equivalent replacement asserted. Retained strict/runtime sanitization, SVG parser, mobile focus recovery and collision/tie cases have different scopes. Static evidence only; historical receipts retain original scope.",
+ "Audit3628: remove the entire one-authored/one-finite RepositoryRemoveProjectSection happy-dom suite. Accept losing the local zero-to-one-terminal stale-count revalidation alarm: first confirmation defers the removal callback and second confirmation invokes it after the count snapshot updates. The test never asserts updated warning text/count, actual terminal creation or removal/PTY teardown, host/scope routing, cancellation or folder/mobile behavior. No equivalent replacement or end-to-end warning-before-teardown proof asserted. Static evidence only; historical receipts retain original scope.",
+ "Audit3629 removes two singleton parser suites: WSL Claude plugin metadata out-of-range index rejection and Git checkout unlink-warning path extraction. Their real range-refusal and quoted-path extraction alarms are intentionally lost without replacement; no WSL execution, checkout recovery or equivalent remaining coverage is claimed.",
+ "Audit3832 deliberately retires76 authored/79 finite cases:75 runtime compatibility cases/78 finite cases across14 fragments, plus one localization extractor default-flag case. Three whole runtime fragments are deleted;27 authored/30 finite cases remain across the reviewed sources. This gate retains only its own selected scope; no equivalent replacement or fresh runtime/native/remote evidence is claimed. Runtime component A: Audit3828 composes3822 with independent3824: deliberately retires49 authored/52 finite cases from seven compatibility fragments, leaving15 authored/18 finite cases and deleting two entire fragments. Accepted losses: positive folder-worker recovery/materialization and reveal deadline; persisted-key normalization and legacy split/group/focus projection; fixed stale CAS refusal; occupied/alias/restored/preallocated terminal-handle variants; fixed OpenCode/Cursor/Claude/Codex/Antigravity classification, readiness, title and management examples; direct private-map browser authority projections; browser-focus and OMP title projection; already-aborted claim cleanup. Additional3824 loss: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts :: does not poll a wrapper foreground for a speculative CLI prompt send :: Speculative retryForegroundWrappers:false check must return false on a wrapper after one foreground read, without polling the supplied later codex response. These real bounded alarms are deliberately retired for low marginal value. Retained callbacks are unchanged and provide only their own bounded scope, not equivalent replacement. Historical receipts do not validate reduced callbacks. No fresh runtime/native/SSH/WSL/phone/browser evidence or full transitive closure is claimed. Runtime component B: Audit3834 deliberately retires26 authored/26 finite cases from seven fresh compatibility fragments, leaving10/10 and deleting the one-case saved-binding reattachment fragment. Original position58 is excluded: its existing substantive3578 KEEP7 review remains historical, with no fresh credit. Accepted losses: fixed hook/provider-session identities and stale metadata refusal; decorative/pre-title foreground ordering variants; saved-binding surface reattachment; saved-row exit ghost removal and silent activation selection; unsupported headless wake; positive pending materialization/group projections; per-caller navigation selection; positive SSH hydration/read partition; laptop mobile publication/buffer and background/pending/status projections; abnormal/unregistered SSH grace, normal-exit refusal, persisted SSH hydration, positive serve reattachment, pending-agent launch arguments and direct seeded running-launch admission guard. These are real bounded alarms deliberately retired for low marginal value. Retained cases preserve their own distinct deferred foreground coalescing, usable handle continuity, stale inventory refresh, concurrent browser snapshot preservation, renderer graph fencing, caller dedup isolation, SSH partition writes, runtime split lifetime, independent relay-ready publication, lease admission/state/expiry. The direct running-launch no-spawn guard alarm is deliberately retired; no remaining owning-launch refusal coverage is claimed. Historical runs do not validate reduced callbacks. No equivalent replacement, runtime/native/SSH/WSL/phone/browser result or full transitive closure is claimed. Additional extractor loss: config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs :: does not change the existing renderer scan by default :: Default options must omit the five native-only fields in this supplied snippet. No equivalent replacement is claimed."
],
"demotionRule": "Keep experimental if any direction skips or fails; do not extend timeouts or retry to green."
},
@@ -14310,10 +14393,10 @@
"providers": ["relay"],
"coveredPlatforms": [],
"coveredProviders": [],
- "coverageNotes": "Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Cloud relay source review intentionally retires95assignment-store examples,23real-process blackbox variants,22headroom examples,17conditionalPostgreSQL examples and25isolated-cell replacement examples. Retain3assignment-store,7blackbox,1headroom,2PostgreSQL and1isolated-cell rollback/log positive-control cases. Two PostgreSQL cases remain conditional on ORCA_RELAY_TEST_POSTGRES_URL; timing-sensitive <300ms threshold remains. These gates already have no active selectors/evidence and protection none; historical receipts remain historical. Audit1572 removes relay predicate/threshold tables, telemetry and route/schema inventories, fake-socket forwarding and simulator-owned diagnostic paths without equivalent replacement claims. Retained production admission queues, placer/reserve-book simulations, reservation lifecycles, bounded Response streams, last-known-good flag state, poller reachability, configuration safety and ledger fences are validated with supplied clocks, network, identity, SQL and socket boundaries. No deployed cell, live Google metadata/storage, PostgreSQL, real socket handshake or authorization proof. Historical scope before this audit: Actual assignment store and SQLite tests on macOS. No real PostgreSQL or live remote host/physical phone run. Local/daemon PTY, SSH execution ownership, WSL, folder/git workspace behavior and transport framing are unaffected. Audit1279 removes fake SQL lock-order receipts, diagnostic projections and mocked reserve callback cases from this selector. Their precise local alarms are intentionally lost; retained SQLite headroom/state checks are not claimed as equivalent replacements. The 2026-09-25 receipt is archived as historical data; the shortened selector has no fresh runtime result yet. The remaining six-file selector passed 164 cases on Linux after these removals; this fixture result is separate from the archived dated receipt and does not establish native PostgreSQL behavior. Audit1507 removes the mocked lock-counter suite from the active selector; the 2026-11-04 six-file receipt remains historical and does not validate the shortened five-file selector. Its direct mocked counter alarm is intentionally retired without replacement equivalence.",
+ "coverageNotes": "Audit3700 removes two authored/two finite conditional PostgreSQL cases from two partial assignment suites: the 50k released-history named-index EXPLAIN assertion and the no-lease ledger-only default-floor move example. No equivalent replacement or fresh execution is claimed. Both drivers remain admitted by the cloud package runner when ORCA_RELAY_TEST_POSTGRES_URL is supplied. This gate remains without active selectors/evidence; prior receipt strings remain historical. Audit3700 intentionally retires the exact composite-index/access-path alarm (named index, cell_id/state ANY Index Cond and no Filter) and the seeded ledger-only/default-floor dead-reserve move returned-cell/epoch8 alarm. The former did not measure latency; the latter supplied death verdict/clock rather than causing a crash or dead-man trip. Remaining PostgreSQL concurrency, debt release, lease-bearing move and epoch-floor/ledger-fence cases guard different outcomes and are not equivalent replacements. No current PostgreSQL pass, native platform, remote or mobile proof was obtained. Removing the EXPLAIN registration also removes its 50k shared-fixture released rows and ANALYZE before later separate-identity heartbeat cases. Removing the ledger example skips one hostSerial increment; raw survivor callbacks do not imply identical runtime fixture state. Previous account (preserved verbatim): Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Cloud relay source review intentionally retires95assignment-store examples,23real-process blackbox variants,22headroom examples,17conditionalPostgreSQL examples and25isolated-cell replacement examples. Retain3assignment-store,7blackbox,1headroom,2PostgreSQL and1isolated-cell rollback/log positive-control cases. Two PostgreSQL cases remain conditional on ORCA_RELAY_TEST_POSTGRES_URL; timing-sensitive <300ms threshold remains. These gates already have no active selectors/evidence and protection none; historical receipts remain historical. Audit1572 removes relay predicate/threshold tables, telemetry and route/schema inventories, fake-socket forwarding and simulator-owned diagnostic paths without equivalent replacement claims. Retained production admission queues, placer/reserve-book simulations, reservation lifecycles, bounded Response streams, last-known-good flag state, poller reachability, configuration safety and ledger fences are validated with supplied clocks, network, identity, SQL and socket boundaries. No deployed cell, live Google metadata/storage, PostgreSQL, real socket handshake or authorization proof. Historical scope before this audit: Actual assignment store and SQLite tests on macOS. No real PostgreSQL or live remote host/physical phone run. Local/daemon PTY, SSH execution ownership, WSL, folder/git workspace behavior and transport framing are unaffected. Audit1279 removes fake SQL lock-order receipts, diagnostic projections and mocked reserve callback cases from this selector. Their precise local alarms are intentionally lost; retained SQLite headroom/state checks are not claimed as equivalent replacements. The 2026-09-25 receipt is archived as historical data; the shortened selector has no fresh runtime result yet. The remaining six-file selector passed 164 cases on Linux after these removals; this fixture result is separate from the archived dated receipt and does not establish native PostgreSQL behavior. Audit1507 removes the mocked lock-counter suite from the active selector; the 2026-11-04 six-file receipt remains historical and does not validate the shortened five-file selector. Its direct mocked counter alarm is intentionally retired without replacement equivalence.",
"motivatingLinks": ["https://github.com/stablyai/orca/issues/23035"],
"invariant": "A single-cell capacity check reads only that cell while retaining snapshot freshness, incarnation, outstanding reservation and missing-limit policy; new placement retains the full fleet inventory.",
- "oracle": "Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Cloud relay source review intentionally retires95assignment-store examples,23real-process blackbox variants,22headroom examples,17conditionalPostgreSQL examples and25isolated-cell replacement examples. Retain3assignment-store,7blackbox,1headroom,2PostgreSQL and1isolated-cell rollback/log positive-control cases. Two PostgreSQL cases remain conditional on ORCA_RELAY_TEST_POSTGRES_URL; timing-sensitive <300ms threshold remains. These gates already have no active selectors/evidence and protection none; historical receipts remain historical. With 32 capped cells, an existing active host stays on its pinned cell and reads one headroom row; new placement reads all 32. Missing, expired or prior-incarnation snapshots, capacity exhaustion and outstanding debt still refuse the active pinned host; an uncapped cell remains admissible.",
+ "oracle": "Audit3700 removes two authored/two finite conditional PostgreSQL cases from two partial assignment suites: the 50k released-history named-index EXPLAIN assertion and the no-lease ledger-only default-floor move example. No equivalent replacement or fresh execution is claimed. Both drivers remain admitted by the cloud package runner when ORCA_RELAY_TEST_POSTGRES_URL is supplied. This gate remains without active selectors/evidence; prior receipt strings remain historical. Audit3700 intentionally retires the exact composite-index/access-path alarm (named index, cell_id/state ANY Index Cond and no Filter) and the seeded ledger-only/default-floor dead-reserve move returned-cell/epoch8 alarm. The former did not measure latency; the latter supplied death verdict/clock rather than causing a crash or dead-man trip. Remaining PostgreSQL concurrency, debt release, lease-bearing move and epoch-floor/ledger-fence cases guard different outcomes and are not equivalent replacements. No current PostgreSQL pass, native platform, remote or mobile proof was obtained. Removing the EXPLAIN registration also removes its 50k shared-fixture released rows and ANALYZE before later separate-identity heartbeat cases. Removing the ledger example skips one hostSerial increment; raw survivor callbacks do not imply identical runtime fixture state. Previous oracle (preserved verbatim): Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Cloud relay source review intentionally retires95assignment-store examples,23real-process blackbox variants,22headroom examples,17conditionalPostgreSQL examples and25isolated-cell replacement examples. Retain3assignment-store,7blackbox,1headroom,2PostgreSQL and1isolated-cell rollback/log positive-control cases. Two PostgreSQL cases remain conditional on ORCA_RELAY_TEST_POSTGRES_URL; timing-sensitive <300ms threshold remains. These gates already have no active selectors/evidence and protection none; historical receipts remain historical. With 32 capped cells, an existing active host stays on its pinned cell and reads one headroom row; new placement reads all 32. Missing, expired or prior-incarnation snapshots, capacity exhaustion and outstanding debt still refuse the active pinned host; an uncapped cell remains admissible.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
@@ -14335,6 +14418,7 @@
"evidence": "Actual sticky path result rows 32 to 1; no new timer, polling, queue, cache or provider call. Supplemental SQLite query benchmark with 32 cells and 400 active reservations each measured median per-query 0.285ms to 0.022ms; not a production PostgreSQL latency claim."
},
"knownGaps": [
+ "Audit3700 removes two authored/two finite conditional PostgreSQL cases from two partial assignment suites: the 50k released-history named-index EXPLAIN assertion and the no-lease ledger-only default-floor move example. No equivalent replacement or fresh execution is claimed. Both drivers remain admitted by the cloud package runner when ORCA_RELAY_TEST_POSTGRES_URL is supplied. This gate remains without active selectors/evidence; prior receipt strings remain historical. Audit3700 intentionally retires the exact composite-index/access-path alarm (named index, cell_id/state ANY Index Cond and no Filter) and the seeded ledger-only/default-floor dead-reserve move returned-cell/epoch8 alarm. The former did not measure latency; the latter supplied death verdict/clock rather than causing a crash or dead-man trip. Remaining PostgreSQL concurrency, debt release, lease-bearing move and epoch-floor/ledger-fence cases guard different outcomes and are not equivalent replacements. No current PostgreSQL pass, native platform, remote or mobile proof was obtained. Removing the EXPLAIN registration also removes its 50k shared-fixture released rows and ANALYZE before later separate-identity heartbeat cases. Removing the ledger example skips one hostSerial increment; raw survivor callbacks do not imply identical runtime fixture state.",
"Audit1572 removes relay predicate/threshold tables, telemetry and route/schema inventories, fake-socket forwarding and simulator-owned diagnostic paths without equivalent replacement claims. Retained production admission queues, placer/reserve-book simulations, reservation lifecycles, bounded Response streams, last-known-good flag state, poller reachability, configuration safety and ledger fences are validated with supplied clocks, network, identity, SQL and socket boundaries. No deployed cell, live Google metadata/storage, PostgreSQL, real socket handshake or authorization proof.",
"Real PostgreSQL query plan and concurrent admission not rerun for the scoped variant.",
"Windows/Linux execution, live remote host/mobile flows and CI soak are not recorded.",
diff --git a/config/repo-host-read-baseline.txt b/config/repo-host-read-baseline.txt
index 7fcaeb3c4b7..c1fbbf6e2ab 100644
--- a/config/repo-host-read-baseline.txt
+++ b/config/repo-host-read-baseline.txt
@@ -2,7 +2,7 @@
# This is a RATCHET: counts may only go DOWN. Resolve the host instead (see fix text).
# A lower bound: destructured and differently named rows are not counted.
# Prune after a fix: pnpm check:repo-host-read-ratchet --prune
-1 src/main/github/account-binding-required-host.ts
+1 src/main/github/accounts/account-binding-required-host.ts
3 src/main/ipc/ephemeral-vm-recipe-context.ts
2 src/main/ipc/filesystem/filesystem-source-control-ai-targets.ts
1 src/main/ipc/folder-repo-git-upgrade.ts
@@ -13,7 +13,6 @@
1 src/main/ipc/source-control/github-work-item-args.ts
1 src/main/ipc/source-control/gitlab-repo-access.ts
2 src/main/ipc/workspace-cleanup/workspace-cleanup-candidate.ts
-1 src/main/ipc/workspace-cleanup/workspace-cleanup-disconnected-ssh.ts
1 src/main/ipc/worktrees-test-metadata-pruning-store.ts
1 src/main/ipc/worktrees/listing/authoritative-local-worktree-metadata-pruning.ts
1 src/main/ipc/worktrees/listing/register-host-catalog-handlers.ts
@@ -47,7 +46,7 @@
1 src/main/workspaces/space-analysis/workspace-space-worktree-row.ts
1 src/shared/endpoint-catalog-adoption.ts
1 src/shared/folder-workspaces/folder-workspace-execution-host.ts
-1 src/shared/github/github-cache-key.ts
+1 src/shared/github/cache/github-cache-key.ts
1 src/shared/new-workspace-dialog-repo.ts
1 src/shared/sidebar-list/workspace-review-facts.ts
1 src/shared/workspace-session/workspace-session-terminal-buffers.ts
diff --git a/config/scripts/build/mobile-web-app/build-mobile-web-app-bundle.mjs b/config/scripts/build/mobile-web-app/build-mobile-web-app-bundle.mjs
index 4b1a1d008b8..48da10cda80 100644
--- a/config/scripts/build/mobile-web-app/build-mobile-web-app-bundle.mjs
+++ b/config/scripts/build/mobile-web-app/build-mobile-web-app-bundle.mjs
@@ -24,6 +24,7 @@ import {
routePathnameFromKey
} from '../../mobile-web-app/mobile-web-app-route-manifest.mjs'
import { MOBILE_WEB_PAGE_ROUTES } from './mobile-web-page-routes.mjs'
+import { reactNativeSvgWebPlugin } from './react-native-svg-web-plugin.mjs'
import {
ROUTE_ENTRY_NAMESPACE,
entryStaticClosure,
@@ -235,6 +236,9 @@ export const lucideBarrelPlugin = {
}
}
+// Render checks bundle components on their own; share the page's module shims so they resolve alike.
+export const mobileWebRenderCheckPlugins = [lucideBarrelPlugin, reactNativeSvgWebPlugin]
+
// react-native-web's own assignment, matched whole so an upgrade that moves it fails the build.
const RNW_HAIRLINE_ASSIGNMENT = 'StyleSheet.hairlineWidth = 1;'
// Round native hairline upward to 1/64 CSS px: WebKit floors exact 1/3 to 21/64 and paints nothing at 3×; 22/64 minimizes spill across rows.
@@ -308,6 +312,7 @@ export function mobileWebAppBuildOptions(
anchoredLazyModules
),
lucideBarrelPlugin,
+ reactNativeSvgWebPlugin,
hairlineDevicePixelPlugin
],
resolveExtensions: [
diff --git a/config/scripts/build/mobile-web-app/react-native-svg-web-plugin.mjs b/config/scripts/build/mobile-web-app/react-native-svg-web-plugin.mjs
new file mode 100644
index 00000000000..6d645582235
--- /dev/null
+++ b/config/scripts/build/mobile-web-app/react-native-svg-web-plugin.mjs
@@ -0,0 +1,26 @@
+import { fileURLToPath } from 'node:url'
+
+const mobileDir = fileURLToPath(new URL('../../../../mobile', import.meta.url))
+
+// react-native-svg 15.16 reaches two native-only modules from its web build: the asset registry RN 0.88
+// folded into react-native (react-native-web keeps its own), and an Android touch-sound TurboModule
+// it requires only when Platform.OS is android. Shared with the render checks so they bundle alike.
+export const reactNativeSvgWebPlugin = {
+ name: 'react-native-svg-web',
+ setup(build) {
+ build.onResolve({ filter: /^@react-native\/assets-registry\/registry$/ }, () =>
+ build.resolve('react-native-web/dist/modules/AssetRegistry', {
+ kind: 'import-statement',
+ resolveDir: mobileDir
+ })
+ )
+ build.onResolve({ filter: /[\\/]fabric[\\/]NativeSvgSoundModule$/ }, (args) => ({
+ path: args.path,
+ namespace: 'react-native-svg-web-stub'
+ }))
+ build.onLoad({ filter: /.*/, namespace: 'react-native-svg-web-stub' }, () => ({
+ contents: 'export default { playTouchSound() {} };',
+ loader: 'js'
+ }))
+ }
+}
diff --git a/config/scripts/build/mobile-web-app/verify-mobile-web-app-bundle.mjs b/config/scripts/build/mobile-web-app/verify-mobile-web-app-bundle.mjs
index b6832054702..ad82807d011 100644
--- a/config/scripts/build/mobile-web-app/verify-mobile-web-app-bundle.mjs
+++ b/config/scripts/build/mobile-web-app/verify-mobile-web-app-bundle.mjs
@@ -34,7 +34,7 @@ export const MOBILE_WEB_APP_HOST_CATALOG_MAX_BYTES = 384 * 1024
// Our own fence on the page's code, well inside the phone contract (32 MiB total, 10 MiB per asset in
// manifest-contract.ts); it fails the build before the code weighs more than any one asset may.
-export const MOBILE_WEB_APP_BUNDLE_MAX_TOTAL_BYTES = 9.5 * 1024 * 1024
+export const MOBILE_WEB_APP_BUNDLE_MAX_TOTAL_BYTES = 10 * 1024 * 1024
// Only this licensed desktop-identical asset has its own allowance; other fonts (KaTeX's) and code count.
export const MOBILE_WEB_APP_TERMINAL_FONT_MAX_BYTES = 1200 * 1024
diff --git a/config/scripts/ci/sharding/ci-shard-timings.json b/config/scripts/ci/sharding/ci-shard-timings.json
index 4d0a97b241c..fbe0d3349a5 100644
--- a/config/scripts/ci/sharding/ci-shard-timings.json
+++ b/config/scripts/ci/sharding/ci-shard-timings.json
@@ -180,7 +180,6 @@
"config/scripts/desktop-distribution/linux/package-linux-formats-appimage.test.mjs": 624,
"config/scripts/desktop-distribution/linux/package-linux-formats.test.mjs": 282,
"config/scripts/desktop-distribution/runtime-verification/packaged-node-pty-prebuild-prune.test.mjs": 74,
- "config/scripts/orcad-distribution/template/packaged-orcad-browser.test.mjs": 407,
"config/scripts/desktop-distribution/runtime-verification/packaged-process-host.test.mjs": 537,
"config/scripts/desktop-distribution/runtime-verification/packaged-repository-input-exclusion.test.mjs": 222,
"config/scripts/desktop-distribution/runtime-verification/packaged-source-map-prune.test.mjs": 73,
@@ -190,7 +189,6 @@
"config/scripts/orcad-distribution/prebuilds/pinned-node-downloads.test.mjs": 128,
"config/scripts/desktop-build/output-contracts/plain-node-entry-guard.test.ts": 710,
"config/scripts/ci/e2e-selection/playwright-focused-workflow-selection.test.mjs": 1565,
- "config/scripts/tool-invocation/pnpm-cli-invocation.test.mjs": 65,
"config/scripts/ci/workflow-contracts/pr-auxiliary-preflight-admission.test.mjs": 2174,
"config/scripts/workflow/source-routing/pr-code-change-scope.test.mjs": 403,
"config/scripts/ci/e2e-selection/pr-e2e-managed-ssh-harness-route.test.mjs": 422,
@@ -225,7 +223,6 @@
"config/scripts/release/versioning/release-rc-history.test.mjs": 230,
"config/scripts/release/workflow-contracts/release-windows-signing-gate.test.mjs": 102,
"config/scripts/static-analysis/oxlint-contracts/renderer-scrollbar-style-plugin.test.mjs": 234,
- "config/scripts/static-analysis/renderer-styles/renderer-tailwind-sources.test.mjs": 289,
"config/scripts/desktop-distribution/nsis/replace-cached-nsis-elevate.test.mjs": 1258,
"config/scripts/ci/workflow-contracts/required-pr-check-name.test.mjs": 1266,
"config/scripts/archives/seven-zip/resolve-7za-path.test.mjs": 1391,
@@ -235,7 +232,6 @@
"config/scripts/typecheck/project-execution/run-typecheck-projects-in-parallel.test.mjs": 182,
"config/scripts/tool-invocation/script-entry-detection.test.mjs": 107,
"config/scripts/test-fixtures/script-copy-closure/script-module-dependencies.test.mjs": 62,
- "config/scripts/orcad-distribution/server-bundle/session-scanner-service-smoke.test.mjs": 562,
"config/scripts/ci/workflow-contracts/setup-pnpm-action.test.mjs": 421,
"config/scripts/electron-installation/shared-dist-cache/shared-electron-dist-cache.test.ts": 140,
"config/scripts/native-build/node-addons/shared-native-build.test.mjs": 127,
@@ -296,9 +292,7 @@
"config/scripts/ci/workflow-contracts/zcode-credential-workflow.test.mjs": 668,
"config/scripts/archives/platform-command/zip-extractor-command.test.mjs": 74,
"src/cli/account-add-process.test.ts": 33700,
- "src/cli/agent-context.test.ts": 142,
"src/cli/agent-launch-process.test.ts": 2348,
- "src/cli/agent-session-search-format.test.ts": 84,
"src/cli/args-repeatable-flags.test.ts": 67,
"src/cli/args.test.ts": 163,
"src/cli/automation-format.test.ts": 101,
@@ -309,12 +303,8 @@
"src/cli/command-suggestion-budget.test.ts": 132,
"src/cli/command-suggestion-destructive-families.test.ts": 226,
"src/cli/command-suggestion.test.ts": 68,
- "src/cli/computer-format.test.ts": 135,
"src/cli/computer-tree-query.test.ts": 79,
- "src/cli/emulator-logcat-format.test.ts": 69,
- "src/cli/format-recovery.test.ts": 413,
"src/cli/format.test.ts": 446,
- "src/cli/handler-group-manifest.test.ts": 3610,
"src/cli/handlers/account.test.ts": 849,
"src/cli/handlers/agent-hooks.test.ts": 1702,
"src/cli/handlers/artifacts.test.ts": 471,
@@ -381,7 +371,6 @@
"src/cli/index-worktree-set.test.ts": 541,
"src/cli/index-worktree-wsl-selection.test.ts": 712,
"src/cli/index.test.ts": 1237,
- "src/cli/linear-format.test.ts": 99,
"src/cli/orchestration-dispatch-refusal-format.test.ts": 133,
"src/cli/orchestration-mutation-recovery.test.ts": 415,
"src/cli/orchestration-session-caller-cli.test.ts": 1513,
@@ -402,7 +391,6 @@
"src/cli/plugin-dev-watch/plugin-dev-watch-process.test.ts": 69,
"src/cli/plugin-dev-watch/plugin-dev-watch-shot.test.ts": 529,
"src/cli/plugin-dev-watch/plugin-frame-log-dedupe.test.ts": 339,
- "src/cli/quote-stripped-json-flag.test.ts": 63,
"src/cli/reference-command-arguments.test.ts": 168,
"src/cli/runtime-client-deferral.test.ts": 1276,
"src/cli/runtime-client.test.ts": 633,
@@ -445,11 +433,7 @@
"src/cli/skills.test.ts": 386,
"src/cli/specs/account.test.ts": 95,
"src/cli/specs/cli-command-names-parity.test.ts": 205,
- "src/cli/specs/profile-state.test.ts": 102,
- "src/cli/terminal-format.test.ts": 84,
"src/cli/terminal-read-screen.test.ts": 660,
- "src/cli/worktree-ps-program-status.test.ts": 65,
- "src/cli/worktree-ps-terminal-verdict.test.ts": 60,
"src/cli/worktree-selector-caller-host.test.ts": 107,
"src/cli/worktree-selector-wsl-posix-path.test.ts": 134,
"src/main/acp/process/acp-agent-connection.test.ts": 407,
@@ -786,28 +770,28 @@
"src/main/automations/automation-dispatch-host-fence.test.ts": 2592,
"src/main/automations/automation-owner-fencing.test.ts": 2028,
"src/main/automations/automation-run-terminal-surface.test.ts": 4180,
- "src/main/automations/automation-run-writer.test.ts": 242,
+
"src/main/automations/automation-skip-coalescing.test.ts": 2577,
- "src/main/automations/automation-ssh-readoption-migration.test.ts": 59,
+ "src/main/automations/ownership/automation-ssh-readoption-migration.test.ts": 59,
"src/main/automations/automation-update-host-retarget.test.ts": 1842,
"src/main/automations/automation-worker-durability.test.ts": 4273,
"src/main/automations/automation-workspace-host-attribution.test.ts": 2088,
"src/main/automations/automation-wsl-distro-stopped-refusal.test.ts": 2151,
"src/main/automations/automation-wsl-move-refusal.test.ts": 2285,
"src/main/automations/automation-zero-grace-tick-latency.test.ts": 2108,
- "src/main/automations/dispatch-refusal-wsl-move.test.ts": 577,
- "src/main/automations/external-automation-manager-cache.test.ts": 70,
- "src/main/automations/external-automation-probe-scheduler.test.ts": 97,
- "src/main/automations/external-manager-scoped.test.ts": 391,
+ "src/main/automations/dispatch/dispatch-refusal-wsl-move.test.ts": 577,
+ "src/main/automations/external-managers/external-automation-manager-cache.test.ts": 70,
+ "src/main/automations/external-managers/external-automation-probe-scheduler.test.ts": 97,
+ "src/main/automations/external-managers/scoped-external-automations.test.ts": 391,
"src/main/automations/run-terminal-retention.test.ts": 112,
"src/main/automations/automation-workspace-create.test.ts": 50,
"src/main/automations/hook-review-blocked-run-terminals.test.ts": 4564,
- "src/main/automations/precheck-runner.test.ts": 1132,
- "src/main/automations/retained-run-reconciliation.test.ts": 1940,
- "src/main/automations/run-target-resolution.test.ts": 367,
+ "src/main/automations/dispatch/precheck-runner.test.ts": 1132,
+ "src/main/automations/observation/retained-run-reconciliation.test.ts": 1940,
+ "src/main/automations/ownership/run-target-resolution.test.ts": 367,
"src/main/automations/runtime-terminal-run-observer-evidence.test.ts": 230,
"src/main/automations/service-precheck.test.ts": 2057,
- "src/main/automations/service.test.ts": 2970,
+ "src/main/automations/automation-service.test.ts": 2970,
"src/main/bitbucket/credential-store.test.ts": 245,
"src/main/bitbucket/repository-ref.test.ts": 426,
"src/main/bitbucket/status-no-decrypt.test.ts": 256,
@@ -916,13 +900,9 @@
"src/main/browser/webauthn/browser-webauthn-account-picker.test.ts": 78,
"src/main/browser/webauthn/browser-webauthn-profile-delete.test.ts": 358,
"src/main/browser/cdp/commands/cdp-bridge-integration.test.ts": 28361,
- "src/main/browser/cdp/transport/cdp-client-response-writer.test.ts": 279,
"src/main/browser/cdp/commands/cdp-print-to-pdf.test.ts": 68,
"src/main/browser/cdp/commands/cdp-screenshot.test.ts": 415,
- "src/main/browser/cdp/transport/cdp-ws-proxy-first-paint.test.ts": 366,
"src/main/browser/cdp/transport/cdp-ws-proxy-host-admission.test.ts": 576,
- "src/main/browser/cdp/transport/cdp-ws-proxy-input-focus.test.ts": 360,
- "src/main/browser/cdp/transport/cdp-ws-proxy-malformed-messages.test.ts": 305,
"src/main/browser/cdp/transport/cdp-ws-proxy-origin.test.ts": 262,
"src/main/browser/cdp/transport/cdp-ws-proxy-startup-lifetime.test.ts": 326,
"src/main/browser/cdp/transport/cdp-ws-proxy.test.ts": 2756,
@@ -1035,33 +1015,25 @@
"src/main/browser/network/execution-routes/wsl-browser-network-execution-route.test.ts": 678,
"src/main/browser/network/execution-routes/wsl-browser-network-relay-launch.test.ts": 146,
"src/main/browser/routing/local-host-partitions/wsl-host-browser-route-partition.test.ts": 753,
- "src/main/claude-accounts/claude-account-folder.test.ts": 153,
+ "src/main/claude-accounts/sign-in/claude-account-folder.test.ts": 153,
"src/main/claude-accounts/claude-account-service.test.ts": 1207,
- "src/main/claude-accounts/claude-command-process-windows-only.test.ts": 90,
- "src/main/claude-accounts/claude-launch-routing.test.ts": 516,
- "src/main/claude-accounts/claude-login-session.test.ts": 1048,
- "src/main/claude-accounts/claude-pasted-code-login.test.ts": 238,
- "src/main/claude-accounts/claude-profile-history-windows.test.ts": 121,
- "src/main/claude-accounts/claude-profile-history.test.ts": 173,
- "src/main/claude-accounts/claude-profile-paths.test.ts": 82,
- "src/main/claude-accounts/claude-profile-provisioning.test.ts": 854,
- "src/main/claude-accounts/claude-profile-router.test.ts": 1091,
- "src/main/claude-accounts/claude-profile-setup-worker.test.ts": 410,
- "src/main/claude-accounts/claude-profile-setup.test.ts": 405,
- "src/main/claude-accounts/claude-profile-wsl-router.test.ts": 919,
- "src/main/claude-accounts/claude-sign-in-browser.test.ts": 314,
- "src/main/claude-accounts/claude-structured-auth-policy.test.ts": 52,
- "src/main/claude-accounts/host-sign-in-real-cli.test.ts": 222,
- "src/main/claude-accounts/keychain-config-directory-aliases.test.ts": 51,
- "src/main/claude-accounts/runtime-auth-service.test.ts": 305,
- "src/main/claude-accounts/runtime-selection.test.ts": 41,
- "src/main/claude-accounts/windows-command-invocation.test.ts": 48,
+ "src/main/claude-accounts/sign-in/claude-login-session.test.ts": 1048,
+ "src/main/claude-accounts/sign-in/claude-pasted-code-login.test.ts": 238,
+ "src/main/claude-accounts/profiles/setup/claude-profile-history-windows.test.ts": 121,
+ "src/main/claude-accounts/profiles/setup/claude-profile-history.test.ts": 173,
+ "src/main/claude-accounts/profiles/claude-profile-paths.test.ts": 82,
+ "src/main/claude-accounts/profiles/setup/claude-profile-provisioning.test.ts": 854,
+ "src/main/claude-accounts/profiles/routing/claude-profile-router.test.ts": 1091,
+ "src/main/claude-accounts/profiles/setup/claude-profile-setup-worker.test.ts": 410,
+ "src/main/claude-accounts/profiles/setup/claude-profile-setup.test.ts": 405,
+ "src/main/claude-accounts/profiles/wsl/claude-profile-wsl-router.test.ts": 919,
+ "src/main/claude-accounts/sign-in/claude-sign-in-browser.test.ts": 314,
+ "src/main/claude-accounts/runtime-auth/keychain-config-directory-aliases.test.ts": 51,
+ "src/main/claude-accounts/selection/runtime-selection.test.ts": 41,
+ "src/main/claude-accounts/sign-in/windows-command-invocation.test.ts": 48,
"src/main/claude-usage/claude-model-pricing.test.ts": 74,
"src/main/claude-usage/claude-usage-report-aggregation.test.ts": 57,
"src/main/claude-usage/persisted-source-authority.test.ts": 491,
- "src/main/claude-usage/scanner-incremental-append.test.ts": 235,
- "src/main/claude-usage/scanner-incremental-ownership.test.ts": 545,
- "src/main/claude-usage/scanner-incremental-reader.test.ts": 819,
"src/main/claude-usage/scanner-long-context.test.ts": 186,
"src/main/claude-usage/scanner-scan.test.ts": 295,
"src/main/claude-usage/scanner.test.ts": 80,
@@ -1075,62 +1047,62 @@
"src/main/claude/agent-view/agent-view-service.test.ts": 403,
"src/main/claude/claude-agent-sdk-contract-pins.test.ts": 3506,
"src/main/claude/claude-agent-sdk-exit-proof-identity.test.ts": 134,
- "src/main/claude/claude-agent-sdk-exit-proof.test.ts": 8832,
- "src/main/claude/claude-agent-sdk-import-boundary.test.ts": 546,
- "src/main/claude/claude-agent-sdk-process-spawn.test.ts": 182,
- "src/main/claude/claude-agent-sdk-user-message-queue.test.ts": 143,
+ "src/main/claude/child-process/claude-agent-sdk-exit-proof.test.ts": 8832,
+ "src/main/claude/sdk-transport/claude-agent-sdk-import-boundary.test.ts": 546,
+ "src/main/claude/child-process/claude-agent-sdk-process-spawn.test.ts": 182,
+ "src/main/claude/sdk-transport/claude-agent-sdk-user-message-queue.test.ts": 143,
"src/main/claude/claude-api-retry-row.test.ts": 901,
"src/main/claude/claude-background-run-isolation-real-cli.test.ts": 147,
"src/main/claude/claude-background-stop-records.test.ts": 1249,
- "src/main/claude/claude-background-task-resume.test.ts": 54,
- "src/main/claude/claude-background-task-terminal-frames.test.ts": 103,
+ "src/main/claude/background-tasks/claude-background-task-resume.test.ts": 54,
+ "src/main/claude/background-tasks/claude-background-task-terminal-frames.test.ts": 103,
"src/main/claude/claude-background-task-turn-resumption.test.ts": 325,
"src/main/claude/claude-background-wake-retention.test.ts": 1652,
- "src/main/claude/claude-child-process-environment.test.ts": 52,
- "src/main/claude/claude-child-work-decoder.test.ts": 110,
+ "src/main/claude/child-process/claude-child-process-environment.test.ts": 52,
+ "src/main/claude/child-work/claude-child-work-decoder.test.ts": 110,
"src/main/claude/claude-close-turn-end.test.ts": 970,
- "src/main/claude/claude-command-lifecycle-frames.test.ts": 268,
- "src/main/claude/claude-command-lifecycle.test.ts": 1107,
- "src/main/claude/claude-command-turn.test.ts": 292,
- "src/main/claude/claude-config-dir-pin.test.ts": 47,
+ "src/main/claude/structured/turns/claude-command-lifecycle-frames.test.ts": 268,
+ "src/main/claude/structured/turns/claude-command-lifecycle.test.ts": 1107,
+ "src/main/claude/structured/turns/claude-command-turn.test.ts": 292,
+ "src/main/claude/structured/launch/claude-config-dir-pin.test.ts": 47,
"src/main/claude/claude-context-model-switch.test.ts": 422,
"src/main/claude/claude-context-usage-restart.test.ts": 925,
"src/main/claude/claude-context-usage-unloaded-turn.test.ts": 4910,
"src/main/claude/claude-descendant-escalation-boundary.test.ts": 593,
- "src/main/claude/claude-diff-panel-auto-open.test.ts": 117,
+ "src/main/claude/configuration/claude-diff-panel-auto-open.test.ts": 117,
"src/main/claude/claude-fold-steer-receipt.test.ts": 1019,
- "src/main/claude/claude-folder-trust-file.test.ts": 762,
- "src/main/claude/claude-hook-event-versions.test.ts": 137,
+ "src/main/claude/configuration/claude-folder-trust-file.test.ts": 762,
+ "src/main/claude/cli-capabilities/claude-hook-event-versions.test.ts": 137,
"src/main/claude/claude-informational-row.test.ts": 811,
- "src/main/claude/claude-journal-turn-scope.test.ts": 254,
- "src/main/claude/claude-model-catalog-probe.test.ts": 2098,
+ "src/main/claude/structured/journal/claude-journal-turn-scope.test.ts": 254,
+ "src/main/claude/model-catalog/claude-model-catalog-probe.test.ts": 2098,
"src/main/claude/claude-naming-invocation.test.ts": 334,
"src/main/claude/claude-plan-approval-mode.test.ts": 905,
- "src/main/claude/claude-profile-hooks.test.ts": 371,
- "src/main/claude/claude-provider-session-rename.test.ts": 597,
- "src/main/claude/claude-provisional-row-corrections.test.ts": 67,
- "src/main/claude/claude-request-end-wait.test.ts": 53,
- "src/main/claude/claude-rewind-transcript.test.ts": 762,
+ "src/main/claude/hooks/claude-profile-hooks.test.ts": 371,
+ "src/main/claude/transcripts/claude-provider-session-rename.test.ts": 597,
+ "src/main/claude/subagents/claude-provisional-row-corrections.test.ts": 67,
+ "src/main/claude/structured/turns/claude-request-end-wait.test.ts": 53,
+ "src/main/claude/transcripts/claude-rewind-transcript.test.ts": 762,
"src/main/claude/claude-settings-schema-install.test.ts": 410,
- "src/main/claude/claude-status-line-install.test.ts": 342,
+ "src/main/claude/hooks/claude-status-line-install.test.ts": 342,
"src/main/claude/claude-status-line-windows.test.ts": 273,
"src/main/claude/claude-stop-ack-race.test.ts": 1301,
"src/main/claude/claude-stream-json-connection-close.test.ts": 621,
- "src/main/claude/claude-stream-json-connection.test.ts": 8687,
- "src/main/claude/claude-streamed-text-checkpoints.test.ts": 59,
+ "src/main/claude/sdk-transport/claude-stream-json-connection.test.ts": 8687,
+ "src/main/claude/structured/journal/claude-streamed-text-checkpoints.test.ts": 59,
"src/main/claude/claude-structured-launch-home-perf.test.ts": 401,
"src/main/claude/claude-structured-result-control-overlap.test.ts": 1136,
- "src/main/claude/claude-subagent-id-aliases.test.ts": 46,
+ "src/main/claude/subagents/claude-subagent-id-aliases.test.ts": 46,
"src/main/claude/claude-subagent-permission-request.test.ts": 3776,
- "src/main/claude/claude-subagent-resume-after-restart.test.ts": 825,
+ "src/main/claude/subagents/claude-subagent-resume-after-restart.test.ts": 825,
"src/main/claude/claude-supervised-stop-real-cli.test.ts": 382,
"src/main/claude/claude-supervised-stop.integration.test.ts": 3821,
- "src/main/claude/claude-transcript-catch-up.test.ts": 4017,
+ "src/main/claude/transcripts/claude-transcript-catch-up.test.ts": 4017,
"src/main/claude/claude-transcript-duration.test.ts": 1411,
- "src/main/claude/claude-transcript-entry-uuid.test.ts": 38,
- "src/main/claude/hook-service.test.ts": 329,
- "src/main/claude/post-compact-hook-command.test.ts": 314,
- "src/main/claude/statusline-script.test.ts": 257,
+ "src/main/claude/transcripts/claude-transcript-entry-uuid.test.ts": 38,
+ "src/main/claude/hooks/hook-service.test.ts": 329,
+ "src/main/claude/hooks/post-compact-hook-command.test.ts": 314,
+ "src/main/claude/hooks/statusline-script.test.ts": 257,
"src/main/claude/structured/claude-structured-content-parts.test.ts": 277,
"src/main/claude/structured/claude-structured-conversation-stop.test.ts": 884,
"src/main/claude/structured/claude-structured-dispatch-admission.test.ts": 426,
@@ -1164,7 +1136,6 @@
"src/main/claude/structured/journal/claude-structured-prompt-ownership.test.ts": 944,
"src/main/claude/structured/launch/claude-structured-applied-options.test.ts": 956,
"src/main/claude/structured/launch/claude-structured-child-env.test.ts": 126,
- "src/main/claude/structured/launch/claude-structured-launch-account-routing.test.ts": 1800,
"src/main/claude/structured/launch/claude-structured-launch-resolution.test.ts": 672,
"src/main/claude/structured/launch/claude-structured-launch-visuals.test.ts": 565,
"src/main/claude/structured/launch/claude-structured-message-options.test.ts": 1586,
@@ -1173,7 +1144,7 @@
"src/main/claude/structured/launch/claude-structured-options.test.ts": 420,
"src/main/claude/structured/launch/claude-structured-provider-fallback.test.ts": 670,
"src/main/claude/structured/launch/claude-structured-real-cli-options.test.ts": 902,
- "src/main/claude/windows-hook-files.test.ts": 356,
+ "src/main/claude/hooks/windows-hook-files.test.ts": 356,
"src/main/claude/windows-native-hook-registration.test.ts": 246,
"src/main/cli/appimage/appimage-copy-pre-extraction.test.ts": 328,
"src/main/cli/appimage/appimage-extraction-pruning-namespace.test.ts": 106,
@@ -1197,58 +1168,40 @@
"src/main/cli/wsl/wsl-cli-registration-registry.test.ts": 150,
"src/main/cli/wsl/wsl-managed-cli.wsl.test.ts": 115,
"src/main/codebuddy/hook-service.test.ts": 272,
- "src/main/codex-accounts/async-file-rename.test.ts": 1065,
- "src/main/codex-accounts/codex-account-identity-api-key-guard.test.ts": 55,
- "src/main/codex-accounts/codex-config-mirror.test.ts": 331,
- "src/main/codex-accounts/codex-credential-absence-grace.test.ts": 62,
- "src/main/codex-accounts/codex-device-auth-prompt.test.ts": 48,
- "src/main/codex-accounts/codex-login-auth-url.test.ts": 44,
- "src/main/codex-accounts/codex-login-session-wsl-open.test.ts": 184,
- "src/main/codex-accounts/codex-managed-home-path-wsl-check.test.ts": 71,
- "src/main/codex-accounts/codex-reset-credit-ledger.test.ts": 283,
+ "src/main/filesystem/async-file-rename.test.ts": 1065,
+ "src/main/codex-accounts/credentials/codex-account-identity-api-key-guard.test.ts": 55,
+ "src/main/codex-accounts/managed-homes/codex-config-mirror.test.ts": 331,
+ "src/main/codex-accounts/credentials/codex-credential-absence-grace.test.ts": 62,
+ "src/main/codex-accounts/login/codex-device-auth-prompt.test.ts": 48,
+ "src/main/codex-accounts/login/codex-login-auth-url.test.ts": 44,
+ "src/main/codex-accounts/managed-homes/codex-managed-home-path-wsl-check.test.ts": 71,
+ "src/main/codex-accounts/reset-credits/codex-reset-credit-ledger.test.ts": 283,
"src/main/filesystem/atomic-file-publication.test.ts": 127,
- "src/main/codex-accounts/guest-codex-account-homes.test.ts": 86,
- "src/main/codex-accounts/host-codex-managed-home-ownership.test.ts": 51,
- "src/main/codex-accounts/legacy-shared-auth-migration.test.ts": 134,
- "src/main/codex-accounts/legacy-shared-config-compatibility.test.ts": 151,
- "src/main/codex-accounts/legacy-wsl-runtime-auth-drain-apply-script.test.ts": 5936,
- "src/main/codex-accounts/legacy-wsl-runtime-auth-drain-interruption-source.test.ts": 68,
- "src/main/codex-accounts/legacy-wsl-runtime-auth-drain-rollback-script.test.ts": 558,
- "src/main/codex-accounts/managed-codex-auth-readiness.test.ts": 86,
- "src/main/codex-accounts/runtime-home-catalog-account-key.test.ts": 2664,
- "src/main/codex-accounts/runtime-home-catalog-probe-prep.test.ts": 583,
- "src/main/codex-accounts/runtime-home-legacy-migration.test.ts": 1147,
- "src/main/codex-accounts/runtime-home-managed-auth-recovery.test.ts": 658,
- "src/main/codex-accounts/runtime-home-mirror-login-copy.test.ts": 1012,
- "src/main/codex-accounts/runtime-home-per-account-homes.test.ts": 1107,
- "src/main/codex-accounts/runtime-home-rate-limit-pinned-distro.test.ts": 521,
- "src/main/codex-accounts/runtime-home-real-home-lane-routing.test.ts": 879,
- "src/main/codex-accounts/runtime-home-retained-auth-provenance.test.ts": 1404,
- "src/main/codex-accounts/runtime-home-service-per-account-migration.test.ts": 980,
- "src/main/codex-accounts/runtime-home-session-discovery-read-only.test.ts": 543,
- "src/main/codex-accounts/runtime-home-session-migration-pass.test.ts": 705,
- "src/main/codex-accounts/runtime-home-status-hook-independence.test.ts": 743,
- "src/main/codex-accounts/runtime-home-system-default-mirror-readback.test.ts": 1493,
- "src/main/codex-accounts/runtime-home-system-default-snapshot.test.ts": 1255,
- "src/main/codex-accounts/runtime-home-system-resource-materialization.test.ts": 1196,
- "src/main/codex-accounts/runtime-home-windows-profile-ownership.test.ts": 359,
- "src/main/codex-accounts/runtime-home-wsl-managed-accounts.test.ts": 1199,
- "src/main/codex-accounts/runtime-home-wsl-session-bridge.test.ts": 1018,
- "src/main/codex-accounts/runtime-home-wsl-system-default.test.ts": 758,
- "src/main/codex-accounts/service-abandoned-login-supersede.test.ts": 780,
- "src/main/codex-accounts/service-account-add-login.test.ts": 757,
- "src/main/codex-accounts/service-account-selection-and-removal.test.ts": 1020,
- "src/main/codex-accounts/service-add-account-from-home.test.ts": 437,
- "src/main/codex-accounts/service-login-process-teardown.test.ts": 570,
- "src/main/codex-accounts/service-managed-home-identity.test.ts": 567,
- "src/main/codex-accounts/service-quota-refresh-decoupling.test.ts": 640,
- "src/main/codex-accounts/service-reauthenticate-activation.test.ts": 758,
- "src/main/codex-accounts/service-reset-credit-home-ownership.test.ts": 768,
- "src/main/codex-accounts/service-system-default-identity.test.ts": 624,
- "src/main/codex-accounts/service-wsl-accounts.test.ts": 780,
- "src/main/codex-accounts/service.test.ts": 866,
- "src/main/codex-accounts/sta-4734-login-rollback-deletes-authenticated-home.test.ts": 713,
- "src/main/codex-accounts/sta-4735-unreadable-host-lane-writes.test.ts": 564,
+ "src/main/codex-accounts/managed-homes/guest-codex-account-homes.test.ts": 86,
+ "src/main/codex-accounts/managed-homes/host-codex-managed-home-ownership.test.ts": 51,
+ "src/main/codex-accounts/runtime-home/legacy-host/legacy-shared-auth-migration.test.ts": 134,
+ "src/main/codex-accounts/runtime-home/legacy-host/legacy-shared-config-compatibility.test.ts": 151,
+ "src/main/codex-accounts/legacy-wsl-auth-drain/legacy-wsl-runtime-auth-drain-apply-script.test.ts": 5936,
+ "src/main/codex-accounts/legacy-wsl-auth-drain/legacy-wsl-runtime-auth-drain-rollback-script.test.ts": 558,
+ "src/main/codex-accounts/credentials/managed-codex-auth-readiness.test.ts": 86,
+ "src/main/codex-accounts/runtime-home/legacy-host/runtime-home-legacy-migration.test.ts": 1147,
+ "src/main/codex-accounts/runtime-home/credentials/runtime-home-managed-auth-recovery.test.ts": 658,
+ "src/main/codex-accounts/runtime-home/credentials/runtime-home-mirror-login-copy.test.ts": 1012,
+ "src/main/codex-accounts/runtime-home/routing/runtime-home-per-account-homes.test.ts": 1107,
+ "src/main/codex-accounts/runtime-home/routing/runtime-home-real-home-lane-routing.test.ts": 879,
+ "src/main/codex-accounts/runtime-home/credentials/runtime-home-retained-auth-provenance.test.ts": 1404,
+ "src/main/codex-accounts/runtime-home/routing/runtime-home-service-per-account-migration.test.ts": 980,
+ "src/main/codex-accounts/runtime-home/routing/runtime-home-session-migration-pass.test.ts": 705,
+ "src/main/codex-accounts/runtime-home/credentials/runtime-home-system-default-mirror-readback.test.ts": 1493,
+ "src/main/codex-accounts/runtime-home/credentials/runtime-home-system-default-snapshot.test.ts": 1255,
+ "src/main/codex-accounts/runtime-home/routing/runtime-home-system-resource-materialization.test.ts": 1196,
+ "src/main/codex-accounts/runtime-home/wsl/runtime-home-wsl-managed-accounts.test.ts": 1199,
+ "src/main/codex-accounts/runtime-home/wsl/runtime-home-wsl-session-bridge.test.ts": 1018,
+ "src/main/codex-accounts/runtime-home/wsl/runtime-home-wsl-system-default.test.ts": 758,
+ "src/main/codex-accounts/account-management/service-system-default-identity.test.ts": 624,
+ "src/main/codex-accounts/account-management/service-wsl-accounts.test.ts": 780,
+ "src/main/codex-accounts/account-management/service.test.ts": 866,
+ "src/main/codex-accounts/account-management/sta-4734-login-rollback-deletes-authenticated-home.test.ts": 713,
"src/main/codex-cli/codex-home-process-lock.test.ts": 52,
"src/main/codex-cli/command-guest-path.test.ts": 126,
"src/main/codex-usage/codex-rollout-file-lifetime.test.ts": 173,
@@ -1311,7 +1264,6 @@
"src/main/codex/hooks/definitions/codex-real-home-hook-key-spellings.test.ts": 408,
"src/main/codex/hooks/reconciliation/codex-real-home-hook-removal.test.ts": 388,
"src/main/codex/configuration/homes/codex-real-home-path.test.ts": 76,
- "src/main/codex/hooks/reconciliation/codex-real-home-shared-entry.test.ts": 641,
"src/main/codex/history/backfill/codex-session-backfill.test.ts": 310,
"src/main/codex/history/bridges/codex-session-bridge.test.ts": 118,
"src/main/codex/history/index/codex-session-index-heal-state.test.ts": 363,
@@ -1401,7 +1353,6 @@
"src/main/codex/hooks/installation/hook-service-managed-codex-hashes.test.ts": 1048,
"src/main/codex/hooks/installation/hook-service-managed-install.test.ts": 492,
"src/main/codex/hooks/installation/hook-service-runtime-trust-repair.test.ts": 475,
- "src/main/codex/hooks/installation/hook-service-trust-grant.test.ts": 318,
"src/main/codex/hooks/installation/hook-service-user-hook-mirroring.test.ts": 596,
"src/main/codex/hooks/installation/hook-service-user-hook-trust-spellings.test.ts": 657,
"src/main/codex/hooks/installation/hook-service-windows-key-spellings.test.ts": 461,
@@ -1440,7 +1391,6 @@
"src/main/crash-reporting/minidumps/minidump-fault-context.test.ts": 57,
"src/main/crash-reporting/minidumps/minidump-file-source.test.ts": 199,
"src/main/crash-reporting/process-exits/process-gone-dedupe.test.ts": 46,
- "src/main/crash-reporting/process-exits/process-gone-recorder.test.ts": 787,
"src/main/crash-reporting/memory/renderer-heap-allocation-sites.test.ts": 62,
"src/main/credentials/saved-credential-readability.test.ts": 56,
"src/main/cursor/hook-command.live-shell.test.ts": 488,
@@ -1598,7 +1548,6 @@
"src/main/daemon/pty-subprocess/testing/pty-subprocess-foreground-identity.test.ts": 818,
"src/main/daemon/pty-subprocess/testing/pty-subprocess-handle-lifecycle.test.ts": 449,
"src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-cleanup.test.ts": 1127,
- "src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-native.test.ts": 3285,
"src/main/daemon/pty-subprocess/testing/pty-subprocess-spawn-file-foreground.test.ts": 528,
"src/main/daemon/pty-subprocess/testing/pty-subprocess-windows-shell-launch.test.ts": 459,
"src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts": 431,
@@ -1710,10 +1659,9 @@
"src/main/foreign-sqlite-readers/readers/opencode-prompt-failure.test.ts": 346,
"src/main/ghostty/index.test.ts": 118,
"src/main/ghostty/theme-import.test.ts": 100,
- "src/main/git/base-ref-search-selector.test.ts": 257,
- "src/main/git/branch-rename.test.ts": 66,
- "src/main/git/canonical-repo-key.test.ts": 221,
- "src/main/git/checkout-branch-identity-real-git.test.ts": 378,
+ "src/main/git/refs/resolution/base-ref-search-selector.test.ts": 257,
+ "src/main/git/worktrees/checkout/branch-rename.test.ts": 66,
+ "src/main/git/worktrees/checkout/checkout-branch-identity-real-git.test.ts": 378,
"src/main/git/remotes/coalesced-probe.test.ts": 43,
"src/main/git/command-runner/exec-file-capture-bytes.test.ts": 4698,
"src/main/git/command-runner/exec-file-capture-stdin.test.ts": 287,
@@ -1731,37 +1679,37 @@
"src/main/git/command-runner/wsl-command-resolution-object-store.test.ts": 127,
"src/main/git/command-runner/wsl-host-failure.test.ts": 241,
"src/main/git/command-runner/wsl-service-failure-direct-git.test.ts": 259,
- "src/main/git/current-branch-identity-real-git.test.ts": 431,
- "src/main/git/default-wsl-cli-fallback-gate.test.ts": 465,
- "src/main/git/exact-ref-probe.test.ts": 62,
+ "src/main/git/remotes/current-branch-identity-real-git.test.ts": 431,
+ "src/main/git/command-runner/hosted-cli/default-wsl-cli-fallback-gate.test.ts": 465,
+ "src/main/git/refs/resolution/exact-ref-probe.test.ts": 62,
"src/main/git/refs/fork-remotes/fork-remote-refspec.test.ts": 51,
"src/main/git/refs/fork-remotes/fork-remote-stale-branch-refspec.test.ts": 46,
- "src/main/git/gh-rate-limit-breaker.test.ts": 50,
+ "src/main/git/command-runner/hosted-cli/gh-rate-limit-breaker.test.ts": 50,
"src/main/git/command-runner/git-capability-state.test.ts": 60,
- "src/main/git/git-network-safety-real-git.test.ts": 378,
+ "src/main/git/command-runner/git-environment/git-network-safety-real-git.test.ts": 378,
"src/shared/git/status/git-status-read-lease-owner.test.ts": 49,
"src/main/git/source-control/git-upstream-status-read-owner.test.ts": 45,
"src/main/git/command-runner/git-worktree-mutation-state.test.ts": 74,
"src/main/git/remotes/hosted-remote-url.test.ts": 43,
- "src/main/git/huge-folder-ignore.test.ts": 58,
- "src/main/git/local-git-object-quarantine.test.ts": 108,
+ "src/main/git/source-control/huge-folder-ignore.test.ts": 58,
+ "src/main/git/objects/local-git-object-quarantine.test.ts": 108,
"src/main/git/refs/maintenance/local-repo-ref-maintenance-wsl-stopped.test.ts": 271,
"src/main/git/refs/maintenance/local-repo-ref-maintenance.test.ts": 339,
- "src/main/git/merge-tree-object-quarantine-real-git.test.ts": 2561,
+ "src/main/git/objects/merge-tree-object-quarantine-real-git.test.ts": 2561,
"src/main/git/refs/maintenance/pack-refs-lock-ownership.test.ts": 59,
"src/main/git/source-control/porcelain-v1-records.test.ts": 138,
"src/main/git/remotes/remote-name-listing.test.ts": 398,
"src/main/git/remotes/remote-ref-probe-cache.test.ts": 414,
- "src/main/git/remote.test.ts": 352,
+ "src/main/git/remotes/remote.test.ts": 352,
"src/main/git/worktrees/removal/remove-worktree-branch-cleanup.test.ts": 409,
"src/main/git/worktrees/removal/remove-worktree-clean-preflight.test.ts": 248,
"src/main/git/worktrees/removal/remove-worktree.test.ts": 310,
- "src/main/git/repo-branch-conflict-real-git.test.ts": 348,
- "src/main/git/repo-branch-conflict.test.ts": 308,
- "src/main/git/repo-detection-async.test.ts": 612,
- "src/main/git/repo-detection-batching.test.ts": 494,
- "src/main/git/repo-detection-command.test.ts": 49,
- "src/main/git/repo-detection.test.ts": 842,
+ "src/main/git/refs/resolution/repo-branch-conflict-real-git.test.ts": 348,
+ "src/main/git/refs/resolution/repo-branch-conflict.test.ts": 308,
+ "src/main/git/repositories/discovery/repo-detection-async.test.ts": 612,
+ "src/main/git/repositories/discovery/repo-detection-batching.test.ts": 494,
+ "src/main/git/repositories/discovery/repo-detection-command.test.ts": 49,
+ "src/main/git/repositories/discovery/repo-detection.test.ts": 842,
"src/main/git/refs/maintenance/repo-maintenance-admission.test.ts": 757,
"src/main/git/refs/maintenance/repo-pack-index-maintenance.test.ts": 152,
"src/main/git/refs/maintenance/repo-pack-index-state.test.ts": 67,
@@ -1769,22 +1717,22 @@
"src/main/git/remotes/repo-remote-drift-real.test.ts": 357,
"src/main/git/repo-search-ref-compat.test.ts": 125,
"src/main/git/repo-username.test.ts": 303,
- "src/main/git/repo.test.ts": 2318,
- "src/main/git/runner-buffer-cancellation.test.ts": 318,
- "src/main/git/runner-buffer-stdin.test.ts": 229,
- "src/main/git/runner-command-exec.test.ts": 764,
- "src/main/git/runner-gh-account-binding.test.ts": 246,
- "src/main/git/runner-gh-host-args.test.ts": 54,
- "src/main/git/runner-gh-rate-limit-breaker.test.ts": 261,
- "src/main/git/runner-network-ssh-policy.test.ts": 283,
- "src/main/git/runner-windows-host-environment.test.ts": 322,
- "src/main/git/runner-wsl-direct-read.test.ts": 413,
- "src/main/git/runner-wsl-gh-fallback.test.ts": 1093,
+ "src/main/git/refs/resolution/repo.test.ts": 2318,
+ "src/main/git/command-runner/runner-buffer-cancellation.test.ts": 318,
+ "src/main/git/command-runner/runner-buffer-stdin.test.ts": 229,
+ "src/main/git/command-runner/runner-command-exec.test.ts": 764,
+ "src/main/git/command-runner/hosted-cli/runner-gh-account-binding.test.ts": 246,
+ "src/main/git/command-runner/hosted-cli/runner-gh-host-args.test.ts": 54,
+ "src/main/git/command-runner/hosted-cli/runner-gh-rate-limit-breaker.test.ts": 261,
+ "src/main/git/command-runner/git-environment/runner-network-ssh-policy.test.ts": 283,
+ "src/main/git/command-runner/host-routing/runner-windows-host-environment.test.ts": 322,
+ "src/main/git/command-runner/host-routing/runner-wsl-direct-read.test.ts": 413,
+ "src/main/git/command-runner/hosted-cli/runner-wsl-gh-fallback.test.ts": 1093,
"src/main/git/runner-wsl-linked-gitdir-timeout.test.ts": 266,
- "src/main/git/runner-wsl-linked-gitdir-windows.test.ts": 381,
- "src/main/git/runner-wsl-login-shell-capture.test.ts": 222,
- "src/main/git/runner-wsl-network-ssh-policy.test.ts": 260,
- "src/main/git/saved-clone-target.test.ts": 890,
+ "src/main/git/command-runner/host-routing/runner-wsl-linked-gitdir-windows.test.ts": 381,
+ "src/main/git/command-runner/host-routing/runner-wsl-login-shell-capture.test.ts": 222,
+ "src/main/git/command-runner/git-environment/runner-wsl-network-ssh-policy.test.ts": 260,
+ "src/main/git/repositories/cloning/saved-clone-target.test.ts": 890,
"src/main/git/source-control/blob-absence-real-git.test.ts": 629,
"src/main/git/source-control/complete-merge-real-git.test.ts": 958,
"src/main/git/source-control/diff-textconv-real-git.test.ts": 520,
@@ -1856,8 +1804,8 @@
"src/main/git/worktrees/content-paths/worktree-shared-directories.test.ts": 1045,
"src/main/git/worktrees/content-paths/worktree-symlink-detection.test.ts": 51,
"src/main/git/command-runner/wsl-linked-worktree-git-route-invalidation.test.ts": 48,
- "src/main/git/wsl-windows-checkout-git-config.test.ts": 64,
- "src/main/git/wsl-windows-checkout-git-probe.test.ts": 273,
+ "src/main/git/command-runner/host-routing/wsl-windows-checkout-git-config.test.ts": 64,
+ "src/main/git/command-runner/host-routing/wsl-windows-checkout-git-probe.test.ts": 273,
"src/main/git/wsl-windows-checkout-sample-script.test.ts": 165,
"src/main/git/worktrees/catalog/wsl-worktree-git-path.test.ts": 88,
"src/main/gitea/client-scan-invalidation.test.ts": 474,
@@ -1868,7 +1816,6 @@
"src/main/github/client-issue-source.test.ts": 663,
"src/main/github/client-merge-queue-auto-merge.test.ts": 848,
"src/main/github/client-pr-check-details.test.ts": 440,
- "src/main/github/client-pr-conversation-requests.test.ts": 533,
"src/main/github/client-pr-fallback-number.test.ts": 577,
"src/main/github/client-pr-linked-lookup.test.ts": 574,
"src/main/github/client-pr-local-runtime.test.ts": 577,
@@ -1976,7 +1923,7 @@
"src/main/host/secret-protection-report.test.ts": 59,
"src/main/i18n/main-i18n-lazy-locale.test.ts": 518,
"src/main/i18n/system-language.test.ts": 358,
- "src/main/media/image-file-signature.test.ts": 47,
+ "src/shared/image-file-signature.test.ts": 47,
"src/main/credentials/integration-state-file-cache.test.ts": 47,
"src/main/credentials/integration-token-file-cache.test.ts": 152,
"src/main/ipc/account-sign-in-link-opener.test.ts": 128,
@@ -2043,28 +1990,22 @@
"src/main/ipc/filesystem/local-disk-write-precondition.test.ts": 8407,
"src/main/ipc/filesystem/local-file-range-read.test.ts": 56,
"src/main/ipc/filesystem/local-regular-file-read.test.ts": 78,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.test.ts": 57,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts": 93,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-crash-fuse.test.ts": 54,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts": 145,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-event-cancellation.test.ts": 58,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts": 162,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-native-error-retirement.test.ts": 120,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-owned-children.test.ts": 59,
+ "src/main/ipc/filesystem/watcher-process/child-lifecycle/parcel-watcher-child-registry.test.ts": 93,
+ "src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-crash-fuse.test.ts": 54,
+ "src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts": 145,
+ "src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts": 162,
+ "src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-native-error-retirement.test.ts": 120,
+ "src/main/ipc/filesystem/watcher-process/child-lifecycle/parcel-watcher-owned-children.test.ts": 59,
"src/main/ipc/filesystem/watcher-process/parcel-watcher-process-dispose.test.ts": 51,
"src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts": 519,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-root-path-rewrite.test.ts": 135,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-shallow-subscription.test.ts": 241,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts": 235,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-disposal.test.ts": 106,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-unsubscribe-timeout.test.ts": 135,
+ "src/main/ipc/filesystem/watcher-process/root-paths/parcel-watcher-root-path-rewrite.test.ts": 135,
+ "src/main/ipc/filesystem/watcher-process/native-subscriptions/parcel-watcher-shallow-subscription.test.ts": 241,
+ "src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-supervisor-capacity.test.ts": 235,
"src/main/ipc/filesystem/watchers/filesystem-watcher-document-lifetime.test.ts": 557,
"src/main/ipc/filesystem/watchers/filesystem-watcher-event-batch.test.ts": 59,
"src/main/ipc/filesystem/watchers/filesystem-watcher-ignore-real.test.ts": 707,
"src/main/ipc/filesystem/watchers/filesystem-watcher-large-batch.test.ts": 306,
"src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts": 1252,
- "src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts": 411,
- "src/main/ipc/filesystem/watchers/filesystem-watcher-real.test.ts": 613,
"src/main/ipc/filesystem/watchers/filesystem-watcher-stat-lifecycle.test.ts": 297,
"src/main/ipc/filesystem/watchers/filesystem-watcher-wsl-stat-stop.test.ts": 107,
"src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts": 119,
@@ -2089,13 +2030,11 @@
"src/main/ipc/markdown-documents-ripgrep.test.ts": 289,
"src/main/ipc/mobile.test.ts": 1861,
"src/main/ipc/notebook-project-link.test.ts": 548,
- "src/main/ipc/notifications-custom-sound.test.ts": 289,
"src/main/ipc/notifications-message-formatting.test.ts": 229,
"src/main/ipc/notifications-subject-retirement.test.ts": 304,
"src/main/ipc/profiles/orca-profiles-switch-persistence.test.ts": 2761,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-crash-fuse-recovery.test.ts": 128,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-delivery-health.test.ts": 110,
- "src/main/ipc/filesystem/watcher-process/parcel-watcher-shallow-file-subscription.test.ts": 4531,
+ "src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-crash-fuse-recovery.test.ts": 128,
+ "src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-delivery-health.test.ts": 110,
"src/main/ipc/pets/pet-bundle.test.ts": 48,
"src/main/ipc/pets/pet.test.ts": 268,
"src/main/ipc/plugin-marketplaces.test.ts": 430,
@@ -2135,8 +2074,7 @@
"src/main/ipc/pty/pty-write-ipc-validation.test.ts": 5157,
"src/main/ipc/pty/runtime/kill-same-id-respawn.test.ts": 3784,
"src/main/ipc/pty/runtime/spawn-preflight-wsl-background-hold.test.ts": 1568,
- "src/main/ipc/filesystem/watcher-process/rebinding-file-watch-noise.test.ts": 317,
- "src/main/ipc/filesystem/watcher-process/rebinding-file-watch.test.ts": 4226,
+ "src/main/ipc/filesystem/watcher-process/native-subscriptions/rebinding-file-watch-noise.test.ts": 317,
"src/main/ipc/worktrees/removal/registered-worktree-root-ownership.test.ts": 498,
"src/main/ipc/worktrees/removal/registered-worktree-root-refresh.test.ts": 224,
"src/main/ipc/worktrees/removal/registered-worktree-root-stopped-distro.test.ts": 168,
@@ -2168,9 +2106,6 @@
"src/main/ipc/runtime-environments/runtime-environments-repair.test.ts": 4122,
"src/main/ipc/runtime-environments/runtime-environments-subscription-lifecycle.test.ts": 5098,
"src/main/ipc/runtime-upload-file-stream.test.ts": 144,
- "src/main/ipc/filesystem/watcher-process/runtime-watcher-disposal-owners.test.ts": 47,
- "src/main/ipc/filesystem/watcher-process/runtime-watcher-pending-assignment.test.ts": 290,
- "src/main/ipc/filesystem/watcher-process/runtime-watcher-pool-shutdown.test.ts": 103,
"src/main/ipc/runtime.test.ts": 3323,
"src/main/ipc/sender-scoped-request-cancellation.test.ts": 80,
"src/main/ipc/session-window-view-save.test.ts": 1998,
@@ -2188,7 +2123,7 @@
"src/main/ipc/terminal-preview-output-stream.test.ts": 53,
"src/main/ipc/terminal-render-desync-evidence.test.ts": 78,
"src/main/ipc/terminal-startup-color-query-replies.test.ts": 265,
- "src/main/ipc/filesystem/watcher-process/watcher-event-root-path-rewrite.test.ts": 48,
+ "src/main/ipc/filesystem/watcher-process/root-paths/watcher-event-root-path-rewrite.test.ts": 48,
"src/main/workspaces/removal/watcher-removal-gate.test.ts": 384,
"src/main/ipc/workspace-cleanup/workspace-cleanup-activity.test.ts": 76,
"src/main/ipc/workspace-cleanup/workspace-cleanup-document-lifetime.test.ts": 1130,
@@ -2214,12 +2149,9 @@
"src/main/git/remotes/worktree-push-target-setup.test.ts": 491,
"src/main/ipc/worktree-symlink-reconciliation.real.test.ts": 410,
"src/main/ipc/worktree-symlinks.test.ts": 152,
- "src/main/ipc/worktrees-delete-pty-teardown.test.ts": 1934,
- "src/main/ipc/worktrees-issue-command-overrides.test.ts": 1594,
"src/main/ipc/worktrees-orphan-directory-cleanup.test.ts": 1486,
"src/main/ipc/worktrees-removal-recovery.test.ts": 1971,
"src/main/ipc/worktrees-remove-preflight.test.ts": 1415,
- "src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts": 1447,
"src/main/ipc/worktrees/listing/detected-provider-listing-catalog-version.test.ts": 650,
"src/main/ipc/worktrees/listing/detected-worktree-scan-hygiene-gate.test.ts": 105,
"src/main/ipc/worktrees/listing/detected-worktree-scan-listing-distro.test.ts": 880,
@@ -2229,7 +2161,6 @@
"src/main/ipc/wsl/wsl-host-automation-wake-launch.test.ts": 939,
"src/main/ipc/wsl/wsl-host-handlers-user-actions.test.ts": 772,
"src/main/ipc/wsl/wsl-host-visible-work-windows.test.ts": 39,
- "src/main/ipc/wsl/wsl-move-driver-handlers.test.ts": 432,
"src/main/ipc/wsl/wsl-move-handlers-setting-off.test.ts": 724,
"src/main/ipc/wsl/wsl-move-host-connect.test.ts": 984,
"src/main/ipc/wsl/wsl-move-partial-undo.test.ts": 939,
@@ -2345,7 +2276,7 @@
"src/main/native-chat/agent-session-attachments/agent-session-attachment-claims.test.ts": 971,
"src/main/native-chat/agent-session-attachments/agent-session-attachment-store.test.ts": 340,
"src/main/native-chat/agent-session-attachments/agent-session-attachment-sweep.test.ts": 948,
- "src/main/native-chat/agent-session-context-snapshots.test.ts": 65,
+ "src/main/native-chat/conversation-context/agent-session-context-snapshots.test.ts": 65,
"src/main/native-chat/agent-session-journal/history-import/adopted-directory-probe.test.ts": 153,
"src/main/native-chat/agent-session-journal/database/journal-checkpoint-attachment-sweep.test.ts": 8790,
"src/main/native-chat/agent-session-journal/history-import/journal-codex-history.test.ts": 786,
@@ -2401,7 +2332,6 @@
"src/main/native-chat/agent-session-wire/operations/testing/structured-agent-session-ended-prompt-cancel.test.ts": 1466,
"src/main/native-chat/agent-session-wire/termination/testing/structured-agent-session-eviction.test.ts": 478,
"src/main/native-chat/agent-session-wire/host/testing/structured-agent-session-exit-delivery.test.ts": 2327,
- "src/main/native-chat/agent-session-wire/host/testing/structured-agent-session-failed-create-owner-verdict.test.ts": 2022,
"src/main/native-chat/agent-session-wire/host/testing/structured-agent-session-fork-rewind.test.ts": 1797,
"src/main/native-chat/agent-session-wire/host/testing/structured-agent-session-held-child-lease-renewal.test.ts": 957,
"src/main/native-chat/agent-session-wire/host/testing/structured-agent-session-input-order-rewind.test.ts": 1509,
@@ -2460,37 +2390,37 @@
"src/main/native-chat/agent-session-wire/host/testing/structured-conversation-command-child-work.test.ts": 1810,
"src/main/native-chat/agent-session-wire/host/testing/structured-conversation-command.test.ts": 2989,
"src/main/native-chat/agent-session-wire/rewind/testing/structured-rewind-cut.test.ts": 672,
- "src/main/native-chat/host-readable-transcript-path.test.ts": 150,
+ "src/main/native-chat/transcript-discovery/host-readable-transcript-path.test.ts": 150,
"src/main/native-chat/native-chat-inline-visuals-setting.test.ts": 751,
- "src/main/native-chat/native-chat-scratch-folder-migration.test.ts": 109,
- "src/main/native-chat/native-chat-visual-file-read.test.ts": 98,
- "src/main/native-chat/native-chat-visuals-sweep.test.ts": 123,
+ "src/main/native-chat/conversation-files/native-chat-scratch-folder-migration.test.ts": 109,
+ "src/main/native-chat/conversation-files/native-chat-visual-file-read.test.ts": 98,
+ "src/main/native-chat/conversation-files/native-chat-visuals-sweep.test.ts": 123,
"src/main/native-chat/session-file-resolver-wsl-scan-gate.test.ts": 156,
"src/main/native-chat/session-file-resolver.test.ts": 245,
- "src/main/native-chat/structured-agent-command-resolution.test.ts": 223,
- "src/main/native-chat/structured-agent-configured-args.test.ts": 191,
- "src/main/native-chat/transcript-claude-read-image.test.ts": 389,
- "src/main/native-chat/transcript-file-version.test.ts": 121,
+ "src/main/native-chat/agent-launch/structured-agent-command-resolution.test.ts": 223,
+ "src/main/native-chat/agent-launch/structured-agent-configured-args.test.ts": 191,
+ "src/shared/native-chat/tools/native-chat-tool-viewed-images-shell-read.test.ts": 389,
+ "src/main/native-chat/transcript-watching/transcript-file-version.test.ts": 121,
"src/main/native-chat/transcript-interruption-message.test.ts": 263,
"src/main/native-chat/transcript-line-decoders-claude-command-output.test.ts": 248,
- "src/main/native-chat/transcript-line-decoders-claude-control-bytes.test.ts": 237,
- "src/main/native-chat/transcript-line-decoders-claude-image-companion.test.ts": 238,
- "src/main/native-chat/transcript-line-decoders-claude-queued-prompt.test.ts": 255,
+ "src/main/native-chat/transcript-decoding/transcript-line-decoders-claude-control-bytes.test.ts": 237,
+ "src/main/native-chat/transcript-decoding/transcript-line-decoders-claude-image-companion.test.ts": 238,
+ "src/main/native-chat/transcript-decoding/transcript-line-decoders-claude-queued-prompt.test.ts": 255,
"src/main/native-chat/transcript-line-decoders-claude-stop-hook.test.ts": 211,
- "src/main/native-chat/transcript-line-decoders.grok.test.ts": 283,
- "src/main/native-chat/transcript-line-decoders.omp.test.ts": 297,
- "src/main/native-chat/transcript-opencode-sqlite-query.test.ts": 886,
+ "src/main/native-chat/transcript-decoding/transcript-line-decoders.grok.test.ts": 283,
+ "src/main/native-chat/transcript-decoding/transcript-line-decoders.omp.test.ts": 297,
+ "src/main/native-chat/transcript-history/opencode/transcript-opencode-sqlite-query.test.ts": 886,
"src/main/native-chat/transcript-read-cache.test.ts": 513,
"src/main/native-chat/transcript-reader.test.ts": 565,
- "src/main/native-chat/transcript-stream-lines.test.ts": 79,
- "src/main/native-chat/transcript-turn-lifecycle.test.ts": 258,
+ "src/main/native-chat/transcript-streaming/transcript-stream-lines.test.ts": 79,
+ "src/main/native-chat/transcript-decoding/transcript-turn-lifecycle.test.ts": 258,
"src/main/native-chat/transcript-watch-engine-wsl-lifecycle.test.ts": 508,
"src/main/native-chat/transcript-watch-error.test.ts": 2306,
"src/main/native-chat/transcript-watch-unflushed-settle.test.ts": 554,
"src/main/native-chat/transcript-window-tool-attribution.test.ts": 523,
- "src/main/native-chat/transcript-zcode.test.ts": 814,
- "src/main/native-chat/wsl-transcript-fs-process-operations.test.ts": 43,
- "src/main/native-chat/wsl-transcript-running-admission.test.ts": 1178,
+ "src/main/native-chat/transcript-history/opencode/transcript-zcode.test.ts": 814,
+ "src/main/native-chat/transcript-filesystem/process/wsl-transcript-fs-process-operations.test.ts": 43,
+ "src/main/native-chat/transcript-filesystem/wsl-transcript-running-admission.test.ts": 1178,
"src/main/native-chat/wsl-transcript-running-observer.test.ts": 103,
"src/main/workspaces/removal/nested-worktree-removal-plan.test.ts": 242,
"src/main/node-runtime/managed-runtime-installation.test.ts": 427,
@@ -2524,46 +2454,40 @@
"src/main/orca-profiles/project-transfer/profile-project-transfer-migration.test.ts": 1642,
"src/main/orca-profiles/project-transfer/profile-project-transfer.test.ts": 1456,
"src/main/orca-profiles/profile-telemetry-consent-seed.test.ts": 536,
- "src/main/orcad/electron-serve-provider-selection.test.ts": 554,
- "src/main/orcad/electron-sidecar-tab-registry.test.ts": 105,
- "src/main/orcad/external-chromium-browser-session.test.ts": 152,
- "src/main/orcad/node-pty-prebuilt-slot.test.ts": 185,
- "src/main/orcad/node-pty-precondition.test.ts": 477,
- "src/main/orcad/orcad-agent-session-claim-signer.test.ts": 64,
- "src/main/orcad/orcad-app-paths.test.ts": 45,
- "src/main/orcad/orcad-artifact-cache-retention.test.ts": 301,
- "src/main/orcad/orcad-artifact-materializer.test.ts": 1129,
+ "src/main/orcad/browser-providers/electron/electron-sidecar-tab-registry.test.ts": 105,
+ "src/main/orcad/browser-providers/chromium/external-chromium-browser-session.test.ts": 152,
+ "src/main/orcad/native-runtime/node-pty-prebuilt-slot.test.ts": 185,
+ "src/main/orcad/native-runtime/node-pty-precondition.test.ts": 477,
+ "src/main/orcad/host-runtime/orcad-app-paths.test.ts": 45,
+ "src/main/orcad/artifact-slots/orcad-artifact-cache-retention.test.ts": 301,
+ "src/main/orcad/artifact-slots/orcad-artifact-materializer.test.ts": 1129,
"src/main/orcad/orcad-bind-address.test.ts": 41,
- "src/main/orcad/orcad-browser-install-park.test.ts": 131,
- "src/main/orcad/orcad-browser-provider.test.ts": 479,
- "src/main/orcad/orcad-bundle-native-load-order.test.ts": 3555,
- "src/main/orcad/orcad-chat-restart-offer.test.ts": 3691,
- "src/main/orcad/orcad-cli-launcher.integration.test.ts": 390,
- "src/main/orcad/orcad-cli-launcher.test.ts": 232,
+ "src/main/orcad/browser-providers/orcad-browser-provider.test.ts": 479,
+ "src/main/orcad/native-runtime/orcad-bundle-native-load-order.test.ts": 3555,
+ "src/main/orcad/serve-startup/orcad-cli-launcher.integration.test.ts": 390,
+ "src/main/orcad/serve-startup/orcad-cli-launcher.test.ts": 232,
"src/main/orcad/orcad-cli-orchestration.integration.test.ts": 214,
- "src/main/orcad/orcad-forked-child-paths.test.ts": 337,
- "src/main/orcad/orcad-help.integration.test.ts": 5016,
- "src/main/orcad/orcad-idle-exit-monitor.test.ts": 106,
- "src/main/orcad/orcad-instance-lock.test.ts": 315,
- "src/main/orcad/orcad-launcher-isolation.integration.test.ts": 617,
- "src/main/orcad/orcad-lifecycle-host.test.ts": 407,
- "src/main/orcad/orcad-managed-idle-exit-chat-provider.test.ts": 2062,
- "src/main/orcad/orcad-managed-idle-exit.test.ts": 180,
- "src/main/orcad/orcad-managed-stop-cancel-race.test.ts": 218,
- "src/main/orcad/orcad-managed-stop-cancellation.test.ts": 285,
- "src/main/orcad/orcad-managed-stop-identity.test.ts": 270,
- "src/main/orcad/orcad-managed-stop.test.ts": 1726,
- "src/main/orcad/orcad-observability.test.ts": 187,
- "src/main/orcad/orcad-packaged-node-pty.integration.test.ts": 78,
- "src/main/orcad/orcad-packaged-structured-chat.integration.test.ts": 448,
- "src/main/orcad/orcad-plaintext-credential-migration.test.ts": 223,
- "src/main/orcad/orcad-process-start-time.test.ts": 77,
- "src/main/orcad/orcad-secret-store.test.ts": 2281,
- "src/main/orcad/orcad-serve-parity.integration.test.ts": 280,
- "src/main/orcad/orcad-stale-lock-reclaim.test.ts": 258,
- "src/main/orcad/orcad-startup-qualification.test.ts": 102,
- "src/main/orcad/orcad-stop-request-shutdown.integration.test.ts": 293,
- "src/main/orcad/orcad-windows-conpty-breakaway.integration.test.ts": 79,
+ "src/main/orcad/serve-startup/orcad-help.integration.test.ts": 5016,
+ "src/main/orcad/host-lifecycle/idle-exit/orcad-idle-exit-monitor.test.ts": 106,
+ "src/main/orcad/instance-lock/orcad-instance-lock.test.ts": 315,
+ "src/main/orcad/runtime-launch/orcad-launcher-isolation.integration.test.ts": 617,
+ "src/main/orcad/host-lifecycle/orcad-lifecycle-host.test.ts": 407,
+ "src/main/orcad/host-lifecycle/idle-exit/orcad-managed-idle-exit.test.ts": 180,
+ "src/main/orcad/host-lifecycle/managed-stop/orcad-managed-stop-cancel-race.test.ts": 218,
+ "src/main/orcad/host-lifecycle/managed-stop/orcad-managed-stop-cancellation.test.ts": 285,
+ "src/main/orcad/host-lifecycle/managed-stop/orcad-managed-stop-identity.test.ts": 270,
+ "src/main/orcad/host-lifecycle/managed-stop/orcad-managed-stop.test.ts": 1726,
+ "src/main/orcad/diagnostics/orcad-observability.test.ts": 187,
+ "src/main/orcad/native-runtime/orcad-packaged-node-pty.integration.test.ts": 78,
+ "src/main/orcad/testing/structured-chat/orcad-packaged-structured-chat.integration.test.ts": 448,
+ "src/main/orcad/credentials/orcad-plaintext-credential-migration.test.ts": 223,
+ "src/main/orcad/instance-lock/orcad-process-start-time.test.ts": 77,
+ "src/main/orcad/credentials/orcad-secret-store.test.ts": 2281,
+ "src/main/orcad/testing/serve-lifecycle/orcad-serve-parity.integration.test.ts": 280,
+ "src/main/orcad/instance-lock/orcad-stale-lock-reclaim.test.ts": 258,
+ "src/main/orcad/runtime-launch/orcad-startup-qualification.test.ts": 102,
+ "src/main/orcad/host-lifecycle/managed-stop/orcad-stop-request-shutdown.integration.test.ts": 293,
+ "src/main/orcad/native-runtime/orcad-windows-conpty-breakaway.integration.test.ts": 79,
"src/main/persistence/preferences/persistence-onboarding-language-cohort.test.ts": 1760,
"src/main/persistence/applying-settings/persistence-automation-extra-agent-args.test.ts": 2268,
"src/main/persistence/applying-settings/persistence-automation-mode-precondition.test.ts": 1595,
@@ -2590,7 +2514,6 @@
"src/main/persistence/loading-store/terminal-bindings/reused-terminal-id-unbind.test.ts": 312,
"src/main/persistence/loading-store/profile-writing/state-write-round-trip.test.ts": 1983,
"src/main/persistence/loading-store/workspace-sessions/store-host-partition-before-unload.test.ts": 1670,
- "src/main/persistence/loading-store/terminal-bindings/terminal-close-async-durability.test.ts": 5719,
"src/main/persistence/loading-store/workspace-sessions/workspace-session-terminal-binding-replay.test.ts": 95,
"src/main/persistence/loading-store/worktree-metadata/worktree-meta-write-normalization.test.ts": 127,
"src/main/persistence/migrating-orcad-catalog/blob-transfer/orcad-migration-blob-staging.test.ts": 466,
@@ -2659,44 +2582,39 @@
"src/main/persistence/restoring-sessions/workspace-pane-normalization-index.test.ts": 466,
"src/main/persistence/runtime-authored-workspace-session-fields.test.ts": 64,
"src/main/persistence/scheduling-automations/automation-run-operations.test.ts": 151,
- "src/main/persistence/terminal-topology/closed-pane-binding-fence.test.ts": 289,
- "src/main/persistence/terminal-topology/duplicate-pty-pane-repair.test.ts": 2087,
- "src/main/persistence/terminal-topology/editor-renames-across-partitions.test.ts": 526,
- "src/main/persistence/terminal-topology/open-in-new-group-layout-apply.test.ts": 1943,
- "src/main/persistence/terminal-topology/pane-last-grid.test.ts": 5642,
- "src/main/persistence/terminal-topology/persistence-closed-pane-binding-fence.test.ts": 1926,
- "src/main/persistence/terminal-topology/persistence-cross-host-pane-identity.test.ts": 1744,
- "src/main/persistence/terminal-topology/persistence-empty-root-layout-load.test.ts": 1841,
- "src/main/persistence/terminal-topology/persistence-layout-binding-recovery.test.ts": 1835,
- "src/main/persistence/terminal-topology/persistence-pane-alias-selective-saves.test.ts": 1961,
- "src/main/persistence/terminal-topology/persistence-pane-identity-migration.test.ts": 5772,
- "src/main/persistence/terminal-topology/persistence-pty-binding-leaf-tab-resolution.test.ts": 1996,
- "src/main/persistence/terminal-topology/persistence-pty-binding-reconciliation.test.ts": 1898,
- "src/main/persistence/terminal-topology/persistence-runtime-admitted-terminal-membership.test.ts": 2143,
- "src/main/persistence/terminal-topology/persistence-split-pane-incarnation.test.ts": 1790,
- "src/main/persistence/terminal-topology/persistence-ssh-pending-pty-kill.test.ts": 1776,
- "src/main/persistence/terminal-topology/persistence-ssh-remote-cli-control-migration.test.ts": 1738,
- "src/main/persistence/terminal-topology/persistence-ssh-remote-pty-binding-replay.test.ts": 1853,
- "src/main/persistence/terminal-topology/persistence-ssh-remote-pty-leases.test.ts": 2079,
- "src/main/persistence/terminal-topology/persistence-tab-terminal-pane-binding-load.test.ts": 1795,
- "src/main/persistence/terminal-topology/terminal-close-write-failure-store.test.ts": 2870,
- "src/main/persistence/terminal-topology/terminal-close-write-failure-switch-off.test.ts": 2027,
- "src/main/persistence/terminal-topology/terminal-late-bind-layout-rules.test.ts": 1808,
+ "src/main/persistence/terminal-topology/pane-ownership/duplicate-pty-pane-repair.test.ts": 2087,
+ "src/main/persistence/terminal-topology/command-application/editor-renames-across-partitions.test.ts": 526,
+ "src/main/persistence/terminal-topology/command-application/open-in-new-group-layout-apply.test.ts": 1943,
+ "src/main/persistence/terminal-topology/command-application/pane-last-grid.test.ts": 5642,
+ "src/main/persistence/terminal-topology/pane-ownership/persistence-closed-pane-binding-fence.test.ts": 1926,
+ "src/main/persistence/restoring-sessions/persistence-cross-host-pane-identity.test.ts": 1744,
+ "src/main/persistence/restoring-sessions/persistence-empty-root-layout-load.test.ts": 1841,
+ "src/main/persistence/loading-store/workspace-sessions/persistence-layout-binding-recovery.test.ts": 1835,
+ "src/main/persistence/restoring-sessions/persistence-pane-identity-migration.test.ts": 5772,
+ "src/main/persistence/terminal-topology/pane-ownership/persistence-pty-binding-leaf-tab-resolution.test.ts": 1996,
+ "src/main/persistence/loading-store/terminal-bindings/persistence-pty-binding-reconciliation.test.ts": 1898,
+ "src/main/persistence/terminal-topology/pane-admission/persistence-runtime-admitted-terminal-membership.test.ts": 2143,
+ "src/main/persistence/loading-store/terminal-bindings/persistence-split-pane-incarnation.test.ts": 1790,
+ "src/main/persistence/leasing-ssh-ptys/persistence-ssh-pending-pty-kill.test.ts": 1776,
+ "src/main/persistence/loading-store/workspace-sessions/persistence-ssh-remote-pty-binding-replay.test.ts": 1853,
+ "src/main/persistence/leasing-ssh-ptys/persistence-ssh-remote-pty-leases.test.ts": 2079,
+ "src/main/persistence/restoring-sessions/persistence-tab-terminal-pane-binding-load.test.ts": 1795,
+ "src/main/persistence/terminal-topology/command-application/terminal-close-write-failure-store.test.ts": 2870,
+ "src/main/persistence/terminal-topology/command-application/terminal-close-write-failure-switch-off.test.ts": 2027,
"src/main/persistence/terminal-topology/terminal-layout-apply.test.ts": 2005,
- "src/main/persistence/terminal-topology/terminal-layout-create-resend.test.ts": 1773,
- "src/main/persistence/terminal-topology/terminal-layout-create.test.ts": 2107,
- "src/main/persistence/terminal-topology/terminal-layout-pane-ops.test.ts": 1753,
- "src/main/persistence/terminal-topology/terminal-layout-rename-tabs.test.ts": 1977,
- "src/main/persistence/terminal-topology/terminal-layout-sleep-wake.test.ts": 2198,
- "src/main/persistence/terminal-topology/terminal-leaf-move-concurrent-close.test.ts": 1847,
- "src/main/persistence/terminal-topology/terminal-leaf-move.test.ts": 2197,
- "src/main/persistence/terminal-topology/terminal-owner-invariants.test.ts": 285,
- "src/main/persistence/terminal-topology/terminal-pane-admission-layout-owner.test.ts": 1796,
- "src/main/persistence/terminal-topology/terminal-sleep-quit-resume.test.ts": 1766,
- "src/main/persistence/terminal-topology/terminal-window-pane-detach.test.ts": 1941,
- "src/main/persistence/terminal-topology/unshown-live-terminal-placement-restart.test.ts": 2114,
- "src/main/persistence/terminal-topology/windowless-host-reload-keeps-terminals.test.ts": 1872,
- "src/main/persistence/terminal-topology/windowless-restart-lost-binding.test.ts": 1626,
+ "src/main/persistence/terminal-topology/pane-admission/terminal-layout-create-resend.test.ts": 1773,
+ "src/main/persistence/terminal-topology/pane-admission/terminal-layout-create.test.ts": 2107,
+ "src/main/persistence/terminal-topology/command-application/terminal-layout-pane-ops.test.ts": 1753,
+ "src/main/persistence/terminal-topology/command-application/terminal-layout-rename-tabs.test.ts": 1977,
+ "src/main/persistence/terminal-topology/command-application/terminal-layout-sleep-wake.test.ts": 2198,
+ "src/main/persistence/terminal-topology/pane-moves/terminal-leaf-move-concurrent-close.test.ts": 1847,
+ "src/main/persistence/terminal-topology/pane-moves/terminal-leaf-move.test.ts": 2197,
+ "src/shared/workspace-layout/terminal-topology/terminal-owner-invariants.test.ts": 285,
+ "src/main/persistence/terminal-topology/pane-admission/terminal-pane-admission-layout-owner.test.ts": 1796,
+ "src/main/persistence/loading-store/workspace-sessions/terminal-sleep-quit-resume.test.ts": 1766,
+ "src/main/persistence/terminal-topology/pane-moves/terminal-window-pane-detach.test.ts": 1941,
+ "src/main/runtime/terminal/adoption/unshown-live-terminal-placement-restart.test.ts": 2114,
+ "src/main/persistence/restoring-sessions/windowless-restart-lost-binding.test.ts": 1626,
"src/main/persistence/tracking-repos/local-worktree-metadata-scan-expectation.test.ts": 544,
"src/main/persistence/tracking-repos/missing-local-worktree-metadata-pruning.test.ts": 619,
"src/main/persistence/tracking-repos/persistence-deregistered-repo-residue.test.ts": 2374,
@@ -2720,16 +2638,13 @@
"src/main/persistence/tracking-repos/repo-update-host-guard.test.ts": 478,
"src/main/persistence/tracking-repos/worktree-identity-migration-field-coverage.test.ts": 505,
"src/main/persistence/tracking-repos/worktree-metadata-normalization.test.ts": 372,
- "src/main/persistence/window-save-reconnect-facts.test.ts": 372,
"src/main/persistence/window-save-sleep-records.test.ts": 60,
"src/main/pi/managed-extensions/agent-status/agent-status-completion-delivery.test.ts": 423,
"src/main/pi/managed-extensions/agent-status/agent-status-extension-nested-run-settlement.test.ts": 335,
"src/main/pi/managed-extensions/agent-status/agent-status-extension-session-change.test.ts": 613,
"src/main/pi/managed-extensions/agent-status/agent-status-input-redaction.test.ts": 573,
"src/main/pi/managed-extensions/agent-status/omp-model-command-source.test.ts": 640,
- "src/main/pi/rpc/launch/rpc-launch.test.ts": 305,
"src/main/pi/rpc/prompts/rpc-prompt-delivery.test.ts": 204,
- "src/main/pi/rpc/prompts/rpc-prompt.test.ts": 228,
"src/main/pi/rpc/rpc-session-rename.test.ts": 1172,
"src/main/pi/rpc/rpc-session-startup.test.ts": 4955,
"src/main/pi/rpc/rpc-turn-races.test.ts": 2191,
@@ -3057,11 +2972,9 @@
"src/main/runtime/session-graph/graph-sync-deletion-fence.test.ts": 4552,
"src/main/runtime/session-tabs/graph-sync-mobile-snapshot-gating.test.ts": 4333,
"src/main/runtime/terminal/surface/headless-create-terminal-handle-main.test.ts": 3873,
- "src/main/runtime/session-tabs/headless-move-leaf-to-new-tab.test.ts": 3596,
"src/main/runtime/terminal/output/headless-terminal-dispose-write-ordering.test.ts": 4309,
"src/main/runtime/terminal/recovery/held-pane-reopen-layout-owner.test.ts": 5093,
"src/main/runtime/terminal/wait/hermes-slash-readiness-transcript.test.ts": 4931,
- "src/main/runtime/terminal/stop/hook-status-resume-sleep-ordering.test.ts": 9614,
"src/main/runtime/agent-session/environment/host-account-sign-in-flows.test.ts": 68,
"src/main/runtime/hosts/platform-probe/host-descriptor.test.ts": 207,
"src/main/runtime/terminal/surface/host-pane-remount-terminal-handle.test.ts": 5293,
@@ -3077,19 +2990,17 @@
"src/main/runtime/workspaces/creation/managed-worktree-create-registry.test.ts": 4143,
"src/main/runtime/workspaces/creation/managed-worktree-create-telemetry.test.ts": 4152,
"src/main/runtime/workspaces/removal/missing-worktree-terminal-reconciliation.test.ts": 432,
- "src/main/runtime/mobile-cloud-relay/desktop-relay-service-installer.test.ts": 48,
- "src/main/runtime/mobile-cloud-relay/mobile-relay-e2ee.integration.test.ts": 408,
- "src/main/runtime/mobile-cloud-relay/relay-auth-coordinator-readiness.test.ts": 580,
- "src/main/runtime/mobile-cloud-relay/relay-auth-coordinator-recovery.test.ts": 161,
- "src/main/runtime/mobile-cloud-relay/relay-auth-coordinator.test.ts": 1013,
- "src/main/runtime/mobile-cloud-relay/relay-control-client.test.ts": 701,
+ "src/main/runtime/mobile-cloud-relay/testing/desktop-relay-service-installer.test.ts": 48,
+ "src/main/runtime/mobile-cloud-relay/testing/mobile-relay-e2ee.integration.test.ts": 408,
+ "src/main/runtime/mobile-cloud-relay/authentication/relay-auth-coordinator-readiness.test.ts": 580,
+ "src/main/runtime/mobile-cloud-relay/authentication/relay-auth-coordinator.test.ts": 1013,
+ "src/main/runtime/mobile-cloud-relay/control-channel/relay-control-client.test.ts": 701,
"src/main/runtime/mobile-cloud-relay/relay-control-origin.test.ts": 147,
- "src/main/runtime/mobile-cloud-relay/relay-host-proof.test.ts": 122,
- "src/main/runtime/mobile-cloud-relay/relay-http-client.test.ts": 175,
- "src/main/runtime/mobile-cloud-relay/relay-readiness-retention.test.ts": 196,
- "src/main/runtime/mobile-cloud-relay/relay-region-preference.test.ts": 253,
- "src/main/runtime/mobile-cloud-relay/relay-region-refresh.test.ts": 127,
- "src/main/runtime/mobile-cloud-relay/relay-revoke-outbox.test.ts": 73,
+ "src/main/runtime/mobile-cloud-relay/control-channel/relay-host-proof.test.ts": 122,
+ "src/main/runtime/mobile-cloud-relay/director/relay-http-client.test.ts": 175,
+ "src/main/runtime/mobile-cloud-relay/authentication/relay-readiness-retention.test.ts": 196,
+ "src/main/runtime/mobile-cloud-relay/region-selection/relay-region-preference.test.ts": 253,
+ "src/main/runtime/mobile-cloud-relay/pairing/relay-revoke-outbox.test.ts": 73,
"src/main/runtime/mobile-cloud-relay/relay-session-broker.test.ts": 804,
"src/main/runtime/mobile-desktop-relay/mobile-desktop-relay.integration.test.ts": 11377,
"src/main/runtime/mobile-desktop-relay/mobile-desktop-relay.test.ts": 1185,
@@ -3117,20 +3028,15 @@
"src/main/runtime/browser/client-pages/orca-runtime-browser-ghost-session-row-close.test.ts": 640,
"src/main/runtime/browser/screencast/orca-runtime-browser-screencast-e2ee-backlog.test.ts": 659,
"src/main/runtime/browser/screencast/orca-runtime-browser-screencast-fanout.test.ts": 607,
- "src/main/runtime/browser/screencast/orca-runtime-browser-screencast-pending-frame-retry.test.ts": 595,
"src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts": 682,
"src/main/runtime/terminal/query/orca-runtime-codex-idle-title-chat-address.test.ts": 5781,
- "src/main/runtime/terminal/surface/orca-runtime-cold-restore-terminal-membership-layout-owner.test.ts": 4130,
- "src/main/runtime/terminal/surface/orca-runtime-cold-restore-terminal-membership.test.ts": 3716,
"src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts": 3617,
"src/main/runtime/terminal/lifecycle/orca-runtime-exited-split-pane-close.test.ts": 4235,
- "src/main/runtime/terminal/surface/orca-runtime-failed-start-pane-layout-owner.test.ts": 4204,
"src/main/runtime/files/orca-runtime-files-preview-budget.test.ts": 672,
"src/main/runtime/files/search/orca-runtime-files-search.test.ts": 675,
"src/main/runtime/terminal/artifacts/orca-runtime-files-terminal-artifact-grants.test.ts": 580,
"src/main/runtime/terminal/artifacts/orca-runtime-files-terminal-artifact-io.test.ts": 668,
"src/main/runtime/terminal/artifacts/orca-runtime-files-terminal-artifact-swap-detection.test.ts": 665,
- "src/main/runtime/terminal/artifacts/orca-runtime-files-terminal-link-host-translation.test.ts": 626,
"src/main/runtime/files/watch/orca-runtime-files-watch.test.ts": 586,
"src/main/runtime/session-lifecycle/projection/orca-runtime-mobile-agent-status-ordering.test.ts": 4281,
"src/main/runtime/session-lifecycle/projection/orca-runtime-mobile-agent-status-title-truthfulness.test.ts": 3908,
@@ -3305,7 +3211,6 @@
"src/main/runtime/rpc/e2ee-channel-text-backpressure.test.ts": 204,
"src/main/runtime/rpc/e2ee-channel-v2.test.ts": 287,
"src/main/runtime/rpc/e2ee-channel.test.ts": 539,
- "src/main/runtime/rpc/e2ee-crypto.test.ts": 121,
"src/main/runtime/rpc/methods/accounts/accounts.test.ts": 161,
"src/main/runtime/rpc/methods/agent-launch/agent-launch-at-rest.test.ts": 4936,
"src/main/runtime/rpc/methods/agent-launch/agent-launch-caller-selection.test.ts": 1680,
@@ -3391,32 +3296,32 @@
"src/main/runtime/rpc/methods/orchestration/runs/runs.test.ts": 4589,
"src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts": 4854,
"src/main/runtime/rpc/methods/orchestration/worker-start-card.test.ts": 7003,
- "src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts": 4775,
- "src/main/runtime/rpc/methods/orchestration/worker/failed-start-retry-release.test.ts": 5044,
- "src/main/runtime/rpc/methods/orchestration/worker/fleet-status-observed-identity.test.ts": 3493,
+ "src/main/runtime/rpc/methods/orchestration/worker/start/worker-start-composition.test.ts": 4775,
+ "src/main/runtime/rpc/methods/orchestration/worker/start/failed-start-retry-release.test.ts": 5044,
+ "src/main/runtime/rpc/methods/orchestration/worker/observation/fleet-status-observed-identity.test.ts": 3493,
"src/main/runtime/rpc/methods/orchestration/worker/helper-follow-up-cli.integration.test.ts": 7626,
- "src/main/runtime/rpc/methods/orchestration/worker/helper-follow-up-ownership-cli.integration.test.ts": 8091,
- "src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-observation.test.ts": 5272,
- "src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-release.test.ts": 5196,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-auto-release-turns.test.ts": 3578,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-auto-release.test.ts": 4863,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-follow-up.test.ts": 4916,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-interactive-wait.test.ts": 5579,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-list-pagination.test.ts": 4740,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-output.test.ts": 541,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-release-authority-contracts.test.ts": 3949,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-release-evidence-contracts.test.ts": 4491,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts": 4562,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts": 5889,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts": 4766,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-run-dispatch-contracts.test.ts": 5136,
+ "src/main/runtime/rpc/methods/orchestration/worker/follow-up/helper-follow-up-ownership-cli.integration.test.ts": 8091,
+ "src/main/runtime/rpc/methods/orchestration/worker/observation/manual-dispatch-observation.test.ts": 5272,
+ "src/main/runtime/rpc/methods/orchestration/worker/stop/manual-dispatch-release.test.ts": 5196,
+ "src/main/runtime/rpc/methods/orchestration/worker/release/worker-auto-release-turns.test.ts": 3578,
+ "src/main/runtime/rpc/methods/orchestration/worker/release/worker-auto-release.test.ts": 4863,
+ "src/main/runtime/rpc/methods/orchestration/worker/follow-up/worker-follow-up.test.ts": 4916,
+ "src/main/runtime/rpc/methods/orchestration/worker/observation/worker-interactive-wait.test.ts": 5579,
+ "src/main/runtime/rpc/methods/orchestration/worker/fleet/worker-list-pagination.test.ts": 4740,
+ "src/main/runtime/rpc/methods/orchestration/worker/output/worker-output.test.ts": 541,
+ "src/main/runtime/rpc/methods/orchestration/worker/release/worker-release-authority-contracts.test.ts": 3949,
+ "src/main/runtime/rpc/methods/orchestration/worker/release/worker-release-evidence-contracts.test.ts": 4491,
+ "src/main/runtime/rpc/methods/orchestration/worker/release/worker-release-mobile-report.test.ts": 4562,
+ "src/main/runtime/rpc/methods/orchestration/worker/release/worker-release-recovery.test.ts": 5889,
+ "src/main/runtime/rpc/methods/orchestration/worker/release/worker-release.test.ts": 4766,
+ "src/main/runtime/rpc/methods/orchestration/worker/testing/worker-run-dispatch-contracts.test.ts": 5136,
"src/main/runtime/rpc/methods/orchestration/worker/worker-start-budgets.test.ts": 45,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts": 6279,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-exit-race.test.ts": 4508,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-liveness-verdict.test.ts": 5279,
- "src/main/runtime/rpc/methods/orchestration/worker/worker-terminal-custody-at-creation.test.ts": 5687,
- "src/main/runtime/rpc/methods/orchestration/worker/workers-new-worktree.test.ts": 6117,
- "src/main/runtime/rpc/methods/orchestration/worker/workers-recovery.test.ts": 5182,
+ "src/main/runtime/rpc/methods/orchestration/worker/start/readiness/worker-start-prompt-contract.test.ts": 6279,
+ "src/main/runtime/rpc/methods/orchestration/worker/stop/worker-stop-exit-race.test.ts": 4508,
+ "src/main/runtime/rpc/methods/orchestration/worker/stop/worker-stop-liveness-verdict.test.ts": 5279,
+ "src/main/runtime/rpc/methods/orchestration/worker/start/placement/worker-terminal-custody-at-creation.test.ts": 5687,
+ "src/main/runtime/rpc/methods/orchestration/worker/start/placement/worker-new-worktree-start.test.ts": 6117,
+ "src/main/runtime/rpc/methods/orchestration/worker/observation/worker-lifecycle-recovery.test.ts": 5182,
"src/main/runtime/rpc/methods/plugins/plugin-dev-emit.test.ts": 3118,
"src/main/runtime/rpc/methods/plugins/plugin-dev-request.test.ts": 3725,
"src/main/runtime/rpc/methods/plugins/plugins.test.ts": 274,
@@ -3463,7 +3368,6 @@
"src/main/runtime/rpc/mobile-e2ee-v2-compressed-frame.test.ts": 75,
"src/main/runtime/rpc/mobile-e2ee-v2-desktop-session.test.ts": 98,
"src/main/runtime/rpc/mobile-socket-wiring.test.ts": 312,
- "src/main/runtime/rpc/orcad-feature-readiness.test.ts": 40,
"src/main/runtime/rpc/orchestration-11745-regression-verification.test.ts": 22874,
"src/main/runtime/rpc/orchestration-check-wait-session.test.ts": 5096,
"src/main/runtime/rpc/orchestration-commit-notify-characterization.test.ts": 5702,
@@ -3493,7 +3397,6 @@
"src/main/runtime/rpc/remote-runtime-server-heartbeat-missed-probe-tolerance.test.ts": 59,
"src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts": 60,
"src/main/runtime/rpc/repo-add-cli.integration.test.ts": 1603,
- "src/main/runtime/rpc/runtime-client-capabilities.test.ts": 43,
"src/main/runtime/rpc/runtime-source-admission.test.ts": 909,
"src/main/runtime/rpc/shadowed-port-probe.test.ts": 99,
"src/main/runtime/rpc/static-web-client-handler-stream.test.ts": 1823,
@@ -3538,7 +3441,6 @@
"src/main/runtime/rpc/unix-socket-transport.test.ts": 79,
"src/main/runtime/rpc/unpaired-device-auth-throttle.test.ts": 42,
"src/main/runtime/rpc/web-session-pairing.test.ts": 402,
- "src/main/runtime/rpc/workspace-creator-context.test.ts": 40,
"src/main/runtime/rpc/worktree-removal-marker-projection.test.ts": 497,
"src/main/runtime/rpc/worktree-rm-cli.integration.test.ts": 6876,
"src/main/runtime/rpc/ws-empty-payload-frame-write.test.ts": 117,
@@ -3593,7 +3495,6 @@
"src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts": 4402,
"src/main/runtime/rpc/server/runtime-rpc-delegated-device-sync.test.ts": 4986,
"src/main/runtime/rpc/server/runtime-rpc-device-key-dispatch.test.ts": 3597,
- "src/main/runtime/rpc/server/runtime-rpc-device-revocation.test.ts": 5350,
"src/main/runtime/rpc/server/runtime-rpc-local-disconnect-forwarding.test.ts": 5138,
"src/main/runtime/rpc/server/runtime-rpc-long-poll-transport.test.ts": 30838,
"src/main/runtime/rpc/server/runtime-rpc-metadata-lifecycle.test.ts": 4652,
@@ -3626,14 +3527,11 @@
"src/main/runtime/workspaces/lineage/runtime-worktree-lineage-controller.test.ts": 1027,
"src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts": 289,
"src/main/runtime/workspaces/process-listing/runtime-worktree-structured-agent-rows-liveness.test.ts": 1412,
- "src/main/runtime/browser/headless/serve-browser-tabs-layout-owner.test.ts": 321,
- "src/main/runtime/session-lifecycle/close/close-by-split-handle-layout-owner.test.ts": 5010,
"src/main/runtime/session-lifecycle/close/close-mobile-row-in-main-layout.test.ts": 4514,
"src/main/runtime/session-lifecycle/projection/pane-sleeping-record.test.ts": 76,
"src/main/runtime/session-lifecycle/projection/sleep-record-pane-claim.test.ts": 48,
"src/main/runtime/session-tabs/session-tab-close-force.test.ts": 7089,
"src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts": 5775,
- "src/main/runtime/session-tabs/headless-mobile-session-absorbed-rows.test.ts": 4223,
"src/main/runtime/session-tabs/main-layout-session-tab-move.test.ts": 4233,
"src/main/runtime/session-tabs/session-tab-prototype-dispatch.test.ts": 4888,
"src/main/runtime/session-tabs/session-tabs-headless-main-change.test.ts": 4320,
@@ -3641,33 +3539,32 @@
"src/main/runtime/session-tabs/session-tabs-main-rows-parity.test.ts": 4606,
"src/main/runtime/session-tabs/session-tabs-phone-layout-moves.test.ts": 4153,
"src/main/runtime/session-tabs/session-tabs-windowed-main-change.test.ts": 4444,
- "src/main/runtime/session-tabs/structured-session-account-home-location.test.ts": 935,
"src/main/runtime/orchestration/terminal-authority/settled-worker-process-replacement.test.ts": 5013,
"src/main/runtime/sidebar-inputs/cached-scan.test.ts": 106,
- "src/main/runtime/sidebar-inputs/desktop-sidebar-facts.test.ts": 378,
- "src/main/runtime/sidebar-inputs/orca-runtime-closed-tab-retention.test.ts": 5233,
- "src/main/runtime/sidebar-inputs/orca-runtime-project-catalog.test.ts": 4975,
+ "src/main/runtime/sidebar-inputs/catalog/desktop-sidebar-facts.test.ts": 378,
+ "src/main/runtime/sidebar-inputs/temporal/orca-runtime-closed-tab-retention.test.ts": 5233,
+ "src/main/runtime/sidebar-inputs/catalog/orca-runtime-project-catalog.test.ts": 4975,
"src/main/runtime/sidebar-inputs/orca-runtime-sidebar-inputs-feed.test.ts": 3968,
- "src/main/runtime/sidebar-inputs/orca-runtime-sort-stamps.test.ts": 3799,
- "src/main/runtime/sidebar-inputs/orca-runtime-terminal-use.test.ts": 4460,
- "src/main/runtime/sidebar-inputs/orca-runtime-workspace-activity-facts.test.ts": 3633,
- "src/main/runtime/sidebar-inputs/orca-runtime-workspace-unread.test.ts": 4608,
- "src/main/runtime/sidebar-inputs/paired-server-rows-producer.test.ts": 340,
- "src/main/runtime/sidebar-inputs/repo-icon-data-urls.test.ts": 250,
+ "src/main/runtime/sidebar-inputs/temporal/orca-runtime-sort-stamps.test.ts": 3799,
+ "src/main/runtime/sidebar-inputs/temporal/orca-runtime-terminal-use.test.ts": 4460,
+ "src/main/runtime/sidebar-inputs/workspace-facts/orca-runtime-workspace-activity-facts.test.ts": 3633,
+ "src/main/runtime/sidebar-inputs/temporal/orca-runtime-workspace-unread.test.ts": 4608,
+ "src/main/runtime/sidebar-inputs/workspace-rows/paired-server-rows-producer.test.ts": 340,
+ "src/main/runtime/sidebar-inputs/repo-icons/repo-icon-data-urls.test.ts": 250,
"src/main/runtime/sidebar-inputs/repo-icon-remote-fetch.test.ts": 101,
"src/main/runtime/sidebar-inputs/sidebar-clock.test.ts": 45,
"src/main/runtime/sidebar-inputs/sidebar-inputs-feed-announcements.test.ts": 1954,
"src/main/runtime/sidebar-inputs/sidebar-inputs-feed-domains.test.ts": 496,
- "src/main/runtime/sidebar-inputs/sidebar-inputs-feed-pages.test.ts": 162,
- "src/main/runtime/sidebar-inputs/sidebar-inputs-feed.test.ts": 387,
- "src/main/runtime/sidebar-inputs/sidebar-project-catalog.test.ts": 416,
- "src/main/runtime/sidebar-inputs/sidebar-retention-owner.test.ts": 77,
- "src/main/runtime/sidebar-inputs/sort-stamp-records-twins.test.ts": 246,
- "src/main/runtime/sidebar-inputs/sort-stamps-producer.test.ts": 813,
- "src/main/runtime/sidebar-inputs/workspace-activity-facts-producer.test.ts": 696,
- "src/main/runtime/sidebar-inputs/workspace-git-identity.test.ts": 50,
- "src/main/runtime/sidebar-inputs/workspace-rows-producer.test.ts": 4181,
- "src/main/runtime/sidebar-inputs/workspace-viewers.test.ts": 65,
+ "src/main/runtime/sidebar-inputs/feed/sidebar-inputs-feed-pages.test.ts": 162,
+ "src/main/runtime/sidebar-inputs/feed/sidebar-inputs-feed.test.ts": 387,
+ "src/main/runtime/sidebar-inputs/catalog/sidebar-project-catalog.test.ts": 416,
+ "src/main/runtime/sidebar-inputs/temporal/sidebar-retention-owner.test.ts": 77,
+ "src/main/runtime/workspaces/metadata/workspace-activity-records-twins.test.ts": 246,
+ "src/main/runtime/sidebar-inputs/temporal/sort-stamps-producer.test.ts": 813,
+ "src/main/runtime/sidebar-inputs/workspace-facts/workspace-activity-facts-producer.test.ts": 696,
+ "src/main/runtime/sidebar-inputs/workspace-rows/workspace-git-identity.test.ts": 50,
+ "src/main/runtime/sidebar-inputs/workspace-rows/workspace-rows-producer.test.ts": 4181,
+ "src/main/runtime/sidebar-inputs/temporal/workspace-viewers.test.ts": 65,
"src/main/runtime/terminal/output/stale-title-display-surfaces.test.ts": 4456,
"src/main/runtime/agent-session/lifecycle/structured-agent-cli-writers.test.ts": 140,
"src/main/runtime/agent-session/lifecycle/structured-agent-session-history-close-race.test.ts": 5020,
@@ -3718,7 +3615,6 @@
"src/main/runtime/terminal/output/tail/terminal-tail-redraw-spans.test.ts": 166,
"src/main/runtime/terminal-tail-redraw-wall-time.test.ts": 43418,
"src/main/runtime/terminal/output/tail/terminal-tail-sentinel-index.test.ts": 3649,
- "src/main/runtime/terminal/stop/terminal-update-admission-census.test.ts": 4182,
"src/main/runtime/terminal/output/terminal-vertical-control-scan.test.ts": 168,
"src/main/runtime/terminal/wait/terminal-wait-detection.test.ts": 220,
"src/main/runtime/terminal/wait/terminal-wait-name-only-idle.test.ts": 5018,
@@ -3731,8 +3627,6 @@
"src/main/runtime/terminal/input/agent-prompt-permission-hold.test.ts": 48,
"src/main/runtime/terminal/input/terminal-send-plugin-hook.test.ts": 169,
"src/main/runtime/terminal/launch/mobile-terminal-chat-fork.test.ts": 3900,
- "src/main/runtime/terminal/launch/terminal-split-layout-owner.test.ts": 4503,
- "src/main/runtime/terminal/launch/terminal-split-retry.test.ts": 4038,
"src/main/runtime/terminal/layout/agent-generated-tab-titles.test.ts": 5572,
"src/main/runtime/terminal/lifecycle/main-pane-liveness.test.ts": 4871,
"src/main/runtime/terminal/lifecycle/ssh-exit-code-pane-outcome.test.ts": 4334,
@@ -3741,7 +3635,6 @@
"src/main/runtime/terminal/stop/exact-terminal-stop-liveness.test.ts": 4321,
"src/main/runtime/terminal/stop/terminal-update-admission.test.ts": 48,
"src/main/runtime/terminal/surface/closed-pane-exit-cleanup-main.test.ts": 4281,
- "src/main/runtime/terminal/surface/main-terminal-acquisition.test.ts": 4330,
"src/main/runtime/terminal/surface/terminal-surface-replies-main.test.ts": 4324,
"src/main/runtime/terminal/wait/tui-idle-codex-plan-menu.test.ts": 4441,
"src/main/runtime/terminal/wait/tui-idle-command-paint.test.ts": 4148,
@@ -3756,8 +3649,6 @@
"src/main/runtime/terminal/surface/workspace-layout-operation-frames.test.ts": 2136,
"src/main/runtime/terminal/surface/workspace-layout-stream.test.ts": 427,
"src/main/runtime/terminal/surface/workspace-session-membership-scaling.test.ts": 72,
- "src/main/runtime/workspaces/persisted-surfaces/live-terminal-placement-before-initial-tab.test.ts": 6111,
- "src/main/runtime/workspaces/persisted-surfaces/sweep-terminal-placement.test.ts": 12352,
"src/main/runtime/workspaces/lifecycle/workspace-lifecycle-queue.test.ts": 116,
"src/main/runtime/workspaces/sleep/workspace-sleep-execution.test.ts": 110,
"src/main/runtime/workspaces/startup/worktree-agent-first-surface.test.ts": 5816,
@@ -3876,7 +3767,6 @@
"src/main/managed-server/install/orcad-launch-ssh-session.test.ts": 689,
"src/main/managed-server/migration/transfers/orcad-migration-blob-coordinator.test.ts": 1464,
"src/main/managed-server/migration/catalog/orcad-migration-catalog-client-frame-budget.test.ts": 405,
- "src/main/managed-server/migration/catalog/orcad-migration-catalog-client-source-kind.test.ts": 400,
"src/main/managed-server/migration/catalog/orcad-migration-catalog-client.test.ts": 400,
"src/main/managed-server/migration/cutover/orcad-migration-cutover-coordinator.test.ts": 2408,
"src/main/managed-server/migration/cutover/orcad-migration-delta-move.test.ts": 3812,
@@ -3971,7 +3861,6 @@
"src/main/star-nag/service-force-show-races.test.ts": 351,
"src/main/star-nag/service-threshold-prompt.test.ts": 307,
"src/main/startup/agent-hooks-uninstall-preflight-real-removers.test.ts": 597,
- "src/main/startup/browser-process-user-agent-ordering.test.ts": 3231,
"src/main/startup/codex-account-restart-resume.test.ts": 465,
"src/main/startup/codex-session-resume-daemon-guard.test.ts": 161,
"src/main/startup/configure-process-dev-parent-shutdown.test.ts": 182,
@@ -3980,7 +3869,6 @@
"src/main/startup/configure-process.test.ts": 255,
"src/main/startup/e2e-external-open-guard.test.ts": 44,
"src/main/startup/e2e-spawn-log-env.test.ts": 89,
- "src/main/startup/ensure-virtual-display.test.ts": 135,
"src/main/startup/first-window-startup-services.test.ts": 54,
"src/main/startup/gpu-fallback-marker.test.ts": 61,
"src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts": 641,
@@ -4011,7 +3899,6 @@
"src/main/startup/serve-user-data-path-guard.test.ts": 198,
"src/main/startup/single-instance-lock-exit.electron.test.ts": 551,
"src/main/startup/skill-share-deep-link-state.test.ts": 217,
- "src/main/startup/startup-diagnostics.test.ts": 39,
"src/main/startup/windows-app-data-path.test.ts": 55,
"src/main/startup/windows-install-dir-acl-recovery.test.ts": 614,
"src/main/startup/windows-install-dir-acl-repair.win32.test.ts": 132,
@@ -4031,17 +3918,13 @@
"src/main/power/system-power-lifecycle.test.ts": 42,
"src/main/power/system-resume-broadcast.test.ts": 67,
"src/main/telemetry/burst-cap.test.ts": 177,
- "src/main/telemetry/classify-error.test.ts": 43,
"src/main/telemetry/client-agent-dashboard-snapshot.test.ts": 201,
"src/main/telemetry/client-deferred-start.test.ts": 8659,
"src/main/telemetry/client-lifecycle.test.ts": 206,
"src/main/telemetry/client.test.ts": 213,
"src/main/telemetry/consent.test.ts": 48,
- "src/main/telemetry/onboarding-feature-setup-validator.test.ts": 182,
"src/main/telemetry/plugin-install-telemetry.test.ts": 282,
"src/main/telemetry/posthog-transport-main-http-client.test.ts": 123,
- "src/main/telemetry/validator-warn-cache.test.ts": 187,
- "src/main/telemetry/validator.test.ts": 170,
"src/main/telemetry/wsl-usage-reporter.test.ts": 407,
"src/main/pty/history/terminal-history-gc-fs-call-count.test.ts": 157,
"src/main/pty/history/terminal-history-gc.test.ts": 824,
@@ -4069,7 +3952,6 @@
"src/main/text-generation/source-control-wsl-launch.test.ts": 482,
"src/main/text-generation/source-control-wsl-prompt.test.ts": 2440,
"src/main/tray/system-tray.test.ts": 556,
- "src/main/tray/tray-attention-icon.test.ts": 52,
"src/main/tray/tray-dev-badge.test.ts": 51,
"src/main/updater/updater-events.test.ts": 280,
"src/main/updater/updater-linux-package-recovery-actions.test.ts": 2294,
@@ -4132,7 +4014,6 @@
"src/main/window/mac-app-paste-input.test.ts": 85,
"src/main/window/macos-app-activation.test.ts": 44,
"src/main/window/macos-desktop-handoff.test.ts": 60,
- "src/main/window/macos-tahoe-release.test.ts": 48,
"src/main/window/main-window-state-lifecycle.test.ts": 60,
"src/main/window/main-window-updater-deferred-setup.test.ts": 215,
"src/main/window/native-chat-paste-files.test.ts": 666,
@@ -4146,12 +4027,9 @@
"src/main/window/renderer-recovery-reload-watchdog.test.ts": 69,
"src/main/window/runtime-renderer-notification-sender.test.ts": 54,
"src/main/window/runtime-window-lifecycle-terminal-reveal.test.ts": 100,
- "src/main/window/runtime-window-pane-title-notification.test.ts": 97,
"src/main/window/session-tab-close-request-relay.test.ts": 74,
- "src/main/window/terminal-pane-reveal-relay.test.ts": 91,
"src/main/window/terminal-tab-close-request-relay.test.ts": 64,
"src/main/window/updater-package-recovery-ipc.test.ts": 169,
- "src/main/window/window-close-decision.test.ts": 39,
"src/main/pty/process-retirement/windows-live-tree-kill.win32.test.ts": 76,
"src/main/pty/process-retirement/windows-pty-root-identity.test.ts": 135,
"src/main/windows/windows-registry-addon.test.ts": 39,
@@ -4315,12 +4193,10 @@
"src/preload/renderer-heap-statistics-reader.test.ts": 50,
"src/preload/renderer-process-memory-reader.test.ts": 66,
"src/preload/renderer-restart-wiring.test.ts": 96,
- "src/preload/runtime-environment-subscriptions.test.ts": 71,
"src/preload/ssh-authority-forwarding.test.ts": 1111,
"src/preload/updater-package-recovery.test.ts": 1102,
"src/preload/usage-provider-api.test.ts": 46,
"src/renderer/src/app-shell/shutdown-checkpoint-persist.test.ts": 65,
- "src/renderer/src/app-shell/startup-window-parity.test.ts": 2306,
"src/renderer/src/app-shell/use-profile-state-save-delay-notice.sonner.test.tsx": 355,
"src/renderer/src/app-shell/use-profile-state-save-delay-notice.test.tsx": 293,
"src/renderer/src/app-shell/visible-review-reporting.test.ts": 1872,
@@ -4358,7 +4234,6 @@
"src/renderer/src/components/activity/activity-thread-list-pane.virtualization.test.tsx": 4863,
"src/renderer/src/components/activity/useActivityUnreadCount.freshness.test.tsx": 1990,
"src/renderer/src/components/activity/useActivityUnreadCount.test.ts": 1633,
- "src/renderer/src/components/agent-session-continuation/agent-session-continuation-selection.test.ts": 56,
"src/renderer/src/components/agent-tab-shortcut-launch.test.ts": 369,
"src/renderer/src/components/agent/AgentLaunchPickerMenu.search.test.tsx": 2090,
"src/renderer/src/components/artifacts/ArtifactCollection.test.tsx": 1833,
@@ -4373,7 +4248,6 @@
"src/renderer/src/components/automations/AutomationsPage.behavior.test.tsx": 3389,
"src/renderer/src/components/automations/AutomationsPage.edit-destination.test.tsx": 2932,
"src/renderer/src/components/automations/ExternalAutomationManagers.test.tsx": 852,
- "src/renderer/src/components/automations/hosts/automation-captured-owner.test.ts": 379,
"src/renderer/src/components/automations/automation-host-cache-controller.test.ts": 411,
"src/renderer/src/components/automations/hosts/automation-host-cache.test.ts": 79,
"src/renderer/src/components/automations/automation-host-diagnostics.test.ts": 460,
@@ -4445,7 +4319,6 @@
"src/renderer/src/components/browser-pane/navigate/browser-page-download-activity.test.ts": 44,
"src/renderer/src/components/browser-pane/navigate/browser-webview-load-failure.test.ts": 243,
"src/renderer/src/components/browser-pane/navigate/chromium-error-page-poll-visibility.test.ts": 1956,
- "src/renderer/src/components/browser-pane/navigate/use-browser-page-reload-actions.test.tsx": 2177,
"src/renderer/src/components/browser-pane/restored-client-hosted-recovery-window.test.tsx": 6205,
"src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-input-model.test.ts": 45,
"src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.address-bar.test.tsx": 2987,
@@ -4487,14 +4360,12 @@
"src/renderer/src/components/dashboard-popout/dashboard-preview-link-composition.test.tsx": 8657,
"src/renderer/src/components/dashboard-popout/preview-terminal-box-fit-lifecycle.test.ts": 192,
"src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts": 479,
- "src/renderer/src/components/dashboard-popout/useDashboardSnapshot.test.tsx": 432,
"src/renderer/src/components/dashboard/AgentDashboardDrawer.focus.test.tsx": 2567,
"src/renderer/src/components/dashboard/AgentDashboardDrawer.test.tsx": 1981,
"src/renderer/src/components/dashboard/agent-dashboard-open-mode.test.ts": 48,
"src/renderer/src/components/dashboard/agent-destination-navigation.integration.test.tsx": 3232,
"src/renderer/src/components/dashboard/agent-row-lineage-model.test.ts": 107,
"src/renderer/src/components/dashboard/build-dashboard-bucket-counts.equivalence.test.ts": 722,
- "src/renderer/src/components/dashboard/build-dashboard-snapshot-folder-workspace.test.ts": 2150,
"src/renderer/src/components/dashboard/build-dashboard-snapshot.test.ts": 2121,
"src/renderer/src/components/dashboard/reveal-dashboard-agent.test.ts": 1098,
"src/renderer/src/components/dashboard/useRetainedAgents.test.ts": 2028,
@@ -4530,7 +4401,6 @@
"src/renderer/src/components/editor/model-lifetime/retention/closed-editor-tab-disposal.test.ts": 121,
"src/renderer/src/components/editor/model-lifetime/retention/closed-editor-view-state-retention.test.ts": 9012,
"src/renderer/src/components/editor/closed-unsaved-files-toast.test.ts": 448,
- "src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-cursor-reveal.test.tsx": 3685,
"src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-load-scheduler.test.ts": 53,
"src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-metadata-retention.test.tsx": 1151,
"src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-section-connection.test.ts": 1699,
@@ -4582,7 +4452,6 @@
"src/renderer/src/components/editor/image-png-export.chromium.test.ts": 212,
"src/renderer/src/components/editor/image-png-export.test.ts": 50,
"src/renderer/src/components/editor/image-viewer-zoom-ownership.test.tsx": 2268,
- "src/renderer/src/components/editor/image-viewer-zoom.test.ts": 47,
"src/renderer/src/components/editor/notebook/kernel/ipynb-kernel-outputs.test.ts": 307,
"src/renderer/src/components/editor/notebook/kernel/ipynb-kernel-session-start-lifetime.test.ts": 140,
"src/renderer/src/components/editor/notebook/kernel/ipynb-kernel-session.test.ts": 180,
@@ -4721,7 +4590,6 @@
"src/renderer/src/components/emulator-pane/use-emulator-pane-session.test.tsx": 1968,
"src/renderer/src/components/emulator-pane/use-mobile-emulator-tab-intro-actions.test.tsx": 1828,
"src/renderer/src/components/feature-tips/ChatUiHereFeatureTipVisual.test.tsx": 1093,
- "src/renderer/src/components/feature-tips/feature-tip-modal-state.test.ts": 244,
"src/renderer/src/components/feature-wall/FeatureWallSetupWorkflowActions.test.tsx": 2028,
"src/renderer/src/components/feature-wall/FullDiskAccessSetupPrompt.test.ts": 466,
"src/renderer/src/components/floating-terminal/floating-workspace-tab-reorder.test.ts": 2520,
@@ -4731,20 +4599,17 @@
"src/renderer/src/components/github-item-dialog/load-item-details/use-github-item-dialog-details.test.tsx": 2850,
"src/renderer/src/components/github-item-dialog/load-item-details/use-github-task-refresh.test.tsx": 1070,
"src/renderer/src/components/github-item-dialog/open-dialog/github-item-dialog.task-record.test.tsx": 1391,
- "src/renderer/src/components/github-project/GhAuthErrorHelp.test.ts": 479,
"src/renderer/src/components/github-project/ProjectBoard.test.tsx": 988,
"src/renderer/src/components/github-project/github-project-picker-filter.test.ts": 53,
"src/renderer/src/components/github-project/group-sort.test.ts": 75,
"src/renderer/src/components/github-project/project-dialog-state.test.ts": 48,
"src/renderer/src/components/github-project/project-picker-input.test.ts": 338,
- "src/renderer/src/components/github-project/project-row-filtering.test.ts": 65,
"src/renderer/src/components/github-project/project-view-wrapper-source-context-boundary.test.ts": 46,
"src/renderer/src/components/github/GitHubMarkdownComposer.test.tsx": 1571,
"src/renderer/src/components/github/PRFilterPickers.test.ts": 291,
"src/renderer/src/components/github/code-host-rate-limit-stopped-wsl.test.tsx": 2457,
"src/renderer/src/components/github/github-mention-option-filter.test.ts": 52,
"src/renderer/src/components/github/github-pr-reviewer-candidate-filter.test.ts": 47,
- "src/renderer/src/components/github/github-work-item-issue-target.test.ts": 324,
"src/renderer/src/components/github/github-work-item-mutation-target.test.ts": 348,
"src/renderer/src/components/github/use-image-input.test.ts": 2619,
"src/renderer/src/components/gitlab-item-dialog/use-gitlab-primary-actions.test.ts": 2141,
@@ -4962,7 +4827,6 @@
"src/renderer/src/components/plugins/page/PluginCommandReplacementRow.test.tsx": 1926,
"src/renderer/src/components/plugins/page/PluginDetailPage.test.tsx": 3367,
"src/renderer/src/components/plugins/page/PluginSettingsSection.test.tsx": 572,
- "src/renderer/src/components/plugins/presentation/plugin-install-source.test.ts": 214,
"src/renderer/src/components/plugins/state/use-plugin-contribution-source.test.tsx": 1935,
"src/renderer/src/components/plugins/state/use-plugin-install-link.test.tsx": 518,
"src/renderer/src/components/plugins/state/use-plugin-page-navigation.test.tsx": 480,
@@ -5097,7 +4961,6 @@
"src/renderer/src/components/settings/runtime-environments/pairing/RuntimePairingGeneratorForm.test.tsx": 461,
"src/renderer/src/components/settings/appearance/fonts/FontAutocomplete.test.tsx": 1202,
"src/renderer/src/components/settings/form-controls/SettingsFormControls.segmented-control.test.tsx": 730,
- "src/renderer/src/components/settings/shortcuts/ShortcutFilterRail.test.ts": 273,
"src/renderer/src/components/settings/shortcuts/ShortcutsPane.provenance.test.tsx": 2302,
"src/renderer/src/components/settings/repository/worktrees/SparsePresetSettingsSection.test.tsx": 744,
"src/renderer/src/components/settings/ssh/server-actions/SshHostDeltaMoveDialog.test.tsx": 438,
@@ -5163,7 +5026,6 @@
"src/renderer/src/components/sidebar/Sidebar.test.tsx": 833,
"src/renderer/src/components/sidebar/SidebarAgentsList.test.tsx": 2985,
"src/renderer/src/components/sidebar/StalledTerminalDaemonBanner.test.tsx": 320,
- "src/renderer/src/components/sidebar/workspace-board/viewport/WorkspaceKanbanLaneGrid.test.tsx": 360,
"src/renderer/src/components/sidebar/workspace-card/surface/WorktreeCard.single-reference-details.test.tsx": 2032,
"src/renderer/src/components/sidebar/workspace-actions/context-menu/WorktreeContextMenu.closed-menu-work.test.tsx": 1753,
"src/renderer/src/components/sidebar/workspace-actions/context-menu/WorktreeContextMenu.test.ts": 299,
@@ -5185,7 +5047,6 @@
"src/renderer/src/components/sidebar/workspace-creation/folder/folder-workspace-composer-submit-host-platform.test.ts": 2264,
"src/renderer/src/components/sidebar/workspace-creation/folder/folder-workspace-composer-submit.test.ts": 2665,
"src/renderer/src/components/sidebar/worktree-list/drag/host-header-drag.test.tsx": 281,
- "src/renderer/src/components/sidebar/worktree-list/grouping/host-section-reveal.test.tsx": 2294,
"src/renderer/src/components/sidebar/worktree-list/listing/manual-sort-switch-toast.test.ts": 1753,
"src/renderer/src/components/sidebar/mobile-sidebar-onboarding-badge.test.ts": 230,
"src/renderer/src/components/sidebar/worktree-list/grouping/pinned-section-worktrees.test.ts": 446,
@@ -5248,10 +5109,8 @@
"src/renderer/src/components/sidebar/wsl-host-offer-move.test.ts": 227,
"src/renderer/src/components/skills/sharing/SkillSharedLinkRow.test.tsx": 817,
"src/renderer/src/components/skills/SkillsPage.test.tsx": 3822,
- "src/renderer/src/components/skills/catalog/skill-agent-filter.test.ts": 274,
"src/renderer/src/components/sparse/sparse-directory-entry-input.test.ts": 207,
"src/renderer/src/components/stats/usage-daily-chart.test.tsx": 333,
- "src/renderer/src/components/stats/usage-overview-model.test.ts": 364,
"src/renderer/src/components/status-bar/ClaudeSwitcherMenu.owner-lifetime.test.tsx": 2317,
"src/renderer/src/components/status-bar/StatusBarUsageChangeNotices.test.tsx": 785,
"src/renderer/src/components/status-bar/UpdateStatusSegment.test.tsx": 2484,
@@ -5265,7 +5124,6 @@
"src/renderer/src/components/status-bar/resource-session-kill-confirmation.test.ts": 53,
"src/renderer/src/components/status-bar/resource-session-removal-render-budget.test.tsx": 290,
"src/renderer/src/components/status-bar/resource-usage-folder-merge.test.ts": 251,
- "src/renderer/src/components/status-bar/usage-pool-label.test.ts": 170,
"src/renderer/src/components/status-bar/use-owner-usage-rate-limits.test.tsx": 462,
"src/renderer/src/components/status-bar/use-resource-memory-snapshot.test.tsx": 321,
"src/renderer/src/components/status-bar/use-resource-pty-actions.test.tsx": 879,
@@ -5281,7 +5139,6 @@
"src/renderer/src/components/tab-bar/host-agent-launch-preferences-source.test.tsx": 3154,
"src/renderer/src/components/tab-bar/tab-agent-launch-options.test.ts": 438,
"src/renderer/src/components/tab-bar/tab-agent-types-by-tab-id.test.ts": 206,
- "src/renderer/src/components/tab-bar/tab-context-menu.test.tsx": 5620,
"src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts": 510,
"src/renderer/src/components/tab-bar/tab-create-entry-local-path.test.ts": 2614,
"src/renderer/src/components/tab-bar/tab-session-history-switch.test.ts": 2348,
@@ -5299,7 +5156,6 @@
"src/renderer/src/components/tab-group/tab-drag-retained-guest-passthrough.test.tsx": 2104,
"src/renderer/src/components/tab-group/tab-group-body-geometry.test.ts": 194,
"src/renderer/src/components/tab-group/tab-group-layout-owner-commands.test.ts": 1764,
- "src/renderer/src/components/tab-group/tab-moves-drawn-from-frames.test.ts": 2105,
"src/renderer/src/components/tab-group/useTabGroupCloseScopeCommands.test.tsx": 2023,
"src/renderer/src/components/tab-group/workspace-tab-close-commands.frame-flush.test.ts": 1604,
"src/renderer/src/components/task-page/github/task-page-github-landing-refresh-record.test.tsx": 971,
@@ -5332,7 +5188,6 @@
"src/renderer/src/components/task-page/task-page-cache-selectors.test.ts": 108,
"src/renderer/src/components/task-page/task-page-initial-selection-scaling.test.tsx": 1953,
"src/renderer/src/components/task-page/task-page-work-item-pagination.test.ts": 63,
- "src/renderer/src/components/task-page/use-task-page-source-display.test.tsx": 5228,
"src/renderer/src/components/terminal-pane/layout/close/RunningTerminalCloseDialog.test.tsx": 2303,
"src/renderer/src/components/terminal-pane/account-restart/detached/account-restart-queue-progress.test.ts": 1988,
"src/renderer/src/components/terminal-pane/agent-completion/agent-completion-coordinator-attention-dispatch.test.ts": 301,
@@ -5353,7 +5208,6 @@
"src/renderer/src/components/terminal-pane/provider-notices/claude-diff-panel/claude-diff-panel-notice-banner.test.tsx": 1986,
"src/renderer/src/components/terminal-pane/notifications/claude-side-question-completion.test.ts": 2305,
"src/renderer/src/components/terminal-pane/provider-notices/codex-backfill/codex-backfill-error-detector.test.ts": 26,
- "src/renderer/src/components/terminal-pane/account-restart/detached/codex-detached-pane-restart.test.ts": 2270,
"src/renderer/src/components/terminal-pane/provider-notices/codex-server-isolation/codex-shared-server-banner.test.tsx": 2766,
"src/renderer/src/components/terminal-pane/pty-connection/output/deferred-reattach-live-data-queue.test.ts": 184,
"src/renderer/src/components/terminal-pane/layout/split/deferred-split-pane-handoff.test.ts": 78,
@@ -5400,7 +5254,6 @@
"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-restore-and-resume.test.ts": 19401,
"src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-restored-baseline-shortfall.test.ts": 1902,
"src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-visible-pane-output-pause-latch.test.ts": 1639,
- "src/renderer/src/components/terminal-pane/pty-connection/reattach/deferred-session-reattach-newer-daemon-hold.test.ts": 2570,
"src/renderer/src/components/terminal-pane/pty-connection/reattach/deferred-session-reattach-startup-snapshot.test.ts": 1830,
"src/renderer/src/components/terminal-pane/pty-connection/reattach/deferred-session-reattach-wsl-distro-stopped-hold.test.ts": 2517,
"src/shared/terminal/protocol/escape/terminal-synchronized-output-socket-splits.test.ts": 92,
@@ -5503,7 +5356,7 @@
"src/renderer/src/components/terminal-pane/input/ime/terminal-ios-hangul-preedit-device-trace.test.ts": 415,
"src/renderer/src/components/terminal-pane/input/ime/terminal-ios-hangul-preedit.test.ts": 818,
"src/renderer/src/components/terminal-pane/input/keyboard/terminal-keyboard-native-chat-cover.test.ts": 2084,
- "src/shared/workspace-layout/terminal-layout-pty-ownership-depth.test.ts": 82,
+ "src/shared/workspace-layout/terminal-topology/terminal-layout-pty-ownership-depth.test.ts": 82,
"src/renderer/src/components/terminal-pane/layout/terminal-layout-pty-ownership.test.ts": 99,
"src/renderer/src/components/terminal-pane/links/terminal-link-click-fallback.test.ts": 985,
"src/renderer/src/components/terminal-pane/links/terminal-link-open-beside-source.test.ts": 947,
@@ -5566,7 +5419,6 @@
"src/renderer/src/components/terminal/terminal-tab-actions-unrouted-close.test.ts": 589,
"src/renderer/src/components/terminal/terminal-tab-actions.test.ts": 626,
"src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts": 499,
- "src/renderer/src/components/terminal/unsaved-close-queue.test.ts": 42,
"src/renderer/src/components/terminal/use-terminal-provider-snapshot-capability.test.tsx": 573,
"src/renderer/src/components/terminal/window-close-running-work.test.ts": 97,
"src/renderer/src/components/ui/menu-pointer-highlight.test.tsx": 350,
@@ -5782,7 +5634,6 @@
"src/renderer/src/lib/agent-session/launch/background/launch-agent-background-session-launch-parity.test.ts": 2792,
"src/renderer/src/lib/agent-session/launch/background/launch-agent-background-session.test.ts": 1040,
"src/renderer/src/lib/agent-session/launch/new-tab/launch-agent-new-tab-host-route-readiness.test.ts": 489,
- "src/renderer/src/lib/agent-session/launch/new-tab/launch-agent-picker-contract.test.ts": 3592,
"src/renderer/src/lib/agent-session/launch/continuation/launch-agent-session-continuation-toast.test.tsx": 2347,
"src/renderer/src/lib/workspace/creation/work-item/launch-work-item-direct-accepted.test.tsx": 2754,
"src/renderer/src/lib/workspace/creation/work-item/launch-work-item-direct-defaults.test.ts": 1594,
@@ -5863,7 +5714,6 @@
"src/renderer/src/lib/workspace/activation/worktree-activation-launch-awaiting-host.test.ts": 2161,
"src/renderer/src/lib/workspace/activation/worktree-activation-structured-chat-surface.test.ts": 2043,
"src/renderer/src/lib/workspace/activation/worktree-activation-web-runtime.test.ts": 2768,
- "src/renderer/src/lib/workspace/activation/worktree-agent-activation-seam.test.ts": 3440,
"src/renderer/src/lib/workspace/creation/worktree-creation-initial-surface.test.ts": 5258,
"src/renderer/src/lib/workspace/creation/worktree-creation-structured-session-prompts.test.tsx": 4554,
"src/renderer/src/lib/workspace/ownership/worktree-live-terminal-surface-owners.test.ts": 266,
@@ -5879,20 +5729,17 @@
"src/renderer/src/runtime/rpc/calls/abortable-runtime-environment-call.test.ts": 189,
"src/renderer/src/runtime/provider-accounts/observations/claude-agent-view-observations.test.ts": 105,
"src/renderer/src/runtime/web-session-tabs-sync/closing/close-mirrored-editor-tab.test.ts": 397,
- "src/renderer/src/runtime/workspace-layout/frames/divider-ratio-refusal.test.ts": 2212,
"src/renderer/src/runtime/sync-runtime-graph/editor-buffer-dirty-readers.test.ts": 1892,
"src/renderer/src/runtime/files/mutations/file-explorer-delete-owner-provenance.test.ts": 1878,
"src/renderer/src/runtime/native-chat/model-catalogs/host-model-catalog-snapshots.test.ts": 2348,
"src/renderer/src/runtime/web-session-tabs-sync/hydration/host-session-mirror-hydration-frame-ordering.test.tsx": 2469,
"src/renderer/src/runtime/web-session-tabs-sync/hydration/host-session-mirror-settle-receipt-frames.test.tsx": 2130,
"src/renderer/src/runtime/hosted-terminals/hydration/host-terminal-scrollback-hydration.test.ts": 467,
- "src/renderer/src/runtime/workspace-layout/frames/layout-changes-during-stream-outage.test.ts": 1948,
"src/renderer/src/runtime/workspace-layout/commands/layout-owner-command.test.ts": 549,
"src/renderer/src/runtime/native-chat/naming/legacy-chat-rename-migration.test.tsx": 3834,
"src/renderer/src/runtime/web-session-tabs-sync/agent-status/mirrored-agent-status-clock-skew.test.ts": 1839,
"src/renderer/src/runtime/web-session-tabs-sync/closing/paired-terminal-tab-close-environment-removal.test.ts": 1897,
"src/renderer/src/runtime/web-session-tabs-sync/closing/paired-terminal-tab-close-reload.test.ts": 1943,
- "src/renderer/src/runtime/workspace-layout/frames/pane-titles-drawn-from-frames.test.ts": 1988,
"src/renderer/src/runtime/web-session-tabs-sync/inventory/remote-runtime-session-tabs-inflight.test.ts": 55,
"src/renderer/src/runtime/hosted-terminals/snapshots/remote-runtime-snapshot-outcome.test.ts": 233,
"src/renderer/src/runtime/hosted-terminals/streams/remote-runtime-terminal-frame-drop-resync.test.ts": 266,
@@ -5912,15 +5759,12 @@
"src/renderer/src/runtime/hosts/connections/runtime-host-contact-regained.test.ts": 413,
"src/renderer/src/runtime/jira/runtime-jira-image-client.test.ts": 214,
"src/renderer/src/runtime/jira/runtime-jira-payload-stream.test.ts": 192,
- "src/renderer/src/runtime/workspace-layout/frames/runtime-layout-client.test.ts": 165,
"src/renderer/src/runtime/files/reads/runtime-paged-file-read.test.ts": 1705,
"src/renderer/src/runtime/files/search/runtime-quick-open-version-compatibility.test.ts": 451,
"src/renderer/src/runtime/rpc/calls/runtime-rpc-client.test.ts": 342,
"src/renderer/src/runtime/files/grants/runtime-terminal-artifact-write.test.ts": 567,
"src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts": 2033,
"src/renderer/src/runtime/hosted-terminals/streams/runtime-terminal-stream.test.ts": 449,
- "src/renderer/src/runtime/workspace-layout/server/server-held-panes.test.tsx": 2254,
- "src/renderer/src/runtime/workspace-layout/server/server-layout-apply.test.ts": 2222,
"src/renderer/src/runtime/workspace-layout/server/server-layout-editor-handover.test.ts": 5075,
"src/renderer/src/runtime/workspace-layout/server/server-layout-frames-handover.test.ts": 1991,
"src/renderer/src/runtime/workspace-layout/server/server-layout-frames.test.ts": 2053,
@@ -5938,7 +5782,6 @@
"src/renderer/src/runtime/sync-runtime-graph/terminal-group-grid-sizes.test.ts": 194,
"src/renderer/src/runtime/browser/creation/web-runtime-browser-creation-placement.test.ts": 1927,
"src/renderer/src/runtime/browser/creation/web-runtime-browser-link-open.test.ts": 2217,
- "src/renderer/src/runtime/web-session-tabs-sync/closing/web-session-close-replay.test.ts": 1119,
"src/renderer/src/runtime/web-session-tabs-sync/identity/web-session-restored-placeholder-identity.test.ts": 985,
"src/renderer/src/runtime/web-session-tabs-sync/agent-status/web-session-tabs-agent-completion-notifications.test.ts": 1953,
"src/renderer/src/runtime/web-session-tabs-sync/tracking/web-session-tabs-removed-frame-retires-live-publisher.test.ts": 854,
@@ -5967,9 +5810,6 @@
"src/renderer/src/runtime/hosted-terminals/recovery/panes/web-session-terminal-pending-handle-recovery.test.ts": 723,
"src/renderer/src/runtime/hosted-terminals/recovery/evidence/web-session-terminal-retirement-proof-ledger.test.ts": 685,
"src/renderer/src/runtime/rpc/subscriptions/window-visibility-subscription-parking-stream-end.test.ts": 225,
- "src/renderer/src/runtime/workspace-layout/frames/workspace-layout-frame-binding.test.ts": 2155,
- "src/renderer/src/runtime/workspace-layout/frames/workspace-layout-frame-held-tabs.test.ts": 2519,
- "src/renderer/src/runtime/workspace-layout/frames/workspace-layout-frame-sync.test.ts": 2282,
"src/renderer/src/ssh/node-dist-mirror-recovery.test.ts": 1770,
"src/renderer/src/ssh/ssh-connect-in-flight.test.ts": 62,
"src/renderer/src/startup/startup-degraded-recovery.test.ts": 574,
@@ -6294,9 +6134,7 @@
"src/shared/agent-launch/choices/agent-launch-settings-permissions.test.ts": 199,
"src/shared/agent-status/process/agent-process-presence-platform.test.ts": 64,
"src/shared/agent-launch/startup/agent-prompt-injection.test.ts": 88,
- "src/shared/agent-launch/permissions/agent-scoped-permission-defaults.test.ts": 213,
"src/shared/agent-scratch-worktrees.test.ts": 61,
- "src/shared/agent-session/agent-message-display-text.test.ts": 147,
"src/shared/agent-session/agent-session-approval-blocked-path.test.ts": 49,
"src/shared/agent-session/agent-session-attachments.test.ts": 46,
"src/shared/agent-session/agent-session-context-clear.test.ts": 222,
@@ -6364,7 +6202,6 @@
"src/shared/agent-status/transport/agent-status-osc.test.ts": 104,
"src/shared/agent-status/store/agent-status-store-reopen.test.ts": 199,
"src/shared/agent-status/title/agent-status-tracker-program-activity.test.ts": 77,
- "src/shared/agent-launch/startup/agent-tui-input-clear.test.ts": 57,
"src/shared/ai-vault/resume/ai-vault-resume-command.test.ts": 70,
"src/shared/ai-vault/resume/ai-vault-resume-target.test.ts": 85,
"src/shared/ai-vault/scanning/ai-vault-scope-paths.test.ts": 73,
@@ -6375,7 +6212,6 @@
"src/shared/ai-vault/session-display/ai-vault-session-filters.test.ts": 176,
"src/shared/ai-vault/resume/ai-vault-ssh-resume-target.test.ts": 84,
"src/shared/ansi-escape-sequences-consumers.test.ts": 140,
- "src/shared/ansi-escape-sequences.test.ts": 289,
"src/shared/antigravity-generation-plan.test.ts": 122,
"src/shared/automatic-work-run-marker.test.ts": 93,
"src/shared/automation-cron-dialect.test.ts": 65,
@@ -6408,7 +6244,6 @@
"src/shared/claude-background-task-status.test.ts": 315,
"src/shared/claude-model-list-probe.test.ts": 55,
"src/shared/claude-shell-function.test.ts": 220,
- "src/shared/cli-runtime-pairing-inputs.test.ts": 64,
"src/shared/cloud-service-url.test.ts": 37,
"src/shared/coalescing-keyed-runner.test.ts": 119,
"src/shared/codebuddy-agent.test.ts": 301,
@@ -6443,18 +6278,15 @@
"src/shared/ephemeral-vm-recipe-checkout-mode.test.ts": 106,
"src/shared/ephemeral-vm-recipe-output-capture.test.ts": 287,
"src/shared/ephemeral-vm-recipe-process.test.ts": 198,
- "src/shared/ephemeral-vm-recipe-repo-url.test.ts": 56,
"src/shared/ephemeral-vm-recipes.test.ts": 160,
"src/shared/ephemeral-vm-runtime-store-rollback.test.ts": 321,
"src/shared/ephemeral-vm-runtime-store.test.ts": 195,
"src/shared/execution-host-registry-shared-control-connect.test.ts": 160,
"src/shared/execution-host-registry.test.ts": 169,
"src/shared/execution-host.test.ts": 56,
- "src/shared/external-automation-jobs-file.test.ts": 72,
"src/shared/external-worktree-inbox.test.ts": 69,
"src/shared/feature-education-telemetry.test.ts": 36,
"src/shared/feature-tips.test.ts": 54,
- "src/shared/file-explorer-display-root.test.ts": 47,
"src/shared/file-inventory-budget.test.ts": 44,
"src/shared/file-links/file-link-location.test.ts": 40,
"src/shared/file-write-disk-precondition.test.ts": 56,
@@ -6505,9 +6337,6 @@
"src/shared/git/worktrees/git-worktree-admin.test.ts": 161,
"src/shared/github/account-binding.test.ts": 48,
"src/shared/github/api-availability.test.ts": 47,
- "src/shared/github/owner-slug.test.ts": 45,
- "src/shared/source-control/review-comments/pr-comments-resolution-prompt.test.ts": 49,
- "src/shared/github/pr-reviewer-display.test.ts": 56,
"src/shared/github/project-board-columns.test.ts": 64,
"src/shared/github/project-identity.test.ts": 33,
"src/shared/github/project-ref-input.test.ts": 40,
@@ -6552,7 +6381,6 @@
"src/shared/keybindings-digit-index.test.ts": 110,
"src/shared/keybindings-double-tap.test.ts": 92,
"src/shared/keybindings-keyboard-layout.test.ts": 86,
- "src/shared/keybindings-parse-cache.test.ts": 61,
"src/shared/keybindings-parsing.test.ts": 86,
"src/shared/keybindings-unassigned-actions.test.ts": 73,
"src/shared/kiro-home.test.ts": 39,
@@ -6567,7 +6395,6 @@
"src/shared/linux-wayland-session.test.ts": 46,
"src/shared/local-build-compatibility.test.ts": 46,
"src/shared/local-windows-terminal-runtime.test.ts": 41,
- "src/shared/localhost-worktree-labels.test.ts": 41,
"src/shared/loose-ref-count.test.ts": 140,
"src/shared/macos-symbolic-hotkeys.test.ts": 95,
"src/shared/managed-agent-command-token.test.ts": 45,
@@ -6606,7 +6433,6 @@
"src/shared/native-chat/input/native-chat-ask.test.ts": 272,
"src/shared/native-chat/input/native-chat-background-task-row.test.ts": 51,
"src/shared/native-chat/input/native-chat-session-option-commands.test.ts": 216,
- "src/shared/native-chat/input/native-chat-session-option-defaults.test.ts": 207,
"src/shared/native-chat/input/native-chat-session-option-snapshot.test.ts": 224,
"src/shared/native-chat/input/native-chat-session-option-state.test.ts": 55,
"src/shared/native-chat/input/native-chat-slash-commands.omp.test.ts": 50,
@@ -6635,7 +6461,6 @@
"src/shared/native-chat/tools/native-chat-tool-attribution-allocation.test.ts": 105,
"src/shared/native-chat/tools/native-chat-tool-identity.test.ts": 73,
"src/shared/native-chat/tools/native-chat-tool-line-identity.test.ts": 50,
- "src/shared/native-chat/tools/native-chat-tool-line-label.test.ts": 259,
"src/shared/native-chat/tools/native-chat-tool-pairing.performance.test.ts": 235,
"src/shared/native-chat/tools/native-chat-tool-preview-prefix.test.ts": 46,
"src/shared/native-chat/tools/native-chat-tool-run-outcome.test.ts": 68,
@@ -6693,7 +6518,6 @@
"src/shared/opencode-tui-plugin-install.test.ts": 82,
"src/shared/openssh-default-shell.test.ts": 54,
"src/shared/orca-browser-cli-commands.test.ts": 59,
- "src/shared/orca-cli-command-name.test.ts": 41,
"src/shared/orca-hook-setup-config.test.ts": 38,
"src/shared/orca-session-address.test.ts": 154,
"src/shared/orca-yaml-alias-bounds.test.ts": 425,
@@ -6740,17 +6564,12 @@
"src/shared/plugins/authoring/plugin-host-typings.test.ts": 2140,
"src/shared/plugins/catalog/plugin-catalog-release.test.ts": 229,
"src/shared/plugins/catalog/plugin-catalog.test.ts": 630,
- "src/shared/plugins/catalog/plugin-detail-fields.test.ts": 171,
"src/shared/plugins/catalog/plugin-kill-list.test.ts": 195,
"src/shared/plugins/catalog/plugin-marketplace.test.ts": 246,
"src/shared/plugins/catalog/plugin-repository-link.test.ts": 205,
"src/shared/plugins/contributions/plugin-command-replaces.test.ts": 230,
"src/shared/plugins/contributions/plugin-content-pack-contributions.test.ts": 227,
"src/shared/plugins/contributions/plugin-custom-editor-contribution.test.ts": 238,
- "src/shared/plugins/contributions/plugin-execution-profile.test.ts": 164,
- "src/shared/plugins/contributions/plugin-panel-contribution.test.ts": 240,
- "src/shared/plugins/contributions/plugin-settings-contribution.test.ts": 202,
- "src/shared/plugins/contributions/plugin-status-bar-item-contribution.test.ts": 232,
"src/shared/plugins/declarative/plugin-declarative-catalog-rich.test.ts": 147,
"src/shared/plugins/declarative/plugin-declarative-example.test.ts": 198,
"src/shared/plugins/declarative/plugin-declarative-tree.test.ts": 168,
@@ -6762,21 +6581,14 @@
"src/shared/plugins/declarative/runtime/declarative-storage-sync.test.ts": 190,
"src/shared/plugins/declarative/testing/orca-testing-hooks.test.ts": 506,
"src/shared/plugins/declarative/testing/orca-testing-worker.test.ts": 480,
- "src/shared/plugins/declarative/testing/orca-testing.test.ts": 489,
"src/shared/plugins/declarative/testing/testing-editor-host.test.ts": 197,
"src/shared/plugins/frames/plugin-frame-document-session.test.ts": 404,
"src/shared/plugins/frames/plugin-frame-document.test.ts": 426,
- "src/shared/plugins/frames/plugin-frame-facades.test.ts": 383,
- "src/shared/plugins/frames/plugin-frame-guest.test.ts": 50,
"src/shared/plugins/frames/plugin-panel-call-admission.test.ts": 89,
- "src/shared/plugins/frames/plugin-panel-message-budget.test.ts": 99,
"src/shared/plugins/frames/plugin-panel-shell.test.ts": 376,
"src/shared/plugins/images/plugin-image-format.test.ts": 104,
"src/shared/plugins/images/plugin-image-url.test.ts": 42,
- "src/shared/plugins/installation/plugin-file-validation.test.ts": 363,
- "src/shared/plugins/installation/plugin-path-safety.test.ts": 221,
"src/shared/plugins/manifest/plugin-display-text.test.ts": 285,
- "src/shared/plugins/manifest/plugin-manifest-source-module-floor.test.ts": 212,
"src/shared/plugins/manifest/plugin-manifest-v2-rules.test.ts": 239,
"src/shared/plugins/manifest/plugin-manifest.test.ts": 234,
"src/shared/plugins/view/plugin-editor-shot-acts.test.ts": 112,
@@ -6862,7 +6674,6 @@
"src/shared/remote-runtime/requests/remote-runtime-subscription-frame-router.test.ts": 143,
"src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts": 646,
"src/shared/renderer-restart-preparation.test.ts": 197,
- "src/shared/repo-display-labels.test.ts": 57,
"src/shared/repo-host-identity.test.ts": 45,
"src/shared/repo-icon.test.ts": 82,
"src/shared/repo-pack-index-scheduling.test.ts": 67,
@@ -6966,7 +6777,6 @@
"src/shared/terminal/protocol/queries/terminal-color-scheme-protocol.test.ts": 39,
"src/shared/terminal/input/terminal-composer-draft.test.ts": 73,
"src/shared/terminal/links/terminal-file-uri-link.test.ts": 51,
- "src/shared/terminal/links/terminal-file-url-target.test.ts": 47,
"src/shared/terminal/links/terminal-github-pr-link-detector.test.ts": 61,
"src/shared/terminal/links/terminal-http-url-extraction.test.ts": 42,
"src/shared/terminal/input/terminal-input.test.ts": 85,
@@ -7042,54 +6852,44 @@
"src/shared/workspace-attachments/workspace-attachment-origins.test.ts": 42,
"src/shared/workspace-attachments/workspace-attachments.test.ts": 204,
"src/shared/workspace-cleanup/workspace-cleanup-browse-state-persistence.test.ts": 55,
- "src/shared/workspace-last-active-switch-on.test.ts": 52,
"src/shared/workspace-layout/old-client/old-client-method-translation.test.ts": 352,
"src/shared/workspace-layout/old-client/old-client-pane-layout-translation.test.ts": 363,
"src/shared/workspace-layout/old-client/old-client-session-tabs-projection-owned-editor.test.ts": 178,
"src/shared/workspace-layout/old-client/old-client-session-tabs-projection.test.ts": 207,
- "src/shared/workspace-layout/tab-group-moves.test.ts": 52,
- "src/shared/workspace-layout/tab-order-moves.test.ts": 44,
- "src/shared/workspace-layout/workspace-layout-agent-session-tab.test.ts": 168,
- "src/shared/workspace-layout/workspace-layout-browser-commands.test.ts": 177,
- "src/shared/workspace-layout/workspace-layout-cold-local-window.test.ts": 319,
- "src/shared/workspace-layout/workspace-layout-command-persistence.test.ts": 329,
- "src/shared/workspace-layout/workspace-layout-commands.test.ts": 215,
- "src/shared/workspace-layout/workspace-layout-default-tabs.test.ts": 159,
- "src/shared/workspace-layout/workspace-layout-dropped-leaves.test.ts": 174,
- "src/shared/workspace-layout/workspace-layout-editor-duplicates.test.ts": 312,
- "src/shared/workspace-layout/workspace-layout-editor-file-owner.test.ts": 349,
- "src/shared/workspace-layout/workspace-layout-editor-open-file-id.test.ts": 162,
- "src/shared/workspace-layout/workspace-layout-editor-open.test.ts": 166,
- "src/shared/workspace-layout/workspace-layout-editor-rekey.test.ts": 169,
- "src/shared/workspace-layout/workspace-layout-fact-locations.test.ts": 449,
- "src/shared/workspace-layout/workspace-layout-initial-surface.test.ts": 163,
- "src/shared/workspace-layout/workspace-layout-legacy-persistence.test.ts": 332,
- "src/shared/workspace-layout/workspace-layout-load-browser-repair.test.ts": 313,
- "src/shared/workspace-layout/workspace-layout-load-check-details.test.ts": 286,
- "src/shared/workspace-layout/workspace-layout-load-duplicate-pty.test.ts": 340,
- "src/shared/workspace-layout/workspace-layout-load-normalization.test.ts": 470,
- "src/shared/workspace-layout/workspace-layout-load-synthetic-pane-title.test.ts": 324,
- "src/shared/workspace-layout/workspace-layout-load-view-less-tabs.test.ts": 294,
- "src/shared/workspace-layout/workspace-layout-minted-ids.test.ts": 40,
- "src/shared/workspace-layout/workspace-layout-model-rules.test.ts": 321,
- "src/shared/workspace-layout/workspace-layout-move-tab-anchor.test.ts": 160,
- "src/shared/workspace-layout/workspace-layout-move-tab-pin.test.ts": 180,
- "src/shared/workspace-layout/workspace-layout-open-in-new-group.test.ts": 195,
- "src/shared/workspace-layout/workspace-layout-owned-editor-id.test.ts": 334,
- "src/shared/workspace-layout/workspace-layout-process-rules.test.ts": 201,
- "src/shared/workspace-layout/workspace-layout-published-editor-view.test.ts": 175,
- "src/shared/workspace-layout/workspace-layout-published.test.ts": 343,
- "src/shared/workspace-layout/workspace-layout-ratio-commands.test.ts": 156,
- "src/shared/workspace-layout/workspace-layout-record-patch.test.ts": 1264,
- "src/shared/workspace-layout/workspace-layout-records.test.ts": 325,
- "src/shared/workspace-layout/workspace-layout-resume-record.test.ts": 370,
- "src/shared/workspace-layout/workspace-layout-round-trip.test.ts": 329,
- "src/shared/workspace-layout/workspace-layout-simulator-tab.test.ts": 159,
- "src/shared/workspace-layout/workspace-layout-terminal-adoption.test.ts": 171,
- "src/shared/workspace-layout/workspace-layout-transitions.test.ts": 203,
- "src/shared/workspace-layout/workspace-layout-views-owned-file.test.ts": 171,
- "src/shared/workspace-layout/workspace-layout-views.test.ts": 183,
- "src/shared/workspace-layout/workspace-layout-workspace-move.test.ts": 181,
+ "src/shared/workspace-layout/tab-groups/tab-group-moves.test.ts": 52,
+ "src/shared/workspace-layout/tab-groups/tab-order-moves.test.ts": 44,
+ "src/shared/workspace-layout/commands/workspace-layout-agent-session-tab.test.ts": 168,
+ "src/shared/workspace-layout/commands/workspace-layout-browser-commands.test.ts": 177,
+ "src/shared/workspace-layout/persistence/workspace-layout-command-persistence.test.ts": 329,
+ "src/shared/workspace-layout/commands/workspace-layout-commands.test.ts": 215,
+ "src/shared/workspace-layout/commands/workspace-layout-default-tabs.test.ts": 159,
+ "src/shared/workspace-layout/commands/workspace-layout-dropped-leaves.test.ts": 174,
+ "src/shared/workspace-layout/editor-tabs/workspace-layout-editor-duplicates.test.ts": 312,
+ "src/shared/workspace-layout/editor-tabs/workspace-layout-editor-file-owner.test.ts": 349,
+ "src/shared/workspace-layout/editor-tabs/workspace-layout-editor-open.test.ts": 166,
+ "src/shared/workspace-layout/editor-tabs/workspace-layout-editor-rekey.test.ts": 169,
+ "src/shared/workspace-layout/commands/workspace-layout-initial-surface.test.ts": 163,
+ "src/shared/workspace-layout/persistence/workspace-layout-legacy-persistence.test.ts": 332,
+ "src/shared/workspace-layout/persistence/workspace-layout-load-browser-repair.test.ts": 313,
+ "src/shared/workspace-layout/persistence/workspace-layout-load-check-details.test.ts": 286,
+ "src/shared/workspace-layout/persistence/workspace-layout-load-duplicate-pty.test.ts": 340,
+ "src/shared/workspace-layout/persistence/workspace-layout-load-normalization.test.ts": 470,
+ "src/shared/workspace-layout/persistence/workspace-layout-load-synthetic-pane-title.test.ts": 324,
+ "src/shared/workspace-layout/persistence/workspace-layout-load-view-less-tabs.test.ts": 294,
+ "src/shared/workspace-layout/invariants/workspace-layout-model-rules.test.ts": 321,
+ "src/shared/workspace-layout/commands/workspace-layout-move-tab-anchor.test.ts": 160,
+ "src/shared/workspace-layout/commands/workspace-layout-move-tab-pin.test.ts": 180,
+ "src/shared/workspace-layout/commands/workspace-layout-open-in-new-group.test.ts": 195,
+ "src/shared/workspace-layout/editor-tabs/workspace-layout-owned-editor-id.test.ts": 334,
+ "src/shared/workspace-layout/commands/workspace-layout-process-rules.test.ts": 201,
+ "src/shared/workspace-layout/commands/workspace-layout-ratio-commands.test.ts": 156,
+ "src/shared/workspace-layout/published-layout/workspace-layout-records.test.ts": 325,
+ "src/shared/workspace-layout/commands/workspace-layout-resume-record.test.ts": 370,
+ "src/shared/workspace-layout/commands/workspace-layout-simulator-tab.test.ts": 159,
+ "src/shared/workspace-layout/commands/workspace-layout-terminal-adoption.test.ts": 171,
+ "src/shared/workspace-layout/commands/workspace-layout-transitions.test.ts": 203,
+ "src/shared/workspace-layout/client-views/workspace-layout-views.test.ts": 183,
+ "src/shared/workspace-layout/editor-tabs/workspace-layout-workspace-move.test.ts": 181,
"src/shared/workspace-attachments/workspace-linked-item-source-context.test.ts": 65,
"src/shared/workspace-name.test.ts": 49,
"src/shared/workspace-attachments/workspace-reference-identity.test.ts": 82,
@@ -7164,7 +6964,6 @@
"src/wsl-guest/wsl-install-plugins-handler.test.ts": 283,
"tests/e2e/SmartWorkspaceSourceResultList.linear-auth.unit.test.ts": 1976,
"tests/e2e/SmartWorkspaceSourceResultList.linear-read-error.unit.test.ts": 3757,
- "tests/e2e/agent-launch-cli.unit.test.ts": 2379,
"tests/e2e/agent-launch-setup-choice.unit.test.ts": 2657,
"tests/e2e/ai-vault-manual-name-clear.unit.test.ts": 21206,
"tests/e2e/automation-chat-reopen.unit.test.ts": 6262,
@@ -7197,7 +6996,6 @@
"tests/e2e/helpers/remote-skill-cloud-fixture.unit.test.ts": 269,
"tests/e2e/helpers/wsl-terminate-retry.unit.test.ts": 60,
"tests/e2e/host-agent-launch-preferences-work.unit.test.ts": 3882,
- "tests/e2e/host-agent-launch-settings-hook-bookkeeping.unit.test.ts": 21972,
"tests/e2e/host-cold-park-remote-subscriber.unit.test.ts": 5314,
"tests/e2e/launch-agent-background-session-remote.unit.test.ts": 1016,
"tests/e2e/linear-cli-recovery.unit.test.ts": 7592,
@@ -7260,7 +7058,6 @@
"src/main/skills/bundled-skill-install/bundled-skill-plan-selection.test.ts": 392,
"src/main/skills/bundled-skill-install/bundled-skill-plan.test.ts": 297,
"src/main/skills/bundled-skill-install/bundled-skill-workspace-targets.test.ts": 248,
- "src/main/skills/discovery/claude-plugin-skill-sources-wsl.test.ts": 93,
"src/main/skills/discovery/skill-discovery-filter-sharing.test.ts": 239,
"src/main/skills/discovery/skill-discovery-stopped-wsl-distro.test.ts": 185,
"src/main/skills/discovery/skill-native-discovery.test.ts": 254,
diff --git a/config/scripts/ci/unit-selection/check-test-file-runners.mjs b/config/scripts/ci/unit-selection/check-test-file-runners.mjs
index 09f620398b7..c47bc154254 100644
--- a/config/scripts/ci/unit-selection/check-test-file-runners.mjs
+++ b/config/scripts/ci/unit-selection/check-test-file-runners.mjs
@@ -84,7 +84,7 @@ const NON_UNIT_TEST_RUNNERS = [
// `orca plugin test` runs every example's own tests in Node; the unit test drives it.
name: 'example plugin tests (orca plugin test)',
include: ['examples/plugins/*/src/**/*.test.ts', 'examples/plugins/*/src/**/*.test.tsx'],
- sources: ['src/cli/plugin-authoring/plugin-test-runner.test.ts'],
+ sources: ['src/cli/plugins/authoring/plugin-test-runner.test.ts'],
mirrors: ['readdirSync(EXAMPLES)']
},
{
diff --git a/config/scripts/ci/unit-selection/dependency-graph/ci-unit-files.mjs b/config/scripts/ci/unit-selection/dependency-graph/ci-unit-files.mjs
index 4fae9b4f7a5..587377b53fc 100644
--- a/config/scripts/ci/unit-selection/dependency-graph/ci-unit-files.mjs
+++ b/config/scripts/ci/unit-selection/dependency-graph/ci-unit-files.mjs
@@ -35,23 +35,22 @@ export const UNIT_EXCLUDE = [
'src/main/pty/history/terminal-history-fish-session.node-pty.test.ts',
'src/main/pty/shell-startup/zsh-scoped-histfile.live-shell.test.ts',
'src/main/pty/shell-startup/zsh-startup-hook-user-config-equivalence.live-shell.test.ts',
+ 'src/main/runtime/terminal/wait/tui-idle-zsh-preexec-hook-order.live-shell.test.ts',
'src/main/runtime/agent-session/environment/structured-session-cli-login-shell.live-shell.test.ts',
- 'src/main/startup/shell-probe-terminal-detach.live-shell.test.ts',
- 'src/main/startup/shell-probe-lifetime.live-shell.test.ts',
+ 'src/main/startup/shell-environment/shell-probe-terminal-detach.live-shell.test.ts',
+ 'src/main/startup/shell-environment/shell-probe-lifetime.live-shell.test.ts',
'src/renderer/src/components/terminal-pane/pty-connection/emulation/fish-color-scheme-child-stdin.node-pty.test.ts',
'src/shared/fish-wsl-cwd-report.node-pty.test.ts',
'src/main/wsl/filesystem/wsl-sh-cwd-report.node-pty.test.ts',
'src/shared/terminal/pty/ingress/pty-reply-echo-shapes.node-pty.test.ts',
'src/shared/startup-shell-portability.live-shell.test.ts',
'src/shared/posix-command-path-lookup.test.ts',
- 'tests/e2e/relay-region-compatibility.unit.test.ts',
'tests/e2e/relay-region-correction.unit.test.ts',
'src/main/browser/cookies/browser-google-cookie-clear.electron.test.ts',
// Electron probes with in-process deadlines; the package job runs them serially.
'src/main/browser/guest-lifecycle/popups/presentation/popup-origin-chrome.electron.test.ts',
'src/main/browser/guest-lifecycle/navigation/browser-link-materialization.electron.test.ts',
'src/main/browser/client-pages/renderer/browser-client-page-renderer-lifecycle.electron.test.ts',
- 'src/main/browser/guest-lifecycle/popups/compatibility/browser-popup-compatibility.electron.test.ts',
'src/main/browser/guest-lifecycle/popups/compatibility/browser-popup-native-compatibility.electron.test.ts',
'src/main/browser/guest-lifecycle/popups/compatibility/browser-popup-background-compatibility.electron.test.ts',
'src/main/browser/extensions/api-runtime/browser-extension-api.electron.test.ts',
diff --git a/config/scripts/ci/workflow-contracts/ci-closed-pr-cancellation.test.mjs b/config/scripts/ci/workflow-contracts/ci-closed-pr-cancellation.test.mjs
index 76f95a09673..183497f5019 100644
--- a/config/scripts/ci/workflow-contracts/ci-closed-pr-cancellation.test.mjs
+++ b/config/scripts/ci/workflow-contracts/ci-closed-pr-cancellation.test.mjs
@@ -69,6 +69,33 @@ it('rechecks closure before cancelling when a PR reopens during lookup', async (
expect(cancel).not.toHaveBeenCalled()
})
+it('skips a close event whose payload was rendered after a quick reopen', async () => {
+ const reopened = execute({
+ closed: { number: 123, closed_at: null },
+ current: { number: 123, state: 'open', closed_at: null, merged_at: null }
+ })
+ await expect(reopened.result).resolves.toBeUndefined()
+ expect(reopened.cancel).not.toHaveBeenCalled()
+
+ const stillClosed = execute()
+ await stillClosed.result
+ expect(stillClosed.cancel).toHaveBeenCalledWith(expect.objectContaining({ run_id: 42 }))
+})
+
+it('skips a close event when the PR was reopened and merged before cleanup', async () => {
+ const { result, cancel } = execute({
+ closed: { number: 123, closed_at: null },
+ current: {
+ number: 123,
+ state: 'closed',
+ closed_at: '2026-10-06T00:00:05Z',
+ merged_at: '2026-10-06T00:00:05Z'
+ }
+ })
+ await expect(result).resolves.toBeUndefined()
+ expect(cancel).not.toHaveBeenCalled()
+})
+
const head = 'a'.repeat(40)
const pushed = { number: 123, head: { sha: head } }
const open = { ...pushed, state: 'open' }
diff --git a/config/scripts/daemon-protocol/admission/check-runtime-launcher-protocol-ratchet.mjs b/config/scripts/daemon-protocol/admission/check-runtime-launcher-protocol-ratchet.mjs
index 24bb8a96093..096afb70520 100644
--- a/config/scripts/daemon-protocol/admission/check-runtime-launcher-protocol-ratchet.mjs
+++ b/config/scripts/daemon-protocol/admission/check-runtime-launcher-protocol-ratchet.mjs
@@ -13,7 +13,7 @@ import {
/** Files that decide which runtime executable launches orcad or the terminal daemon. */
export const RUNTIME_LAUNCHER_PATHS = [
// orcad handoff to its bundled runtime, and the pinned runtimes it can hand off to.
- 'src/main/orcad/orcad-bundled-runtime.ts',
+ 'src/main/orcad/runtime-launch/orcad-bundled-runtime.ts',
'src/main/orcad/launcher.ts',
'config/scripts/orcad-distribution/server-bundle/orcad-entry-build.mjs',
'src/shared/node-runtime-pin.ts',
diff --git a/config/scripts/desktop-distribution/macos/sign-mac-app.mjs b/config/scripts/desktop-distribution/macos/sign-mac-app.mjs
index 046dca0cbfb..d32b58196eb 100644
--- a/config/scripts/desktop-distribution/macos/sign-mac-app.mjs
+++ b/config/scripts/desktop-distribution/macos/sign-mac-app.mjs
@@ -1,8 +1,21 @@
import { createRequire } from 'node:module'
+// serve-sim launches these with `simctl spawn`, whose DYLD_ROOT_PATH the hardened runtime drops (#40509).
+const IOS_SIMULATOR_HELPER_PATHS = [
+ '/node_modules/serve-sim/dist/simduo/serve-sim-duo-hid',
+ '/node_modules/serve-sim/dist/simax/serve-sim-ax-settings'
+]
+const IOS_SIMULATOR_HELPER_ENTITLEMENTS = ['com.apple.security.cs.allow-dyld-environment-variables']
+
export function signMacApp(options, { sign, retry }) {
+ const optionsForFile = (filePath, context) => {
+ const fileOptions = options.optionsForFile?.(filePath, context)
+ return IOS_SIMULATOR_HELPER_PATHS.some((helperPath) => filePath.endsWith(helperPath))
+ ? { ...fileOptions, entitlements: IOS_SIMULATOR_HELPER_ENTITLEMENTS }
+ : fileOptions
+ }
// A custom signer bypasses electron-builder's retry wrapper.
- return retry(() => sign({ ...options, batchCodesignCalls: true }), {
+ return retry(() => sign({ ...options, optionsForFile, batchCodesignCalls: true }), {
retries: 3,
interval: 5000,
backoff: 5000
diff --git a/config/scripts/desktop-distribution/runtime-verification/smoke-packaged-hang-watchdog-worker.mjs b/config/scripts/desktop-distribution/runtime-verification/smoke-packaged-hang-watchdog-worker.mjs
index a8c4e578a8c..fd6d15422b9 100644
--- a/config/scripts/desktop-distribution/runtime-verification/smoke-packaged-hang-watchdog-worker.mjs
+++ b/config/scripts/desktop-distribution/runtime-verification/smoke-packaged-hang-watchdog-worker.mjs
@@ -85,14 +85,13 @@ async function runInternal() {
const tempRoot = mkdtempSync(join(tmpdir(), 'orca-packaged-watchdog-smoke-'))
const markerPath = join(tempRoot, 'main-thread-hang.json')
const entryPath = join(appAsar, 'out', 'main', 'main-thread-hang-watchdog-entry.js')
- let worker
try {
await app.whenReady()
if (!existsSync(entryPath)) {
throw new Error(`Packaged watchdog entry is missing from app.asar: ${entryPath}`)
}
const workerError = { current: null }
- worker = new Worker(entryPath, {
+ const worker = new Worker(entryPath, {
workerData: {
parentPid: process.pid,
markerPath,
@@ -103,15 +102,22 @@ async function runInternal() {
worker.once('error', (error) => {
workerError.current = error
})
+ worker.on('message', (message) => {
+ if (
+ message?.type === 'capture-drain' &&
+ typeof message.token === 'string' &&
+ message.token.length <= 80
+ ) {
+ setImmediate(() => worker.postMessage({ type: 'capture-drain-ack', token: message.token }))
+ }
+ })
await waitForMarker(markerPath, (marker) => marker?.selfRecovered === false, workerError)
worker.postMessage({ type: 'heartbeat' })
await waitForMarker(markerPath, (marker) => marker?.selfRecovered === true, workerError)
worker.postMessage({ type: 'shutdown' })
await waitForExit(worker, workerError)
- worker = undefined
console.log(SUCCESS_LINE)
} finally {
- await worker?.terminate()
rmSync(tempRoot, { recursive: true, force: true })
}
}
diff --git a/src/main/startup/__fixtures__/electron-vite-dev-grandchild.mjs b/config/scripts/development/launch/fixtures/electron-vite-dev-grandchild.mjs
similarity index 100%
rename from src/main/startup/__fixtures__/electron-vite-dev-grandchild.mjs
rename to config/scripts/development/launch/fixtures/electron-vite-dev-grandchild.mjs
diff --git a/src/main/startup/__fixtures__/fake-electron-vite-dev-cli.mjs b/config/scripts/development/launch/fixtures/fake-electron-vite-dev-cli.mjs
similarity index 100%
rename from src/main/startup/__fixtures__/fake-electron-vite-dev-cli.mjs
rename to config/scripts/development/launch/fixtures/fake-electron-vite-dev-cli.mjs
diff --git a/src/main/startup/run-electron-vite-dev.test.ts b/config/scripts/development/launch/run-electron-vite-dev.test.ts
similarity index 96%
rename from src/main/startup/run-electron-vite-dev.test.ts
rename to config/scripts/development/launch/run-electron-vite-dev.test.ts
index a25b5b79e5c..119815d5f67 100644
--- a/src/main/startup/run-electron-vite-dev.test.ts
+++ b/config/scripts/development/launch/run-electron-vite-dev.test.ts
@@ -183,7 +183,9 @@ describe('run-electron-vite-dev', () => {
const tempDir = mkdtempSync(join(tmpdir(), 'orca-dev-wrapper-'))
const pidFile = join(tempDir, 'grandchild.pid')
const wrapperPath = resolve('config/scripts/development/launch/run-electron-vite-dev.mjs')
- const fakeCliPath = resolve('src/main/startup/__fixtures__/fake-electron-vite-dev-cli.mjs')
+ const fakeCliPath = resolve(
+ 'config/scripts/development/launch/fixtures/fake-electron-vite-dev-cli.mjs'
+ )
const wrapper = spawn(process.execPath, [wrapperPath], {
cwd: resolve('.'),
@@ -228,7 +230,9 @@ describe('run-electron-vite-dev', () => {
async () => {
const tempDir = mkdtempSync(join(tmpdir(), 'orca-dev-wrapper-'))
const wrapperPath = resolve('config/scripts/development/launch/run-electron-vite-dev.mjs')
- const fakeCliPath = resolve('src/main/startup/__fixtures__/fake-electron-vite-dev-cli.mjs')
+ const fakeCliPath = resolve(
+ 'config/scripts/development/launch/fixtures/fake-electron-vite-dev-cli.mjs'
+ )
const baseEnv = devWrapperTestEnv({
ORCA_ELECTRON_VITE_CLI: fakeCliPath,
ORCA_SKIP_DEV_CLI_PREPARE: '1',
@@ -302,7 +306,9 @@ describe('run-electron-vite-dev', () => {
const pidFile = join(tempDir, 'grandchild.pid')
const envFile = join(tempDir, 'env.json')
const wrapperPath = resolve('config/scripts/development/launch/run-electron-vite-dev.mjs')
- const fakeCliPath = resolve('src/main/startup/__fixtures__/fake-electron-vite-dev-cli.mjs')
+ const fakeCliPath = resolve(
+ 'config/scripts/development/launch/fixtures/fake-electron-vite-dev-cli.mjs'
+ )
const { wrapper, readOutput } = spawnDevWrapper(
[wrapperPath, '--remote-debugging-port=9448'],
diff --git a/config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs b/config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs
index 41553c836a1..e3c0969cb33 100644
--- a/config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs
+++ b/config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs
@@ -7,7 +7,7 @@ import { build } from 'esbuild'
const ENTRY_PATH = resolve('out/main/parcel-watcher-process-entry.js')
const SUPERVISOR_SOURCE = resolve(
- 'src/main/ipc/filesystem/watcher-process/parcel-watcher-process-supervisor.ts'
+ 'src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-process-supervisor.ts'
)
const WAIT_TIMEOUT_MS = 15_000
const require = createRequire(import.meta.url)
diff --git a/config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs b/config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs
index fd5a57f8a35..3856bbaedfa 100644
--- a/config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs
+++ b/config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs
@@ -9,13 +9,13 @@ import { build } from 'esbuild'
const ENTRY_PATH = resolve('out/main/parcel-watcher-process-entry.js')
const POOL_SOURCE = resolve(
- 'src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.ts'
+ 'src/main/ipc/filesystem/watcher-process/runtime-pool/runtime-watcher-process-pool.ts'
)
const FAILURE_SOURCE = resolve(
'src/main/ipc/filesystem/watcher-process/parcel-watcher-process-failure.ts'
)
const REGISTRY_SOURCE = resolve(
- 'src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.ts'
+ 'src/main/ipc/filesystem/watcher-process/child-lifecycle/parcel-watcher-child-registry.ts'
)
const MAX_CHILD_RSS_KIB = 128 * 1024
const MAX_CHILD_CPU_PERCENT = 50
diff --git a/config/scripts/locale-catalog/locale-ko-key-overrides.json b/config/scripts/locale-catalog/locale-ko-key-overrides.json
index 8e46d02ef70..c5808babd64 100644
--- a/config/scripts/locale-catalog/locale-ko-key-overrides.json
+++ b/config/scripts/locale-catalog/locale-ko-key-overrides.json
@@ -446,9 +446,6 @@
"auto.components.Terminal.5b2c1a9e44": {
"ko": "agent CLI를 찾지 못했습니다. 하나를 설치하거나 설정에서 기본 agent를 선택하세요."
},
- "auto.components.Terminal.7958465754": {
- "ko": "실행 중인 프로세스가 있는 terminals이 있습니다. 그래도 창을 닫으시겠습니까?"
- },
"auto.components.Terminal.e57db40c11": {
"ko": "{{value0}} 실행 명령을 만들 수 없습니다."
},
@@ -1898,9 +1895,6 @@
"auto.components.settings.RepositoryHooksSection.a3fc966677": {
"ko": "# 예: pnpm install cp \"$ORCA_ROOT_PATH/.env\" \"$ORCA_WORKTREE_PATH/.env\""
},
- "auto.components.settings.RepositoryHooksSection.b20c5df6ca": {
- "ko": "이 repo의 공유 설정, 아카이브 또는 이슈 자동화 기본값을 사용하려면 `orca.yaml` 파일을 추가하세요. 예제 템플릿:"
- },
"auto.components.settings.RepositoryHooksSection.c5a55a2d2e": {
"ko": "고급"
},
@@ -4718,21 +4712,9 @@
"auto.components.settings.ZcodePlanAccountsSection.detailsUnavailable": {
"ko": "요금제 자격 증명 세부 정보는 Orca를 실행 중인 컴퓨터에서만 볼 수 있습니다."
},
- "accounts.antigravity.signIn": {
- "ko": "이 호스트에서 agy를 실행하고 브라우저 로그인을 완료한 후 현재 계정을 저장하세요. 다른 계정을 추가하려면 agy에서 /logout 명령을 실행하고 다시 로그인하세요."
- },
- "accounts.antigravity.signedOut": {
- "ko": "로그인된 agy 자체 계정이 없습니다."
- },
"accounts.antigravity.changed": {
"ko": "agy 자체 계정이 변경되었습니다. agy를 시작하기 전에 저장된 계정을 다시 선택하세요."
},
- "accounts.antigravity.save": {
- "ko": "현재 계정 저장"
- },
- "accounts.antigravity.sessions": {
- "ko": "선택한 계정은 이 호스트의 새 agy 세션에 적용됩니다. 기존 세션은 이전 계정을 계속 사용할 수 있습니다."
- },
"accounts.antigravity.keyword.antigravity": {
"ko": "antigravity"
},
@@ -5638,5 +5620,17 @@
},
"components.workspace.cleanup.browse.agent.idle": {
"ko": "유휴 상태"
+ },
+ "auto.components.activity.clearCompleted.undo": {
+ "ko": "실행 취소"
+ },
+ "auto.components.settings.terminal.search.stop": {
+ "ko": "중지"
+ },
+ "components.native-chat.backgroundTasks.stop": {
+ "ko": "중지"
+ },
+ "rendererRecovery.quit": {
+ "ko": "종료"
}
}
diff --git a/config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs b/config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs
index be3dd5d8541..a24179060cd 100644
--- a/config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs
+++ b/config/scripts/localization/source-extraction/audit-localization-native-dialogs.test.mjs
@@ -30,10 +30,6 @@ describe('native dialog localization coverage', () => {
])
})
- it('does not change the existing renderer scan by default', () => {
- expect(collectLocalizationCandidates(path, source, '/repo')).toEqual([])
- })
-
it('fails the opt-in check for a new native dialog literal', async () => {
const root = await mkdtemp(join(tmpdir(), 'orca-native-localization-'))
const report = vi.spyOn(console, 'error').mockImplementation(() => {})
diff --git a/config/scripts/mobile-web-app/preview/mobile-web-app-html-preview-render.test.mjs b/config/scripts/mobile-web-app/preview/mobile-web-app-html-preview-render.test.mjs
index 8e57c3cb0f4..ebf5a689287 100644
--- a/config/scripts/mobile-web-app/preview/mobile-web-app-html-preview-render.test.mjs
+++ b/config/scripts/mobile-web-app/preview/mobile-web-app-html-preview-render.test.mjs
@@ -8,7 +8,7 @@ import { fileURLToPath } from 'node:url'
import { afterAll, beforeAll, describe, expect, it } from 'vitest'
import * as esbuild from 'esbuild'
import { chromium, webkit } from 'playwright-core'
-import { lucideBarrelPlugin } from '../../build/mobile-web-app/build-mobile-web-app-bundle.mjs'
+import { mobileWebRenderCheckPlugins } from '../../build/mobile-web-app/build-mobile-web-app-bundle.mjs'
import { mobileWebAppDependenciesPresent } from '../mobile-web-app-bundle-dependencies.mjs'
import {
createBundleServer,
@@ -109,7 +109,7 @@ beforeAll(async () => {
jsx: 'automatic',
logLevel: 'silent',
// Reuse shipped Lucide shim; barrel reexports missing LucideProvider and toolbar otherwise fails linking.
- plugins: [lucideBarrelPlugin],
+ plugins: mobileWebRenderCheckPlugins,
nodePaths: [join(mobileDir, 'node_modules')],
alias: { 'react-native': 'react-native-web' },
// Prefer web siblings, including .web.jsx/.web.js; native WebView/Fabric SVG paths fail in browser.
@@ -236,20 +236,6 @@ for (const engine of ['chromium', 'webkit']) {
expect(sealed.reported.join(' ')).not.toContain('script-src')
}, 180_000)
- it('loads the artifact https images the directive admits, and still refuses its font', async (ctx) => {
- // Await both images explicitly; bounded settle once observed background before element on loaded Chrome.
- const read = await open(browser(), {
- assets: assetServer.origin,
- frameReady: 'images',
- signal: ctx.signal
- })
- expect(read.pixel).toBe(ARTIFACT_RGB)
- // img-src governs CSS background and img element; require both requests.
- expect([...read.secureHits].sort()).toEqual(['/css-bg.png', '/img.png'])
- // Same HTTPS origin still cannot load font; img-src admission must not widen font-src.
- expect(read.secureHits).not.toContain('/probe.woff2')
- }, 120_000)
-
it('sends no referrer with an admitted https image, which is the shell header doing it', async (ctx) => {
const sealed = await open(browser(), {
assets: assetServer.origin,
@@ -384,109 +370,6 @@ for (const engine of ['chromium', 'webkit']) {
expect(read.popups).toBe(0)
}, 120_000)
- it("cannot reach the shell through a meta refresh at the embedder's own URL", async (ctx) => {
- // Same-origin meta-refresh targets shell document; foreign-origin arm cannot prove shell-origin counter works.
- const own = await open(browser(), {
- signal: ctx.signal,
- extra: { head: '' }
- })
- // Require painted artifact before interpreting navigation refusal.
- expect(own.pixelBefore).toBe(ARTIFACT_RGB)
- // Link-to-/ control reads one on same counter, proving refresh zero is observable.
- expect(own.ownOriginTopNavigations).toBe(0)
- expect(own.topNavigations).toBe(0)
- // Also reject self-frame shell-document fetch, which would embed session page inside preview.
- expect(own.ownOriginFrameNavigations).toBe(0)
-
- // No-policy/allow-same-origin control must navigate frame to shell / to prove observer is not blind.
- const loose = await open(browser(), {
- signal: ctx.signal,
- csp: null,
- sandbox: 'allow-scripts allow-same-origin allow-top-navigation',
- extra: { head: '' },
- // Navigating arm no longer contains marker; await navigation instead of artifact readiness.
- frameReady: 'load',
- expectNavigation: 'frame'
- })
- expect(loose.ownOriginFrameNavigations).toBe(1)
-
- // Test sandbox token alone with no CSP; navigation must never begin or report.
- const tokenOnly = await open(browser(), {
- signal: ctx.signal,
- csp: null,
- extra: { head: '' }
- })
- expect(tokenOnly.pixelBefore).toBe(ARTIFACT_RGB)
- expect(tokenOnly.ownOriginFrameNavigations).toBe(0)
- expect(tokenOnly.ownOriginTopNavigations).toBe(0)
- expect(tokenOnly.violations).toEqual([])
-
- // Test CSP alone with allow-same-origin: frame-src none blocks request at embedder; engines leave different content, so assert no server request.
- const policyOnly = await open(browser(), {
- signal: ctx.signal,
- sandbox: 'allow-scripts allow-same-origin allow-top-navigation',
- extra: { head: '' },
- frameReady: 'load'
- })
- expect(policyOnly.ownOriginFrameNavigations).toBe(0)
- expect(policyOnly.ownOriginTopNavigations).toBe(0)
- expect(policyOnly.violations.join(' ')).toContain('frame-src')
- }, 180_000)
-
- it('hands up nothing without a tap, and nothing for a form or a new window', async (ctx) => {
- const meta = await open(browser(), {
- signal: ctx.signal,
- extra: { head: `` }
- })
- expect(meta.topNavigations).toBe(0)
- expect(meta.ownOriginTopNavigations).toBe(0)
- const form = await open(browser(), {
- signal: ctx.signal,
- act: async ({ frame }) => {
- await frame.click('#submit', { timeout: 2000 })
- }
- })
- expect(form.actError).toBeNull()
- expect(form.pixelBefore).toBe(ARTIFACT_RGB)
- expect(form.topNavigations).toBe(0)
- const blank = await open(browser(), {
- signal: ctx.signal,
- act: async ({ frame }) => {
- await frame.click('#blanklink', { timeout: 2000 })
- }
- })
- expect(blank.actError).toBeNull()
- expect(blank.pixelBefore).toBe(ARTIFACT_RGB)
- expect(blank.topNavigations).toBe(0)
- expect(blank.popups).toBe(0)
- const allowedForm = await open(browser(), {
- signal: ctx.signal,
- csp: null,
- sandbox: 'allow-forms allow-top-navigation-by-user-activation',
- expectNavigation: 'main-frame',
- act: async ({ frame }) => {
- await frame.click('#submit', { timeout: 2000 })
- }
- })
- expect(allowedForm.pixelBefore).toBe(ARTIFACT_RGB)
- expect(allowedForm.actError).toBeNull()
- expect(allowedForm.topNavigations).toBe(1)
- const allowedBlank = await open(browser(), {
- signal: ctx.signal,
- csp: null,
- sandbox: 'allow-popups allow-popups-to-escape-sandbox',
- act: async ({ page, frame }) => {
- await Promise.all([
- page.waitForEvent('popup', { timeout: 10_000 }),
- frame.click('#blanklink', { timeout: 2000 })
- ])
- }
- })
- expect(allowedBlank.pixelBefore).toBe(ARTIFACT_RGB)
- expect(allowedBlank.actError).toBeNull()
- expect(allowedBlank.popups).toBe(1)
- }, 180_000)
-
// Force slow-arm diagnostic sampling branch; formerly unexecuted branch had out-of-scope name and no test/lint coverage.
// Force bounded navigation timeout after missed click; require useful diagnostic instead of exhausting whole case budget.
diff --git a/config/scripts/mobile-web-app/preview/mobile-web-app-render-harness.mjs b/config/scripts/mobile-web-app/preview/mobile-web-app-render-harness.mjs
index fe7b188b67b..34b54f8f3ea 100644
--- a/config/scripts/mobile-web-app/preview/mobile-web-app-render-harness.mjs
+++ b/config/scripts/mobile-web-app/preview/mobile-web-app-render-harness.mjs
@@ -120,7 +120,7 @@ export async function readClipboardImageUploadChunkBase64Chars() {
// Read shipped screencast JPEG quality; copied value would certify budget for an encoder configuration no product uses.
export async function readBrowserFrameQuality() {
const source = await readFile(
- join(projectDir, 'mobile/src/browser/browser-screencast-request-parameters.ts'),
+ join(projectDir, 'mobile/src/browser/screencast/browser-screencast-request-parameters.ts'),
'utf8'
)
const match = /BROWSER_FRAME_QUALITY = (\d+)/.exec(source)
diff --git a/config/scripts/mobile-web-app/session/mobile-web-app-mermaid-render.test.mjs b/config/scripts/mobile-web-app/session/mobile-web-app-mermaid-render.test.mjs
index 6d49041de90..ac769ce322b 100644
--- a/config/scripts/mobile-web-app/session/mobile-web-app-mermaid-render.test.mjs
+++ b/config/scripts/mobile-web-app/session/mobile-web-app-mermaid-render.test.mjs
@@ -4,7 +4,7 @@ import { fileURLToPath } from 'node:url'
import { afterAll, beforeAll, describe, expect, it } from 'vitest'
import * as esbuild from 'esbuild'
import { chromium, webkit } from 'playwright-core'
-import { lucideBarrelPlugin } from '../../build/mobile-web-app/build-mobile-web-app-bundle.mjs'
+import { mobileWebRenderCheckPlugins } from '../../build/mobile-web-app/build-mobile-web-app-bundle.mjs'
import { mobileWebAppDependenciesPresent } from '../mobile-web-app-bundle-dependencies.mjs'
import {
createBundleServer,
@@ -101,7 +101,7 @@ beforeAll(async () => {
logLevel: 'silent',
nodePaths: [join(mobileDir, 'node_modules')],
alias: { 'react-native': 'react-native-web' },
- plugins: [lucideBarrelPlugin],
+ plugins: mobileWebRenderCheckPlugins,
// Resolve web sibling; native WebView becomes text in a browser.
resolveExtensions: ['.web.tsx', '.web.ts', '.web.js', '.tsx', '.ts', '.js'],
define: { __DEV__: 'false', 'process.env.NODE_ENV': '"production"' }
diff --git a/config/scripts/mobile-web-app/session/mobile-web-app-native-chat-touch-scroll-render.test.mjs b/config/scripts/mobile-web-app/session/mobile-web-app-native-chat-touch-scroll-render.test.mjs
new file mode 100644
index 00000000000..72f2380b7ed
--- /dev/null
+++ b/config/scripts/mobile-web-app/session/mobile-web-app-native-chat-touch-scroll-render.test.mjs
@@ -0,0 +1,141 @@
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import * as esbuild from 'esbuild'
+import { chromium } from 'playwright-core'
+import {
+ MOBILE_WEB_APP_ROOT_RESET,
+ mobileWebAppBuildOptions
+} from '../../build/mobile-web-app/build-mobile-web-app-bundle.mjs'
+import { mobileWebAppDependenciesPresent } from '../mobile-web-app-bundle-dependencies.mjs'
+import { createBundleServer, readShellCsp } from '../preview/mobile-web-app-render-harness.mjs'
+
+// The phone's web pages must pan the transcript by touch and give a pinch to its text-size detector, not page zoom.
+const mobileDir = fileURLToPath(new URL('../../../../mobile', import.meta.url))
+
+const entry = `
+import { createRoot } from 'react-dom/client'
+import { Text, View } from 'react-native'
+import { GestureHandlerRootView } from 'react-native-gesture-handler'
+import { MobileNativeChatPageScroll } from './src/session/native-chat/transcript/MobileNativeChatPageScroll'
+import {
+ MobileNativeChatPinchZoom,
+ useMobileNativeChatPinchGesture
+} from './src/session/native-chat/transcript/mobile-native-chat-pinch-zoom'
+
+function Transcript() {
+ const { fontScale, pinchGesture } = useMobileNativeChatPinchGesture('chat')
+ return
+ {fontScale}
+
+
+
+ {Array.from({ length: 60 }, (_, i) => message {i})}
+
+
+
+
+}
+createRoot(document.getElementById('root')).render()
+`
+
+const bundles = mobileWebAppDependenciesPresent()
+const describeRender = bundles ? describe : describe.skip
+let scratch
+let server
+let origin
+let browser
+
+beforeAll(async () => {
+ if (!bundles) {
+ return
+ }
+ await mkdir(join(mobileDir, '.tmp'), { recursive: true })
+ scratch = await mkdtemp(join(mobileDir, '.tmp', 'chat-touch-scroll-'))
+ const outDir = join(scratch, 'bundle')
+ await esbuild.build({
+ ...mobileWebAppBuildOptions([]),
+ entryPoints: undefined,
+ stdin: { contents: entry, resolveDir: mobileDir, loader: 'tsx', sourcefile: 'transcript.tsx' },
+ splitting: false,
+ write: true,
+ outdir: outDir,
+ entryNames: 'transcript',
+ metafile: false
+ })
+ await writeFile(
+ join(outDir, 'index.html'),
+ '' +
+ '' +
+ `${MOBILE_WEB_APP_ROOT_RESET}` +
+ ''
+ )
+ const served = await createBundleServer({ outDir, cspHeader: await readShellCsp() })
+ server = served.server
+ origin = served.origin
+ const executablePath = process.env.ORCA_MOBILE_WEB_RENDER_BROWSER
+ browser = await chromium.launch({ headless: true, ...(executablePath ? { executablePath } : {}) })
+}, 180_000)
+
+afterAll(async () => {
+ await browser?.close()
+ server?.close()
+ if (scratch) {
+ await rm(scratch, { recursive: true, force: true })
+ }
+})
+
+async function touch(page, steps) {
+ const cdp = await page.context().newCDPSession(page)
+ const [first, ...rest] = steps
+ await cdp.send('Input.dispatchTouchEvent', { type: 'touchStart', touchPoints: first })
+ for (const touchPoints of rest) {
+ await cdp.send('Input.dispatchTouchEvent', { type: 'touchMove', touchPoints })
+ await page.evaluate(() => new Promise(requestAnimationFrame))
+ }
+ await cdp.send('Input.dispatchTouchEvent', { type: 'touchEnd', touchPoints: [] })
+ await cdp.detach()
+}
+
+const frames = (count, at) => Array.from({ length: count + 1 }, (_, step) => at(step / count))
+
+async function openTranscript() {
+ const context = await browser.newContext({
+ viewport: { width: 390, height: 844 },
+ hasTouch: true,
+ isMobile: true
+ })
+ const page = await context.newPage()
+ await page.goto(`${origin}/`)
+ await page.getByTestId('transcript').waitFor()
+ return page
+}
+
+describeRender('native chat transcript in the phone web pages', () => {
+ it('pans the transcript under one finger', async () => {
+ const page = await openTranscript()
+ await touch(
+ page,
+ frames(10, (t) => [{ x: 195, y: 200 + 300 * t }])
+ )
+ await expect
+ .poll(() => page.getByTestId('transcript').evaluate((element) => element.scrollTop))
+ .toBeLessThan(-100)
+ await page.context().close()
+ })
+
+ it('gives a pinch to the text size, not to page zoom', async () => {
+ const page = await openTranscript()
+ await touch(
+ page,
+ frames(10, (t) => [
+ { x: 195, y: 330 - 120 * t, id: 0 },
+ { x: 195, y: 370 + 120 * t, id: 1 }
+ ])
+ )
+ await expect.poll(() => page.getByTestId('font-scale').textContent()).not.toBe('1')
+ expect(await page.evaluate(() => window.visualViewport.scale)).toBe(1)
+ await page.context().close()
+ })
+})
diff --git a/config/scripts/mobile-web-app/session/mobile-web-app-rich-markdown-render.test.mjs b/config/scripts/mobile-web-app/session/mobile-web-app-rich-markdown-render.test.mjs
index 5c2c8312a16..af884f5aa77 100644
--- a/config/scripts/mobile-web-app/session/mobile-web-app-rich-markdown-render.test.mjs
+++ b/config/scripts/mobile-web-app/session/mobile-web-app-rich-markdown-render.test.mjs
@@ -10,37 +10,18 @@ import { chromium, webkit } from 'playwright-core'
import {
MOBILE_WEB_APP_NATIVE_PARITY_STYLE,
MOBILE_WEB_APP_ROOT_RESET,
- lucideBarrelPlugin
+ mobileWebRenderCheckPlugins
} from '../../build/mobile-web-app/build-mobile-web-app-bundle.mjs'
import { mobileWebAppDependenciesPresent } from '../mobile-web-app-bundle-dependencies.mjs'
import {
createBundleServer,
installCspViolationRecorder,
- installListenerRecorder,
readShellCsp
} from '../preview/mobile-web-app-render-harness.mjs'
const mobileDir = fileURLToPath(new URL('../../../../mobile', import.meta.url))
const componentDir = join(mobileDir, 'src/components')
-const COMMANDS = [
- { label: 'H1', command: 'heading1', select: 'all', expect: 'h1' },
- { label: 'H2', command: 'heading2', select: 'all', expect: 'h2' },
- { label: 'H3', command: 'heading3', select: 'all', expect: 'h3' },
- { label: 'Bold', command: 'bold', select: 'word', expect: 'b,strong' },
- { label: 'Italic', command: 'italic', select: 'word', expect: 'i,em' },
- { label: 'Strike', command: 'strike', select: 'word', expect: 'strike,s,del' },
- { label: 'Bullet list', command: 'bulletList', select: 'all', expect: 'ul' },
- { label: 'Numbered list', command: 'orderedList', select: 'all', expect: 'ol' },
- { label: 'Checklist', command: 'taskList', select: 'all', expect: 'ul[data-type="taskList"]' },
- { label: 'Quote', command: 'quote', select: 'all', expect: 'blockquote' },
- { label: 'Inline code', command: 'inlineCode', select: 'word', expect: 'code' },
- { label: 'Code block', command: 'codeBlock', select: 'all', expect: 'pre' }
-]
-
-// Paragraph undoes another command; starting from p would prove nothing.
-const PARAGRAPH = { label: 'Body', command: 'paragraph' }
-
// Serve inserted image locally: nonexistent URL logs WebKit load failure; successful paint proves shipped CSP admits it.
const IMAGE_PATH = '/inserted.png'
const URL_COMMANDS = [
@@ -151,21 +132,6 @@ function Harness() {
createRoot(document.getElementById('root')).render(createElement(Harness))
`
-// Install ReactNativeWebView recorder before bundle: absence alone cannot prove editor JSON avoids shell bridge if bridge object never existed.
-function installBridgeObjectRecorder() {
- globalThis.__orcaBridgeReads = []
- const bridge = {
- postMessage: (message) => globalThis.__orcaBridgeReads.push(`post ${String(message)}`)
- }
- Object.defineProperty(globalThis, 'ReactNativeWebView', {
- configurable: true,
- get: () => {
- globalThis.__orcaBridgeReads.push('read')
- return bridge
- }
- })
-}
-
const bundles = mobileWebAppDependenciesPresent()
const describeEditor = bundles ? describe : describe.skip
@@ -200,7 +166,7 @@ beforeAll(async () => {
nodePaths: [join(mobileDir, 'node_modules')],
alias: { 'react-native': 'react-native-web' },
// Match app plugin: barrel reexports LucideProvider absent from its context module.
- plugins: [lucideBarrelPlugin],
+ plugins: mobileWebRenderCheckPlugins,
// Prefer .web.jsx/.web.js or toolbar’s react-native-svg resolves Fabric and fails codegenNativeComponent.
resolveExtensions: ['.web.tsx', '.web.ts', '.web.jsx', '.web.js', '.tsx', '.ts', '.jsx', '.js'],
// Match app’s RN shims for JSX-in-.js, process.env and Metro global; missing global made isFabric throw before mount.
@@ -256,9 +222,7 @@ async function openPage(browser) {
}
})
page.on('pageerror', (error) => consoleErrors.push(`pageerror: ${error.message}`))
- await page.addInitScript(installBridgeObjectRecorder)
await page.addInitScript(installCspViolationRecorder)
- await page.addInitScript(installListenerRecorder, { selector: '#editor' })
await page.goto(`${origin}/`, { waitUntil: 'domcontentloaded' })
await page.waitForFunction(() => document.body.dataset.ready === 'yes')
await page.waitForSelector('#first-surface #editor')
@@ -326,89 +290,7 @@ describeEditor(
afterAll(() => browser?.close())
- it('mounts the document, reports ready through the seam and never touches the bridge', async () => {
- const { page, consoleErrors } = await openPage(browser)
- try {
- await setContent(page, '# Title', '
Title
')
- expect(await readSurface(page)).toBe('
Title
')
- // Initial markup proves document ready reached controller and pushed content through seam.
- expect(await page.evaluate(() => globalThis.__orcaBridgeReads)).toEqual([])
- expect(await page.evaluate(() => globalThis.__orcaCspViolations)).toEqual([])
- expect(consoleErrors).toEqual([])
- // No editor occlusion report: screen’s web module already measures viewport, so reporting twice would lift bar twice.
- expect(await page.evaluate(() => globalThis.__orcaEditor.insets)).toEqual([])
- } finally {
- await page.close()
- }
- }, 600_000)
-
- it('runs every one of the fifteen commands against the document', async () => {
- const { page, consoleErrors } = await openPage(browser)
- try {
- for (const [index, entry] of COMMANDS.entries()) {
- const body = bodyFor(index)
- await setContent(page, body, `
${body}
`)
- // Require command effect absent beforehand or undelivered command could pass on previous document.
- expect(
- await page.evaluate(
- (selector) =>
- document.querySelector('#first-surface #editor')?.querySelector(selector),
- entry.expect
- ),
- `${entry.label} was already applied before it ran`
- ).toBeNull()
- await select(page, entry.select)
- await press(page, entry.label)
- await page.waitForFunction(
- (selector) =>
- document.querySelector('#first-surface #editor')?.querySelector(selector) !==
- null,
- entry.expect,
- { timeout: 15_000 }
- )
- }
-
- // Paragraph must undo another block type; it is a no-op on p.
- await setContent(page, '# Title', '
Title
')
- await select(page, 'all')
- await press(page, PARAGRAPH.label)
- await page.waitForFunction(
- () =>
- document.querySelector('#first-surface #editor')?.querySelector('h1') === null &&
- document.querySelector('#first-surface #editor')?.querySelector('p') !== null,
- null,
- { timeout: 15_000 }
- )
-
- expect(await page.evaluate(() => globalThis.__orcaCspViolations)).toEqual([])
- expect(consoleErrors).toEqual([])
- } finally {
- await page.close()
- }
- }, 600_000)
-
// Both engines nest unordered list inside existing p; inline paragraph serialization once dropped bullet when saved.
- it('edits and selects under the shipped document style, which makes other text unselectable', async () => {
- const { page, consoleErrors } = await openPage(browser)
- try {
- await setContent(page, 'alpha', '
alpha
')
- const word = page.locator('#first-surface #editor p')
- await word.click()
- await page.keyboard.press('End')
- await page.keyboard.type(' bravo')
- await page.waitForFunction(
- () =>
- document.querySelector('#first-surface #editor p')?.textContent === 'alpha bravo'
- )
- // Use browser gesture: a scripted Range bypasses body user-select:none.
- await page.evaluate(() => window.getSelection()?.removeAllRanges())
- await word.dblclick()
- expect(await page.evaluate(() => window.getSelection()?.toString().trim())).not.toBe('')
- expect(consoleErrors).toEqual([])
- } finally {
- await page.close()
- }
- }, 600_000)
it('reports a typed bullet list as a list, and renders that markdown back as one', async () => {
const { page, consoleErrors } = await openPage(browser)
diff --git a/config/scripts/node-server/qualification/node-server-change-scope.test.mjs b/config/scripts/node-server/qualification/node-server-change-scope.test.mjs
index 29172c0ad5c..0818dcbded8 100644
--- a/config/scripts/node-server/qualification/node-server-change-scope.test.mjs
+++ b/config/scripts/node-server/qualification/node-server-change-scope.test.mjs
@@ -74,23 +74,6 @@ it('tracks workspace source and manifest closures without trusting dist or widen
).toBe(false)
})
-it('checks ordinary source unit files against actual imports before skipping the matrix', async () => {
- const reachable = 'src/main/persistence/example/used.test.ts'
- const unrelated = 'src/main/persistence/example/unrelated.test.tsx'
- const removed = 'src/main/persistence/example/removed.test.ts'
- const root = moduleTree({
- 'entry.ts': `import './${reachable}'; throw Error('never execute')`,
- [reachable]: 'export const value = 1',
- [unrelated]: 'throw Error("never execute unrelated test")'
- })
- const inputs = await collectNodeServerInputs({ root, entryPoints: ['entry.ts'] })
- expect(inputs.has(reachable)).toBe(true)
- expect(inputs.has(unrelated)).toBe(false)
- expect((await classifyNodeServerChanges([reachable], async () => inputs)).shouldRun).toBe(true)
- expect((await classifyNodeServerChanges([unrelated], async () => inputs)).shouldRun).toBe(false)
- expect((await classifyNodeServerChanges([removed], async () => inputs)).shouldRun).toBe(false)
-})
-
it('retains qualification when a removed ordinary unit file breaks an actual import', async () => {
const removed = 'src/main/persistence/example/removed.test.ts'
const root = moduleTree({ 'entry.ts': `import './${removed}'` })
diff --git a/config/scripts/node-server/qualification/node-server-qualification.mjs b/config/scripts/node-server/qualification/node-server-qualification.mjs
index a61db2145c0..6a70b26d9e2 100644
--- a/config/scripts/node-server/qualification/node-server-qualification.mjs
+++ b/config/scripts/node-server/qualification/node-server-qualification.mjs
@@ -21,8 +21,8 @@ const CROSS_HOST_PREFIXES = [
'src/main/ssh/',
'src/main/managed-server/',
'src/main/node-runtime/',
- 'src/main/orcad/orcad-artifact-materializer.ts',
- 'src/main/orcad/orcad-host-unavailable.ts',
+ 'src/main/orcad/artifact-slots/orcad-artifact-materializer.ts',
+ 'src/main/orcad/diagnostics/orcad-host-unavailable.ts',
'src/main/providers/',
'src/wsl-guest/'
]
diff --git a/config/scripts/node-server/qualification/node-server-test-paths.mjs b/config/scripts/node-server/qualification/node-server-test-paths.mjs
index 7ec2eeb38a5..8085092bebd 100644
--- a/config/scripts/node-server/qualification/node-server-test-paths.mjs
+++ b/config/scripts/node-server/qualification/node-server-test-paths.mjs
@@ -1,11 +1,11 @@
-/** Mirrors ORCA_REQUIRED_TEST_INPUTS_ENV in src/main/orcad/orcad-node-slot-fixture.ts. */
+/** Mirrors ORCA_REQUIRED_TEST_INPUTS_ENV in src/main/orcad/testing/native-slots/orcad-node-slot-fixture.ts. */
export const REQUIRED_TEST_INPUTS_ENV = 'ORCA_REQUIRED_TEST_INPUTS'
export const CROSS_RUNTIME_TEST_PATHS = []
// Need the built desktop server template; CI runs them by path after build-orcad-template.mjs.
export const TEMPLATE_TEST_PATHS = [
- 'src/main/orcad/orcad-packaged-structured-chat.integration.test.ts'
+ 'src/main/orcad/testing/structured-chat/orcad-packaged-structured-chat.integration.test.ts'
]
export function nodeServerTestPaths({
@@ -18,10 +18,10 @@ export function nodeServerTestPaths({
'src/main/persistence/loading-store/profile-writing/profile-state',
'src/main/sqlite',
// The orcad server's identity and stop path, which Windows SSH hosts rely on (W2).
- 'src/main/orcad/orcad-instance-lock.test.ts',
- 'src/main/orcad/orcad-process-start-time.test.ts',
- 'src/main/orcad/orcad-managed-stop.test.ts',
- 'src/main/orcad/orcad-managed-stop-cancellation.test.ts',
+ 'src/main/orcad/instance-lock/orcad-instance-lock.test.ts',
+ 'src/main/orcad/instance-lock/orcad-process-start-time.test.ts',
+ 'src/main/orcad/host-lifecycle/managed-stop/orcad-managed-stop.test.ts',
+ 'src/main/orcad/host-lifecycle/managed-stop/orcad-managed-stop-cancellation.test.ts',
// The directory, not a prefix: its siblings are POSIX-host unit tests pr.yml already runs.
'src/main/daemon/pty-subprocess/conpty-startup-input-reader.ts',
'src/main/daemon/pty-subprocess/daemon-pty-physical-owner.ts',
@@ -39,18 +39,17 @@ export function nodeServerTestPaths({
'src/main/daemon/pty-subprocess/spawn-preflight.ts',
'src/main/daemon/pty-subprocess/subprocess-handle.ts',
'src/main/daemon/pty-subprocess/testing/pty-subprocess-spawn-file-foreground.test.ts',
- 'src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-native.test.ts',
...(artifact
? [
'tests/e2e/daemon-running-work-probe.unit.test.ts',
'src/shared/terminal/pty/lifecycle/pty-running-work-probe.test.ts',
- 'src/main/orcad/orcad-packaged-node-pty.integration.test.ts',
+ 'src/main/orcad/native-runtime/orcad-packaged-node-pty.integration.test.ts',
'src/main/providers/agent-foreground-process-git-bash.win32.test.ts',
- 'src/main/orcad/orcad-cli-launcher.integration.test.ts',
- 'src/main/orcad/orcad-launcher-isolation.integration.test.ts',
- 'src/main/orcad/orcad-stop-request-shutdown.integration.test.ts',
- 'src/main/orcad/orcad-windows-conpty-breakaway.integration.test.ts',
- 'src/main/orcad/orcad-serve-parity.integration.test.ts',
+ 'src/main/orcad/serve-startup/orcad-cli-launcher.integration.test.ts',
+ 'src/main/orcad/runtime-launch/orcad-launcher-isolation.integration.test.ts',
+ 'src/main/orcad/host-lifecycle/managed-stop/orcad-stop-request-shutdown.integration.test.ts',
+ 'src/main/orcad/native-runtime/orcad-windows-conpty-breakaway.integration.test.ts',
+ 'src/main/orcad/testing/serve-lifecycle/orcad-serve-parity.integration.test.ts',
'config/scripts/archives/platform-command/zip-extractor-command.test.mjs'
]
: []),
diff --git a/config/scripts/orcad-distribution/server-bundle/orcad-entry-build.mjs b/config/scripts/orcad-distribution/server-bundle/orcad-entry-build.mjs
index 27c736a8faa..d08953600e9 100644
--- a/config/scripts/orcad-distribution/server-bundle/orcad-entry-build.mjs
+++ b/config/scripts/orcad-distribution/server-bundle/orcad-entry-build.mjs
@@ -22,13 +22,15 @@ export const ORCAD_CHILD_ENTRY_POINTS = {
backup: 'src/main/persistence/profile-state/backup/profile-state-backup-worker-entry.ts',
sessionSearch: 'src/main/ai-vault-search/worker/session-search-worker-entry.ts',
foreignSqliteReader: 'src/main/foreign-sqlite-readers/foreign-sqlite-reader-entry.ts',
+ agentIdentityWorker: 'src/main/agent-hooks/identity/agent-identity-worker-entry.ts',
portScanCommandWorker: 'src/main/ports/port-scan-command-worker-entry.ts',
commandPathDirectoryWorker: 'src/main/ipc/command-path/command-path-directory-worker-entry.ts',
sessionScanner: 'src/main/ai-vault/scan-service/session-scanner-service-entry.ts',
workerThreadChildProcess:
'src/main/worker-thread-child-process/worker-thread-child-process-entry.ts',
- claudeProfileSetup: 'src/main/claude-accounts/claude-profile-setup-worker-entry.ts',
- claudeConversationFork: 'src/main/claude/claude-conversation-fork-worker-entry.ts',
+ claudeProfileSetup:
+ 'src/main/claude-accounts/profiles/setup/claude-profile-setup-worker-entry.ts',
+ claudeConversationFork: 'src/main/claude/transcripts/claude-conversation-fork-worker-entry.ts',
sttWorker: 'src/main/speech/stt-worker.ts',
computerSidecar: 'src/main/computer/computer-sidecar.ts'
}
diff --git a/config/scripts/orcad-distribution/server-bundle/session-scanner-service-smoke.test.mjs b/config/scripts/orcad-distribution/server-bundle/session-scanner-service-smoke.test.mjs
deleted file mode 100644
index 60faa437f52..00000000000
--- a/config/scripts/orcad-distribution/server-bundle/session-scanner-service-smoke.test.mjs
+++ /dev/null
@@ -1,49 +0,0 @@
-import { build } from 'esbuild'
-import { mkdtempSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join, resolve } from 'node:path'
-import { afterAll, beforeAll, describe, expect, it } from 'vitest'
-import { smokeSessionScannerService } from './session-scanner-service-smoke.mjs'
-import {
- externalNativeAddons,
- ORCAD_CHILD_ENTRY_POINTS,
- ORCAD_EXTERNAL_MODULES,
- orcadChildOutputFilename
-} from './orcad-entry-build.mjs'
-
-const ENTRY = orcadChildOutputFilename(ORCAD_CHILD_ENTRY_POINTS.sessionScanner)
-const directories = []
-let builtDirectory
-
-function fixtureDirectory() {
- const directory = mkdtempSync(join(tmpdir(), 'orca-session-scanner-smoke-test-'))
- directories.push(directory)
- return directory
-}
-
-beforeAll(async () => {
- builtDirectory = fixtureDirectory()
- await build({
- entryPoints: [resolve(ORCAD_CHILD_ENTRY_POINTS.sessionScanner)],
- outfile: join(builtDirectory, ENTRY),
- bundle: true,
- platform: 'node',
- target: 'node18',
- format: 'cjs',
- external: ORCAD_EXTERNAL_MODULES,
- plugins: [externalNativeAddons],
- logLevel: 'silent'
- })
-}, 60_000)
-
-afterAll(() => {
- for (const directory of directories) {
- rmSync(directory, { recursive: true, force: true })
- }
-})
-
-describe('session scanner service build smoke', () => {
- it('lists a seeded session through the built entry', () => {
- expect(() => smokeSessionScannerService(builtDirectory)).not.toThrow()
- }, 60_000)
-})
diff --git a/config/scripts/orcad-distribution/template/compact-packaged-orcad-ripgrep.test.mjs b/config/scripts/orcad-distribution/template/compact-packaged-orcad-ripgrep.test.mjs
index b685476dd23..2313680fdd0 100644
--- a/config/scripts/orcad-distribution/template/compact-packaged-orcad-ripgrep.test.mjs
+++ b/config/scripts/orcad-distribution/template/compact-packaged-orcad-ripgrep.test.mjs
@@ -1,12 +1,12 @@
import { createHash } from 'node:crypto'
-import { existsSync } from 'node:fs'
-import { copyFile, mkdir, mkdtemp, readFile, rm, stat, symlink, writeFile } from 'node:fs/promises'
+import 'node:fs'
+import { copyFile, mkdir, mkdtemp, readFile, rm, symlink, writeFile } from 'node:fs/promises'
import { createRequire } from 'node:module'
import { tmpdir } from 'node:os'
-import { basename, dirname, join } from 'node:path'
+import { dirname, join } from 'node:path'
import { afterEach, describe, expect, it, vi } from 'vitest'
-import { assembleOrcadArtifact } from '../../../../src/main/orcad/orcad-artifact-materializer.ts'
-import { readOrcadArtifactIdentity } from '../../../../src/main/orcad/orcad-artifact-identity.ts'
+import '../../../../src/main/orcad/artifact-slots/orcad-artifact-materializer.ts'
+import '../../../../src/main/orcad/artifact-slots/orcad-artifact-identity.ts'
import {
ORCAD_TEMPLATE_MANIFEST_FILENAME,
orcadRipgrepArtifact
@@ -46,63 +46,6 @@ async function fixture() {
}
describe('packaged ripgrep storage', () => {
- it('preserves every deployed slot byte and version, including old schema 3 templates', async () => {
- const f = await fixture()
- const original = new Map()
- const cacheRoot = join(f.appDir, 'cache')
- for (const target of Object.keys(f.manifest.targets)) {
- const slot = await assembleOrcadArtifact({ templateDir: f.templateDir, cacheRoot, target })
- original.set(target, basename(slot))
- }
- expect(compactPackagedOrcadRipgrep(f.resourcesDir)).toBeGreaterThan(0)
- expect(compactPackagedOrcadRipgrep(f.resourcesDir)).toBe(0)
- for (const target of Object.keys(f.manifest.targets)) {
- const slot = await assembleOrcadArtifact({
- templateDir: f.templateDir,
- cacheRoot: join(f.appDir, 'fresh-cache'),
- target
- })
- expect(basename(slot)).toBe(original.get(target))
- expect(await readOrcadArtifactIdentity(slot)).toBe(original.get(target))
- const filename = orcadRipgrepArtifact(target)
- expect(await readFile(join(slot, filename))).toEqual(
- await readFile(join(f.resourcesDir, filename))
- )
- if (process.platform !== 'win32' && !target.startsWith('win32-')) {
- expect((await stat(join(slot, filename))).mode & 0o777).toBe(0o755)
- }
- expect(existsSync(join(f.templateDir, 'targets', target, filename))).toBe(
- target.startsWith('darwin-')
- )
- }
- // No template storage schema reaches the deployment slot.
- expect(
- existsSync(
- join(
- cacheRoot,
- 'linux-x64-glibc',
- original.get('linux-x64-glibc'),
- ORCAD_TEMPLATE_MANIFEST_FILENAME
- )
- )
- ).toBe(false)
- })
-
- it('keeps binaries that differ and never removes Darwin signing inputs', async () => {
- const f = await fixture()
- const desktop = join(f.resourcesDir, 'ripgrep/linux-arm64/rg')
- await writeFile(desktop, 'different desktop bytes')
- compactPackagedOrcadRipgrep(f.resourcesDir)
- const manifest = JSON.parse(await readFile(f.manifestPath, 'utf8'))
- expect(manifest.schemaVersion).toBe(4)
- for (const [target, entry] of Object.entries(manifest.targets)) {
- expect(entry.packagedRipgrep).toBe(
- target.startsWith('darwin-') || target.startsWith('linux-arm64') ? undefined : true
- )
- }
- expect(await readFile(desktop, 'utf8')).toBe('different desktop bytes')
- })
-
it('does not launder corrupted target bytes while removing duplicates', async () => {
const f = await fixture()
await writeFile(join(f.templateDir, 'targets/linux-x64-glibc/ripgrep/linux-x64/rg'), 'tampered')
diff --git a/config/scripts/orcad-distribution/template/packaged-orcad-browser.test.mjs b/config/scripts/orcad-distribution/template/packaged-orcad-browser.test.mjs
deleted file mode 100644
index 85aa5737ee6..00000000000
--- a/config/scripts/orcad-distribution/template/packaged-orcad-browser.test.mjs
+++ /dev/null
@@ -1,69 +0,0 @@
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
-import { createRequire } from 'node:module'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import { assembleOrcadArtifact } from '../../../../src/main/orcad/orcad-artifact-materializer.ts'
-import { ORCAD_TEMPLATE_MANIFEST_FILENAME } from '../../../../src/shared/orcad-artifacts.ts'
-import { writeOrcadTemplateTestFixture } from './orcad-template-test-fixture.mjs'
-
-const require = createRequire(import.meta.url)
-const {
- finalizePackagedOrcadTemplate,
- resealSignedWindowsApp
-} = require('./packaged-orcad-template.cjs')
-const roots = []
-
-afterEach(async () => {
- vi.restoreAllMocks()
- await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
-})
-
-async function packagedApp() {
- vi.spyOn(console, 'log').mockImplementation(() => {})
- const appDir = await mkdtemp(join(tmpdir(), 'orca-packaged-browser-'))
- roots.push(appDir)
- const resourcesDir = join(appDir, 'resources')
- const templateDir = await writeOrcadTemplateTestFixture(resourcesDir)
- const driver = join(resourcesDir, 'agent-browser-win32-x64.exe')
- await writeFile(driver, 'desktop driver')
- await finalizePackagedOrcadTemplate(resourcesDir, { platform: 'win32', signMacBinary: vi.fn() })
- return {
- appDir,
- templateDir,
- driver,
- manifestPath: join(templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME)
- }
-}
-
-describe("packaged orcad uses the app's agent-browser driver (#33846)", () => {
- it("materializes the host target's slot with the driver the app ships", async () => {
- const app = await packagedApp()
- const slot = await assembleOrcadArtifact({
- templateDir: app.templateDir,
- cacheRoot: join(app.appDir, 'cache'),
- target: 'win32-x64'
- })
- expect(await readFile(join(slot, 'agent-browser-win32-x64.exe'), 'utf8')).toBe('desktop driver')
- // A target that carries its own copy keeps it.
- const manifest = JSON.parse(await readFile(app.manifestPath, 'utf8'))
- expect(manifest.targets['linux-x64-glibc'].packagedBrowser).toBeUndefined()
- expect(manifest.targets['win32-arm64'].browserName).toBeUndefined()
- })
-
- it('reseals the driver after SignPath rewrites it', async () => {
- const app = await packagedApp()
- await writeFile(app.driver, 'authenticode-signed driver')
- const list = join(app.appDir, 'inner-signing-list.txt')
- await writeFile(list, 'Orca.exe\r\nresources\\agent-browser-win32-x64.exe\r\n')
- resealSignedWindowsApp(app.appDir, list)
- const slot = await assembleOrcadArtifact({
- templateDir: app.templateDir,
- cacheRoot: join(app.appDir, 'cache'),
- target: 'win32-x64'
- })
- expect(await readFile(join(slot, 'agent-browser-win32-x64.exe'), 'utf8')).toBe(
- 'authenticode-signed driver'
- )
- })
-})
diff --git a/config/scripts/performance/check-job-log/check-job-log-consumer-oracles.mjs b/config/scripts/performance/check-job-log/check-job-log-consumer-oracles.mjs
index db333fd5888..9492a3be936 100644
--- a/config/scripts/performance/check-job-log/check-job-log-consumer-oracles.mjs
+++ b/config/scripts/performance/check-job-log/check-job-log-consumer-oracles.mjs
@@ -13,7 +13,7 @@ export async function loadAnsiConsumers(root = process.cwd()) {
'restoredSnapshotPaintsPrintableContent',
'renderer/src/components/terminal-pane/snapshots/restored-snapshot-coverage'
],
- ['parseCodexLoginAuthUrl', 'main/codex-accounts/codex-login-auth-url'],
+ ['parseCodexLoginAuthUrl', 'main/codex-accounts/login/codex-login-auth-url'],
['TerminalCommandPaint', 'main/runtime/terminal/input/terminal-command-paint'],
['claudePermissionSubject', 'main/claude/claude-permission-presentation'],
['terminalSafe', 'shared/terminal/output/terminal-safe-text']
diff --git a/config/scripts/performance/mobile-projection/mobile-linear-group-sorted-benchmark.mjs b/config/scripts/performance/mobile-projection/mobile-linear-group-sorted-benchmark.mjs
index fb4df6d2af7..9c68f0c1f56 100644
--- a/config/scripts/performance/mobile-projection/mobile-linear-group-sorted-benchmark.mjs
+++ b/config/scripts/performance/mobile-projection/mobile-linear-group-sorted-benchmark.mjs
@@ -14,7 +14,12 @@ if (!baseline) {
}
async function load(file, contents) {
const result = await build({
- stdin: { contents, loader: 'ts', resolveDir: dirname(resolve(file)) },
+ stdin: {
+ contents,
+ sourcefile: resolve(file),
+ loader: 'ts',
+ resolveDir: dirname(resolve(file))
+ },
bundle: true,
platform: 'node',
format: 'esm',
@@ -28,6 +33,23 @@ async function load(file, contents) {
bundler.onResolve({ filter: /mobile-tasks-dependencies$/ }, () => ({
path: resolve('mobile/src/theme/mobile-theme.ts')
}))
+ const relocatedImports = new Map([
+ [
+ resolve('mobile/src/tasks/mobile-tasks-hosted-review'),
+ resolve('mobile/src/tasks/hosted-review/mobile-tasks-hosted-review.ts')
+ ],
+ [
+ resolve('mobile/src/tasks/mobile-tasks-item-mapping'),
+ resolve('mobile/src/tasks/item-detail/mobile-tasks-item-mapping.ts')
+ ]
+ ])
+ bundler.onResolve({ filter: /^\./ }, (args) => {
+ if (args.importer !== resolve(originalFile)) {
+ return
+ }
+ const target = relocatedImports.get(resolve(args.resolveDir, args.path))
+ return target ? { path: target } : undefined
+ })
}
}
]
@@ -36,17 +58,24 @@ async function load(file, contents) {
`data:text/javascript;base64,${Buffer.from(result.outputFiles[0].text).toString('base64')}`
)
}
-const file = 'mobile/src/tasks/mobile-tasks-reviewer-linear.ts'
+const originalFile = 'mobile/src/tasks/mobile-tasks-reviewer-linear.ts'
+const file = 'mobile/src/tasks/item-detail/mobile-tasks-reviewer-linear.ts'
const original = await load(
- file,
- execFileSync('git', ['show', `${baseline}:${file}`], { encoding: 'utf8', windowsHide: true })
+ originalFile,
+ execFileSync('git', ['show', `${baseline}:${originalFile}`], {
+ encoding: 'utf8',
+ windowsHide: true
+ })
)
const current = await load(file, readFileSync(file, 'utf8'))
const sorterRef = process.argv[3]
const sorter = sorterRef
? await load(
- file,
- execFileSync('git', ['show', `${sorterRef}:${file}`], { encoding: 'utf8', windowsHide: true })
+ originalFile,
+ execFileSync('git', ['show', `${sorterRef}:${originalFile}`], {
+ encoding: 'utf8',
+ windowsHide: true
+ })
)
: original
const results = []
diff --git a/config/scripts/performance/mobile-projection/mobile-linear-sort-benchmark.mjs b/config/scripts/performance/mobile-projection/mobile-linear-sort-benchmark.mjs
index 7a9c0107f89..4c97acd0fa0 100644
--- a/config/scripts/performance/mobile-projection/mobile-linear-sort-benchmark.mjs
+++ b/config/scripts/performance/mobile-projection/mobile-linear-sort-benchmark.mjs
@@ -14,7 +14,12 @@ if (!baseline) {
}
async function load(file, contents) {
const result = await build({
- stdin: { contents, loader: 'ts', resolveDir: dirname(resolve(file)) },
+ stdin: {
+ contents,
+ sourcefile: resolve(file),
+ loader: 'ts',
+ resolveDir: dirname(resolve(file))
+ },
bundle: true,
platform: 'node',
format: 'esm',
@@ -28,6 +33,23 @@ async function load(file, contents) {
bundler.onResolve({ filter: /mobile-tasks-dependencies$/ }, () => ({
path: resolve('mobile/src/theme/mobile-theme.ts')
}))
+ const relocatedImports = new Map([
+ [
+ resolve('mobile/src/tasks/mobile-tasks-hosted-review'),
+ resolve('mobile/src/tasks/hosted-review/mobile-tasks-hosted-review.ts')
+ ],
+ [
+ resolve('mobile/src/tasks/mobile-tasks-item-mapping'),
+ resolve('mobile/src/tasks/item-detail/mobile-tasks-item-mapping.ts')
+ ]
+ ])
+ bundler.onResolve({ filter: /^\./ }, (args) => {
+ if (args.importer !== resolve(originalFile)) {
+ return
+ }
+ const target = relocatedImports.get(resolve(args.resolveDir, args.path))
+ return target ? { path: target } : undefined
+ })
}
}
]
@@ -36,10 +58,11 @@ async function load(file, contents) {
`data:text/javascript;base64,${Buffer.from(result.outputFiles[0].text).toString('base64')}`
)
}
-const file = 'mobile/src/tasks/mobile-tasks-reviewer-linear.ts'
+const originalFile = 'mobile/src/tasks/mobile-tasks-reviewer-linear.ts'
+const file = 'mobile/src/tasks/item-detail/mobile-tasks-reviewer-linear.ts'
const before = await load(
- file,
- execFileSync('git', ['show', `${baseline}:${file}`], { encoding: 'utf8' })
+ originalFile,
+ execFileSync('git', ['show', `${baseline}:${originalFile}`], { encoding: 'utf8' })
)
const after = await load(file, readFileSync(file, 'utf8'))
const results = []
diff --git a/config/scripts/performance/mobile-projection/mobile-task-sort-benchmark.mjs b/config/scripts/performance/mobile-projection/mobile-task-sort-benchmark.mjs
index 2fc4788dc85..06c433cc7c1 100644
--- a/config/scripts/performance/mobile-projection/mobile-task-sort-benchmark.mjs
+++ b/config/scripts/performance/mobile-projection/mobile-task-sort-benchmark.mjs
@@ -14,7 +14,12 @@ if (!baseline) {
}
async function load(file, contents) {
const result = await build({
- stdin: { contents, loader: 'ts', resolveDir: dirname(resolve(file)) },
+ stdin: {
+ contents,
+ sourcefile: resolve(file),
+ loader: 'ts',
+ resolveDir: dirname(resolve(file))
+ },
bundle: true,
platform: 'node',
format: 'esm',
@@ -28,6 +33,19 @@ async function load(file, contents) {
bundler.onResolve({ filter: /mobile-tasks-dependencies$/ }, () => ({
path: resolve('mobile/src/theme/mobile-theme.ts')
}))
+ const relocatedImports = new Map([
+ [
+ resolve('mobile/src/tasks/mobile-tasks-item-mapping'),
+ resolve('mobile/src/tasks/item-detail/mobile-tasks-item-mapping.ts')
+ ]
+ ])
+ bundler.onResolve({ filter: /^\./ }, (args) => {
+ if (args.importer !== resolve(originalFile)) {
+ return
+ }
+ const target = relocatedImports.get(resolve(args.resolveDir, args.path))
+ return target ? { path: target } : undefined
+ })
}
}
]
@@ -36,10 +54,11 @@ async function load(file, contents) {
`data:text/javascript;base64,${Buffer.from(result.outputFiles[0].text).toString('base64')}`
)
}
-const file = 'mobile/src/tasks/mobile-tasks-repository-presentation.ts'
+const originalFile = 'mobile/src/tasks/mobile-tasks-repository-presentation.ts'
+const file = 'mobile/src/tasks/repositories/mobile-tasks-repository-presentation.ts'
const before = await load(
- file,
- execFileSync('git', ['show', `${baseline}:${file}`], { encoding: 'utf8' })
+ originalFile,
+ execFileSync('git', ['show', `${baseline}:${originalFile}`], { encoding: 'utf8' })
)
const after = await load(file, readFileSync(file, 'utf8'))
const repos = new Map()
diff --git a/config/scripts/performance/session-transcripts/session-dedup-batches-benchmark.mjs b/config/scripts/performance/session-transcripts/session-dedup-batches-benchmark.mjs
index 44a0bbd187c..6dac3efbbf3 100644
--- a/config/scripts/performance/session-transcripts/session-dedup-batches-benchmark.mjs
+++ b/config/scripts/performance/session-transcripts/session-dedup-batches-benchmark.mjs
@@ -5,7 +5,7 @@ import { buildCounterbalancedSchedule } from '../measurement/counterbalanced-ben
const bundled = await build({
stdin: {
- contents: "export * from './src/main/ai-vault/session-root-dedup.ts'",
+ contents: "export * from './src/main/ai-vault/parsing/session-root-dedup.ts'",
resolveDir: process.cwd(),
loader: 'ts'
},
diff --git a/config/scripts/performance/session-transcripts/session-scan-cutoff-benchmark.mjs b/config/scripts/performance/session-transcripts/session-scan-cutoff-benchmark.mjs
index b7311577324..07e54291087 100644
--- a/config/scripts/performance/session-transcripts/session-scan-cutoff-benchmark.mjs
+++ b/config/scripts/performance/session-transcripts/session-scan-cutoff-benchmark.mjs
@@ -32,10 +32,10 @@ async function load(contents) {
return import(`data:text/javascript;base64,${encoded}`)
}
const [baselineModule, currentModule] = await Promise.all([
- load(`import { sessionSortTime } from './session-scanner-accumulator';
+ load(`import { sessionSortTime } from './parsing/session-scanner-accumulator';
export ${baselineFunction.getText(baselineSource)}`),
- load(`export { canStopParsingSessions } from './session-scan-cutoff';
-export { ScannedSessionCollection } from './session-root-dedup';`)
+ load(`export { canStopParsingSessions } from './parsing/session-scan-cutoff';
+export { ScannedSessionCollection } from './parsing/session-root-dedup';`)
])
const baseline = baselineModule.canStopParsingSessions
const current = currentModule.canStopParsingSessions
diff --git a/config/scripts/performance/session-transcripts/session-timeline-benchmark.mjs b/config/scripts/performance/session-transcripts/session-timeline-benchmark.mjs
index 7e53173fcaf..71373dbab13 100644
--- a/config/scripts/performance/session-transcripts/session-timeline-benchmark.mjs
+++ b/config/scripts/performance/session-transcripts/session-timeline-benchmark.mjs
@@ -1,28 +1,81 @@
import assert from 'node:assert/strict'
import { readFileSync } from 'node:fs'
-import { dirname, resolve } from 'node:path'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
import { performance } from 'node:perf_hooks'
import { build } from 'esbuild'
import { buildCounterbalancedSchedule } from '../measurement/counterbalanced-benchmark-schedule.mjs'
import { summarizeBenchmarkSamples } from '../measurement/benchmark-sample-summary.mjs'
+import ts from 'typescript-api'
+
+const baselineSourcePathArgument = process.argv.find((arg) =>
+ arg.startsWith('--baseline-source-path=')
+)
+const baselineSourcePath = resolve(
+ baselineSourcePathArgument?.slice('--baseline-source-path='.length) ??
+ 'src/main/ai-vault/session-scanner-accumulator.ts'
+)
+
+function retargetLegacyAccumulatorValueImports(source) {
+ const program = ts.createSourceFile(baselineSourcePath, source, ts.ScriptTarget.Latest, true)
+ assert.equal(program.parseDiagnostics.length, 0, 'Baseline source must parse')
+ const replacements = []
+ for (const statement of program.statements) {
+ if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier)) {
+ continue
+ }
+ if (
+ resolve(dirname(baselineSourcePath), statement.moduleSpecifier.text) !==
+ resolve('src/main/ai-vault/session-scanner-values')
+ ) {
+ continue
+ }
+ const clause = statement.importClause
+ assert(
+ clause && !clause.name && clause.namedBindings && ts.isNamedImports(clause.namedBindings)
+ )
+ const imports = clause.namedBindings.elements.map((binding) => {
+ const name = (binding.propertyName ?? binding.name).text
+ const owner =
+ name === 'extractString'
+ ? 'src/shared/trimmed-string.ts'
+ : name === 'timestampMs'
+ ? 'src/main/ai-vault/parsing/session-record-time.ts'
+ : null
+ assert(owner, `Unsupported historical accumulator value import: ${name}`)
+ return `import ${clause.isTypeOnly ? 'type ' : ''}{ ${binding.getText(program)} } from ${JSON.stringify(resolve(owner))}`
+ })
+ replacements.push({
+ start: statement.getStart(program),
+ end: statement.end,
+ text: imports.join('\n')
+ })
+ }
+ for (const replacement of replacements.toReversed()) {
+ source = source.slice(0, replacement.start) + replacement.text + source.slice(replacement.end)
+ }
+ return source
+}
// git show :src/main/ai-vault/session-scanner-accumulator.ts | node config/scripts/session-timeline-benchmark.mjs
-const target = resolve('src/main/ai-vault/session-scanner-accumulator.ts')
-async function load(source) {
+const target = resolve('src/main/ai-vault/parsing/session-scanner-accumulator.ts')
+async function load(source, sourcePath = target) {
const result = await build({
stdin: {
contents: `
export {createAccumulator, cloneSessionAccumulator, updateTimeline, finalizeSession}
from './session-scanner-accumulator';
export {createClaudeSessionParseState, consumeClaudeSessionLine}
- from './session-scanner-primary-parsers';`,
+ from '../scanners/claude/session-scanner-primary-parsers';`,
loader: 'ts',
resolveDir: dirname(target)
},
bundle: true,
write: false,
platform: 'node',
- format: 'esm',
+ format: 'cjs',
plugins: [
{
name: 'timeline-baseline',
@@ -30,18 +83,26 @@ async function load(source) {
plugin.onLoad({ filter: /session-scanner-accumulator\.ts$/ }, () => ({
contents: source,
loader: 'ts',
- resolveDir: dirname(target)
+ resolveDir: dirname(sourcePath)
}))
}
}
]
})
- return import(
- `data:text/javascript;base64,${Buffer.from(result.outputFiles[0].text).toString('base64')}`
- )
+ const directory = await mkdtemp(join(tmpdir(), 'orca-session-timeline-'))
+ try {
+ const file = join(directory, 'timeline.cjs')
+ await writeFile(file, result.outputFiles[0].text)
+ return createRequire(import.meta.url)(file)
+ } finally {
+ await rm(directory, { recursive: true, force: true })
+ }
}
const implementations = {
- before: await load(readFileSync(0, 'utf8')),
+ before: await load(
+ retargetLegacyAccumulatorValueImports(readFileSync(0, 'utf8')),
+ baselineSourcePath
+ ),
after: await load(readFileSync(target, 'utf8'))
}
const file = { path: 'timeline.jsonl', mtimeMs: 0, modifiedAt: '2026-01-01T00:00:00.000Z' }
diff --git a/config/scripts/performance/session-transcripts/transcript-stream-fragments-benchmark.mjs b/config/scripts/performance/session-transcripts/transcript-stream-fragments-benchmark.mjs
index 786d1e8d047..28605ad332e 100644
--- a/config/scripts/performance/session-transcripts/transcript-stream-fragments-benchmark.mjs
+++ b/config/scripts/performance/session-transcripts/transcript-stream-fragments-benchmark.mjs
@@ -6,7 +6,7 @@ import { performance } from 'node:perf_hooks'
import { build } from 'esbuild'
import { buildCounterbalancedSchedule } from '../measurement/counterbalanced-benchmark-schedule.mjs'
-const modulePath = 'src/main/native-chat/transcript-stream-lines.ts'
+const modulePath = 'src/main/native-chat/transcript-streaming/transcript-stream-lines.ts'
const baselineSource = readFileSync(0, 'utf8')
assert.ok(baselineSource.includes('decodeTranscriptStream'), 'Pipe the baseline module on stdin')
const arms = {}
diff --git a/config/scripts/performance/terminal-stream/terminal-output-frame-chunk-benchmark.mjs b/config/scripts/performance/terminal-stream/terminal-output-frame-chunk-benchmark.mjs
index 3869c703a5f..555e1bc69cb 100644
--- a/config/scripts/performance/terminal-stream/terminal-output-frame-chunk-benchmark.mjs
+++ b/config/scripts/performance/terminal-stream/terminal-output-frame-chunk-benchmark.mjs
@@ -50,7 +50,10 @@ if (ROUNDS % 2 !== 0) {
}
const CHUNK_SOURCE = readFileSync(
- new URL('../../../../src/main/runtime/rpc/terminal-output-frame-chunks.ts', import.meta.url),
+ new URL(
+ '../../../../src/main/runtime/rpc/terminal/terminal-output-frame-chunks.ts',
+ import.meta.url
+ ),
'utf8'
)
@@ -101,7 +104,10 @@ const { TerminalStreamOpcode, encodeTerminalStreamJson, encodeTerminalStreamText
.href
)
const { exceedsTerminalStreamChunkBytes, iterateTerminalOutputFrameChunks } = await import(
- new URL('../../../../src/main/runtime/rpc/terminal-output-frame-chunks.ts', import.meta.url).href
+ new URL(
+ '../../../../src/main/runtime/rpc/terminal/terminal-output-frame-chunks.ts',
+ import.meta.url
+ ).href
)
function previousGate(data) {
diff --git a/config/scripts/performance/terminal-stream/terminal-shutdown-byte-limit-benchmark.mjs b/config/scripts/performance/terminal-stream/terminal-shutdown-byte-limit-benchmark.mjs
index 874600c3049..7eed0f984b9 100644
--- a/config/scripts/performance/terminal-stream/terminal-shutdown-byte-limit-benchmark.mjs
+++ b/config/scripts/performance/terminal-stream/terminal-shutdown-byte-limit-benchmark.mjs
@@ -44,7 +44,7 @@ const layoutFunctions = layoutAst.statements.filter(
assert.equal(layoutFunctions.length, layoutNames.length)
const layoutSubset = `import { isTerminalLeafId } from ${JSON.stringify(path.resolve('src/shared/workspace-layout/stable-pane-id.ts'))};
import { readSplitRatio } from '@/lib/pane-manager/pane-layout/pane-split-ratio';
-import { SPLIT_RATIO_TOLERANCE } from ${JSON.stringify(path.resolve('src/shared/workspace-layout/terminal-pane-tree.ts'))};
+import { SPLIT_RATIO_TOLERANCE } from ${JSON.stringify(path.resolve('src/shared/workspace-layout/terminal-topology/terminal-pane-tree.ts'))};
${layoutFunctions.map((node) => node.getText(layoutAst)).join('\n')}`
async function load(source) {
@@ -65,6 +65,11 @@ async function load(source) {
resolveDir: path.dirname(entry)
}))
// Historical inputs keep their bodies while imports select this checkout's defining owners.
+ builder.onResolve({ filter: /(?:^|[/\\])terminal-pane-layout-tree$/ }, () => ({
+ path: path.resolve(
+ 'src/shared/workspace-layout/terminal-topology/terminal-pane-layout-tree.ts'
+ )
+ }))
builder.onResolve({ filter: /^(?:\.\.\/)+shared\// }, (args) => {
const target = path.resolve('src/shared', args.path.split('/shared/')[1])
return { path: existsSync(target) ? target : `${target}.ts` }
diff --git a/config/scripts/performance/terminal-stream/terminal-stream-byte-length-benchmark.mjs b/config/scripts/performance/terminal-stream/terminal-stream-byte-length-benchmark.mjs
index 85d0ce1da1d..493290c7b11 100644
--- a/config/scripts/performance/terminal-stream/terminal-stream-byte-length-benchmark.mjs
+++ b/config/scripts/performance/terminal-stream/terminal-stream-byte-length-benchmark.mjs
@@ -68,7 +68,10 @@ const {
measureTerminalStreamByteLength,
terminalStreamByteLengthExceeds
} = await import(
- new URL('../../../../src/main/runtime/rpc/terminal-stream-byte-length.ts', import.meta.url).href
+ new URL(
+ '../../../../src/main/runtime/rpc/terminal/terminal-stream-byte-length.ts',
+ import.meta.url
+ ).href
)
const REQUESTED_SNAPSHOT_BYTE_BUDGET = (() => {
diff --git a/config/scripts/performance/transport/cli-runtime-client-deferral-benchmark.mjs b/config/scripts/performance/transport/cli-runtime-client-deferral-benchmark.mjs
deleted file mode 100644
index 21e3e86cabc..00000000000
--- a/config/scripts/performance/transport/cli-runtime-client-deferral-benchmark.mjs
+++ /dev/null
@@ -1,258 +0,0 @@
-#!/usr/bin/env node
-// Compare real CLI emits before/after deferring RuntimeClient’s Zod/ws/tweetnacl/store graph until after flag validation.
-// Restore seven baseline files; use fresh processes to measure cold graphs, alternate arm order, and verify output/exit equality before timing.
-import { execFileSync, spawnSync } from 'node:child_process'
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { performance } from 'node:perf_hooks'
-import { fileURLToPath } from 'node:url'
-
-const REPO = fileURLToPath(new URL('../../../..', import.meta.url))
-
-const ROUNDS = Number(process.env.ORCA_CLI_DEFER_BENCH_ROUNDS ?? '30')
-const WARMUP = Number(process.env.ORCA_CLI_DEFER_BENCH_WARMUP ?? '3')
-
-for (const [name, value] of [
- ['ORCA_CLI_DEFER_BENCH_ROUNDS', ROUNDS],
- ['ORCA_CLI_DEFER_BENCH_WARMUP', WARMUP]
-]) {
- if (!Number.isSafeInteger(value) || value <= 0) {
- throw new Error(`${name} must be a positive integer, received ${value}`)
- }
-}
-if (ROUNDS % 2 !== 0) {
- // Why: arms alternate which one leads; an odd count biases one arm.
- throw new Error(`ORCA_CLI_DEFER_BENCH_ROUNDS must be even, received ${ROUNDS}`)
-}
-
-const TOUCHED = [
- 'src/cli/args.ts',
- 'src/cli/dispatch.ts',
- 'src/cli/flags.ts',
- 'src/cli/format.ts',
- 'src/cli/index.ts',
- 'src/cli/runtime/client.ts',
- 'src/cli/selectors.ts'
-]
-
-// Re-read production call forms so reverting deferral cannot make both arms identical; prose mentions must not satisfy the guard.
-function assertMarkersFresh() {
- const checks = [
- ['src/cli/index.ts', "await import('./runtime-client.js')"],
- ['src/cli/index.ts', 'await loadRuntimeClientClass()'],
- ['src/cli/index.ts', "import type { RuntimeClient } from './runtime-client'"],
- ['src/cli/runtime/client.ts', "await import('./websocket-transport.js')"],
- ['src/cli/runtime/client.ts', 'await loadSendWebSocketRequest()'],
- ['src/cli/args.ts', "import { RuntimeClientError } from './runtime/types'"],
- ['src/cli/flags.ts', "import { RuntimeClientError } from './runtime/types'"],
- ['src/cli/dispatch.ts', "import { RuntimeClientError } from './runtime/types'"],
- ['src/cli/selectors.ts', "import { RuntimeClientError } from './runtime/types'"],
- ['src/cli/format.ts', "} from './runtime/types'"]
- ]
- for (const [file, marker] of checks) {
- if (!readFileSync(join(REPO, file), 'utf8').includes(marker)) {
- throw new Error(
- `${file} no longer contains \`${marker}\` — cli-runtime-client-deferral-benchmark.mjs is stale`
- )
- }
- }
-}
-
-function buildArm(label, baselineRev) {
- // Build inside repo so emitted modules resolve its node_modules.
- const outDir = join(REPO, `.bench-out-${label}`)
- rmSync(outDir, { recursive: true, force: true })
- const restore = []
- try {
- if (baselineRev) {
- for (const file of TOUCHED) {
- const path = join(REPO, file)
- restore.push([path, readFileSync(path)])
- writeFileSync(
- path,
- execFileSync('git', ['show', `${baselineRev}:${file}`], {
- cwd: REPO,
- maxBuffer: 64 * 1024 * 1024
- })
- )
- }
- }
- execFileSync(
- 'npx',
- [
- 'tsc',
- '-p',
- 'config/tsconfig.cli.json',
- '--outDir',
- outDir,
- '--composite',
- 'false',
- '--incremental',
- 'false'
- ],
- { cwd: REPO, stdio: 'inherit' }
- )
- } finally {
- for (const [path, contents] of restore) {
- writeFileSync(path, contents)
- }
- }
- return join(outDir, 'cli/index.js')
-}
-
-function run(entry, argv, env) {
- const result = spawnSync(process.execPath, [entry, ...argv], {
- cwd: REPO,
- env: { ...process.env, ...env },
- encoding: 'buffer'
- })
- if (result.error) {
- throw result.error
- }
- return {
- status: result.status,
- stdout: result.stdout.toString('utf8'),
- stderr: result.stderr.toString('utf8')
- }
-}
-
-// Count eager CJS graph in a child via Module._load, measuring the graph deferral actually moves.
-function countEagerModules(entry) {
- const probe = `
- const Module = require('module')
- const original = Module._load
- const seen = new Set()
- Module._load = function (request, parent, isMain) {
- try { seen.add(Module._resolveFilename(request, parent, isMain)) } catch { seen.add(request) }
- return original.apply(this, arguments)
- }
- require(${JSON.stringify(entry)})
- const all = [...seen]
- process.stdout.write(JSON.stringify({
- total: all.length,
- nodeModules: all.filter((p) => p.includes('node_modules')).length
- }))
- `
- const result = spawnSync(process.execPath, ['-e', probe], { cwd: REPO, encoding: 'utf8' })
- if (result.status !== 0) {
- throw new Error(`module probe failed: ${result.stderr}`)
- }
- return JSON.parse(result.stdout)
-}
-
-const median = (values) => {
- const sorted = [...values].sort((a, b) => a - b)
- return sorted[Math.floor(sorted.length / 2)]
-}
-
-const baselineIndex = process.argv.indexOf('--baseline')
-const baselineRev = baselineIndex === -1 ? 'HEAD' : process.argv[baselineIndex + 1]
-
-assertMarkersFresh()
-
-const userDataPath = mkdtempSync(join(REPO, '.bench-userdata-'))
-
-try {
- console.log(`Building eager baseline (${baselineRev}) …`)
- const eagerEntry = buildArm('eager', baselineRev)
- console.log('Building deferred (working tree) …')
- const deferredEntry = buildArm('deferred', null)
-
- const eagerGraph = countEagerModules(eagerEntry)
- const deferredGraph = countEagerModules(deferredEntry)
- console.log(
- `\nEager modules at process load: ${eagerGraph.total} -> ${deferredGraph.total} ` +
- `(node_modules ${eagerGraph.nodeModules} -> ${deferredGraph.nodeModules})`
- )
- if (deferredGraph.total >= eagerGraph.total) {
- throw new Error(
- 'deferred arm loads no fewer modules — the fixture does not exercise the change'
- )
- }
-
- // Use empty user-data dirs for deterministic runtime-dependent cases.
- const isolated = { ORCA_USER_DATA_PATH: userDataPath }
- /** @type {Array<[string, string[], Record]>} */
- const cases = [
- ['orca --help', ['--help'], {}],
- ['orca help worktree', ['help', 'worktree'], {}],
- ['orca (no args)', [], {}],
- ['unknown command', ['no-such-command'], {}],
- ['unknown flag', ['worktree', 'list', '--nope'], {}],
- ['orca agent-context --json', ['agent-context', '--json'], {}],
- ['orca status --json', ['status', '--json'], isolated],
- ['orca worktree list --json', ['worktree', 'list', '--json'], isolated]
- ]
-
- // Compare output/exit before timing or a broken arm printing nothing appears fastest.
- for (const [label, argv, env] of cases) {
- const before = run(eagerEntry, argv, env)
- const after = run(deferredEntry, argv, env)
- if (
- before.status !== after.status ||
- before.stdout !== after.stdout ||
- before.stderr !== after.stderr
- ) {
- throw new Error(`arms disagree for "${label}" — refusing to report a timing`)
- }
- if (before.stdout.length + before.stderr.length === 0) {
- throw new Error(`"${label}" produced no output on either arm; it proves nothing`)
- }
- }
-
- const pad = (value, width) => String(value).padStart(width)
- console.log('\nFresh process per sample, wall clock. Lower is better.')
- console.log(`rounds=${ROUNDS} warmup=${WARMUP} (per-arm median, arms alternate lead)`)
- console.log(`${pad('case', 26)} ${pad('eager', 10)} ${pad('deferred', 10)} ${pad('speedup', 9)}`)
-
- // Accumulated so V8 cannot treat the spawn loop as dead code.
- let consumed = 0
-
- for (const [label, argv, env] of cases) {
- for (let index = 0; index < WARMUP; index += 1) {
- consumed += run(eagerEntry, argv, env).stdout.length
- consumed += run(deferredEntry, argv, env).stdout.length
- }
- const samples = { eager: [], deferred: [] }
- for (let round = 0; round < ROUNDS; round += 1) {
- // Alternate which arm leads so a drifting machine load cannot be
- // attributed to one arm.
- const order =
- round % 2 === 0
- ? [
- ['eager', eagerEntry],
- ['deferred', deferredEntry]
- ]
- : [
- ['deferred', deferredEntry],
- ['eager', eagerEntry]
- ]
- for (const [arm, entry] of order) {
- const started = performance.now()
- const result = run(entry, argv, env)
- samples[arm].push(performance.now() - started)
- consumed += result.stdout.length
- }
- }
- const eagerMs = median(samples.eager)
- const deferredMs = median(samples.deferred)
- console.log(
- `${pad(label, 26)} ${pad(`${eagerMs.toFixed(1)} ms`, 10)} ${pad(`${deferredMs.toFixed(1)} ms`, 10)} ${pad(`${(eagerMs / deferredMs).toFixed(2)}x`, 9)}`
- )
- }
-
- if (consumed === 0) {
- throw new Error('no output consumed — the timing loop was optimised away')
- }
- console.log(
- '\nThe help and error rows are the ones the change targets: they return\n' +
- 'before any client construction, so they drop the whole graph. `status` and\n' +
- '`worktree list` still construct a client, so they only save the eager parse\n' +
- 'of the parts the local path never uses (ws/tweetnacl via websocket-transport).'
- )
-} finally {
- rmSync(userDataPath, { recursive: true, force: true })
- for (const label of ['eager', 'deferred']) {
- rmSync(join(REPO, `.bench-out-${label}`), { recursive: true, force: true })
- }
-}
diff --git a/config/scripts/performance/transport/cli-runtime-client-deferral-equivalence.mjs b/config/scripts/performance/transport/cli-runtime-client-deferral-equivalence.mjs
deleted file mode 100644
index a3d06d5f9d6..00000000000
--- a/config/scripts/performance/transport/cli-runtime-client-deferral-equivalence.mjs
+++ /dev/null
@@ -1,446 +0,0 @@
-#!/usr/bin/env node
-// Compare stdout/stderr/exit byte-for-byte across two real CLI emits: current tree and selected files restored from baseline (default HEAD~).
-// Usage: node config/scripts/cli-runtime-client-deferral-equivalence.mjs [--baseline ]
-import { execFileSync, spawnSync } from 'node:child_process'
-import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync, readFileSync } from 'node:fs'
-import { join, resolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const REPO = fileURLToPath(new URL('../../../..', import.meta.url))
-
-// Restore only these baseline files; remove baseline-absent files (e.g. cli-error.ts), then restore the working tree.
-const TOUCHED = [
- 'src/cli/args.ts',
- 'src/cli/cli-error.ts',
- 'src/cli/dispatch.ts',
- 'src/cli/flags.ts',
- 'src/cli/format.ts',
- 'src/cli/index.ts',
- 'src/cli/runtime/client.ts',
- 'src/cli/selectors.ts'
-]
-
-// Fail if real deferral call shapes change or baseline/current could become identical and pass vacuously.
-function assertMarkersFresh() {
- const index = readFileSync(join(REPO, 'src/cli/index.ts'), 'utf8')
- const client = readFileSync(join(REPO, 'src/cli/runtime/client.ts'), 'utf8')
- const checks = [
- ['src/cli/index.ts', index, 'await loadRuntimeClientClass()'],
- ['src/cli/index.ts', index, "await import('./runtime-client.js')"],
- ['src/cli/index.ts', index, "import type { RuntimeClient } from './runtime-client'"],
- ['src/cli/runtime/client.ts', client, 'await loadSendWebSocketRequest()'],
- ['src/cli/runtime/client.ts', client, "await import('./websocket-transport.js')"]
- ]
- for (const [file, source, marker] of checks) {
- // Match calls so prose mentions cannot satisfy the guard.
- if (!source.includes(marker)) {
- throw new Error(
- `${file} no longer contains \`${marker}\` — cli-runtime-client-deferral-equivalence.mjs is stale`
- )
- }
- }
- const repointed = ['src/cli/args.ts', 'src/cli/flags.ts', 'src/cli/dispatch.ts']
- for (const file of repointed) {
- const source = readFileSync(join(REPO, file), 'utf8')
- if (!source.includes("import { RuntimeClientError } from './runtime/types'")) {
- throw new Error(`${file} no longer repoints RuntimeClientError at ./runtime/types — stale`)
- }
- }
-}
-
-function buildTree(label, baselineRev) {
- // Build inside repo so emitted modules resolve its node_modules.
- const outDir = join(REPO, `.equiv-out-${label}`)
- rmSync(outDir, { recursive: true, force: true })
- const restored = []
- try {
- if (baselineRev) {
- for (const file of TOUCHED) {
- const path = join(REPO, file)
- restored.push([path, existsSync(path) ? readFileSync(path) : null])
- const old = spawnSync('git', ['show', `${baselineRev}:${file}`], {
- cwd: REPO,
- maxBuffer: 64 * 1024 * 1024
- })
- if (old.status === 0) {
- writeFileSync(path, old.stdout)
- } else {
- rmSync(path, { force: true })
- }
- }
- }
- execFileSync(
- 'npx',
- [
- 'tsc',
- '-p',
- 'config/tsconfig.cli.json',
- '--outDir',
- outDir,
- '--composite',
- 'false',
- '--incremental',
- 'false'
- ],
- { cwd: REPO, stdio: 'inherit' }
- )
- } finally {
- for (const [path, contents] of restored) {
- if (contents === null) {
- rmSync(path, { force: true })
- } else {
- writeFileSync(path, contents)
- }
- }
- }
- return join(outDir, 'cli/index.js')
-}
-
-// Every case must exit itself; bound spawnSync so reaching a blocking command fails instead of stalling forever.
-const RUN_TIMEOUT_MS = 30_000
-
-function run(entry, argv, env) {
- const result = spawnSync(process.execPath, [entry, ...argv], {
- cwd: REPO,
- env: { ...process.env, ...env },
- encoding: 'buffer',
- timeout: RUN_TIMEOUT_MS,
- killSignal: 'SIGKILL'
- })
- if (result.error) {
- if (result.error.code === 'ETIMEDOUT') {
- throw new Error(
- `orca ${argv.join(' ')} did not exit within ${RUN_TIMEOUT_MS} ms — it reached a blocking command`
- )
- }
- throw result.error
- }
- return {
- status: result.status,
- stdout: result.stdout.toString('utf8'),
- stderr: result.stderr.toString('utf8')
- }
-}
-
-// Require identical bytes; empty user-data dirs make runtime-dependent cases deterministically report not running.
-function buildCases(isolatedUserData) {
- const isolated = { ORCA_USER_DATA_PATH: isolatedUserData }
- const cases = [
- // Paths that must never load the runtime client at all.
- [[], {}],
- [['--help'], {}],
- [['help'], {}],
- [['help', 'worktree'], {}],
- [['help', 'browser'], {}],
- [['worktree', '--help'], {}],
- [['help', 'no-such-command'], {}],
- [['no-such-command'], {}],
- [['no-such-command'], { ORCA_PAIRING_CODE: 'garbage' }],
- [['wrktree', 'list'], {}],
- [['agent-context'], {}],
- [['agent-context', '--json'], {}],
- // Flag validation must still fire before any runtime lookup.
- [['worktree', 'list', '--nonexistent-flag'], {}],
- [['worktree', 'list', '--nonexistent-flag', '--json'], {}],
- [['browser', 'snapshot', '--nonexistent-flag'], {}],
- // resolveRemotePairing throws from the RuntimeClient CONSTRUCTOR.
- [['status', '--pairing-code', 'x', '--environment', 'y'], isolated],
- [['status', '--pairing-code', 'x', '--environment', 'y', '--json'], isolated],
- [['status', '--pairing-code', 'not-a-pairing-code'], isolated],
- [['status', '--pairing-code', 'not-a-pairing-code', '--json'], isolated],
- [['status', '--pairing-code', 'orca://pair?code=zzzz'], isolated],
- [['status', '--environment', 'no-such-environment'], isolated],
- [['status', '--environment', 'no-such-environment', '--json'], isolated],
- [['worktree', 'list', '--environment', 'no-such-environment', '--json'], isolated],
- // The env-var fallback must stay live for non-suppressed commands...
- [['status', '--json'], { ...isolated, ORCA_PAIRING_CODE: 'not-a-pairing-code' }],
- [['status', '--json'], { ...isolated, ORCA_REMOTE_PAIRING: 'not-a-pairing-code' }],
- [['status', '--json'], { ...isolated, ORCA_ENVIRONMENT: 'no-such-environment' }],
- // Keep suppression for local-only groups. Do not invoke agent hooks on/off: they modify real ~/.claude configuration outside ORCA_USER_DATA_PATH.
- [['environment', 'list', '--json'], { ...isolated, ORCA_ENVIRONMENT: 'no-such-environment' }],
- [['environment', 'list', '--json'], { ...isolated, ORCA_PAIRING_CODE: 'not-a-pairing-code' }],
- [['agent-context', '--json'], { ...isolated, ORCA_PAIRING_CODE: 'not-a-pairing-code' }],
- // Runtime-unavailable reporting (RuntimeClientError formatting).
- [['status'], isolated],
- [['status', '--json'], isolated],
- [['worktree', 'list', '--json'], isolated],
- [['terminal', 'list', '--json'], isolated]
- ]
- // Seed fuzzing for reproducibility; all pool tokens must be safe to execute, checked against UNSAFE_TOKENS before running any case.
- const tokens = [
- 'worktree',
- 'list',
- 'status',
- 'browser',
- 'snapshot',
- 'terminal',
- 'environment',
- 'agent',
- 'agent-context',
- 'vm',
- '--json',
- '--help',
- '--pairing-code',
- '--environment',
- '--worktree',
- 'orca://pair?code=!!!',
- '',
- '-',
- '--',
- '--=',
- 'a'.repeat(300),
- 'näme-ünicode',
- '💥',
- '../..',
- 'x\ty'
- ]
- let seed = 0x9e3779b9
- const next = () => {
- seed ^= seed << 13
- seed ^= seed >>> 17
- seed ^= seed << 5
- return (seed >>> 0) / 0x100000000
- }
- // Check entire pool, not just sampled cases: serve once survived review here and escaped the per-case scan by chance.
- assertTokensSafe(tokens, 'fuzz token pool')
- assertFuzzPoolDeclaredReadOnly(tokens)
- for (let index = 0; index < 400; index += 1) {
- const length = 1 + Math.floor(next() * 4)
- const argv = []
- for (let part = 0; part < length; part += 1) {
- argv.push(tokens[Math.floor(next() * tokens.length)])
- }
- cases.push([argv, isolated])
- }
- for (const [argv] of cases) {
- assertTokensSafe(argv, `argv ${JSON.stringify(argv)}`)
- }
- return cases
-}
-
-// Cases run real CLI with developer HOME/PATH: deny foreground commands, surviving children, config/registry writes and real UI input.
-// Deny mixed read/write groups (capture/intercept/label/relation) wholesale; fuzzing cannot distinguish their subcommands.
-const FOREGROUND_TOKENS = ['serve', 'open', 'claude-teams', 'exec', 'eval', 'launch', 'attach']
-const MUTATING_TOKENS = [
- // persistent config and registry state
- 'on',
- 'off',
- 'hooks',
- 'create',
- 'remove',
- 'rm',
- 'delete',
- 'add',
- 'edit',
- 'set',
- 'set-value',
- 'set-base-ref',
- 'setup-clone',
- 'setup-create',
- 'setup-update',
- 'setup-delete',
- 'setup-existing-folder',
- 'install',
- 'uninstall',
- 'reinstall',
- 'update',
- 'clone',
- 'apply',
- 'write',
- 'reset',
- 'clear',
- 'enable',
- 'disable',
- 'use-default',
- 'permissions',
- // process and pane lifecycle
- 'run',
- 'run-stop',
- 'start',
- 'stop',
- 'kill',
- 'shutdown',
- 'close',
- 'split',
- 'switch',
- 'rename',
- 'focus',
- // orchestration writes
- 'send',
- 'reply',
- 'dispatch',
- 'task-create',
- 'task-update',
- 'gate-create',
- 'gate-resolve',
- // issue-tracker writes
- 'save-issue',
- 'comment',
- 'label',
- 'relation',
- 'assignee',
- 'priority',
- 'estimate',
- 'due-date',
- // browser / computer / emulator input and navigation
- 'goto',
- 'back',
- 'forward',
- 'reload',
- 'click',
- 'dblclick',
- 'hover',
- 'fill',
- 'type',
- 'type-text',
- 'select',
- 'select-all',
- 'uncheck',
- 'keypress',
- 'press-key',
- 'inserttext',
- 'hotkey',
- 'paste-text',
- 'perform-secondary-action',
- 'drag',
- 'scroll',
- 'scrollintoview',
- 'wheel',
- 'move',
- 'up',
- 'down',
- 'tap',
- 'gesture',
- 'button',
- 'rotate',
- 'upload',
- 'download',
- 'dismiss',
- 'accept',
- 'highlight',
- 'viewport',
- 'geolocation',
- 'headers',
- 'credentials',
- 'offline',
- 'media',
- 'device',
- 'capture',
- 'intercept'
-]
-
-const UNSAFE_TOKENS = new Map([
- ...FOREGROUND_TOKENS.map((token) => [token, 'runs in the foreground or spawns a process']),
- ...MUTATING_TOKENS.map((token) => [token, 'can write outside ORCA_USER_DATA_PATH'])
-])
-
-// Deny lists miss new verbs (serve once escaped); require explicit read-only allowlisting for every pool token too.
-const READ_ONLY_FUZZ_TOKENS = new Set([
- // command tokens: every path they can form is a list/show or a parse error
- 'agent',
- 'agent-context',
- 'browser',
- 'environment',
- 'list',
- 'snapshot',
- 'status',
- 'terminal',
- 'vm',
- 'worktree',
- // global flags and hostile strings, which reach no handler at all
- '--json',
- '--help',
- '--pairing-code',
- '--environment',
- '--worktree',
- 'orca://pair?code=!!!',
- '',
- '-',
- '--',
- '--=',
- 'a'.repeat(300),
- 'näme-ünicode',
- '💥',
- '../..',
- 'x\ty'
-])
-
-function assertTokensSafe(tokens, context) {
- for (const token of tokens) {
- const reason = UNSAFE_TOKENS.get(token)
- if (reason) {
- throw new Error(`Refusing to run ${context}: "${token}" ${reason}`)
- }
- }
-}
-
-// Reject neither/both-list membership before any case runs; sampling cannot prove pool safety.
-function assertFuzzPoolDeclaredReadOnly(tokens) {
- for (const token of tokens) {
- if (!READ_ONLY_FUZZ_TOKENS.has(token)) {
- throw new Error(
- `Fuzz token ${JSON.stringify(token)} is not declared in READ_ONLY_FUZZ_TOKENS — declare it read-only or drop it`
- )
- }
- }
- for (const token of READ_ONLY_FUZZ_TOKENS) {
- if (UNSAFE_TOKENS.has(token)) {
- throw new Error(
- `Token ${JSON.stringify(token)} is declared both read-only and unsafe — the two lists disagree`
- )
- }
- }
-}
-
-const baselineIndex = process.argv.indexOf('--baseline')
-const baselineRev = baselineIndex === -1 ? 'HEAD' : process.argv[baselineIndex + 1]
-
-assertMarkersFresh()
-
-const isolatedUserData = mkdtempSync(join(REPO, '.equiv-userdata-'))
-mkdirSync(join(isolatedUserData, 'empty'), { recursive: true })
-
-let oldEntry
-let newEntry
-try {
- // Build cases and check safety before expensive tsc compiles so unsafe tokens fail immediately.
- const cases = buildCases(isolatedUserData)
-
- console.log(`Building baseline (${baselineRev}) …`)
- oldEntry = buildTree('old', baselineRev)
- console.log('Building working tree …')
- newEntry = buildTree('new', null)
-
- console.log(`Comparing ${cases.length} invocations byte for byte …`)
- let mismatches = 0
- for (const [argv, env] of cases) {
- const before = run(oldEntry, argv, env)
- const after = run(newEntry, argv, env)
- if (
- before.status !== after.status ||
- before.stdout !== after.stdout ||
- before.stderr !== after.stderr
- ) {
- mismatches += 1
- console.error(`\nMISMATCH argv=${JSON.stringify(argv)} env=${JSON.stringify(env)}`)
- console.error(` exit before=${before.status} after=${after.status}`)
- if (before.stdout !== after.stdout) {
- console.error(` stdout before=${JSON.stringify(before.stdout.slice(0, 400))}`)
- console.error(` after =${JSON.stringify(after.stdout.slice(0, 400))}`)
- }
- if (before.stderr !== after.stderr) {
- console.error(` stderr before=${JSON.stringify(before.stderr.slice(0, 400))}`)
- console.error(` after =${JSON.stringify(after.stderr.slice(0, 400))}`)
- }
- }
- }
- if (mismatches > 0) {
- throw new Error(`${mismatches} of ${cases.length} invocations differ`)
- }
- console.log(`\nAll ${cases.length} invocations byte-identical (stdout, stderr, exit code).`)
-} finally {
- rmSync(isolatedUserData, { recursive: true, force: true })
- for (const label of ['old', 'new']) {
- rmSync(resolve(REPO, `.equiv-out-${label}`), { recursive: true, force: true })
- }
-}
diff --git a/config/scripts/performance/wsl-git/wsl-git-shell-benchmark.mjs b/config/scripts/performance/wsl-git/wsl-git-shell-benchmark.mjs
index 92dbfad149b..a78e33d39c7 100644
--- a/config/scripts/performance/wsl-git/wsl-git-shell-benchmark.mjs
+++ b/config/scripts/performance/wsl-git/wsl-git-shell-benchmark.mjs
@@ -325,8 +325,10 @@ async function main() {
'--untracked-files=all'
]
const [{ gitExecFileAsync }, { getWslGitReadEnvironment }, expected] = await Promise.all([
- jiti.import('../../../../src/main/git/runner.ts'),
- jiti.import('../../../../src/main/git/wsl-git-read-environment.ts'),
+ jiti.import('../../../../src/main/git/command-runner/git-exec-file.ts'),
+ jiti.import(
+ '../../../../src/main/git/command-runner/host-routing/wsl-git-read-environment.ts'
+ ),
runGit('fast', repo, args)
])
await getWslGitReadEnvironment(distro)
diff --git a/config/scripts/plugin-authoring/content-validation/validate-plugin-files.mjs b/config/scripts/plugin-authoring/content-validation/validate-plugin-files.mjs
index bbdb13719aa..45164a171a7 100644
--- a/config/scripts/plugin-authoring/content-validation/validate-plugin-files.mjs
+++ b/config/scripts/plugin-authoring/content-validation/validate-plugin-files.mjs
@@ -17,11 +17,12 @@ const { validatePluginFile, pluginManifestWarnings } = loadPluginSchemaModule(
const { parsePluginManifest } = loadPluginSchemaModule('manifest/plugin-manifest.ts')
// Why the CLI's main entry: `orca plugin validate` and `release-entry` run these same checks, and
// the printed contentHash must be what Orca computes at install.
-const {
- pluginCatalogReleaseForHead,
- validateDeclaredPluginArtifacts,
- validatePluginInstallContent
-} = loadPluginSchemaModule('../../main/plugins/plugin-authoring-checks.ts')
+const { pluginCatalogReleaseForHead } = loadPluginSchemaModule(
+ '../../main/plugins/plugin-catalog-release-entry.ts'
+)
+const { validateDeclaredPluginArtifacts, validatePluginInstallContent } = loadPluginSchemaModule(
+ '../../main/plugins/plugin-artifact-validation.ts'
+)
// Why shared: `orca plugin validate` runs these same strict artifact checks.
const { strictPluginArtifactErrors, strictPluginArtifactWarnings } = loadPluginSchemaModule(
'authoring/plugin-strict-artifact-checks.ts'
diff --git a/config/scripts/plugin-authoring/content-validation/validate-plugin-files.test.mjs b/config/scripts/plugin-authoring/content-validation/validate-plugin-files.test.mjs
index f9ddb0587af..18ce2787ee4 100644
--- a/config/scripts/plugin-authoring/content-validation/validate-plugin-files.test.mjs
+++ b/config/scripts/plugin-authoring/content-validation/validate-plugin-files.test.mjs
@@ -4,7 +4,7 @@ import path from 'node:path'
import process from 'node:process'
import { runProcess } from '@orca/process-host'
import { afterEach, describe, expect, it } from 'vitest'
-import { createPluginFromTemplate } from '../../../../src/cli/plugin-authoring/plugin-create'
+import { createPluginFromTemplate } from '../../../../src/cli/plugins/authoring/plugin-create'
const SCRIPT = path.join(import.meta.dirname, './validate-plugin-files.mjs')
const roots = []
diff --git a/config/scripts/preflight/changed-checks/check-changed-selection.mjs b/config/scripts/preflight/changed-checks/check-changed-selection.mjs
index a8dddc16970..7128af32b8d 100644
--- a/config/scripts/preflight/changed-checks/check-changed-selection.mjs
+++ b/config/scripts/preflight/changed-checks/check-changed-selection.mjs
@@ -35,8 +35,19 @@ const RATCHET_INPUTS = {
'check-host-list-render-ratchet.mjs': ['src/renderer/src/'],
'check-id-only-store-write-ratchet.mjs': ['src/main/persistence/'],
'check-layout-writer-ratchets.mjs': ['src/main/', 'src/renderer/src/'],
- 'check-main-sync-fs-ratchet.mjs': ['src/main/', 'src/shared/'],
- 'check-main-sync-spawn-ratchet.mjs': ['src/main/'],
+ 'check-main-sync-fs-ratchet.mjs': [
+ 'src/main/',
+ 'src/shared/',
+ 'config/main-blocking-worker-entries.json',
+ 'config/scripts/static-analysis/process-boundaries/main-blocking-source-paths.mjs'
+ ],
+ 'check-main-sync-spawn-ratchet.mjs': [
+ 'src/main/',
+ 'src/shared/',
+ 'src/preload/',
+ 'config/main-blocking-worker-entries.json',
+ 'config/scripts/static-analysis/process-boundaries/main-blocking-source-paths.mjs'
+ ],
'check-react-compiler-compat-ratchet.mjs': ['src/renderer/src/'],
'check-recurring-timer-ratchet.mjs': [
'src/main/',
@@ -293,6 +304,7 @@ export function selectTypecheckProjects(files) {
// Shared analysis modules select every ratchet built on them.
const RATCHET_SHARED_MODULES = {
'config/scripts/static-analysis/process-boundaries/gated-call-use-collector.mjs': [
+ 'check-main-blocking-api-ratchet.mjs',
'check-daemon-blocking-call-ratchet.mjs',
'check-main-sync-fs-ratchet.mjs',
'check-main-sync-spawn-ratchet.mjs',
diff --git a/config/scripts/release/publication/mirror-release-to-r2.sh b/config/scripts/release/publication/mirror-release-to-r2.sh
index f32992eaafd..38ef2ea83f9 100755
--- a/config/scripts/release/publication/mirror-release-to-r2.sh
+++ b/config/scripts/release/publication/mirror-release-to-r2.sh
@@ -1,7 +1,7 @@
#!/usr/bin/env bash
# Needs bash 4+ (mapfile); on macOS use Homebrew bash.
# Mirror Orca release assets from GitHub Releases to the public R2 bucket
-# served at https://downloads.onorca.dev. onorca.dev's "Download started" page
+# served at https://downloads.orca.dev. orca.dev's "Download started" page
# offers these as an opt-in "mirror link" for when GitHub returns 5xx.
# Run by .github/workflows/release-mirror-r2.yml after each published release.
#
@@ -29,7 +29,7 @@ set -euo pipefail
REPO="${REPO:-stablyai/orca}"
BUCKET="${BUCKET:-orca-downloads}"
-PUBLIC_BASE="${PUBLIC_BASE:-https://downloads.onorca.dev}"
+PUBLIC_BASE="${PUBLIC_BASE:-https://downloads.orca.dev}"
WEBSITE_ASSETS=(orca-macos-arm64.dmg orca-macos-x64.dmg orca-windows-setup.exe orca-linux.AppImage)
CLOUDFLARE_ACCOUNT_ID="${CLOUDFLARE_ACCOUNT_ID:-57e6ddd3bb755dbf8e8dc7ff557e9014}"
R2_ENDPOINT="https://$CLOUDFLARE_ACCOUNT_ID.r2.cloudflarestorage.com"
diff --git a/config/scripts/remote-host-build/wsl-guest/build-wsl-guest.mjs b/config/scripts/remote-host-build/wsl-guest/build-wsl-guest.mjs
index 678052caba0..0790109a5eb 100644
--- a/config/scripts/remote-host-build/wsl-guest/build-wsl-guest.mjs
+++ b/config/scripts/remote-host-build/wsl-guest/build-wsl-guest.mjs
@@ -55,7 +55,7 @@ stampVersion('wsl-browser-network-relay.js', '.browser-network-version')
console.log(`Built WSL browser network relay → ${outDir}/wsl-browser-network-relay.js`)
await bundle(
- 'src/main/claude-accounts/claude-profile-wsl-entry.ts',
+ 'src/main/claude-accounts/profiles/wsl/claude-profile-wsl-entry.ts',
WSL_CLAUDE_PROFILE_HELPER_FILENAME
)
await bundle(
diff --git a/config/scripts/runtime-verification/daemon-lifecycle/run-headless-linux-pairing-docker.mjs b/config/scripts/runtime-verification/daemon-lifecycle/run-headless-linux-pairing-docker.mjs
index 799b8d73ab1..b0d79937213 100644
--- a/config/scripts/runtime-verification/daemon-lifecycle/run-headless-linux-pairing-docker.mjs
+++ b/config/scripts/runtime-verification/daemon-lifecycle/run-headless-linux-pairing-docker.mjs
@@ -4,10 +4,8 @@ import { existsSync } from 'node:fs'
import { resolve } from 'node:path'
const STARTUP_TIMEOUT_MS = 20_000
-const APPIMAGE_EXTRACTION_TIMEOUT_MS = 60_000
const commandArgs = process.argv.slice(2)
const appImageArg = valueAfter('--appimage')
-const pairingOnly = commandArgs.includes('--pairing-only')
if (!appImageArg) {
fail('Usage: run-headless-linux-pairing-docker.mjs --appimage /path/to/orca.AppImage')
}
@@ -32,28 +30,17 @@ const images = [
tag: 'orca-headless-pairing:debian-13',
base: 'debian@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd',
libasound: 'libasound2t64'
- },
- {
- name: 'ubuntu-22.04-baseline',
- tag: 'orca-headless-pairing:ubuntu-22.04',
- base: 'ubuntu@sha256:0e0a0fc6d18feda9db1590da249ac93e8d5abfea8f4c3c0c849ce512b5ef8982',
- libasound: 'libasound2'
}
]
try {
docker(['volume', 'create', artifactVolume])
docker(['network', 'create', network])
- for (const image of pairingOnly ? images.slice(0, 2) : images) {
+ for (const image of images) {
buildImage(image)
}
extractAppImage(images[0].tag)
- if (!pairingOnly) {
- await validateStartupMatrix()
- await validateUnavailableContracts()
- }
await validateAuthenticatedPairing()
- await validateUnreachableOffer()
console.log('Headless Linux pairing Docker validation passed.')
} finally {
for (const container of containers) {
@@ -111,71 +98,6 @@ function extractAppImage(image) {
])
}
-async function validateStartupMatrix() {
- const required = images.slice(0, 2)
- for (const image of required) {
- for (const launch of ['direct', 'xvfb', 'dbus-xvfb', 'journal']) {
- for (const mode of ['human', 'json']) {
- const result = await startAndWait({ image, launch, mode, address: 'pair-host.test' })
- validateReady(result.stdout, mode, 'pair-host.test', {
- allowStdoutNoise: launch !== 'direct'
- })
- stopContainer(result.name)
- console.log(`PASS ${image.name} ${launch} ${mode}`)
- }
- }
- }
- const baseline = await startAndWait({
- image: images[2],
- launch: 'xvfb',
- mode: 'json',
- address: '127.0.0.1'
- })
- validateReady(baseline.stdout, 'json', '127.0.0.1', { allowStdoutNoise: true })
- stopContainer(baseline.name)
- console.log(`PASS ${images[2].name} xvfb json`)
-
- const publicEntry = await startAndWait({
- image: images[0],
- launch: 'direct',
- mode: 'json',
- address: '127.0.0.1',
- appPath: '/artifacts/orca.AppImage',
- startupTimeoutMs: APPIMAGE_EXTRACTION_TIMEOUT_MS
- })
- validateReady(publicEntry.stdout, 'json', '127.0.0.1', { allowStdoutNoise: true })
- stopContainer(publicEntry.name)
- console.log('PASS AppImage --appimage-extract-and-run --no-sandbox serve')
-}
-
-async function validateUnavailableContracts() {
- const invalid = await startAndWait({
- image: images[0],
- launch: 'direct',
- mode: 'json',
- address: '0.0.0.0'
- })
- const invalidPayload = readyJson(invalid.stdout)
- assert(invalidPayload.pairing?.available === false, 'wildcard pairing must be unavailable')
- assert(
- invalidPayload.pairing.reason === 'invalid_advertised_endpoint',
- 'wildcard pairing must expose invalid_advertised_endpoint'
- )
- stopContainer(invalid.name)
-
- const disabled = await startAndWait({
- image: images[1],
- launch: 'journal',
- mode: 'json',
- address: '127.0.0.1',
- noPairing: true
- })
- const disabledPayload = readyJson(disabled.stdout)
- assert(disabledPayload.pairing?.reason === 'disabled_by_operator', 'disabled reason is missing')
- stopContainer(disabled.name)
- console.log('PASS explicit unavailable pairing contracts')
-}
-
async function validateAuthenticatedPairing() {
const server = await startAndWait({
image: images[0],
@@ -220,22 +142,6 @@ async function validateAuthenticatedPairing() {
console.log('PASS paired E2EE updater inventory and manual-service fallback')
}
-async function validateUnreachableOffer() {
- const server = await startAndWait({
- image: images[0],
- launch: 'direct',
- mode: 'json',
- address: 'orca-pairing-server:6769',
- port: '6768',
- networkAlias: 'orca-pairing-server'
- })
- const payload = readyJson(server.stdout)
- const client = runPairingClient(payload.pairing.url)
- assert(client.status !== 0, 'a deliberately mismatched advertised port unexpectedly connected')
- stopContainer(server.name)
- console.log('PASS unreachable advertised endpoint fails the real client probe')
-}
-
async function startAndWait({
image,
launch,
@@ -318,39 +224,6 @@ function hasCompleteReadyContract(stdout) {
return readyJsonObjects(stdout).length > 0
}
-function validateReady(logs, mode, expectedHost, options = {}) {
- if (mode === 'human') {
- assert(
- (logs.match(/^Orca server ready$/gm) ?? []).length === 1,
- 'human ready marker is not exact-once'
- )
- assert(logs.includes('Bound endpoint: ws://0.0.0.0:'), 'human bound endpoint is missing')
- assert(
- logs.includes(`Advertised endpoint: ws://${expectedHost}:`),
- 'human advertised endpoint is missing'
- )
- assert(logs.includes('Pairing URL: orca://pair?code='), 'human pairing URL is missing')
- return
- }
- if (!options.allowStdoutNoise) {
- const stdoutLines = logs.split(/\r?\n/).filter(Boolean)
- assert(
- stdoutLines.length === 1,
- `JSON stdout must contain exactly one line, found ${stdoutLines.length}:\n${logs}`
- )
- }
- const payload = readyJson(logs)
- assert(payload.schemaVersion === 1, 'ready JSON schemaVersion is missing')
- assert(payload.endpoint === payload.boundEndpoint, 'legacy JSON endpoint alias is inconsistent')
- assert(payload.boundEndpoint?.startsWith('ws://0.0.0.0:'), 'JSON bound endpoint is invalid')
- assert(payload.advertisedEndpoint?.includes(expectedHost), 'JSON advertised endpoint is invalid')
- assert(payload.pairing?.available === true, 'JSON pairing offer is unavailable')
- assert(
- new URL(payload.boundEndpoint).port === new URL(payload.advertisedEndpoint).port,
- 'an advertised host without a port must use the actual bound port'
- )
-}
-
function readyJson(logs) {
const matches = readyJsonObjects(logs)
assert(matches.length === 1, `expected one ready JSON object, found ${matches.length}`)
diff --git a/config/scripts/runtime-verification/desktop-transport/run-linux-cli-launch-contract-docker.mjs b/config/scripts/runtime-verification/desktop-transport/run-linux-cli-launch-contract-docker.mjs
index d0c3c54c4d5..d577caf6c7c 100755
--- a/config/scripts/runtime-verification/desktop-transport/run-linux-cli-launch-contract-docker.mjs
+++ b/config/scripts/runtime-verification/desktop-transport/run-linux-cli-launch-contract-docker.mjs
@@ -24,18 +24,6 @@ const CLEANUP_TIMEOUT_MS = 30_000
// Exact statuses reject silent no-op launches as well as crashes.
const CASES = [
- {
- name: 'nofuse-userns-bundled-help',
- expectStatus: 0,
- expectOutput: 'Usage: orca ',
- why: 'The bundled launcher must run with no FUSE, no display, and userns restricted (#11609, #12530).'
- },
- {
- name: 'nofuse-userns-bundled-version',
- expectStatus: 0,
- expectOutput: /^\d+\.\d+\.\d+/m,
- why: 'A deployment must be able to read the installed version without a display (#13719).'
- },
{
name: 'nofuse-userns-bundled-status',
// No runtime is running; the CLI must report that itself.
@@ -43,32 +31,12 @@ const CASES = [
expectOutput: 'appRunning',
why: 'A command that needs the runtime must report its absence, not abort.'
},
- {
- name: 'nofuse-userns-bundled-skills',
- expectStatus: 0,
- // Why: the rendered help header, not a bare 'skills' — the case name contains that word.
- expectOutput: 'Usage: orca skills',
- why: 'skills is a pure-text command that must never need Chromium (#14229).'
- },
- {
- name: 'nofuse-userns-bundled-worktree',
- expectStatus: 1,
- expectOutput: "Orca is not running. Run 'orca open' first.",
- why: 'A runtime-dependent command must report the missing runtime, not abort.'
- },
{
name: 'nofuse-nosandbox-direct-binary-skills',
expectStatus: 0,
expectOutput: 'Usage: orca skills',
why: 'A direct binary launch that reaches JavaScript must run the command, not boot a GUI (#14229).'
},
- {
- name: 'nofuse-nosandbox-direct-binary-gui',
- // A missing display is an expected diagnosis, not a crash.
- expectStatus: 1,
- expectOutput: 'needs a usable display server',
- why: 'A desktop launch with no display must diagnose it instead of dying in uv_close (#13719).'
- },
{
name: 'stale-display-nosandbox-direct-binary-gui',
expectStatus: 1,
diff --git a/config/scripts/skills/bundle-generation/generate-bundled-skill-guides.mjs b/config/scripts/skills/bundle-generation/generate-bundled-skill-guides.mjs
index 40056f21e91..7cb75b19306 100644
--- a/config/scripts/skills/bundle-generation/generate-bundled-skill-guides.mjs
+++ b/config/scripts/skills/bundle-generation/generate-bundled-skill-guides.mjs
@@ -179,7 +179,7 @@ function serializeEmbeddedModule(guides) {
})
.join(',\n')
- return `// Generated by config/scripts/generate-bundled-skill-guides.mjs. Do not edit.\n\nexport type BundledSkillGuideReference = {\n readonly name: string\n readonly markdown: string\n}\n\nexport type BundledSkillGuide = {\n readonly name: string\n readonly description: string\n readonly markdown: string\n readonly aliases: readonly string[]\n readonly references: readonly BundledSkillGuideReference[]\n}\n\n${markdownConstants}\n\n// oxfmt-ignore\nexport const BUNDLED_SKILL_GUIDES = [\n${guideEntries}\n] as const satisfies readonly BundledSkillGuide[]\n`
+ return `// Generated by config/scripts/skills/bundle-generation/generate-bundled-skill-guides.mjs. Do not edit.\n\nexport type BundledSkillGuideReference = {\n readonly name: string\n readonly markdown: string\n}\n\nexport type BundledSkillGuide = {\n readonly name: string\n readonly description: string\n readonly markdown: string\n readonly aliases: readonly string[]\n readonly references: readonly BundledSkillGuideReference[]\n}\n\n${markdownConstants}\n\n// oxfmt-ignore\nexport const BUNDLED_SKILL_GUIDES = [\n${guideEntries}\n] as const satisfies readonly BundledSkillGuide[]\n`
}
async function readGuideReferences(repoRoot, guideName) {
@@ -317,7 +317,7 @@ async function buildArtifacts(repoRoot = REPO_ROOT) {
return [
{
- path: path.join(repoRoot, 'src', 'cli', 'bundled-skill-guides.ts'),
+ path: path.join(repoRoot, 'src', 'cli', 'skills', 'bundled-skill-guides.ts'),
content: serializeEmbeddedModule(guides)
},
...projections
diff --git a/config/scripts/skills/bundle-generation/generate-plugin-authoring-skill-references.mjs b/config/scripts/skills/bundle-generation/generate-plugin-authoring-skill-references.mjs
index 3c656d5530b..8f5a05f3495 100644
--- a/config/scripts/skills/bundle-generation/generate-plugin-authoring-skill-references.mjs
+++ b/config/scripts/skills/bundle-generation/generate-plugin-authoring-skill-references.mjs
@@ -208,12 +208,15 @@ function hookLines({ hooks, hookContribution, typeText }) {
function renderHostApi(sources, { frame, worker }) {
const { hostApi, hostDoc, capabilities } = sources
- const names = hostApi.PLUGIN_HOST_METHOD_NAMES
+ const names = hostApi.PLUGIN_STABLE_HOST_METHOD_NAMES
const methodsFor = (surface) => hostApi.pluginHostMethodsFor(surface).map(code).join(', ')
const methods = names.map((name) => {
const spec = hostApi.PLUGIN_HOST_API[name]
const facts = [
spec.capability ? `capability ${code(spec.capability)}` : 'no capability',
+ ...Object.entries(spec.paramCapabilities ?? {}).map(
+ ([param, kind]) => `${code(param)} also needs ${code(kind)}`
+ ),
spec.surfaces.join(', '),
`since ${hostVersion(sources, spec.since)}`,
...(spec.deprecatedSince === undefined
diff --git a/config/scripts/skills/bundle-generation/generate-skill-bundle-manifest.test.mjs b/config/scripts/skills/bundle-generation/generate-skill-bundle-manifest.test.mjs
index e3c242f0f1a..dd8b8596d0a 100644
--- a/config/scripts/skills/bundle-generation/generate-skill-bundle-manifest.test.mjs
+++ b/config/scripts/skills/bundle-generation/generate-skill-bundle-manifest.test.mjs
@@ -1,7 +1,6 @@
import { createHash } from 'node:crypto'
import { execFileSync } from 'node:child_process'
import {
- chmod,
copyFile,
mkdir,
mkdtemp,
@@ -114,29 +113,6 @@ describe('skill bundle manifest generator', () => {
expect(digests).toHaveLength(2)
})
- it.runIf(process.platform !== 'win32')(
- 'rejects executable files in shipped skill packages',
- async () => {
- const packageRoot = await createPackage()
- await writeFile(path.join(packageRoot, 'SKILL.md'), 'skill\n')
- await writeFile(path.join(packageRoot, 'run.sh'), '#!/bin/sh\necho ok\n')
- await chmod(path.join(packageRoot, 'run.sh'), 0o755)
-
- await expect(collectPackageFiles(packageRoot)).rejects.toThrow(
- 'Executable file is not allowed in a shipped skill: run.sh'
- )
- }
- )
-
- it.runIf(process.platform === 'linux')('rejects case-colliding paths', async () => {
- const packageRoot = await createPackage()
- await writeFile(path.join(packageRoot, 'SKILL.md'), 'skill')
- await writeFile(path.join(packageRoot, 'Readme.md'), 'one')
- await writeFile(path.join(packageRoot, 'README.md'), 'two')
-
- await expect(collectPackageFiles(packageRoot)).rejects.toThrow('Case-colliding skill paths')
- })
-
it('keeps guarding a directory or link that only wears an OS metadata name', async () => {
const packageRoot = await createPackage()
await writeFile(path.join(packageRoot, 'SKILL.md'), 'demo skill\n')
diff --git a/config/scripts/static-analysis/process-boundaries/check-main-sync-spawn-ratchet.mjs b/config/scripts/static-analysis/process-boundaries/check-main-sync-spawn-ratchet.mjs
index 92730a85a81..f6a4e6b05a1 100644
--- a/config/scripts/static-analysis/process-boundaries/check-main-sync-spawn-ratchet.mjs
+++ b/config/scripts/static-analysis/process-boundaries/check-main-sync-spawn-ratchet.mjs
@@ -8,19 +8,22 @@ import {
totalCount
} from '../ratchet-baseline/ratchet-baseline.mjs'
import { createGatedCallCollector } from './gated-call-use-collector.mjs'
+import { isMainBlockingSource } from './main-blocking-source-paths.mjs'
import { isTestOnlySourcePath } from './test-only-source-path.mjs'
// Synchronous launches freeze all Electron windows; Windows antivirus magnifies the delay. Count launch APIs and synchronous wrappers per file.
const ROOT = path.resolve(import.meta.dirname, '../../..', '..')
const BASELINE_PATH = 'config/main-sync-spawn-baseline.txt'
-const SCAN_DIRECTORIES = ['src/main', 'src/shared']
+const SCAN_DIRECTORIES = ['src/main', 'src/shared', 'src/preload']
const PROCESS_ADVICE = 'use runProcess or spawnProcess from @orca/process-host'
const SECURE_ADVICE = `rewrites a DACL on the calling thread, and a directory rewrite blocks on its whole subtree; use restrictWindowsDirectory for a directory, or raise this file's count in ${BASELINE_PATH} (or add a row)`
// Include package/repo re-exporters so moving an import cannot bypass the gate.
const GATED_FAMILIES = [
{
modules: ['child_process', 'node:child_process'],
+ exportPattern: /Sync$/,
+ defaultAdvice: PROCESS_ADVICE,
advice: { execFileSync: PROCESS_ADVICE, spawnSync: PROCESS_ADVICE, execSync: PROCESS_ADVICE }
},
{ modules: ['@orca/process-host'], advice: { runProcessSync: PROCESS_ADVICE } },
@@ -31,8 +34,7 @@ const GATED_FAMILIES = [
{
modules: [
'src/main/git/command-runner/git-exec-file',
- 'src/main/git/command-runner/git-exec-file-sync',
- 'src/main/git/runner'
+ 'src/main/git/command-runner/git-exec-file-sync'
],
advice: { gitExecFileSync: 'use gitExecFileAsync' }
},
@@ -84,6 +86,7 @@ export const adviceFor = collector.adviceFor
export function isRatchetedSourcePath(file) {
return (
SCAN_DIRECTORIES.some((directory) => file.startsWith(`${directory}/`)) &&
+ isMainBlockingSource(file) &&
!file.endsWith('.d.ts') &&
!isTestOnlySourcePath(file)
)
diff --git a/config/scripts/static-analysis/process-boundaries/check-main-sync-spawn-ratchet.test.mjs b/config/scripts/static-analysis/process-boundaries/check-main-sync-spawn-ratchet.test.mjs
index 15c416efd14..504795bbf88 100644
--- a/config/scripts/static-analysis/process-boundaries/check-main-sync-spawn-ratchet.test.mjs
+++ b/config/scripts/static-analysis/process-boundaries/check-main-sync-spawn-ratchet.test.mjs
@@ -121,18 +121,11 @@ describe('main sync-spawn ratchet', () => {
'const other = { spawnSync() {} }\nother.spawnSync()',
"// execFileSync('git')\nconst script = \"require('child_process').execSync('ls')\"",
"import * as cp from 'child_process'\ncp.spawn('git')",
- "import { gitExecFileAsync } from './git/runner'\ngitExecFileAsync(['status'])"
+ "import { gitExecFileAsync } from './git/command-runner/git-exec-file'\ngitExecFileAsync(['status'])"
])('ignores %s', (source) => {
expect(uses(source)).toEqual({ count: 0, symbols: [] })
})
- it.each(['import {', 'const broken = ;'])(
- 'fails closed on source it cannot parse: %s',
- (source) => {
- expect(() => uses(source)).toThrow('Cannot parse src/main/consumer.ts')
- }
- )
-
it('fails a new file and a rising count, and passes at the baseline count', () => {
const one = "import { spawnSync } from 'node:child_process'\nspawnSync('a')"
const root = tree({
diff --git a/config/scripts/static-analysis/process-boundaries/check-runtime-electron-ratchet.mjs b/config/scripts/static-analysis/process-boundaries/check-runtime-electron-ratchet.mjs
index 5fd2dd67e4c..cf8e42f10ba 100644
--- a/config/scripts/static-analysis/process-boundaries/check-runtime-electron-ratchet.mjs
+++ b/config/scripts/static-analysis/process-boundaries/check-runtime-electron-ratchet.mjs
@@ -23,6 +23,7 @@ const ENTRY_POINTS = [
// Whole lane directories cover new files automatically; only structured-chat files are plain-Node-safe inside runtime/.
export const STRUCTURED_CHAT_LANES = [
+ { directory: ['src', 'main', 'backend'] },
{ directory: ['src', 'main', 'native-chat'] },
{ directory: ['src', 'main', 'claude'] },
{ directory: ['src', 'main', 'codex'] },
diff --git a/config/scripts/static-analysis/process-boundaries/gated-call-use-collector.mjs b/config/scripts/static-analysis/process-boundaries/gated-call-use-collector.mjs
index e17bb894adf..8ecf456adfc 100644
--- a/config/scripts/static-analysis/process-boundaries/gated-call-use-collector.mjs
+++ b/config/scripts/static-analysis/process-boundaries/gated-call-use-collector.mjs
@@ -55,16 +55,23 @@ export function createGatedCallCollector(families, ratchetName) {
const advice = new Map(families.flatMap((family) => Object.entries(family.advice)))
const markers = [
...advice.keys(),
+ ...families.filter((family) => family.exportPattern).map(() => 'Sync'),
...new Set(
families.flatMap((family) => family.modules.map((module) => path.posix.basename(module)))
)
]
function symbolsOf(key) {
- const names = families
- .filter((family) => family.modules.includes(key))
- .flatMap((family) => Object.keys(family.advice))
- return names.length > 0 ? new Set(names) : null
+ const matched = families.filter((family) => family.modules.includes(key))
+ if (!matched.length) {
+ return null
+ }
+ const names = new Set(matched.flatMap((family) => Object.keys(family.advice)))
+ const patterns = matched.map((family) => family.exportPattern).filter(Boolean)
+ names.has = (name) =>
+ Set.prototype.has.call(names, name) ||
+ (typeof name === 'string' && patterns.some((pattern) => pattern.test(name)))
+ return names
}
function gatedSymbolsFor(file, specifier) {
@@ -97,7 +104,11 @@ export function createGatedCallCollector(families, ratchetName) {
}
const used = new Set()
let count = 0
- const namespaces = new Map()
+ const namespaces = new Map(
+ families.flatMap((family) =>
+ (family.globals ?? []).map((name) => [name, new Set(Object.keys(family.advice))])
+ )
+ )
const functions = new Map([...(symbolsOf(moduleKey(file)) ?? [])].map((name) => [name, name]))
const aliases = []
const members = []
@@ -115,7 +126,11 @@ export function createGatedCallCollector(families, ratchetName) {
const loads =
ts.isCallExpression(node) &&
(node.expression.kind === ts.SyntaxKind.ImportKeyword ||
- (ts.isIdentifier(node.expression) && node.expression.text === 'require'))
+ (ts.isIdentifier(node.expression) && node.expression.text === 'require') ||
+ (ts.isPropertyAccessExpression(node.expression) &&
+ ts.isIdentifier(node.expression.expression) &&
+ node.expression.expression.text === 'process' &&
+ node.expression.name.text === 'getBuiltinModule'))
const specifier = loads ? literalString(node.arguments[0]) : null
return specifier === null ? null : gatedSymbolsFor(file, specifier)
}
@@ -279,7 +294,17 @@ export function createGatedCallCollector(families, ratchetName) {
function adviceFor(symbols) {
const groups = new Map()
for (const symbol of symbols) {
- groups.set(advice.get(symbol), [...(groups.get(advice.get(symbol)) ?? []), symbol])
+ groups.set(
+ advice.get(symbol) ??
+ families.find((family) => family.exportPattern?.test(symbol))?.defaultAdvice,
+ [
+ ...(groups.get(
+ advice.get(symbol) ??
+ families.find((family) => family.exportPattern?.test(symbol))?.defaultAdvice
+ ) ?? []),
+ symbol
+ ]
+ )
}
return [...groups].map(([advice, names]) => `${names.join(', ')}: ${advice}.`).join(' ')
}
diff --git a/config/scripts/static-analysis/process-boundaries/main-blocking-source-paths.mjs b/config/scripts/static-analysis/process-boundaries/main-blocking-source-paths.mjs
new file mode 100644
index 00000000000..035176aed0b
--- /dev/null
+++ b/config/scripts/static-analysis/process-boundaries/main-blocking-source-paths.mjs
@@ -0,0 +1,25 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { isTestOnlySourcePath } from './test-only-source-path.mjs'
+
+// Exact entry files only: dependencies remain guarded, even when a worker imports them.
+const entries = JSON.parse(
+ readFileSync(new URL('../../../main-blocking-worker-entries.json', import.meta.url), 'utf8')
+)
+for (const [file, reason] of Object.entries(entries)) {
+ if (
+ !file.startsWith('src/main/') ||
+ !reason.trim() ||
+ !existsSync(new URL(`../../../../${file}`, import.meta.url))
+ ) {
+ throw new Error(`Invalid worker entry: ${file}`)
+ }
+}
+
+export function isMainBlockingSource(file) {
+ return (
+ /\.[cm]?[jt]sx?$/.test(file) &&
+ !/\.d\.[cm]?ts$/.test(file) &&
+ !isTestOnlySourcePath(file) &&
+ !Object.hasOwn(entries, file)
+ )
+}
diff --git a/config/scripts/static-analysis/process-boundaries/sqlite-call-use-collector.mjs b/config/scripts/static-analysis/process-boundaries/sqlite-call-use-collector.mjs
new file mode 100644
index 00000000000..ad689f0b3b3
--- /dev/null
+++ b/config/scripts/static-analysis/process-boundaries/sqlite-call-use-collector.mjs
@@ -0,0 +1,166 @@
+import ts from 'typescript-api'
+import { propertyName, unwrap } from '../module-requests/static-module-specifiers.mjs'
+
+const METHODS = new Set(['prepare', 'run', 'get', 'all', 'iterate', 'exec'])
+const SQLITE_MODULE =
+ /^(?:node:sqlite|better-sqlite3)$|(?:^|\/)(?:sync-database|sqlite-statement)(?:\.[cm]?[jt]s)?$/
+
+// Local syntax only: imported SQLite types, typed receivers, constructors and prepare() results.
+export function countSqliteCalls(file, contents) {
+ const source = ts.createSourceFile(file, contents, ts.ScriptTarget.Latest, true)
+ if (source.parseDiagnostics.length) {
+ throw new Error(`Cannot parse ${file}; SQLite ratchet must not skip it.`)
+ }
+ const types = new Set()
+ const constructors = new Set()
+ const callableConstructors = new Set()
+ const receivers = new Set(file.endsWith('/sqlite/sync-database.ts') ? ['this'] : [])
+ const declarations = []
+ const calls = []
+ const key = (node) => unwrap(node)?.getText(source)
+ function constructor(node) {
+ const text = key(node)
+ return (
+ constructors.has(text) ||
+ ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) &&
+ types.has(key(node.expression)) &&
+ propertyName(node) === 'DatabaseSync')
+ )
+ }
+ function visit(node) {
+ if (ts.isImportDeclaration(node) && SQLITE_MODULE.test(node.moduleSpecifier.text)) {
+ const clause = node.importClause
+ if (clause?.name) {
+ types.add(clause.name.text)
+ if (!clause.isTypeOnly) {
+ constructors.add(clause.name.text)
+ if (node.moduleSpecifier.text === 'better-sqlite3') {
+ callableConstructors.add(clause.name.text)
+ }
+ }
+ }
+ const named = clause?.namedBindings
+ if (named && ts.isNamespaceImport(named)) {
+ types.add(named.name.text)
+ }
+ for (const element of named && ts.isNamedImports(named) ? named.elements : []) {
+ if (
+ ['DatabaseSync', 'StatementSync', 'SqliteStatement'].includes(
+ (element.propertyName ?? element.name).text
+ )
+ ) {
+ types.add(element.name.text)
+ if (!clause.isTypeOnly && !element.isTypeOnly) {
+ constructors.add(element.name.text)
+ }
+ }
+ }
+ }
+ if (
+ ts.isVariableDeclaration(node) &&
+ node.initializer &&
+ ts.isCallExpression(node.initializer) &&
+ ['require', 'process.getBuiltinModule'].includes(key(node.initializer.expression)) &&
+ node.initializer.arguments[0] &&
+ ts.isStringLiteral(node.initializer.arguments[0]) &&
+ SQLITE_MODULE.test(node.initializer.arguments[0].text)
+ ) {
+ if (ts.isIdentifier(node.name)) {
+ types.add(node.name.text)
+ constructors.add(node.name.text)
+ if (node.initializer.arguments[0].text === 'better-sqlite3') {
+ callableConstructors.add(node.name.text)
+ }
+ } else if (ts.isObjectBindingPattern(node.name)) {
+ for (const element of node.name.elements) {
+ if (
+ (element.propertyName ?? element.name).getText(source) === 'DatabaseSync' &&
+ ts.isIdentifier(element.name)
+ ) {
+ types.add(element.name.text)
+ constructors.add(element.name.text)
+ }
+ }
+ }
+ }
+ if (ts.isVariableDeclaration(node) || ts.isParameter(node) || ts.isPropertyDeclaration(node)) {
+ declarations.push(node)
+ }
+ if (ts.isCallExpression(node) || ts.isNewExpression(node)) {
+ calls.push(node)
+ }
+ ts.forEachChild(node, visit)
+ }
+ visit(source)
+ const sqliteType = (node) => {
+ if (!node) {
+ return false
+ }
+ if (ts.isUnionTypeNode(node)) {
+ return node.types.some(sqliteType)
+ }
+ if (!ts.isTypeReferenceNode(node)) {
+ return false
+ }
+ const name = node.typeName.getText(source)
+ return (
+ types.has(name.split('.')[0]) &&
+ (!name.includes('.') || /\.(Database|Statement|DatabaseSync|StatementSync)$/.test(name))
+ )
+ }
+ function instance(node) {
+ node = unwrap(node)
+ if (!node) {
+ return false
+ }
+ if (receivers.has(key(node))) {
+ return true
+ }
+ if (ts.isNewExpression(node)) {
+ return constructor(node.expression)
+ }
+ if (ts.isCallExpression(node) && callableConstructors.has(key(node.expression))) {
+ return true
+ }
+ if (
+ ts.isCallExpression(node) &&
+ (ts.isPropertyAccessExpression(node.expression) ||
+ ts.isElementAccessExpression(node.expression))
+ ) {
+ return propertyName(node.expression) === 'prepare' && instance(node.expression.expression)
+ }
+ return false
+ }
+ for (let changed = true; changed;) {
+ changed = false
+ for (const node of declarations) {
+ if (!ts.isIdentifier(node.name) || !(sqliteType(node.type) || instance(node.initializer))) {
+ continue
+ }
+ const names = [ts.isPropertyDeclaration(node) ? `this.${node.name.text}` : node.name.text]
+ if (ts.isParameter(node) && ts.isParameterPropertyDeclaration(node, node.parent)) {
+ names.push(`this.${node.name.text}`)
+ }
+ for (const name of names) {
+ if (!receivers.has(name)) {
+ receivers.add(name)
+ changed = true
+ }
+ }
+ }
+ }
+ return calls.filter((node) => {
+ const target = unwrap(node.expression)
+ if (ts.isNewExpression(node)) {
+ return constructor(target)
+ }
+ if (callableConstructors.has(key(target))) {
+ return true
+ }
+ return (
+ (ts.isPropertyAccessExpression(target) || ts.isElementAccessExpression(target)) &&
+ METHODS.has(propertyName(target)) &&
+ instance(target.expression)
+ )
+ }).length
+}
diff --git a/config/scripts/static-analysis/ratchet-baseline/ratchet-baseline.mjs b/config/scripts/static-analysis/ratchet-baseline/ratchet-baseline.mjs
index 10c0e0d0bfd..23cb7586345 100644
--- a/config/scripts/static-analysis/ratchet-baseline/ratchet-baseline.mjs
+++ b/config/scripts/static-analysis/ratchet-baseline/ratchet-baseline.mjs
@@ -195,7 +195,7 @@ export function runCountRatchet(ratchet, root, arg) {
}
if (shrunk.length > 0) {
console.error(
- `The baseline may only shrink. Fix it: pnpm check:${ratchet.name}-ratchet --prune`
+ `The baseline may only shrink. Fix it: ${ratchet.pruneCommand ?? `pnpm check:${ratchet.name}-ratchet --prune`}`
)
}
if (grown.length + shrunk.length > 0) {
diff --git a/config/scripts/static-analysis/ratchets/runtime-lifecycle/check-main-blocking-api-ratchet.mjs b/config/scripts/static-analysis/ratchets/runtime-lifecycle/check-main-blocking-api-ratchet.mjs
new file mode 100644
index 00000000000..3be64ba86ca
--- /dev/null
+++ b/config/scripts/static-analysis/ratchets/runtime-lifecycle/check-main-blocking-api-ratchet.mjs
@@ -0,0 +1,135 @@
+import path from 'node:path'
+import { pathToFileURL } from 'node:url'
+import ts from 'typescript-api'
+import { createGatedCallCollector } from '../../process-boundaries/gated-call-use-collector.mjs'
+import { countSqliteCalls } from '../../process-boundaries/sqlite-call-use-collector.mjs'
+import { isMainBlockingSource } from '../../process-boundaries/main-blocking-source-paths.mjs'
+import { propertyName } from '../../module-requests/static-module-specifiers.mjs'
+import { readTrackedSources, runCountRatchet } from '../../ratchet-baseline/ratchet-baseline.mjs'
+
+export const OFF_MAIN_ADVICE =
+ 'Move CPU or SQL work to a worker, utility process or the backend; async is right only for real I/O waits. Use asynchronous requests and replies for IPC.'
+const advice = (names) => Object.fromEntries(names.map((name) => [name, OFF_MAIN_ADVICE]))
+const collectors = new Map([
+ [
+ 'compression',
+ createGatedCallCollector(
+ [
+ {
+ modules: ['node:zlib', 'zlib'],
+ exportPattern: /Sync$/,
+ defaultAdvice: OFF_MAIN_ADVICE,
+ advice: advice([
+ 'gzipSync',
+ 'gunzipSync',
+ 'deflateSync',
+ 'inflateSync',
+ 'deflateRawSync',
+ 'inflateRawSync',
+ 'unzipSync',
+ 'brotliCompressSync',
+ 'brotliDecompressSync',
+ 'zstdCompressSync',
+ 'zstdDecompressSync'
+ ])
+ }
+ ],
+ 'main compression'
+ )
+ ],
+ [
+ 'crypto',
+ createGatedCallCollector(
+ [{ modules: ['node:crypto', 'crypto'], advice: advice(['pbkdf2Sync', 'scryptSync']) }],
+ 'main crypto'
+ )
+ ],
+ [
+ 'atomics',
+ createGatedCallCollector(
+ [{ modules: [], globals: ['Atomics'], advice: advice(['wait']) }],
+ 'main Atomics'
+ )
+ ]
+])
+
+export function countBlockingApis(sources) {
+ const counts = new Map(
+ ['compression', 'crypto', 'atomics', 'sqlite', 'ipc'].map((name) => [name, new Map()])
+ )
+ for (const [file, contents] of sources) {
+ if (!isMainBlockingSource(file)) {
+ continue
+ }
+ for (const [category, collector] of collectors) {
+ const { count } = collector.collectUses(file, contents)
+ if (count) {
+ counts.get(category).set(file, count)
+ }
+ }
+ const sql = countSqliteCalls(file, contents)
+ if (sql) {
+ counts.get('sqlite').set(file, sql)
+ }
+ const source = ts.createSourceFile(file, contents, ts.ScriptTarget.Latest, true)
+ let ipc = 0
+ function visit(node) {
+ if (
+ (file.startsWith('src/preload/') || file.startsWith('src/shared/')) &&
+ ts.isCallExpression(node) &&
+ (ts.isPropertyAccessExpression(node.expression) ||
+ ts.isElementAccessExpression(node.expression)) &&
+ propertyName(node.expression) === 'sendSync'
+ ) {
+ ipc++
+ }
+ if (
+ (file.startsWith('src/main/') || file.startsWith('src/shared/')) &&
+ ts.isBinaryExpression(node) &&
+ node.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
+ (ts.isPropertyAccessExpression(node.left) || ts.isElementAccessExpression(node.left)) &&
+ propertyName(node.left) === 'returnValue'
+ ) {
+ ipc++
+ }
+ ts.forEachChild(node, visit)
+ }
+ visit(source)
+ if (ipc) {
+ counts.get('ipc').set(file, ipc)
+ }
+ }
+ return counts
+}
+
+export function main(root = process.cwd(), arg = undefined) {
+ const counts = countBlockingApis(
+ readTrackedSources(root, ['src/main', 'src/shared', 'src/preload'], isMainBlockingSource)
+ )
+ let status = 0
+ for (const [category, current] of counts) {
+ const result = runCountRatchet(
+ {
+ name: `main-blocking-${category}`,
+ baselinePath: `config/main-blocking-${category}-baseline.txt`,
+ header: [
+ `# Legacy synchronous ${category} uses per file; counts may only go DOWN.`,
+ '# Only explicit worker/utility entry files are exempt; their imports remain guarded.'
+ ],
+ collect: () => current,
+ pruneCommand:
+ 'node config/scripts/static-analysis/ratchets/runtime-lifecycle/check-main-blocking-api-ratchet.mjs --prune',
+ unit: `blocking ${category} use(s)`,
+ fix: [OFF_MAIN_ADVICE]
+ },
+ root,
+ arg
+ )
+ status ||= result
+ }
+ return status
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+ process.exitCode = main(process.cwd(), process.argv[2])
+}
diff --git a/config/scripts/static-analysis/ratchets/runtime-lifecycle/check-main-blocking-api-ratchet.test.mjs b/config/scripts/static-analysis/ratchets/runtime-lifecycle/check-main-blocking-api-ratchet.test.mjs
new file mode 100644
index 00000000000..32e1a11584b
--- /dev/null
+++ b/config/scripts/static-analysis/ratchets/runtime-lifecycle/check-main-blocking-api-ratchet.test.mjs
@@ -0,0 +1,101 @@
+import { execFileSync } from 'node:child_process'
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { main as fsMain } from './check-main-sync-fs-ratchet.mjs'
+import '../../process-boundaries/check-main-sync-spawn-ratchet.mjs'
+import { countBlockingApis, main } from './check-main-blocking-api-ratchet.mjs'
+
+const file = 'src/main/consumer.ts'
+const counts = (source, name = file) =>
+ Object.fromEntries(
+ [...countBlockingApis(new Map([[name, source]]))].map(([category, rows]) => [
+ category,
+ rows.get(name) ?? 0
+ ])
+ )
+const roots = []
+afterEach(() => {
+ vi.restoreAllMocks()
+ for (const root of roots.splice(0)) {
+ rmSync(root, { recursive: true, force: true })
+ }
+})
+
+describe('main blocking API ratchets', () => {
+ it('guards typed SQL receivers without charging Map.get or async backup', () => {
+ expect(
+ counts(`import type Database from '../sqlite/sync-database'
+ class Owner {
+ db: Database.Database | null
+ query() { this.db.prepare('select').get(); this.db.backup('copy') }
+ }
+ function query(db: Database.Database, statement: Database.Statement, cache: Map) {
+ db.exec('schema'); statement.run(); cache.get('key')
+ }`)
+ ).toEqual({ compression: 0, crypto: 0, atomics: 0, sqlite: 4, ipc: 0 })
+ })
+
+ it('guards constructor properties and namespace SQLite types', () => {
+ expect(
+ counts(`import type * as sqlite from 'node:sqlite'
+ class Owner {
+ constructor(private readonly db: sqlite.DatabaseSync, private readonly statement: sqlite.StatementSync) {}
+ query() { this.db.prepare('select').get(); this.statement.run() }
+ }
+ function query(db: sqlite.DatabaseSync, statement: sqlite.StatementSync) { db.exec('sql'); statement.get() }
+ `).sqlite
+ ).toBe(5)
+ })
+
+ it('ignores strings, comments, unrelated SQL-shaped methods and nonblocking APIs', () => {
+ expect(
+ counts(`import * as c from 'node:crypto'; import * as z from 'node:zlib'
+ c.scrypt('pw'); z.gzip('bytes'); Atomics.waitAsync(buffer, 0, 0)
+ const db = { prepare() {}, exec() {}, get() {} }; db.prepare(); db.get(); db.exec()
+ const example = "Atomics.wait(buffer, 0, 0)" // c.scryptSync('pw')
+ `)
+ ).toEqual({ compression: 0, crypto: 0, atomics: 0, sqlite: 0, ipc: 0 })
+ })
+
+ it('rejects growth and shrinkage; prune cannot raise a baseline', () => {
+ const root = mkdtempSync(path.join(tmpdir(), 'orca-blocking-ratchet-'))
+ roots.push(root)
+ mkdirSync(path.join(root, 'src/main'), { recursive: true })
+ mkdirSync(path.join(root, 'config'))
+ const cryptoFile = path.join(root, 'config/main-blocking-crypto-baseline.txt')
+ writeFileSync(path.join(root, file), "import { scryptSync } from 'crypto'; scryptSync('pw')")
+ for (const category of ['crypto', 'compression', 'atomics', 'sqlite', 'ipc']) {
+ writeFileSync(path.join(root, `config/main-blocking-${category}-baseline.txt`), '# debt\n')
+ }
+ execFileSync('git', ['init', '--quiet'], { cwd: root })
+ execFileSync('git', ['add', '.'], { cwd: root })
+ mkdirSync(path.join(root, 'src/main/daemon'), { recursive: true })
+ const daemon = path.join(root, 'src/main/daemon/daemon-entry.ts')
+ writeFileSync(daemon, "import { statSync } from 'node:fs'; statSync('file')")
+ writeFileSync(
+ path.join(root, 'config/main-sync-fs-baseline.txt'),
+ '1 src/main/daemon/daemon-entry.ts\n'
+ )
+ execFileSync('git', ['add', '.'], { cwd: root })
+ const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+ vi.spyOn(console, 'log').mockImplementation(() => {})
+ expect(fsMain(root)).toBe(0)
+ writeFileSync(
+ daemon,
+ "import { statSync } from 'node:fs'; statSync('file'); statSync('another')"
+ )
+ expect(fsMain(root)).toBe(1)
+ expect(main(root)).toBe(1)
+ expect(error.mock.calls.flat().join('\n')).toContain('Move CPU or SQL work to a worker')
+ main(root, '--prune')
+ expect(readFileSync(cryptoFile, 'utf8')).not.toContain('1 src/')
+ writeFileSync(cryptoFile, '1 src/main/consumer.ts\n')
+ expect(main(root)).toBe(0)
+ writeFileSync(path.join(root, file), '')
+ expect(main(root)).toBe(1)
+ main(root, '--prune')
+ expect(main(root)).toBe(0)
+ })
+})
diff --git a/config/scripts/static-analysis/ratchets/runtime-lifecycle/check-main-sync-fs-ratchet.mjs b/config/scripts/static-analysis/ratchets/runtime-lifecycle/check-main-sync-fs-ratchet.mjs
index 82ad501f702..fccba49b072 100644
--- a/config/scripts/static-analysis/ratchets/runtime-lifecycle/check-main-sync-fs-ratchet.mjs
+++ b/config/scripts/static-analysis/ratchets/runtime-lifecycle/check-main-sync-fs-ratchet.mjs
@@ -2,6 +2,7 @@ import process from 'node:process'
import { pathToFileURL } from 'node:url'
import { createGatedCallCollector } from '../../process-boundaries/gated-call-use-collector.mjs'
import { readTrackedSources, runCountRatchet } from '../../ratchet-baseline/ratchet-baseline.mjs'
+import { isMainBlockingSource } from '../../process-boundaries/main-blocking-source-paths.mjs'
import { isTestOnlySourcePath } from '../../process-boundaries/test-only-source-path.mjs'
// Sync fs on Electron main stalls every window (and in the daemon/orcad, every terminal); per-spawn/RPC/focus stat and read sweeps were a recurring lag source (#39805, #35967, #38481).
@@ -10,7 +11,7 @@ const BASELINE_PATH = 'config/main-sync-fs-baseline.txt'
// src/shared runs on main too; leaving it out would let a helper move bypass the gate.
const SCAN_ROOTS = ['src/main', 'src/shared']
const ADVICE =
- 'use node:fs/promises, or cache the result on a stat fingerprint outside the hot path'
+ 'move CPU or SQL work to a worker, utility process or backend; async is right only for real I/O waits (node:fs/promises for filesystem waits)'
// Every *Sync export of node:fs (descriptor and copy APIs included), listed so the baseline doesn't depend on the runtime.
const SYNC_FS = [
'accessSync',
@@ -69,7 +70,12 @@ const collector = createGatedCallCollector(
)
function isScannedPath(rel) {
- return /\.[cm]?[jt]sx?$/.test(rel) && !rel.endsWith('.d.ts') && !isTestOnlySourcePath(rel)
+ return (
+ isMainBlockingSource(rel) &&
+ /\.[cm]?[jt]sx?$/.test(rel) &&
+ !rel.endsWith('.d.ts') &&
+ !isTestOnlySourcePath(rel)
+ )
}
export function countSyncFsCalls(rel, source) {
diff --git a/config/scripts/static-analysis/renderer-styles/renderer-tailwind-sources.test.mjs b/config/scripts/static-analysis/renderer-styles/renderer-tailwind-sources.test.mjs
deleted file mode 100644
index e06676bb5ab..00000000000
--- a/config/scripts/static-analysis/renderer-styles/renderer-tailwind-sources.test.mjs
+++ /dev/null
@@ -1,55 +0,0 @@
-import {
- cpSync,
- mkdtempSync,
- mkdirSync,
- readFileSync,
- rmSync,
- symlinkSync,
- writeFileSync
-} from 'node:fs'
-import { createRequire } from 'node:module'
-import { tmpdir } from 'node:os'
-import { join, resolve } from 'node:path'
-import { expect, it } from 'vitest'
-
-const require = createRequire(import.meta.resolve('@tailwindcss/vite'))
-const { compile } = require('@tailwindcss/node')
-const { Scanner } = require('@tailwindcss/oxide')
-
-it('generates renderer CSS from production files while excluding test and spec files', async () => {
- const root = mkdtempSync(join(tmpdir(), 'orca-tailwind-sources-'))
- try {
- const renderer = join(root, 'src', 'renderer', 'src')
- const assets = join(renderer, 'assets')
- cpSync(resolve('src/renderer/src/assets'), assets, { recursive: true })
- cpSync(resolve('src/shared/styles'), join(root, 'src', 'shared', 'styles'), { recursive: true })
- symlinkSync(resolve('node_modules'), join(root, 'node_modules'), 'junction')
- const components = join(renderer, 'components')
- mkdirSync(components)
- writeFileSync(join(components, 'example.tsx'), 'export const style = "z-[31415]"')
- writeFileSync(join(components, 'example.test.tsx'), 'export const style = "z-[27182]"')
- writeFileSync(join(components, 'example.spec.ts'), 'export const style = "z-[16180]"')
-
- const compiler = await compile(readFileSync(join(assets, 'main.css'), 'utf8'), {
- base: assets,
- onDependency() {}
- })
- const automaticSources =
- compiler.root === 'none' ? [] : [compiler.root ?? { base: root, pattern: '**/*' }]
- const scanner = new Scanner({
- sources: [
- ...automaticSources.map((source) => ({ ...source, negated: false })),
- ...compiler.sources
- ]
- })
- const css = compiler.build(scanner.scan())
- expect(css).toContain('z-index: 31415')
- expect(css).not.toContain('z-index: 27182')
- expect(css).not.toContain('z-index: 16180')
-
- writeFileSync(join(components, 'added.tsx'), 'export const style = "z-[14142]"')
- expect(compiler.build(scanner.scan())).toContain('z-index: 14142')
- } finally {
- rmSync(root, { recursive: true, force: true })
- }
-})
diff --git a/config/scripts/static-analysis/repository-layout/check-workspace-layout-rules.mjs b/config/scripts/static-analysis/repository-layout/check-workspace-layout-rules.mjs
index 402dc443fd3..5a9952afa0a 100644
--- a/config/scripts/static-analysis/repository-layout/check-workspace-layout-rules.mjs
+++ b/config/scripts/static-analysis/repository-layout/check-workspace-layout-rules.mjs
@@ -23,7 +23,7 @@ try {
contents: `
export { readPersistedProfileState } from './tests/e2e/helpers/persisted-profile-state'
export { partitionsFromProfileRoot } from './tests/e2e/helpers/workspace-layout-oracle-views'
- export { checkWorkspaceLayoutRules } from './src/shared/workspace-layout/workspace-layout-rules'
+ export { checkWorkspaceLayoutRules } from './src/shared/workspace-layout/invariants/workspace-layout-rules'
`,
resolveDir: root,
loader: 'ts'
diff --git a/config/scripts/test-runtime/environment/vitest-caller-identity-env-setup.ts b/config/scripts/test-runtime/environment/vitest-caller-identity-env-setup.ts
index eb8cd17bbf7..ed00c9ae8b6 100644
--- a/config/scripts/test-runtime/environment/vitest-caller-identity-env-setup.ts
+++ b/config/scripts/test-runtime/environment/vitest-caller-identity-env-setup.ts
@@ -1,4 +1,5 @@
// Clear the launching terminal’s inherited Orca identity so test branches depend on fixture env, not which agent launched runner.
+// Clear the launching terminal's identity too: macOS /etc/zshrc and /etc/bashrc source /etc/{zsh,bash}rc_$TERM_PROGRAM.
for (const name of [
'ORCA_AGENT_SESSION_ID',
'ORCA_STRUCTURED_SESSION',
@@ -6,7 +7,10 @@ for (const name of [
'ORCA_WORKSPACE_ID',
'ORCA_RUNTIME_SOURCE_ID',
'ORCA_RUNTIME_SOURCE_INCARNATION',
- 'ORCA_RUNTIME_SOURCE_PROFILE_PATH'
+ 'ORCA_RUNTIME_SOURCE_PROFILE_PATH',
+ 'TERM_PROGRAM',
+ 'TERM_PROGRAM_VERSION',
+ 'TERM_SESSION_ID'
]) {
delete process.env[name]
}
diff --git a/config/scripts/test-runtime/environment/vitest-git-signing-env.mjs b/config/scripts/test-runtime/environment/vitest-git-signing-env.mjs
new file mode 100644
index 00000000000..67d82d400eb
--- /dev/null
+++ b/config/scripts/test-runtime/environment/vitest-git-signing-env.mjs
@@ -0,0 +1,64 @@
+import { execFileSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import { existsSync, mkdirSync, renameSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+
+// Per-checkout, user-owned: a predictable name in a shared /tmp could be planted by another user.
+const CACHE_DIR = resolve(import.meta.dirname, '../../../../node_modules/.cache')
+
+function signsByDefault(env) {
+ try {
+ const values = execFileSync(
+ 'git',
+ [
+ 'config',
+ '--type=bool',
+ '--get-regexp',
+ '^(commit\\.gpgsign|tag\\.(gpgsign|forcesignannotated))$'
+ ],
+ { cwd: tmpdir(), env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
+ )
+ return /\strue$/m.test(values)
+ } catch {
+ return false
+ }
+}
+
+/**
+ * Real-git fixtures must not sign with the developer's key, and `tag.gpgsign` breaks `git tag `.
+ * The rest of the global config (e.g. safe.directory) still applies; `~` keeps HOME-isolated fixtures isolated.
+ */
+export function gitSigningOffEnv(env = process.env) {
+ if (!signsByDefault(env)) {
+ return {}
+ }
+ const inherited = env.GIT_CONFIG_GLOBAL
+ ? [resolve(env.GIT_CONFIG_GLOBAL)]
+ : [
+ env.XDG_CONFIG_HOME
+ ? join(resolve(env.XDG_CONFIG_HOME), 'git', 'config')
+ : '~/.config/git/config',
+ '~/.gitconfig'
+ ]
+ const config = [
+ '[include]',
+ ...inherited.map((path) => `\tpath = ${JSON.stringify(path.replaceAll('\\', '/'))}`),
+ '[commit]',
+ '\tgpgsign = false',
+ '[tag]',
+ '\tgpgsign = false',
+ '\tforceSignAnnotated = false',
+ ''
+ ].join('\n')
+ const hash = createHash('sha256').update(config).digest('hex').slice(0, 16)
+ const file = join(CACHE_DIR, `orca-vitest-unsigned-${hash}.gitconfig`)
+ if (!existsSync(file)) {
+ mkdirSync(CACHE_DIR, { recursive: true })
+ // Concurrent runs may share the cache; rename so no git ever reads a half-written file.
+ const partial = `${file}.${process.pid}`
+ writeFileSync(partial, config)
+ renameSync(partial, file)
+ }
+ return { GIT_CONFIG_GLOBAL: file }
+}
diff --git a/config/scripts/test-runtime/environment/vitest-git-signing-env.test.mjs b/config/scripts/test-runtime/environment/vitest-git-signing-env.test.mjs
new file mode 100644
index 00000000000..05e1a70c271
--- /dev/null
+++ b/config/scripts/test-runtime/environment/vitest-git-signing-env.test.mjs
@@ -0,0 +1,43 @@
+import { execFileSync } from 'node:child_process'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import { afterEach, expect, it } from 'vitest'
+import { gitSigningOffEnv } from './vitest-git-signing-env.mjs'
+
+const cleanup = []
+
+afterEach(() => {
+ for (const path of cleanup.splice(0)) {
+ rmSync(path, { recursive: true, force: true })
+ }
+})
+
+it('commits and tags unsigned under a signing global config, keeping its other settings', () => {
+ const root = mkdtempSync(join(tmpdir(), 'orca-git-signing-env-'))
+ cleanup.push(root)
+ const globalConfig = join(root, 'global.gitconfig')
+ // Forward slashes: a backslash starts an escape in a gitconfig value.
+ const missingSigner = join(root, 'missing-signer').replaceAll('\\', '/')
+ writeFileSync(
+ globalConfig,
+ `[commit]\n\tgpgsign = true\n[tag]\n\tgpgsign = true\n\tforceSignAnnotated = true\n[gpg]\n\tprogram = ${missingSigner}\n[user]\n\tname = Test\n\temail = test@example.invalid\n`
+ )
+ const inherited = { ...process.env, GIT_CONFIG_GLOBAL: globalConfig, GIT_CONFIG_NOSYSTEM: '1' }
+ const env = { ...inherited, ...gitSigningOffEnv(inherited) }
+ cleanup.push(env.GIT_CONFIG_GLOBAL)
+ expect(dirname(env.GIT_CONFIG_GLOBAL)).toBe(
+ resolve(import.meta.dirname, '../../../../node_modules/.cache')
+ )
+ const git = (...args) =>
+ execFileSync('git', args, { cwd: root, env, encoding: 'utf8', stdio: 'pipe' }).trim()
+
+ git('init', '--quiet')
+ git('commit', '--quiet', '--allow-empty', '-m', 'fixture')
+ git('tag', 'v1.0.0')
+ git('tag', '-m', 'release', 'v1.0.1')
+
+ expect(git('cat-file', '-t', 'v1.0.0')).toBe('commit')
+ expect(git('log', '-1', '--format=%an %G?')).toBe('Test N')
+ expect(gitSigningOffEnv({ ...inherited, GIT_CONFIG_GLOBAL: join(root, 'missing') })).toEqual({})
+})
diff --git a/config/scripts/test-runtime/environment/vitest-orcad-feature-readiness-reset.ts b/config/scripts/test-runtime/environment/vitest-orcad-feature-readiness-reset.ts
index b5480be2016..8675c384f75 100644
--- a/config/scripts/test-runtime/environment/vitest-orcad-feature-readiness-reset.ts
+++ b/config/scripts/test-runtime/environment/vitest-orcad-feature-readiness-reset.ts
@@ -1,6 +1,6 @@
// A startOrcad test that fails partway must not leave latches closed: later tests in the worker would wait 10 s.
import { afterEach } from 'vitest'
-import { _resetOrcadFeatureReadinessForTests } from '../../../../src/main/runtime/rpc/orcad-feature-readiness'
+import { _resetOrcadFeatureReadinessForTests } from '../../../../src/main/runtime/rpc/startup/orcad-readiness'
afterEach(() => {
_resetOrcadFeatureReadinessForTests()
diff --git a/config/scripts/test-runtime/sqlite-admission/vitest-node-runtime-files.mjs b/config/scripts/test-runtime/sqlite-admission/vitest-node-runtime-files.mjs
index d7f4c05c431..669928bd511 100644
--- a/config/scripts/test-runtime/sqlite-admission/vitest-node-runtime-files.mjs
+++ b/config/scripts/test-runtime/sqlite-admission/vitest-node-runtime-files.mjs
@@ -12,14 +12,13 @@ const NODE_RUNTIME_INCLUDE = [
'tests/e2e/cursor-quota-transport.unit.test.ts',
'tests/e2e/helpers/electron-process-shutdown.unit.test.ts',
'src/main/ai-vault-search/storage/session-search-index-writer.test.ts',
- 'src/main/ai-vault/session-scanner-unlimited-dedup.test.ts',
+ 'src/main/ai-vault/parsing/session-scanner-unlimited-dedup.test.ts',
// The parse cache persists through node:sqlite.
'src/main/ai-vault/parse-cache/session-parse-cache-antigravity-upgrade.test.ts',
'src/main/ai-vault/parse-cache/session-parse-cache-persistence.test.ts',
- 'src/main/ai-vault/session-scanner-scope-cwd-facts.test.ts',
- 'src/main/ai-vault/session-scanner-scope-walk.test.ts',
+ 'src/main/ai-vault/scope/session-scanner-scope-walk.test.ts',
// The forced-probe handoff race opens only under V8's promise scheduling, which Electron main uses.
- 'src/main/github/rate-limit.test.ts',
+ 'src/main/github/api/rate-limit.test.ts',
// Electron main bridges streams with Node's implementation.
'src/main/host/electron-http-client.test.ts',
'src/main/browser/extensions/native-messaging/browser-extension-native-host-process-backpressure.test.ts',
@@ -33,8 +32,7 @@ const NODE_RUNTIME_INCLUDE = [
'config/scripts/test-runtime/dom/happy-dom-mutation-observer-retention.test.ts',
// These reach Node SQLite through a shared helper or a dynamic import, which the scan skips.
'src/main/agent-hooks/server/testing/providers/codex/server-codex-session-start.test.ts',
- 'src/main/claude/claude-transcript-catch-up.test.ts',
- 'src/main/claude/claude-transcript-duration.test.ts',
+ 'src/main/claude/transcripts/claude-transcript-catch-up.test.ts',
'tests/e2e/native-chat-startup-option-pickers.unit.test.ts',
'src/main/ai-vault/transcripts/session-document-consumer-replacement.test.ts',
'src/main/ai-vault-search/indexing/session-search-dependent-transcripts.test.ts',
@@ -42,12 +40,8 @@ const NODE_RUNTIME_INCLUDE = [
'src/main/runtime/rpc/server/orchestration-cli-subprocess.test.ts',
'src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts',
'src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing.test.ts',
- 'src/main/runtime/orchestration/workers/archives/worker-terminal-archive-release.test.ts',
- 'src/main/runtime/orchestration/workers/archives/worker-terminal-archive-screen.test.ts',
- 'src/main/runtime/orchestration/workers/archives/worker-terminal-wrap-provenance.test.ts',
'tests/e2e/cross-version-wire/agent-session-clear-old-client.unit.test.ts',
'tests/e2e/cross-version-wire/agent-session-clear-old-tab-mirror.unit.test.ts',
- 'tests/e2e/cross-version-wire/host-model-catalog-released-phone.unit.test.ts',
'src/main/pi/rpc/rpc-session-startup.test.ts',
'src/main/acp/session/acp-structured-omp-recordings.test.ts',
'src/main/native-chat/agent-session-wire/host/testing/structured-agent-session-clear-queued-command.test.ts',
@@ -60,7 +54,6 @@ const NODE_RUNTIME_INCLUDE = [
'src/main/runtime/construction/orca-runtime.test.ts',
'src/main/runtime/workspaces/startup/worktree-agent-first-surface.test.ts',
'src/main/runtime/client/settings/runtime-client-agent-launch-settings-durability.test.ts',
- 'tests/e2e/host-agent-launch-settings-hook-bookkeeping.unit.test.ts',
'src/cli/**/*.test.ts',
'src/main/persistence/**/*.test.ts',
'src/main/persistence*.test.ts',
@@ -93,7 +86,7 @@ const NODE_RUNTIME_INCLUDE = [
'src/main/ipc/command-path/command-path-directory-worker.test.ts',
// Asserts Node's spawn-failure close signal and that a dead worker closes its children's pipes.
'src/main/worker-thread-child-process/worker-thread-child-process.test.ts',
- 'src/main/git/command-runner/worker-exec-file.test.ts',
+ 'src/main/git/command-runner/process-capture/worker-exec-file.test.ts',
'src/main/git/worktrees/removal/worktree-removal-real-git.test.ts',
'src/main/git/worktrees/catalog/worktree-list-paths.test.ts',
'src/main/runtime/workspaces/removal/runtime-failed-local-worktree-removal.test.ts',
@@ -114,28 +107,26 @@ const NODE_RUNTIME_INCLUDE = [
// Playwright's CDP transport needs Node's WebSocket implementation.
'src/main/browser/guest-lifecycle/popups/presentation/popup-origin-chrome.electron.test.ts',
'src/main/browser/guest-lifecycle/navigation/browser-link-materialization.electron.test.ts',
- 'src/main/browser/guest-lifecycle/popups/compatibility/browser-popup-compatibility.electron.test.ts',
'src/main/browser/guest-lifecycle/popups/compatibility/browser-popup-native-compatibility.electron.test.ts',
'src/main/browser/guest-lifecycle/popups/compatibility/browser-popup-background-compatibility.electron.test.ts',
'src/main/ai-vault/scanners/devin/session-scanner-devin-db.test.ts',
'src/shared/workspace-session/workspace-session-salvage.test.ts',
- 'src/main/git/repo-detection.test.ts',
+ 'src/main/git/repositories/discovery/repo-detection.test.ts',
'src/renderer/src/components/browser-pane/annotate/browser-grab-toast-owner-cleanup.test.tsx',
- 'src/main/window/native-chat-paste-files.test.ts',
+ 'src/main/native-chat/paste-files/native-chat-paste-files.test.ts',
'src/main/computer/desktop-script/runtime-host/desktop-script-serve-channel.test.ts',
'src/main/providers/local-pty/local-pty-child-process-verdict.test.ts',
'src/main/providers/working-directory-validation.test.ts',
'src/main/pty/process-retirement/posix-pty-process-groups.integration.test.ts',
'src/shared/ephemeral-vm-recipe-output-capture.test.ts',
- 'src/main/window/main-window-updater-deferred-setup.test.ts',
+ 'src/main/updater/lifecycle/main-window-updater-deferred-setup.test.ts',
'src/renderer/src/components/terminal-pane/host-state/terminal-pane-host-state-memo.test.ts',
'src/main/native-chat/agent-session-journal/**/*.test.ts',
'src/main/native-chat/agent-session-wire/host/testing/structured-agent-session-terminal-writer-acquire.test.ts',
'src/main/runtime/agent-session/records/agent-session-conversation-name-store.test.ts',
- 'src/main/runtime/rpc/ws-transport.test.ts',
'src/main/runtime/rpc/methods/structured-sessions/attachments/structured-agent-session-visual.test.ts',
// Bun resolves 'ws' to its built-in client, which bypasses the patched package.
- 'src/main/runtime/rpc/ws-empty-payload-frame-write.test.ts',
+ 'src/main/runtime/rpc/transports/websocket/ws-empty-payload-frame-write.test.ts',
'src/shared/remote-runtime/remote-runtime-client.test.ts',
'src/shared/remote-runtime/remote-runtime-connect-bound.test.ts',
// Bun's built-in ws client ignores maxPayload; the product opener only runs on Node.
@@ -150,18 +141,15 @@ const NODE_RUNTIME_INCLUDE = [
'src/main/ipc/renderer-shutdown-checkpoint-sleep-records.test.ts',
'src/main/runtime/agent-session/records/structured-agent-session-startup-tab-restore.test.ts',
'src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts',
- 'src/main/runtime/mobile-cloud-relay/relay-control-client.test.ts',
+ 'src/main/runtime/mobile-cloud-relay/control-channel/relay-control-client.test.ts',
'src/main/ipc/filesystem/watchers/filesystem-watcher-ignore-real.test.ts',
'src/main/ipc/runtime-environments/runtime-environment-preference.test.ts',
- // Real fs.watch file bindings; Bun's watcher is not the one Electron runs.
- 'src/main/ipc/filesystem/watcher-process/rebinding-file-watch.test.ts',
- 'src/main/ipc/filesystem/watcher-process/parcel-watcher-shallow-file-subscription.test.ts',
'src/renderer/src/components/emulator-pane/emulator-device-frame-visibility.test.tsx',
- 'src/main/claude/claude-agent-sdk-contract-pins.test.ts',
'config/scripts/desktop-distribution/runtime-verification/process-host-dev-rebuild.test.ts',
'config/scripts/test-runtime/node-worker/vitest-node-runtime-pool.test.ts',
// Reopen WAL-backed row caches read-only, which Bun on macOS cannot.
'src/main/agent-hooks/server/testing/identity/server-hook-session-binding.test.ts',
+ 'src/main/agent-hooks/server/testing/persistence/server-last-status-claude-model.test.ts',
'tests/e2e/helpers/persisted-profile-state.unit.test.ts',
'src/main/runtime/push/notifications/mobile-notification-dismissal-store.test.ts',
'src/main/runtime/push/notifications/mobile-notification-dismissal-read-failure.test.ts',
diff --git a/config/scripts/tool-invocation/pnpm-cli-invocation.test.mjs b/config/scripts/tool-invocation/pnpm-cli-invocation.test.mjs
deleted file mode 100644
index 0e49612637e..00000000000
--- a/config/scripts/tool-invocation/pnpm-cli-invocation.test.mjs
+++ /dev/null
@@ -1,156 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import { resolvePnpmCliInvocation } from './pnpm-cli-invocation.mjs'
-
-const nodeExecPath = '/usr/local/bin/node'
-
-describe('resolvePnpmCliInvocation', () => {
- // Why: config/vitest.config.ts does not set unstubEnvs, so stubs would leak into later cases.
- afterEach(() => {
- vi.unstubAllEnvs()
- })
-
- it('runs a JS CLI through node so older pnpm.cjs still works', () => {
- expect(
- resolvePnpmCliInvocation({
- npmExecPath: '/Users/runner/setup-pnpm/node_modules/pnpm/bin/pnpm.cjs',
- nodeExecPath,
- platform: 'darwin'
- })
- ).toEqual({
- command: nodeExecPath,
- prefixArgs: ['/Users/runner/setup-pnpm/node_modules/pnpm/bin/pnpm.cjs'],
- shell: false
- })
- })
-
- it('executes pnpm 12 native binaries directly instead of through node', () => {
- expect(
- resolvePnpmCliInvocation({
- npmExecPath: '/Users/runner/setup-pnpm/pnpm',
- nodeExecPath,
- platform: 'darwin'
- })
- ).toEqual({
- command: '/Users/runner/setup-pnpm/pnpm',
- prefixArgs: [],
- shell: false
- })
- })
-
- it.each([
- ['/usr/share/nodejs/npm/bin/npx-cli.js', 'linux', 'pnpm', false],
- ['/usr/local/lib/node_modules/npm/bin/npm-cli.js', 'darwin', 'pnpm', false],
- ['/Users/dev/.volta/tools/image/npm/10.8.0/bin/npm-cli.js', 'darwin', 'pnpm', false],
- ['C:\\Program Files\\nodejs\\node_modules\\npm\\bin\\npx-cli.js', 'win32', 'pnpm.cmd', true]
- ])(
- 'ignores the npm CLI %s that `npx` or `npm run` exports',
- (npmExecPath, platform, command, shell) => {
- expect(
- resolvePnpmCliInvocation({ npmExecPath, nodeExecPath, platform, pnpmHome: '' })
- ).toEqual({ command, prefixArgs: [], shell })
- }
- )
-
- it('shells out for every Windows batch wrapper extension and casing', () => {
- for (const npmExecPath of [
- 'C:\\Users\\runner\\pnpm.cmd',
- 'C:\\Users\\runner\\pnpm.bat',
- 'C:\\tools\\PNPM.CMD',
- 'C:\\tools\\PNPM.BAT'
- ]) {
- expect(
- resolvePnpmCliInvocation({
- npmExecPath,
- nodeExecPath: 'C:\\Program Files\\nodejs\\node.exe',
- platform: 'win32'
- })
- ).toEqual({ command: npmExecPath, prefixArgs: [], shell: true })
- }
- })
-
- // Why: only cmd.exe needs the shell hop; a .cmd-named path elsewhere must still exec directly.
- it('does not shell out for a .cmd path on a non-Windows platform', () => {
- for (const platform of ['darwin', 'linux']) {
- expect(
- resolvePnpmCliInvocation({ npmExecPath: '/opt/pnpm.cmd', nodeExecPath, platform })
- ).toEqual({ command: '/opt/pnpm.cmd', prefixArgs: [], shell: false })
- }
- })
-
- it('uses the flat native Windows install when exec supplies no npm_execpath', () => {
- vi.stubEnv('npm_execpath', undefined)
- vi.stubEnv('PNPM_HOME', 'C:\\Users\\Runner Admin\\setup-pnpm')
- const native = 'C:\\Users\\Runner Admin\\setup-pnpm\\pnpm.exe'
- const fileExists = vi.fn((path) => path === native)
- expect(resolvePnpmCliInvocation({ platform: 'win32', fileExists })).toEqual({
- command: native,
- prefixArgs: [],
- shell: false
- })
- expect(fileExists.mock.calls.map(([path]) => path)).toEqual([
- 'C:\\Users\\Runner Admin\\setup-pnpm\\bin\\pnpm.exe',
- native
- ])
- })
-
- it('prefers the updated native bin entry over the original native install', () => {
- const native = 'C:\\pnpm\\bin\\pnpm.exe'
- const fileExists = vi.fn(() => true)
- expect(
- resolvePnpmCliInvocation({
- npmExecPath: '',
- platform: 'win32',
- pnpmHome: 'C:/pnpm',
- fileExists
- })
- ).toEqual({ command: native, prefixArgs: [], shell: false })
- expect(fileExists).toHaveBeenCalledExactlyOnceWith(native)
- })
-
- it.each([
- ['C:\\legacy\\pnpm.cjs', nodeExecPath, ['C:\\legacy\\pnpm.cjs'], false],
- ['C:\\legacy\\pnpm.CMD', 'C:\\legacy\\pnpm.CMD', [], true],
- ['C:\\legacy\\pnpm.exe', 'C:\\legacy\\pnpm.exe', [], false]
- ])('keeps explicit %s ahead of any native home fallback', (entry, command, prefixArgs, shell) => {
- const fileExists = vi.fn(() => true)
- expect(
- resolvePnpmCliInvocation({
- npmExecPath: entry,
- nodeExecPath,
- platform: 'win32',
- pnpmHome: 'C:\\pnpm',
- fileExists
- })
- ).toEqual({ command, prefixArgs, shell })
- expect(fileExists).not.toHaveBeenCalled()
- })
-
- it.each(['', 'pnpm', 'C:pnpm'])('does not probe the relative or empty home %s', (pnpmHome) => {
- const fileExists = vi.fn(() => true)
- expect(
- resolvePnpmCliInvocation({ npmExecPath: '', platform: 'win32', pnpmHome, fileExists })
- ).toEqual({ command: 'pnpm.cmd', prefixArgs: [], shell: true })
- expect(fileExists).not.toHaveBeenCalled()
- })
-
- it('keeps the batch fallback when the native home files are absent', () => {
- const fileExists = vi.fn(() => false)
- expect(
- resolvePnpmCliInvocation({
- npmExecPath: '',
- platform: 'win32',
- pnpmHome: 'C:\\pnpm',
- fileExists
- })
- ).toEqual({ command: 'pnpm.cmd', prefixArgs: [], shell: true })
- expect(fileExists).toHaveBeenCalledTimes(2)
- })
-
- it.each(['darwin', 'linux'])('does not use a Windows home lookup on %s', (platform) => {
- const fileExists = vi.fn(() => true)
- expect(
- resolvePnpmCliInvocation({ npmExecPath: '', platform, pnpmHome: 'C:\\pnpm', fileExists })
- ).toEqual({ command: 'pnpm', prefixArgs: [], shell: false })
- expect(fileExists).not.toHaveBeenCalled()
- })
-})
diff --git a/config/scripts/workflow/source-routing/pr-code-change-scope.mjs b/config/scripts/workflow/source-routing/pr-code-change-scope.mjs
index 971ee6708a7..2236be8aa5e 100644
--- a/config/scripts/workflow/source-routing/pr-code-change-scope.mjs
+++ b/config/scripts/workflow/source-routing/pr-code-change-scope.mjs
@@ -130,10 +130,10 @@ const CODEX_INDEX_HEAL_CONTRACT_PREFIXES = [
]
const ORCAD_BROWSER_PREFIXES = [
- 'src/main/orcad/external-chromium-',
- 'src/main/orcad/orcad-browser-provider',
- 'src/main/orcad/orcad-agent-browser-binary',
- 'src/main/orcad/electron-serve-browser-process'
+ 'src/main/orcad/browser-providers/chromium/external-chromium-',
+ 'src/main/orcad/browser-providers/orcad-browser-provider',
+ 'src/main/orcad/browser-providers/orcad-agent-browser-binary',
+ 'src/main/orcad/browser-providers/electron/electron-serve-browser-process'
]
// Include page build/verification/manifest/packaging, entry/routes/imported mobile sources and render-check shell policy.
@@ -211,7 +211,7 @@ const CROSS_VERSION_WIRE_PREFIXES = [
'src/shared/browser/client-hosting/browser-client-host-protocol',
'src/shared/browser/network/tunnels/browser-network-tunnel-protocol',
// Both released/current WebSocket transports must accept web upgrade marker (cross-version-web-upgrade-marker).
- 'src/main/runtime/rpc/ws-transport.ts',
+ 'src/main/runtime/rpc/transports/websocket/ws-transport.ts',
'src/shared/web-origin-security.ts',
'src/shared/browser/client-hosting/browser-client-host-placement',
'src/shared/agent-launch/contracts/agent-launch-intent',
@@ -241,7 +241,7 @@ const CROSS_VERSION_WIRE_PREFIXES = [
'src/shared/agent-session-record',
'src/shared/agent-session-provider-handle',
'src/shared/agent-session/journal/',
- 'src/main/ai-vault/structured-session-ownership.ts',
+ 'src/main/ai-vault/structured-sessions/structured-session-ownership.ts',
'src/main/native-chat/agent-session-journal/',
'src/main/native-chat/agent-session-wire/',
// The released phone contract runs the current discovery owner and Claude producer.
@@ -251,18 +251,18 @@ const CROSS_VERSION_WIRE_PREFIXES = [
'src/main/native-chat/agent-model-catalog/agent-model-catalog-lister.ts',
'src/main/native-chat/agent-model-catalog/agent-model-catalog-listing-waiters.ts',
'src/main/native-chat/agent-model-catalog/agent-model-catalog-probe-runner.ts',
- 'src/main/claude/claude-model-catalog-probe.ts',
+ 'src/main/claude/model-catalog/claude-model-catalog-probe.ts',
'src/main/runtime/agent-session/records/agent-session-record-store',
'src/main/runtime/agent-session/records/agent-session-recovery-capsule',
'src/shared/agent-session-resume-marker',
'src/main/runtime/rpc/dispatcher',
// Run on every request the suites dispatch, whatever its method.
'src/main/runtime/rpc/core.ts',
- 'src/main/runtime/rpc/errors.ts',
- 'src/main/runtime/rpc/orchestration-contract-fence.ts',
- 'src/main/runtime/rpc/orchestration-session-caller.ts',
- 'src/main/runtime/rpc/orchestration-legacy-compatibility.ts',
- 'src/main/runtime/rpc/orchestration-mutation-executor.ts',
+ 'src/main/runtime/rpc/responses/rpc-response.ts',
+ 'src/main/runtime/rpc/orchestration/compatibility/orchestration-contract-fence.ts',
+ 'src/main/runtime/rpc/orchestration/callers/orchestration-session-caller.ts',
+ 'src/main/runtime/rpc/orchestration/compatibility/orchestration-legacy-compatibility.ts',
+ 'src/main/runtime/rpc/orchestration/mutations/orchestration-mutation-executor.ts',
'src/shared/orchestration/orchestration-rpc-contract.ts',
'src/main/runtime/rpc/methods/agent-launch/agent-launch',
'src/main/runtime/rpc/methods/history/ai-vault.ts',
diff --git a/config/scripts/workflow/source-routing/pr-code-change-scope.test.mjs b/config/scripts/workflow/source-routing/pr-code-change-scope.test.mjs
index 4808097d99b..82a352b868a 100644
--- a/config/scripts/workflow/source-routing/pr-code-change-scope.test.mjs
+++ b/config/scripts/workflow/source-routing/pr-code-change-scope.test.mjs
@@ -1,9 +1,27 @@
import { spawn } from 'node:child_process'
+import { readFileSync } from 'node:fs'
import { resolve } from 'node:path'
import { describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { UNIT_EXCLUDE } from '../../ci/unit-selection/dependency-graph/ci-unit-files.mjs'
+import { classifyPrJobs } from './pr-code-change-scope.mjs'
const projectDir = resolve(import.meta.dirname, '../../../..')
+const SHELL_CONTRACTS_STEP = 'Test real shell contracts'
+
+/** Every test file the shell contracts step's whole `run` script names, across all of its commands.
+ * The YAML parser owns the block's extent, so a blank line or a later command cannot truncate the
+ * list (C3-3). Null when the step is gone. */
+function shellContractsStepTests(workflowYaml) {
+ const steps = parse(workflowYaml)?.jobs?.shell_contracts?.steps ?? []
+ const step = steps.find((candidate) => candidate?.name === SHELL_CONTRACTS_STEP)
+ if (typeof step?.run !== 'string') {
+ return null
+ }
+ return step.run.split(/\s+/).filter((token) => token.endsWith('.test.ts'))
+}
+
describe('per-job path classification', () => {
// Mobile-only edits must run audits that lint mobile; skipped audits let #20702 duplicate imports break later merge refs.
@@ -58,4 +76,22 @@ describe('per-job path classification', () => {
expect(stdout).toContain('should_run=true\n')
expect(stdout).toContain('xterm_patch_sync=true\n')
})
+
+ // Unit shards exclude live-shell tests, so a test the shell contracts job runs must also route a focused
+ // edit to that job; otherwise a change to it, or to what it guards, runs no real shell at all (STA-2380 C2 F1).
+ it('routes every test the shell contracts job runs to shell_contracts', () => {
+ const tests = shellContractsStepTests(
+ readFileSync(resolve(projectDir, '.github/workflows/pr.yml'), 'utf8')
+ )
+ expect(tests, `pr.yml must keep the "${SHELL_CONTRACTS_STEP}" step`).not.toBeNull()
+ // Partial-omission guard with an independent source: every real-shell test the unit shards exclude
+ // is run by this job or by nothing, so each must appear in the parsed step.
+ const realShellTests = UNIT_EXCLUDE.filter((file) =>
+ /\.(?:live-shell|node-pty)\.test\.ts$/.test(file)
+ )
+ expect(realShellTests.length).toBeGreaterThan(0)
+ expect(tests).toEqual(expect.arrayContaining(realShellTests))
+ const unrouted = tests.filter((file) => classifyPrJobs([file]).shell_contracts !== true)
+ expect(unrouted).toEqual([])
+ })
})
diff --git a/config/scripts/workflow/source-routing/pr-e2e-source-routing.mjs b/config/scripts/workflow/source-routing/pr-e2e-source-routing.mjs
index ff23fadcffa..185f388ef22 100644
--- a/config/scripts/workflow/source-routing/pr-e2e-source-routing.mjs
+++ b/config/scripts/workflow/source-routing/pr-e2e-source-routing.mjs
@@ -132,7 +132,7 @@ export const PR_E2E_SOURCE_ROUTES = [
file
) ||
(isProductSource(file) &&
- /^src\/(?:cli\/runtime\/(?:launch|serve-)|main\/orcad\/(?:main|orcad-entry|orcad-command-startup|orcad-instance-lock|orcad-command-arguments|orcad-lifecycle)\.ts$|main\/startup\/desktop-profile-instance-lock\.ts$|main\/daemon\/(?:[^/]+\/)*daemon-(?:spawner|endpoint-adoption|init)|main\/server\/serve-)/.test(
+ /^src\/(?:cli\/runtime\/(?:launch|serve-)|main\/orcad\/(?:main|orcad-entry|orcad-command-startup|orcad-instance-lock|orcad-command-arguments|orcad-lifecycle)\.ts$|main\/startup\/profile-startup\/desktop-profile-instance-lock\.ts$|main\/daemon\/(?:[^/]+\/)*daemon-(?:spawner|endpoint-adoption|init)|main\/server\/serve-)/.test(
file
))
},
@@ -142,14 +142,16 @@ export const PR_E2E_SOURCE_ROUTES = [
matches: (file) =>
file === 'tests/e2e/helpers/orca-serve-cli-host.ts' ||
(isProductSource(file) &&
- /^src\/main\/startup\/(?:windows-app-data-path|main-process-preflight)\.ts$/.test(file))
+ /^src\/main\/startup\/(?:windows-startup\/windows-app-data-path|main-process-preflight)\.ts$/.test(
+ file
+ ))
},
{
id: 'clipboard.windows-copy-file',
specs: ['tests/e2e/file-explorer-copy-file-windows.spec.ts'],
matches: (file) =>
isProductSource(file) &&
- /^src\/(?:main\/window\/clipboard-(?:file-copy|ipc-handlers)|renderer\/src\/components\/right-sidebar\/file-explorer\/panel\/file-explorer-row-file-transfer)\.ts$/.test(
+ /^src\/(?:main\/window\/clipboard\/clipboard-(?:file-copy|ipc-handlers)|renderer\/src\/components\/right-sidebar\/file-explorer\/panel\/file-explorer-row-file-transfer)\.ts$/.test(
file
)
},
@@ -320,7 +322,7 @@ export const PR_E2E_SOURCE_ROUTES = [
MANAGED_SSH_HARNESS.test(file) ||
file === 'tests/e2e/fixtures/structured-claude-stub.cjs' ||
(isProductSource(file) &&
- /^src\/(?:main\/(?:claude\/claude-(?:stream-json-connection|stream-json-exit-error|structured-session-exit-lifecycle)|native-chat\/agent-session-wire\/structured-agent-session-failure-text)|renderer\/src\/components\/native-chat\/structured-agent-session-delivery-notices)\.ts$/.test(
+ /^src\/(?:main\/(?:claude\/(?:claude-(?:stream-json-connection|structured-session-exit-lifecycle)|sdk-transport\/claude-stream-json-exit-error)|native-chat\/agent-session-wire\/structured-agent-session-failure-text)|renderer\/src\/components\/native-chat\/structured-agent-session-delivery-notices)\.ts$/.test(
file
))
},
@@ -476,16 +478,6 @@ export const PR_E2E_SOURCE_ROUTES = [
file
)
},
- {
- // Layout resolution can invent split directions; publishing the guess overwrites the original tree irreversibly.
- id: 'terminal-session.split-orientation-resolution',
- specs: ['tests/e2e/desktop-published-split-orientation-legacy-leaf.spec.ts'],
- matches: (file) =>
- isProductSource(file) &&
- /^src\/renderer\/src\/runtime\/(?:remote-terminal-layout-resolution\.ts|sync-runtime-graph\/(?:graph-publication|mobile-session-terminal-tabs|mobile-session-surfaces)\.ts|web-session-tabs-sync\/terminal-surfaces\.ts)$/.test(
- file
- )
- },
{
id: 'terminal-session.remote-pane-layout-retry',
specs: ['tests/e2e/paired-remote-pane-layout-retry.spec.ts'],
@@ -502,7 +494,7 @@ export const PR_E2E_SOURCE_ROUTES = [
matches: (file) =>
file === 'tests/e2e/helpers/connector-fake-claude.ts' ||
(isProductSource(file) &&
- /^src\/(?:main\/external-conversations\/|main\/runtime\/rpc\/methods\/connector\.ts$|cli\/(?:handlers|specs)\/connector\.ts$|shared\/rpc-contract\/connector-params\.ts$)/.test(
+ /^src\/(?:main\/external-conversations\/|main\/runtime\/rpc\/methods\/connector\.ts$|cli\/(?:connectors|specs)\/connector\.ts$|shared\/rpc-contract\/connector-params\.ts$)/.test(
file
))
}
diff --git a/config/scripts/workflow/source-routing/pr-editor-preview-e2e-source-routes.mjs b/config/scripts/workflow/source-routing/pr-editor-preview-e2e-source-routes.mjs
index 22ff77e7998..5beaae6b8be 100644
--- a/config/scripts/workflow/source-routing/pr-editor-preview-e2e-source-routes.mjs
+++ b/config/scripts/workflow/source-routing/pr-editor-preview-e2e-source-routes.mjs
@@ -51,7 +51,7 @@ export const PR_EDITOR_PREVIEW_E2E_SOURCE_ROUTES = [
) ||
[
'src/main/ipc/filesystem/filesystem-read-handlers.ts',
- 'src/main/startup/privileged-custom-schemes.ts',
+ 'src/main/startup/chromium-policy/privileged-custom-schemes.ts',
'src/preload/api/fs-bridge.ts',
'src/renderer/src/runtime/files/reads/runtime-file-range-preview.ts',
'src/renderer/src/runtime/files/reads/runtime-file-read-client.ts',
diff --git a/config/scripts/workflow/source-routing/pr-feature-area-e2e-source-routes.mjs b/config/scripts/workflow/source-routing/pr-feature-area-e2e-source-routes.mjs
index 1e6977f9dd9..63a7cb1c644 100644
--- a/config/scripts/workflow/source-routing/pr-feature-area-e2e-source-routes.mjs
+++ b/config/scripts/workflow/source-routing/pr-feature-area-e2e-source-routes.mjs
@@ -15,16 +15,7 @@ function featureRoute(id, specs, prefixes) {
// Feature areas whose specs the nightly suite alone used to select (gap audit, Oct 2026).
export const PR_FEATURE_AREA_E2E_SOURCE_ROUTES = [
- featureRoute(
- 'feature.automations-ui',
- ['automation-prompt-disclosure'],
- [`${COMPONENTS}automations/`]
- ),
- featureRoute(
- 'feature.sparse-checkout',
- ['sparse-explorer-proof', 'sparse-preset-proof'],
- [`${COMPONENTS}sparse/`]
- ),
+ featureRoute('feature.sparse-checkout', ['sparse-explorer-proof'], [`${COMPONENTS}sparse/`]),
featureRoute(
'feature.onboarding',
['onboarding', 'onboarding-language-catalog-retry'],
diff --git a/config/scripts/workflow/source-routing/pr-layout-oracle-route.mjs b/config/scripts/workflow/source-routing/pr-layout-oracle-route.mjs
index e81577e5f4c..18929a56156 100644
--- a/config/scripts/workflow/source-routing/pr-layout-oracle-route.mjs
+++ b/config/scripts/workflow/source-routing/pr-layout-oracle-route.mjs
@@ -10,7 +10,7 @@ const LAYOUT_ORACLE_PREFIXES = [
// Layout model, persistence and compatibility folders.
'src/shared/workspace-layout/',
'src/shared/remote-layout-snapshot.ts',
- 'src/shared/workspace-layout/terminal-leaf-move.ts',
+ 'src/shared/workspace-layout/terminal-topology/terminal-leaf-move.ts',
'src/main/persistence/terminal-topology/',
'src/main/persistence/restoring-sessions/',
'src/main/persistence/loading-store/terminal-bindings/pty-binding-',
diff --git a/config/scripts/workflow/source-routing/pr-package-test-paths.mjs b/config/scripts/workflow/source-routing/pr-package-test-paths.mjs
index 3917f9a496b..7d65675fdae 100644
--- a/config/scripts/workflow/source-routing/pr-package-test-paths.mjs
+++ b/config/scripts/workflow/source-routing/pr-package-test-paths.mjs
@@ -129,7 +129,6 @@ export const LINUX_PACKAGE_TESTS = [
'src/main/browser/guest-lifecycle/popups/presentation/popup-origin-chrome.electron.test.ts',
'src/main/browser/guest-lifecycle/navigation/browser-link-materialization.electron.test.ts',
'src/main/browser/client-pages/renderer/browser-client-page-renderer-lifecycle.electron.test.ts',
- 'src/main/browser/guest-lifecycle/popups/compatibility/browser-popup-compatibility.electron.test.ts',
'src/main/browser/guest-lifecycle/popups/compatibility/browser-popup-native-compatibility.electron.test.ts',
'src/main/browser/guest-lifecycle/popups/compatibility/browser-popup-background-compatibility.electron.test.ts',
'src/main/browser/extensions/api-runtime/browser-extension-api.electron.test.ts',
@@ -170,12 +169,9 @@ export const WINDOWS_BOUNDARY_TESTS = [
'src/shared/windows-batch-spawn.win32.test.ts',
'src/main/claude/structured/launch/claude-structured-child-env.test.ts',
'src/main/agent-hooks/installation/commands/windows-hook-payload-delivery.test.ts',
- 'src/main/agent-hooks/installation/scripts/managed-hook-stdin-lifecycle.test.ts',
'src/main/jcode/hook-gate-script.test.ts',
'src/main/agent-hooks/installation/commands/windows-native-hook-exe-hosts.test.ts',
- 'src/main/claude/windows-native-hook-registration.test.ts',
'src/main/agent-hooks/installation/commands/windows-batch-hook-launcher.test.ts',
- 'src/main/claude/claude-status-line-windows.test.ts',
'src/main/codex/hooks/installation/windows-hook-command.test.ts',
'src/main/codex/hooks/installation/hook-service-managed-install.test.ts',
'src/main/windows/windows-pty-job.win32.test.ts',
@@ -193,15 +189,15 @@ export const WINDOWS_BOUNDARY_TESTS = [
'src/main/pty/process-retirement/windows-live-tree-kill.win32.test.ts',
'src/main/wsl/execution/wsl-guest-environment.test.ts',
'src/main/wsl/execution/wsl-executable-path.win32.test.ts',
- 'src/main/claude-accounts/claude-profile-history-windows.test.ts',
+ 'src/main/claude-accounts/profiles/setup/claude-profile-history-windows.test.ts',
'src/shared/source-scan/source-tree-scan.test.ts',
'src/main/cli/wsl/wsl-cli-powershell-boundary.test.ts',
'src/main/cursor/hook-service.test.ts',
'src/main/orca-profiles/profile-index-store.test.ts',
- 'src/main/startup/windows-install-dir-acl-repair.win32.test.ts',
- 'src/main/startup/windows-app-data-path.test.ts',
- 'src/main/startup/windows-std-handle-inheritance.win32.test.ts',
- 'src/main/startup/windows-isolated-spawner.win32.test.ts',
+ 'src/main/startup/windows-install-permissions/windows-install-dir-acl-repair.win32.test.ts',
+ 'src/main/startup/windows-startup/windows-app-data-path.test.ts',
+ 'src/main/startup/windows-startup/windows-std-handle-inheritance.win32.test.ts',
+ 'src/main/startup/windows-startup/windows-isolated-spawner.win32.test.ts',
'src/main/runtime/workspaces/catalog/worktree-scan-admin-fingerprint-gate.test.ts',
'src/shared/secure-storage/secure-path-windows-acl.win32.test.ts',
'src/main/runtime/rpc/server/pairing/unreadable-secret-store-preservation.win32.test.ts',
diff --git a/config/scripts/workflow/source-routing/pr-plugin-e2e-source-routes.mjs b/config/scripts/workflow/source-routing/pr-plugin-e2e-source-routes.mjs
index f1fd56d0d32..b7314a73fe9 100644
--- a/config/scripts/workflow/source-routing/pr-plugin-e2e-source-routes.mjs
+++ b/config/scripts/workflow/source-routing/pr-plugin-e2e-source-routes.mjs
@@ -120,12 +120,12 @@ const SPECIFIC_PLUGIN_ROUTES = [
'plugins.isolated-frames',
['plugin-isolated-frame', 'plugin-panel-containment'],
[
- 'src\\/main\\/plugins\\/panels\\/plugin-frame-',
+ 'src\\/main\\/plugins\\/panels\\/(?:frame-serving\\/|guest-isolation\\/|desktop-actions\\/)?plugin-frame-',
'src\\/shared\\/plugins\\/frames\\/plugin-(?:frame-guest|panel-shell)',
'src\\/preload\\/plugin-frame-guest',
- 'src\\/main\\/window\\/(?:main-window-webview-security|attach-main-window-services|host-frame-permission-policy)',
+ 'src\\/main\\/window\\/(?:security/(?:main-window-webview-security|host-frame-permission-policy)|attach-main-window-services)',
'src\\/main\\/ipc\\/(?:plugins|plugin-frame-entry-ipc)\\.ts$',
- 'src\\/main\\/startup\\/main-process-plugins',
+ 'src\\/main\\/startup\\/plugin-startup\\/main-process-plugins',
'config\\/build-plugins\\/main-build-entry-points',
'src\\/main\\/browser\\/guest-lifecycle\\/input\\/browser-guest-shortcut-(?:forwarding|dispatch)',
'src\\/renderer\\/src\\/components\\/(?:plugins\\/frames\\/|right-sidebar\\/plugin-panels\\/PluginPanel\\.tsx$)',
@@ -152,7 +152,7 @@ const SPECIFIC_PLUGIN_ROUTES = [
`${UI}declarative\\/`,
'src\\/shared\\/plugins\\/declarative\\/plugin-declarative-(?:catalog|[a-z]+-props|prop-schemas|tree)',
'resources\\/plugins\\/declarative\\/orca-components',
- 'src\\/main\\/plugins\\/panels\\/plugin-panel-image',
+ 'src\\/main\\/plugins\\/panels\\/panel-lifetime\\/plugin-panel-image',
'examples\\/plugins\\/components-gallery\\/'
].join('|'),
'plugin-frame-guest|plugin-smoke'
@@ -162,10 +162,10 @@ const SPECIFIC_PLUGIN_ROUTES = [
'plugins.buildless-tsx',
['plugin-buildless-tsx'],
[
- 'src\\/main\\/plugins\\/panels\\/plugin-frame-(?:module-|source-serving|protocol\\.ts$)',
+ 'src\\/main\\/plugins\\/panels\\/(?:frame-serving\\/)?plugin-frame-(?:module-|source-serving|protocol\\.ts$)',
'src\\/main\\/plugins\\/plugin-content-hash',
'src\\/shared\\/plugins\\/frames\\/plugin-frame-source-modules',
- 'src\\/cli\\/plugin-authoring\\/plugin-(?:type-files|components-template)',
+ 'src\\/cli\\/plugins\\/authoring\\/plugin-(?:type-files|components-template)',
'examples\\/plugins\\/hello-tsx\\/'
].join('|'),
'plugin-frame-guest|plugin-smoke'
@@ -178,7 +178,7 @@ const SPECIFIC_PLUGIN_ROUTES = [
'src\\/shared\\/plugins\\/declarative\\/(?:plugin-declarative-message|runtime\\/declarative-(?:atoms|memory-retention|error-location|panel-context|renderer))',
'src\\/shared\\/plugins\\/frames\\/plugin-(?:declarative-host-document|frame-bridge)',
'src\\/renderer\\/src\\/components\\/right-sidebar\\/plugin-panels\\/(?:PluginPanel\\.tsx$|declarative\\/(?:PluginDeclarativePanel|use-plugin-declarative-(?:state|tree)|plugin-declarative-retained-memory))',
- 'src\\/main\\/plugins\\/(?:plugin-dev-|panels\\/plugin-frame-guest-sessions)',
+ 'src\\/main\\/plugins\\/(?:plugin-dev-|panels\\/guest-isolation\\/plugin-frame-guest-sessions)',
'resources\\/plugins\\/declarative\\/'
].join('|'),
'plugin-frame-guest|plugin-smoke'
@@ -188,7 +188,7 @@ const SPECIFIC_PLUGIN_ROUTES = [
'plugins.panel-agents',
['plugin-panel-agents'],
[
- 'src\\/main\\/plugins\\/(?:plugin-runtime-binding|plugin-agent-status-event|workers\\/plugin-workspace-projection)',
+ 'src\\/main\\/plugins\\/(?:plugin-runtime-binding|plugin-agent-status-event|workers\\/host-api\\/plugin-workspace-projection)',
'src\\/shared\\/plugins\\/events\\/plugin-events'
].join('|'),
'plugin-frame-guest|plugin-smoke|agent-hook-endpoint'
@@ -199,7 +199,7 @@ const SPECIFIC_PLUGIN_ROUTES = [
['plugin-worker-panel'],
[
'src\\/main\\/plugins\\/panels\\/plugin-panel-bridge',
- 'src\\/main\\/plugins\\/(?:plugin-declared-settings|workers\\/plugin-(?:worker-orca-api|host-panel-method-bindings|worker-requests))',
+ 'src\\/main\\/plugins\\/(?:plugin-declared-settings|workers\\/(?:plugin-worker-orca-api|host-api\\/plugin-host-panel-method-bindings|parent-process\\/plugin-worker-requests))',
'src\\/main\\/ipc\\/plugin-(?:panel-push|settings)-ipc',
'src\\/shared\\/plugins\\/(?:workers\\/plugin-panel-bridge-protocol|frames\\/plugin-panel-shell-facades|contributions\\/plugin-settings-)',
'src\\/shared\\/plugins\\/declarative\\/runtime\\/declarative-(?:data-sdk|storage-sync)',
@@ -218,7 +218,7 @@ const SPECIFIC_PLUGIN_ROUTES = [
'src\\/(?:main\\/plugins\\/view\\/(?!plugin-view-replay)|shared\\/plugins\\/view\\/)',
'src\\/main\\/runtime\\/rpc\\/methods\\/plugin-view',
// Every `plugin shot` checks for a chrome region and resolves the default shots folder.
- 'src\\/cli\\/(?:handlers\\/plugin-(?:view|shot-chrome|shot-default-dir)|specs\\/plugin-view)',
+ 'src\\/cli\\/(?:plugins\\/view\\/plugin-(?:view|shot-chrome|shot-default-dir)|specs\\/plugin-view)',
'src\\/renderer\\/src\\/hooks\\/(?:ipc-events\\/plugin-view-ipc-bridge|use-document-dark-theme)',
'src\\/renderer\\/src\\/components\\/right-sidebar\\/(?:plugin-panels\\/health\\/(?:plugin-panel-draw-status|use-plugin-panel-draw-report)|right-sidebar-panel-content)'
].join('|'),
@@ -233,14 +233,14 @@ const SPECIFIC_PLUGIN_ROUTES = [
`${STORE}shot-replay`,
'src\\/main\\/plugins\\/view\\/plugin-view-replay',
'src\\/main\\/plugins\\/testing\\/plugin-test-(?:hooks|register)',
- 'src\\/cli\\/(?:handlers|specs)\\/plugin-shot-scenario',
- 'src\\/cli\\/plugin-authoring\\/plugin-(?:panel-check|test-runner|test-node)'
+ 'src\\/cli\\/(?:plugins\\/view|specs)\\/plugin-shot-scenario',
+ 'src\\/cli\\/plugins\\/authoring\\/plugin-(?:panel-check|test-runner|test-node)'
].join('|')
),
pluginRoute(
'plugins.view-shot-editor',
['plugin-shot-editor'],
- 'src\\/cli\\/handlers\\/plugin-shot-editor'
+ 'src\\/cli\\/plugins\\/view\\/plugin-shot-editor'
),
pluginRoute(
'plugins.startup-and-manifest',
diff --git a/config/scripts/workflow/source-routing/pr-shell-contract-prefixes.mjs b/config/scripts/workflow/source-routing/pr-shell-contract-prefixes.mjs
index 7fc2b972fec..de73fef0e5f 100644
--- a/config/scripts/workflow/source-routing/pr-shell-contract-prefixes.mjs
+++ b/config/scripts/workflow/source-routing/pr-shell-contract-prefixes.mjs
@@ -12,16 +12,23 @@ export const SHELL_PREFIXES = [
'src/main/runtime/agent-session/environment/structured-session-cli-login-shell',
'src/main/runtime/agent-session/environment/structured-session-login-shell-test-harness',
'src/main/runtime/agent-session/environment/structured-session-child-env',
- 'src/main/startup/shell-probe-terminal-detach',
- 'src/main/startup/shell-probe-lifetime',
- 'src/main/startup/hydrate-shell-path',
- 'src/main/startup/login-shell-environment',
- 'src/main/startup/shell-path-probe',
+ // STA-2380: the only real-shell guard for command-paint attribution under zsh preexec hooks; the
+ // unit shards exclude the live-shell test, so these exact files must route here or nothing runs it.
+ 'src/main/runtime/terminal/input/terminal-command-paint.ts',
+ 'src/main/runtime/terminal/wait/tui-idle-evidence-source.ts',
+ 'src/main/runtime/terminal/wait/tui-idle-evidence.ts',
+ 'src/main/runtime/terminal/wait/tui-idle-zsh-preexec-hook-order.live-shell.test.ts',
+ 'src/main/startup/shell-environment/shell-probe-terminal-detach',
+ 'src/main/startup/shell-environment/shell-probe-lifetime',
+ 'src/main/startup/shell-environment/hydrate-shell-path',
+ 'src/main/startup/shell-environment/login-shell-environment',
+ 'src/main/startup/shell-environment/shell-path-probe',
'src/renderer/src/components/terminal-pane/pty-connection/emulation/fish-color-scheme',
'src/shared/fish-',
'src/shared/terminal/pty/ingress/pty-reply-echo-shapes',
'src/shared/startup-shell-portability',
'src/shared/posix-command-path-lookup',
+ 'src/shared/draft-paste-ready-scanner.ts',
'src/main/wsl/filesystem/wsl-shell-cwd-report',
'src/main/wsl/filesystem/wsl-sh-cwd-report',
'src/shared/wsl-login-shell-command',
diff --git a/config/scripts/workspace-package-build/generated-artifact-line-ending-pin.test.mjs b/config/scripts/workspace-package-build/generated-artifact-line-ending-pin.test.mjs
index 600d7c1f10a..05379ea2053 100644
--- a/config/scripts/workspace-package-build/generated-artifact-line-ending-pin.test.mjs
+++ b/config/scripts/workspace-package-build/generated-artifact-line-ending-pin.test.mjs
@@ -12,25 +12,11 @@ it('keeps byte-compared artifacts and source LF in an autocrlf checkout', () =>
const crlf = 'first\r\nsecond\r\n'
const paths = new Map([
['resources/skills/current-manifest.json', lf],
- ['src/main/__snapshots__/example.test.ts.snap', lf],
- ['src/renderer/src/example.tsx', lf],
['src/main/example.ts', lf],
- ['config/scripts/example.mjs', lf],
['config/scripts/nested/deeper/example.mjs', lf],
- ['skill-guides/example.md', lf],
- ['skill-stubs/example.md', lf],
- ['skill-stubs/_shared/example.md', lf],
- ['skills/example/SKILL.md', lf],
- ['src/cli/bundled-skill-guides.ts', lf],
- ...['cmd', 'bat', 'ps1', 'nsh'].map((extension) => [`config/example.${extension}`, crlf]),
+ ['config/example.cmd', crlf],
['resources/skills-extra/example.json', crlf],
- ['vendor/resources/skills/example.json', crlf],
- ['scripts/example.mjs', crlf],
- ['config/scripts-extra/example.mjs', crlf],
- ['vendor/config/scripts/example.mjs', crlf],
- ['config/scripts/example.mjsx', crlf],
- ['src/main/runtime/__fixtures__/example.txt', crlf],
- ['src/main/daemon/__fixtures__/pty-transcripts/example.txt', crlf]
+ ['src/main/runtime/__fixtures__/example.txt', crlf]
])
const git = (args) => execFileSync('git', args, { cwd: root, stdio: 'pipe' })
diff --git a/config/startup-worktree-localization-allowlist.json b/config/startup-worktree-localization-allowlist.json
index 57d98c87207..4be5ddcec5a 100644
--- a/config/startup-worktree-localization-allowlist.json
+++ b/config/startup-worktree-localization-allowlist.json
@@ -1,6 +1,6 @@
[
{
- "filePath": "src/main/startup/main-process-quit.ts",
+ "filePath": "src/main/startup/quit/main-process-quit.ts",
"kind": "object-property:message",
"text": "before-quit allowed for update install",
"dynamic": false,
@@ -8,7 +8,7 @@
"reason": "Updater lifecycle diagnostics are not displayed as UI copy."
},
{
- "filePath": "src/main/startup/main-process-quit.ts",
+ "filePath": "src/main/startup/quit/main-process-quit.ts",
"kind": "object-property:message",
"text": "will-quit cleanup for update install; daemonTeardown=disconnect",
"dynamic": false,
@@ -16,7 +16,7 @@
"reason": "Updater lifecycle diagnostics are not displayed as UI copy."
},
{
- "filePath": "src/main/startup/profile-state-recovery-preflight.ts",
+ "filePath": "src/main/startup/profile-startup/profile-state-recovery-preflight.ts",
"kind": "object-property:message",
"text": "Invalid profile-state recovery launch.",
"dynamic": false,
diff --git a/config/tsconfig.node.json b/config/tsconfig.node.json
index e871e791659..86dad6f7d38 100644
--- a/config/tsconfig.node.json
+++ b/config/tsconfig.node.json
@@ -30,6 +30,7 @@
"../src/renderer/src/components/native-chat/session/structured/delivery/structured-agent-session-pending-sends.ts",
"../src/renderer/src/components/native-chat/queue/structured-agent-session-queue-request.ts",
"../src/renderer/src/components/native-chat/native-chat-composer-primary-action.ts",
+ "../src/renderer/src/components/settings/accounts/codex/codex-account-auth-warning.ts",
"../src/renderer/src/components/terminal-pane/pty-transport/legacy-relay/legacy-relay-bridge-panes.ts",
"../src/preload/**/*",
"../src/shared/**/*",
@@ -38,8 +39,7 @@
"../src/types/**/*"
],
"exclude": [
- "../src/main/runtime/orchestration/terminal-authority/structured-sessions/structured-chat-coordinator-mail.test.ts",
- "../src/main/runtime/agent-session/structured-agent-session-chat-wait-work-state.test.ts"
+ "../src/main/runtime/orchestration/terminal-authority/structured-sessions/structured-chat-coordinator-mail.test.ts"
],
"compilerOptions": {
"composite": true,
diff --git a/config/tsconfig.tc.web.json b/config/tsconfig.tc.web.json
index 0c4e66706e0..b0f23d98c71 100644
--- a/config/tsconfig.tc.web.json
+++ b/config/tsconfig.tc.web.json
@@ -14,6 +14,7 @@
"../src/renderer/src/**/*.tsx",
"../src/preload/api-types.ts",
"../src/preload/api/**/*",
+ "../src/preload/backend-port-client.ts",
"../src/preload/browser-client-page-renderer-requests.ts",
"../src/preload/browser-find-subscriptions.ts",
"../src/preload/close-active-tab-payload-admission.ts",
@@ -42,13 +43,13 @@
"../src/main/source-control/hosted-review-provider-read.ts",
"../src/main/persistence/profile-state-cutover-fixture.ts",
"../src/main/runtime/sidebar-inputs/sidebar-clock.ts",
- "../src/main/runtime/sidebar-inputs/sidebar-retention-owner.ts",
+ "../src/main/runtime/sidebar-inputs/temporal/sidebar-retention-owner.ts",
"../src/main/runtime/sidebar-inputs/producer-revision.ts",
- "../src/main/runtime/sidebar-inputs/sidebar-inputs-feed.ts",
- "../src/main/runtime/sidebar-inputs/sidebar-inputs-feed-log.ts",
- "../src/main/runtime/sidebar-inputs/sidebar-inputs-feed-pages.ts",
- "../src/main/runtime/sidebar-inputs/sidebar-inputs-feed-pins.ts",
- "../src/main/runtime/sidebar-inputs/sidebar-inputs-feed.test-fixture.ts",
+ "../src/main/runtime/sidebar-inputs/feed/sidebar-inputs-feed.ts",
+ "../src/main/runtime/sidebar-inputs/feed/sidebar-inputs-feed-log.ts",
+ "../src/main/runtime/sidebar-inputs/feed/sidebar-inputs-feed-pages.ts",
+ "../src/main/runtime/sidebar-inputs/feed/sidebar-inputs-feed-pins.ts",
+ "../src/main/runtime/sidebar-inputs/feed/testing/sidebar-inputs-feed.test-fixture.ts",
"../src/main/jira/adf-markdown.ts",
"../src/main/jira/adf-text-marks.ts",
"../src/main/jira/adf-media-destination.ts",
@@ -63,6 +64,7 @@
"../src/main/ipc/worktree-linked-work-item-metadata.ts",
"../src/main/ipc/worktree-metadata-merge.ts",
"../src/main/wsl/discovery/wsl-availability.ts",
+ "../src/main/wsl/discovery/wsl-discovery-change.ts",
"../src/main/wsl/filesystem/wsl-directory-probe-command.ts",
"../src/main/wsl/discovery/wsl-distro-list-output.ts",
"../src/main/wsl/discovery/wsl-distro-retry.ts",
@@ -86,13 +88,13 @@
"../src/main/persistence/applying-settings/ui-selection-normalization.ts",
"../src/main/persistence/applying-settings/ui-interaction-merge.ts",
"../src/main/credentials/protected-secret-persistence.ts",
- "../src/main/startup/serve-desktop-activation.ts",
- "../src/main/startup/serve-mode-argv.ts",
- "../src/main/startup/single-instance-lock.ts",
- "../src/main/startup/startup-diagnostics.ts",
- "../src/main/window/focus-existing-window.ts",
- "../src/main/window/foreground-activation-policy.ts",
- "../src/main/window/macos-app-activation.ts"
+ "../src/main/startup/serve-launch/serve-desktop-activation.ts",
+ "../src/main/startup/serve-launch/serve-mode-argv.ts",
+ "../src/main/startup/profile-startup/single-instance-lock.ts",
+ "../src/main/startup/diagnostics/startup-diagnostics.ts",
+ "../src/main/window/activation/focus-existing-window.ts",
+ "../src/main/window/activation/foreground-activation-policy.ts",
+ "../src/main/window/activation/macos-app-activation.ts"
],
"compilerOptions": {
"paths": {
diff --git a/config/tsconfig.test.mobile-host-declarations.json b/config/tsconfig.test.mobile-host-declarations.json
index df4e8408dd9..5f5ba25a476 100644
--- a/config/tsconfig.test.mobile-host-declarations.json
+++ b/config/tsconfig.test.mobile-host-declarations.json
@@ -16,11 +16,11 @@
"../src/main/runtime/rpc/methods/source-control/github/github-repo-work-item-methods.ts",
"../src/main/runtime/orca-runtime.ts",
"../src/main/runtime/rpc/core.ts",
- "../src/main/runtime/rpc/dispatcher-request-parsing.ts",
- "../src/main/github/issue-field-options.ts",
+ "../src/main/runtime/rpc/dispatch/dispatcher-request-parsing.ts",
+ "../src/main/github/issues/issue-field-options.ts",
"../src/main/runtime/workspaces/process-listing/runtime-worktree-ps-summaries.ts",
"../src/types/build-constants.d.ts",
- "../src/main/native-chat/transcript-line-decoders-claude.ts",
+ "../src/main/native-chat/transcript-decoding/transcript-line-decoders-claude.ts",
"../src/main/codex/structured/items/codex-thread-item-identity.ts",
"../src/main/codex/structured/items/codex-structured-item-translation.ts"
],
diff --git a/config/tsconfig.test.pane-launch.json b/config/tsconfig.test.pane-launch.json
index 07117e2ab40..cdffd47c2df 100644
--- a/config/tsconfig.test.pane-launch.json
+++ b/config/tsconfig.test.pane-launch.json
@@ -2,7 +2,6 @@
"extends": "./tsconfig.web.json",
"include": [
"../src/main/runtime/orchestration/terminal-authority/structured-sessions/structured-chat-coordinator-mail.test.ts",
- "../src/main/runtime/agent-session/structured-agent-session-chat-wait-work-state.test.ts",
"../src/renderer/src/components/task-page/linear/task-page-linear-detail-query.test.tsx",
"../src/renderer/src/runtime/observed-provider-accounts.test.tsx",
"../src/renderer/src/components/status-bar/ClaudeSwitcherMenu.observation.test.tsx",
diff --git a/config/vitest.config.ts b/config/vitest.config.ts
index bfed0dadfdd..ad1f0045a93 100644
--- a/config/vitest.config.ts
+++ b/config/vitest.config.ts
@@ -10,6 +10,7 @@ import {
} from './scripts/ci/unit-selection/dependency-graph/ci-unit-files.mjs'
import TimingSequencer from './scripts/ci/sharding/ci-unit-sequencer.mjs'
import { filesSafeToShareWorker } from './scripts/test-runtime/execution-policy/vitest-shared-worker-files.mjs'
+import { gitSigningOffEnv } from './scripts/test-runtime/environment/vitest-git-signing-env.mjs'
import RuntimeSequencer from './scripts/test-runtime/execution-policy/vitest-runtime-sequencer.mjs'
import { getNodeRuntimeInclude } from './scripts/test-runtime/sqlite-admission/vitest-node-runtime-files.mjs'
import { nodeRuntimePool } from './scripts/test-runtime/node-worker/vitest-node-runtime-pool'
@@ -22,6 +23,8 @@ const nodeRuntimeInclude = process.versions.bun
? getNodeRuntimeInclude({ filters: readRunFilters() })
: []
const balancedShards = process.env.ORCA_BALANCE_UNIT_SHARDS === '1'
+// An Orca terminal publishes its WSL hosts gate to children; empty reads as unset, so tests resolve their own.
+const gitEnv = { ...gitSigningOffEnv(), ORCA_WSL_HOSTS_GATE_STATE: '' }
const moduleCachePath = process.env.ORCA_UNIT_MODULE_CACHE_PATH
const phoneContractPattern = /\/mobile\/src\/.*\.(?:ts|tsx)(?:\?.*)?$/
const transforms = {
@@ -88,7 +91,7 @@ const testOptions = {
// Keyed by ci-unit-module-cache.mjs in CI and vitest-local-module-cache.mjs locally.
fsModuleCache: Boolean(moduleCachePath),
...(moduleCachePath ? { fsModuleCachePath: moduleCachePath } : {}),
- env: { ORCA_VITEST_RUNTIME: 'node' },
+ env: { ...gitEnv, ORCA_VITEST_RUNTIME: 'node' },
server: { deps: { inline: ['zod'] } },
// Node's storage globals and V8 retention checks require the existing child flags.
execArgv: ['--no-experimental-webstorage', '--expose-gc'],
@@ -104,7 +107,7 @@ const nodeProject = {
test: {
...testOptions,
name: process.versions.bun ? 'node-runtime' : 'node',
- env: { ORCA_VITEST_RUNTIME: process.versions.bun ? 'node-runtime' : 'node' },
+ env: { ...gitEnv, ORCA_VITEST_RUNTIME: process.versions.bun ? 'node-runtime' : 'node' },
include: process.versions.bun ? nodeRuntimeInclude : UNIT_INCLUDE,
sequence: { groupOrder: 1 },
...(process.versions.bun
@@ -118,7 +121,7 @@ const bunProject = {
test: {
...testOptions,
name: 'bun',
- env: { ORCA_VITEST_RUNTIME: 'bun' },
+ env: { ...gitEnv, ORCA_VITEST_RUNTIME: 'bun' },
pool: 'forks',
exclude: [...testOptions.exclude, ...nodeRuntimeInclude],
sequence: { groupOrder: 1 }
diff --git a/config/vitest.performance.config.ts b/config/vitest.performance.config.ts
index 8035a86a0b8..37d4f7a4763 100644
--- a/config/vitest.performance.config.ts
+++ b/config/vitest.performance.config.ts
@@ -14,9 +14,7 @@ const contracts = [
'src/main/codex-usage/scanner-incremental-append.test.ts',
'src/main/usage/source-input/jsonl/jsonl-file-reader.test.ts',
'config/scripts/static-analysis/oxlint-contracts/app-store-performance-plugin.test.mjs',
- 'config/scripts/static-analysis/oxlint-contracts/quadratic-buffer-concat-plugin.test.mjs',
- 'src/main/claude-usage/scanner-incremental-append.test.ts',
- 'src/main/runtime/agent-session/structured-agent-session-chat-wait-work-state.test.ts'
+ 'config/scripts/static-analysis/oxlint-contracts/quadratic-buffer-concat-plugin.test.mjs'
]
for (const contract of contracts) {
if (!existsSync(resolve(contract))) {
diff --git a/docs/STYLEGUIDE.md b/docs/STYLEGUIDE.md
index ee8a8c1e177..64157482f31 100644
--- a/docs/STYLEGUIDE.md
+++ b/docs/STYLEGUIDE.md
@@ -44,7 +44,7 @@ Tokens pair a **surface** with a **foreground** that meets contrast on it; alway
- Body letter-spacing is set globally on `body`; don't override per component.
- Use Tailwind's scale. Common: 14px body/default buttons, 13px sidebar items and dense rows, 12px sub-text and paths, 11px uppercase meta/captions.
- Use `text-2xs` (11px) and `text-3xs` (10px), not `text-[11px]` / `text-[10px]`.
-- Category labels: 11px, `font-semibold`, `uppercase`, `tracking-wider` (0.05em). Settings content uses sentence case without tracking: 14px row labels, `text-settings-detail` (12.5px) help, and `text-settings-heading` (15px) semibold section headings. Settings form rows use about 9px vertical padding (44px minimum), selects are 28px, and the centered content column is at most 720px with at least 32px side gutters. These density rules are scoped to `.settings-view-shell`; shared primitives retain their defaults elsewhere.
+- Category labels: 11px, `font-semibold`, `uppercase`, `tracking-wider` (0.05em). Settings content uses sentence case without tracking: 14px row labels, `text-settings-detail` (12.5px) help, and `text-settings-heading` (15px) semibold section headings. Settings form rows use about 9px vertical padding (44px minimum), selects are 28px, and the centered content column is at most 720px with at least 32px side gutters. These density rules are scoped to `.settings-view-shell`; shared primitives retain their defaults elsewhere. Every Settings card that holds rows is a `SettingsGroup` (`settings/section-layout/SettingsGroup.tsx`): one 20px side inset, rules between rows, title outside the card; use its `collapse` prop, `SettingsGroupSubsection`, `SettingsGroupNestedRows` and `SettingsGroupDisclosure` instead of local padding or indents.
- Native chat has its own lint-enforced scale and colours: see [native-chat.md](./styleguide/native-chat.md).
## Radius and elevation
diff --git a/docs/assets/readme-downloads.svg b/docs/assets/readme-downloads.svg
index 8d3c1e202ba..b7020a28499 100644
--- a/docs/assets/readme-downloads.svg
+++ b/docs/assets/readme-downloads.svg
@@ -1,5 +1,5 @@
-
Orca
+ 
@@ -36,11 +36,11 @@
Run any agent in Chat UI or as the raw CLI, and move a conversation between the two without losing context.
-[Docs →](https://www.onorca.dev/docs/agents/native-chat)
+[Docs →](https://orca.dev/docs/agents/native-chat)
- **Feedback & Ideas:** We ship fast. Missing something? [Request a new feature](https://github.com/stablyai/orca/issues).
-- **Privacy:** See the [privacy & telemetry docs](https://www.onorca.dev/docs/telemetry) for what anonymous usage data Orca collects and how to opt out.
+- **Privacy:** See the [privacy & telemetry docs](https://orca.dev/docs/telemetry) for what anonymous usage data Orca collects and how to opt out.
- **Show Support:** [Star](https://github.com/stablyai/orca) this repo to follow along with our daily ships.
---
diff --git a/cloud/apps/push/package.json b/cloud/apps/push/package.json
index d932fed48fe..cd4e6b2011e 100644
--- a/cloud/apps/push/package.json
+++ b/cloud/apps/push/package.json
@@ -15,11 +15,11 @@
"typecheck": "tsc -p tsconfig.json --noEmit"
},
"dependencies": {
- "@hono/node-server": "^2.1.5",
+ "@hono/node-server": "^2.1.6",
"@orca-cloud/cloud-database": "workspace:*",
"@orca-cloud/push-contract": "workspace:*",
"google-auth-library": "^11.3.1",
- "hono": "^4.13.13",
+ "hono": "^4.13.17",
"tweetnacl": "^1.0.3",
"zod": "^4.6.7"
},
diff --git a/cloud/apps/push/src/apns-client.test.ts b/cloud/apps/push/src/apns-client.test.ts
deleted file mode 100644
index 6e17085506d..00000000000
--- a/cloud/apps/push/src/apns-client.test.ts
+++ /dev/null
@@ -1,100 +0,0 @@
-import { generateKeyPairSync } from 'node:crypto'
-import { expect, it } from 'vitest'
-
-import { ApnsClient } from './apns-client.js'
-import type { ApnsRequest, ApnsResponse } from './apns-http2-transport.js'
-import type { ApnsCredentials } from './config.js'
-import { buildPushDelivery } from './push-delivery-message.js'
-
-const HOST = 'abcdefghijklmnop'
-
-function credentials(): ApnsCredentials {
- const { privateKey } = generateKeyPairSync('ec', {
- namedCurve: 'P-256',
- privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
- publicKeyEncoding: { type: 'spki', format: 'pem' }
- })
- return { keyPem: privateKey, keyId: 'ABCDE12345', teamId: 'TEAM123456' }
-}
-
-function delivery(now = Date.now()) {
- return buildPushDelivery({
- expiresAt: now + 300_000,
- registrationId: 'reg-1',
- hostFingerprint: HOST,
- notification: {
- notificationId: 'note-1',
- notificationSeq: 7,
- notificationEpoch: 'epoch-1',
- source: 'agent-task-complete',
- agentState: 'needs-input',
- title: 'Agent needs input',
- body: 'Waiting on your answer',
- worktreeId: 'wt-1'
- }
- })
-}
-
-function fakeTransport(response: ApnsResponse) {
- const requests: ApnsRequest[] = []
- return {
- requests,
- transport: async (request: ApnsRequest): Promise